diff --git a/api/src/main/proto/envoy/admin/v2alpha/certs.proto b/api/src/main/proto/envoy/admin/v2alpha/certs.proto
index ffcd06954..bb8d173b9 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/certs.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/certs.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 import "google/protobuf/timestamp.proto";
 
diff --git a/api/src/main/proto/envoy/admin/v2alpha/clusters.proto b/api/src/main/proto/envoy/admin/v2alpha/clusters.proto
index b41d97335..68e3cb363 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/clusters.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/clusters.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 import "envoy/admin/v2alpha/metrics.proto";
 import "envoy/api/v2/core/address.proto";
diff --git a/api/src/main/proto/envoy/admin/v2alpha/config_dump.proto b/api/src/main/proto/envoy/admin/v2alpha/config_dump.proto
index f02acaffe..0cb1ad21e 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/config_dump.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/config_dump.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 import "envoy/api/v2/cds.proto";
 import "envoy/api/v2/lds.proto";
diff --git a/api/src/main/proto/envoy/admin/v2alpha/memory.proto b/api/src/main/proto/envoy/admin/v2alpha/memory.proto
index 556af7348..3e83811a7 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/memory.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/memory.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 // [#protodoc-title: Memory]
 
diff --git a/api/src/main/proto/envoy/admin/v2alpha/metrics.proto b/api/src/main/proto/envoy/admin/v2alpha/metrics.proto
index 936ef2181..f2a90b0bc 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/metrics.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/metrics.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 // [#protodoc-title: Metrics]
 
diff --git a/api/src/main/proto/envoy/admin/v2alpha/mutex_stats.proto b/api/src/main/proto/envoy/admin/v2alpha/mutex_stats.proto
index 6b6b58451..65f121cce 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/mutex_stats.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/mutex_stats.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 // [#protodoc-title: MutexStats]
 
diff --git a/api/src/main/proto/envoy/admin/v2alpha/server_info.proto b/api/src/main/proto/envoy/admin/v2alpha/server_info.proto
index 51595efef..3feb5952b 100644
--- a/api/src/main/proto/envoy/admin/v2alpha/server_info.proto
+++ b/api/src/main/proto/envoy/admin/v2alpha/server_info.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_multiple_files = true;
 
 import "google/protobuf/duration.proto";
 
diff --git a/api/src/main/proto/envoy/api/v2/auth/cert.proto b/api/src/main/proto/envoy/api/v2/auth/cert.proto
index 1393924e2..778c8c17b 100644
--- a/api/src/main/proto/envoy/api/v2/auth/cert.proto
+++ b/api/src/main/proto/envoy/api/v2/auth/cert.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.auth;
 option java_package = "io.envoyproxy.envoy.api.v2.auth";
-option java_multiple_files = true;
 option go_package = "auth";
 
 import "envoy/api/v2/core/base.proto";
@@ -38,12 +37,14 @@ message TlsParameters {
   // Minimum TLS protocol version. By default, it's ``TLSv1_0``.
   TlsProtocol tls_minimum_protocol_version = 1 [(validate.rules).enum.defined_only = true];
 
-  // Maximum TLS protocol version. By default, it's ``TLSv1_2``.
+  // Maximum TLS protocol version. By default, it's ``TLSv1_3`` for servers in non-FIPS builds, and
+  // ``TLSv1_2`` for clients and for servers using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`.
   TlsProtocol tls_maximum_protocol_version = 2 [(validate.rules).enum.defined_only = true];
 
   // If specified, the TLS listener will only support the specified `cipher list
-  // <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_.
-  // If not specified, the default list will be used.
+  // <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
+  // when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3). If not
+  // specified, the default list will be used.
   //
   // In non-FIPS builds, the default cipher list is:
   //
diff --git a/api/src/main/proto/envoy/api/v2/cds.proto b/api/src/main/proto/envoy/api/v2/cds.proto
index e8f86e9bf..71d48e28b 100644
--- a/api/src/main/proto/envoy/api/v2/cds.proto
+++ b/api/src/main/proto/envoy/api/v2/cds.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 option java_package = "io.envoyproxy.envoy.api.v2";
-option java_multiple_files = true;
 
 option java_generic_services = true;
 
@@ -233,9 +232,8 @@ message Cluster {
   // for upstream connections. The key should match the extension filter name, such as
   // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on
   // specific options.
-  map<string, google.protobuf.Struct> extension_protocol_options = 35;
+  map<string, google.protobuf.Struct> extension_protocol_options = 35 [deprecated = true];
 
-  // [#not-implemented-hide:]
   // The extension_protocol_options field is used to provide extension-specific protocol options
   // for upstream connections. The key should match the extension filter name, such as
   // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on
@@ -417,6 +415,20 @@ message Cluster {
     // Deprecated settings from v1 config.
     // [#not-implemented-hide:] Hide from docs.
     DeprecatedV1 deprecated_v1 = 2 [deprecated = true];
+
+    // The hash function used to hash hosts onto the ketama ring.
+    enum HashFunction {
+      // Use `xxHash <https://github.com/Cyan4973/xxHash>`_, this is the default hash function.
+      XX_HASH = 0;
+      // Use `MurmurHash2 <https://sites.google.com/site/murmurhash/>`_, this is compatible with
+      // std:hash<string> in GNU libstdc++ 3.4.20 or above. This is typically the case when compiled
+      // on Linux and not macOS.
+      MURMUR_HASH_2 = 1;
+    }
+
+    // The hash function used to hash hosts onto the ketama ring. The value defaults to
+    // :ref:`XX_HASH<envoy_api_enum_value_Cluster.RingHashLbConfig.HashFunction.XX_HASH>`.
+    HashFunction hash_function = 3 [(validate.rules).enum.defined_only = true];
   }
 
   // Specific configuration for the
diff --git a/api/src/main/proto/envoy/api/v2/cluster/circuit_breaker.proto b/api/src/main/proto/envoy/api/v2/cluster/circuit_breaker.proto
index 0571f90ee..a1193cc6b 100644
--- a/api/src/main/proto/envoy/api/v2/cluster/circuit_breaker.proto
+++ b/api/src/main/proto/envoy/api/v2/cluster/circuit_breaker.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.cluster;
 option java_package = "io.envoyproxy.envoy.api.v2.cluster";
-option java_multiple_files = true;
 option go_package = "cluster";
 option csharp_namespace = "Envoy.Api.V2.ClusterNS";
 
diff --git a/api/src/main/proto/envoy/api/v2/cluster/outlier_detection.proto b/api/src/main/proto/envoy/api/v2/cluster/outlier_detection.proto
index c4fb9e815..dd373c2e2 100644
--- a/api/src/main/proto/envoy/api/v2/cluster/outlier_detection.proto
+++ b/api/src/main/proto/envoy/api/v2/cluster/outlier_detection.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.cluster;
 option java_package = "io.envoyproxy.envoy.api.v2.cluster";
-option java_multiple_files = true;
 option csharp_namespace = "Envoy.Api.V2.ClusterNS";
 
 import "google/protobuf/duration.proto";
diff --git a/api/src/main/proto/envoy/api/v2/core/address.proto b/api/src/main/proto/envoy/api/v2/core/address.proto
index 009def943..44fdd8656 100644
--- a/api/src/main/proto/envoy/api/v2/core/address.proto
+++ b/api/src/main/proto/envoy/api/v2/core/address.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/base.proto";
 
diff --git a/api/src/main/proto/envoy/api/v2/core/base.proto b/api/src/main/proto/envoy/api/v2/core/base.proto
index 824820995..23f525096 100644
--- a/api/src/main/proto/envoy/api/v2/core/base.proto
+++ b/api/src/main/proto/envoy/api/v2/core/base.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 option go_package = "core";
 
 import "google/protobuf/any.proto";
@@ -190,9 +189,8 @@ message TransportSocket {
   // Implementation specific configuration which depends on the implementation being instantiated.
   // See the supported transport socket implementations for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/src/main/proto/envoy/api/v2/core/config_source.proto b/api/src/main/proto/envoy/api/v2/core/config_source.proto
index 56eb23796..5f47da177 100644
--- a/api/src/main/proto/envoy/api/v2/core/config_source.proto
+++ b/api/src/main/proto/envoy/api/v2/core/config_source.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/grpc_service.proto";
 
@@ -21,8 +20,9 @@ option (gogoproto.equal_all) = true;
 message ApiConfigSource {
   // APIs may be fetched via either REST or gRPC.
   enum ApiType {
-    // REST-JSON legacy corresponds to the v1 API.
-    REST_LEGACY = 0 [deprecated = true];
+    // Ideally this would be 'reserved 0' but one can't reserve the default
+    // value. Instead we throw an exception if this is ever used.
+    UNSUPPORTED_REST_LEGACY = 0 [deprecated = true];
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
     // the v2 protos is used.
@@ -31,7 +31,7 @@ message ApiConfigSource {
     GRPC = 2;
   }
   ApiType api_type = 1 [(validate.rules).enum.defined_only = true];
-  // Cluster names should be used only with REST_LEGACY/REST. If > 1
+  // Cluster names should be used only with REST. If > 1
   // cluster is defined, clusters will be cycled through if any kind of failure
   // occurs.
   //
diff --git a/api/src/main/proto/envoy/api/v2/core/grpc_service.proto b/api/src/main/proto/envoy/api/v2/core/grpc_service.proto
index 7a009d813..08672849c 100644
--- a/api/src/main/proto/envoy/api/v2/core/grpc_service.proto
+++ b/api/src/main/proto/envoy/api/v2/core/grpc_service.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/base.proto";
 
@@ -82,9 +81,8 @@ message GrpcService {
       message MetadataCredentialsFromPlugin {
         string name = 1;
         oneof config_type {
-          google.protobuf.Struct config = 2;
+          google.protobuf.Struct config = 2 [deprecated = true];
 
-          // [#not-implemented-hide:]
           google.protobuf.Any typed_config = 3;
         }
       }
diff --git a/api/src/main/proto/envoy/api/v2/core/health_check.proto b/api/src/main/proto/envoy/api/v2/core/health_check.proto
index ea2e245a7..9f4ca6029 100644
--- a/api/src/main/proto/envoy/api/v2/core/health_check.proto
+++ b/api/src/main/proto/envoy/api/v2/core/health_check.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/base.proto";
 
@@ -163,9 +162,8 @@ message HealthCheck {
     // A custom health checker specific configuration which depends on the custom health checker
     // being instantiated. See :api:`envoy/config/health_checker` for reference.
     oneof config_type {
-      google.protobuf.Struct config = 2;
+      google.protobuf.Struct config = 2 [deprecated = true];
 
-      // [#not-implemented-hide:]
       google.protobuf.Any typed_config = 3;
     }
   }
diff --git a/api/src/main/proto/envoy/api/v2/core/http_uri.proto b/api/src/main/proto/envoy/api/v2/core/http_uri.proto
index 5b48bdd5e..c0a007e10 100644
--- a/api/src/main/proto/envoy/api/v2/core/http_uri.proto
+++ b/api/src/main/proto/envoy/api/v2/core/http_uri.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 
 import "google/protobuf/duration.proto";
 import "gogoproto/gogo.proto";
diff --git a/api/src/main/proto/envoy/api/v2/core/protocol.proto b/api/src/main/proto/envoy/api/v2/core/protocol.proto
index e8ddf0e7f..69bddec07 100644
--- a/api/src/main/proto/envoy/api/v2/core/protocol.proto
+++ b/api/src/main/proto/envoy/api/v2/core/protocol.proto
@@ -4,7 +4,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_multiple_files = true;
 
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
diff --git a/api/src/main/proto/envoy/api/v2/discovery.proto b/api/src/main/proto/envoy/api/v2/discovery.proto
index 85fa34b90..aed7a5d03 100644
--- a/api/src/main/proto/envoy/api/v2/discovery.proto
+++ b/api/src/main/proto/envoy/api/v2/discovery.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 option java_package = "io.envoyproxy.envoy.api.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/base.proto";
diff --git a/api/src/main/proto/envoy/api/v2/eds.proto b/api/src/main/proto/envoy/api/v2/eds.proto
index d4cdd6722..afb932190 100644
--- a/api/src/main/proto/envoy/api/v2/eds.proto
+++ b/api/src/main/proto/envoy/api/v2/eds.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 option java_package = "io.envoyproxy.envoy.api.v2";
-option java_multiple_files = true;
 
 option java_generic_services = true;
 
@@ -53,6 +52,9 @@ message ClusterLoadAssignment {
   // List of endpoints to load balance to.
   repeated endpoint.LocalityLbEndpoints endpoints = 2 [(gogoproto.nullable) = false];
 
+  // Map of named endpoints that can be referenced in LocalityLbEndpoints.
+  map<string, endpoint.Endpoint> named_endpoints = 5;
+
   // Load balancing policy settings.
   message Policy {
     reserved 1;
diff --git a/api/src/main/proto/envoy/api/v2/endpoint/endpoint.proto b/api/src/main/proto/envoy/api/v2/endpoint/endpoint.proto
index bdb677b80..b8e67ce5e 100644
--- a/api/src/main/proto/envoy/api/v2/endpoint/endpoint.proto
+++ b/api/src/main/proto/envoy/api/v2/endpoint/endpoint.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.endpoint;
 option java_package = "io.envoyproxy.envoy.api.v2.endpoint";
-option java_multiple_files = true;
 option go_package = "endpoint";
 
 import "envoy/api/v2/core/address.proto";
@@ -54,8 +53,11 @@ message Endpoint {
 
 // An Endpoint that Envoy can route traffic to.
 message LbEndpoint {
-  // Upstream host identifier
-  Endpoint endpoint = 1;
+  // Upstream host identifier or a named reference.
+  oneof host_identifier {
+    Endpoint endpoint = 1;
+    string endpoint_name = 5;
+  }
 
   // Optional health status when known and supplied by EDS server.
   core.HealthStatus health_status = 2;
diff --git a/api/src/main/proto/envoy/api/v2/endpoint/load_report.proto b/api/src/main/proto/envoy/api/v2/endpoint/load_report.proto
index 832e8504d..cbb01d327 100644
--- a/api/src/main/proto/envoy/api/v2/endpoint/load_report.proto
+++ b/api/src/main/proto/envoy/api/v2/endpoint/load_report.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.endpoint;
 option java_package = "io.envoyproxy.envoy.api.v2.endpoint";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
diff --git a/api/src/main/proto/envoy/api/v2/lds.proto b/api/src/main/proto/envoy/api/v2/lds.proto
index d05e37e5b..732702282 100644
--- a/api/src/main/proto/envoy/api/v2/lds.proto
+++ b/api/src/main/proto/envoy/api/v2/lds.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 option java_package = "io.envoyproxy.envoy.api.v2";
-option java_multiple_files = true;
 
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/api/v2/listener/listener.proto b/api/src/main/proto/envoy/api/v2/listener/listener.proto
index 0d617ceac..c919531c0 100644
--- a/api/src/main/proto/envoy/api/v2/listener/listener.proto
+++ b/api/src/main/proto/envoy/api/v2/listener/listener.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.listener;
 option java_package = "io.envoyproxy.envoy.api.v2.listener";
-option java_multiple_files = true;
 option go_package = "listener";
 option csharp_namespace = "Envoy.Api.V2.ListenerNS";
 
@@ -39,9 +38,8 @@ message Filter {
   // Filter specific configuration which depends on the filter being
   // instantiated. See the supported filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 4;
   }
 
@@ -209,9 +207,8 @@ message ListenerFilter {
   // Filter specific configuration which depends on the filter being instantiated.
   // See the supported filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/src/main/proto/envoy/api/v2/ratelimit/ratelimit.proto b/api/src/main/proto/envoy/api/v2/ratelimit/ratelimit.proto
index e60172d23..78bdc9c86 100644
--- a/api/src/main/proto/envoy/api/v2/ratelimit/ratelimit.proto
+++ b/api/src/main/proto/envoy/api/v2/ratelimit/ratelimit.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.ratelimit;
 option java_package = "io.envoyproxy.envoy.api.v2.ratelimit";
-option java_multiple_files = true;
 option go_package = "ratelimit";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/api/v2/rds.proto b/api/src/main/proto/envoy/api/v2/rds.proto
index 3671f359b..9699accf9 100644
--- a/api/src/main/proto/envoy/api/v2/rds.proto
+++ b/api/src/main/proto/envoy/api/v2/rds.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 option java_package = "io.envoyproxy.envoy.api.v2";
-option java_multiple_files = true;
 
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/api/v2/route/route.proto b/api/src/main/proto/envoy/api/v2/route/route.proto
index 7fbe350b5..1075d9d74 100644
--- a/api/src/main/proto/envoy/api/v2/route/route.proto
+++ b/api/src/main/proto/envoy/api/v2/route/route.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.route;
 option java_package = "io.envoyproxy.envoy.api.v2.route";
-option java_multiple_files = true;
 option go_package = "route";
 option java_generic_services = true;
 
@@ -28,7 +27,7 @@ option (gogoproto.equal_all) = true;
 // host header. This allows a single listener to service multiple top level domain path trees. Once
 // a virtual host is selected based on the domain, the routes are processed in order to see which
 // upstream cluster to route to or whether to perform a redirect.
-// [#comment:next free field: 16]
+// [#comment:next free field: 17]
 message VirtualHost {
   // The logical name of the virtual host. This is used when emitting certain
   // statistics but is not relevant for routing.
@@ -113,9 +112,8 @@ message VirtualHost {
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
   // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
   // for if and how it is utilized.
-  map<string, google.protobuf.Struct> per_filter_config = 12;
+  map<string, google.protobuf.Struct> per_filter_config = 12 [deprecated = true];
 
-  // [#not-implemented-hide:]
   // The per_filter_config field can be used to provide virtual host-specific
   // configurations for filters. The key should match the filter name, such as
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
@@ -132,6 +130,11 @@ message VirtualHost {
   // :ref:`suppress_envoy_headers
   // <envoy_api_field_config.filter.http.router.v2.Router.suppress_envoy_headers>` flag.
   bool include_request_attempt_count = 14;
+
+  // Indicates the retry policy for all routes in this virtual host. Note that setting a
+  // route level entry will take precedence over this config and it'll be treated
+  // independently (e.g.: values are not inherited).
+  RetryPolicy retry_policy = 16;
 }
 
 // A route is both a specification of how to match a request as well as an indication of what to do
@@ -176,9 +179,8 @@ message Route {
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
   // specific; see the :ref:`HTTP filter documentation <config_http_filters>` for
   // if and how it is utilized.
-  map<string, google.protobuf.Struct> per_filter_config = 8;
+  map<string, google.protobuf.Struct> per_filter_config = 8 [deprecated = true];
 
-  // [#not-implemented-hide:]
   // The per_filter_config field can be used to provide route-specific
   // configurations for filters. The key should match the filter name, such as
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
@@ -274,9 +276,8 @@ message WeightedCluster {
     // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
     // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
     // for if and how it is utilized.
-    map<string, google.protobuf.Struct> per_filter_config = 8;
+    map<string, google.protobuf.Struct> per_filter_config = 8 [deprecated = true];
 
-    // [#not-implemented-hide:]
     // The per_filter_config field can be used to provide weighted cluster-specific
     // configurations for filters. The key should match the filter name, such as
     // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
@@ -377,7 +378,7 @@ message RouteMatch {
   GrpcRouteMatchOptions grpc = 8;
 }
 
-// [#comment:next free field: 9]
+// [#comment:next free field: 11]
 message CorsPolicy {
   // Specifies the origins that will be allowed to do CORS requests.
   //
@@ -404,11 +405,41 @@ message CorsPolicy {
   // Specifies whether the resource allows credentials.
   google.protobuf.BoolValue allow_credentials = 6;
 
-  // Specifies if CORS is enabled. Defaults to true. Only effective on route.
-  google.protobuf.BoolValue enabled = 7;
+  oneof enabled_specifier {
+    // Specifies if CORS is enabled. Defaults to true. Only effective on route.
+    //
+    // .. attention::
+    //
+    //   **This field is deprecated**. Set the
+    //   :ref:`filter_enabled<envoy_api_field_route.CorsPolicy.filter_enabled>` field instead.
+    google.protobuf.BoolValue enabled = 7 [deprecated = true];
+
+    // Specifies if CORS is enabled.
+    //
+    // More information on how this can be controlled via runtime can be found
+    // :ref:`here <cors-runtime>`.
+    //
+    // .. note::
+    //
+    //   This field defaults to 100/:ref:`HUNDRED
+    //   <envoy_api_enum_type.FractionalPercent.DenominatorType>`.
+    core.RuntimeFractionalPercent filter_enabled = 9;
+  }
+
+  // Specifies if CORS policies are evaluated and tracked when filter is off but
+  // does not enforce any policies.
+  //
+  // More information on how this can be controlled via runtime can be found
+  // :ref:`here <cors-runtime>`.
+  //
+  // .. note::
+  //
+  //   This field defaults to 100/:ref:`HUNDRED
+  //   <envoy_api_enum_type.FractionalPercent.DenominatorType>`.
+  core.RuntimeFractionalPercent shadow_enabled = 10;
 }
 
-// [#comment:next free field: 26]
+// [#comment:next free field: 27]
 message RouteAction {
   oneof cluster_specifier {
     option (validate.required) = true;
@@ -510,71 +541,6 @@ message RouteAction {
   //   :ref:`retry overview <arch_overview_http_routing_retry>`.
   google.protobuf.Duration timeout = 8 [(gogoproto.stdduration) = true];
 
-  // HTTP retry :ref:`architecture overview <arch_overview_http_routing_retry>`.
-  message RetryPolicy {
-    // Specifies the conditions under which retry takes place. These are the same
-    // conditions documented for :ref:`config_http_filters_router_x-envoy-retry-on` and
-    // :ref:`config_http_filters_router_x-envoy-retry-grpc-on`.
-    string retry_on = 1;
-
-    // Specifies the allowed number of retries. This parameter is optional and
-    // defaults to 1. These are the same conditions documented for
-    // :ref:`config_http_filters_router_x-envoy-max-retries`.
-    google.protobuf.UInt32Value num_retries = 2;
-
-    // Specifies a non-zero upstream timeout per retry attempt. This parameter is optional. The
-    // same conditions documented for
-    // :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms` apply.
-    //
-    // .. note::
-    //
-    //   If left unspecified, Envoy will use the global
-    //   :ref:`route timeout <envoy_api_field_route.RouteAction.timeout>` for the request.
-    //   Consequently, when using a :ref:`5xx <config_http_filters_router_x-envoy-retry-on>` based
-    //   retry policy, a request that times out will not be retried as the total timeout budget
-    //   would have been exhausted.
-    google.protobuf.Duration per_try_timeout = 3 [(gogoproto.stdduration) = true];
-
-    message RetryPriority {
-      string name = 1 [(validate.rules).string.min_bytes = 1];
-      oneof config_type {
-        google.protobuf.Struct config = 2;
-
-        // [#not-implemented-hide:]
-        google.protobuf.Any typed_config = 3;
-      }
-    }
-
-    // Specifies an implementation of a RetryPriority which is used to determine the
-    // distribution of load across priorities used for retries. Refer to
-    // :ref:`retry plugin configuration <arch_overview_http_retry_plugins>` for more details.
-    RetryPriority retry_priority = 4;
-
-    message RetryHostPredicate {
-      string name = 1 [(validate.rules).string.min_bytes = 1];
-      oneof config_type {
-        google.protobuf.Struct config = 2;
-
-        // [#not-implemented-hide:]
-        google.protobuf.Any typed_config = 3;
-      }
-    }
-
-    // Specifies a collection of RetryHostPredicates that will be consulted when selecting a host
-    // for retries. If any of the predicates reject the host, host selection will be reattempted.
-    // Refer to :ref:`retry plugin configuration <arch_overview_http_retry_plugins>` for more
-    // details.
-    repeated RetryHostPredicate retry_host_predicate = 5;
-
-    // The maximum number of times host selection will be reattempted before giving up, at which
-    // point the host that was last selected will be routed to. If unspecified, this will default to
-    // retrying once.
-    int64 host_selection_retry_max_attempts = 6;
-
-    // HTTP status codes that should trigger a retry in addition to those specified by retry_on.
-    repeated uint32 retriable_status_codes = 7;
-  }
-
   // Specifies the idle timeout for the route. If not specified, there is no per-route idle timeout,
   // although the connection manager wide :ref:`stream_idle_timeout
   // <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.stream_idle_timeout>`
@@ -596,7 +562,9 @@ message RouteAction {
   google.protobuf.Duration idle_timeout = 24
       [(validate.rules).duration.gt = {}, (gogoproto.stdduration) = true];
 
-  // Indicates that the route has a retry policy.
+  // Indicates that the route has a retry policy. Note that if this is set,
+  // it'll take precedence over the virtual host level retry policy entirely
+  // (e.g.: policies are not merged, most internal one becomes the enforced policy).
   RetryPolicy retry_policy = 9;
 
   // The router is capable of shadowing traffic from one cluster to another. The current
@@ -803,6 +771,76 @@ message RouteAction {
     google.protobuf.BoolValue enabled = 2;
   };
   repeated UpgradeConfig upgrade_configs = 25;
+
+  // Configures :ref:`internal redirect <arch_overview_internal_redirects>` behavior.
+  enum InternalRedirectAction {
+    PASS_THROUGH_INTERNAL_REDIRECT = 0;
+    HANDLE_INTERNAL_REDIRECT = 1;
+  }
+  InternalRedirectAction internal_redirect_action = 26;
+}
+
+// HTTP retry :ref:`architecture overview <arch_overview_http_routing_retry>`.
+message RetryPolicy {
+  // Specifies the conditions under which retry takes place. These are the same
+  // conditions documented for :ref:`config_http_filters_router_x-envoy-retry-on` and
+  // :ref:`config_http_filters_router_x-envoy-retry-grpc-on`.
+  string retry_on = 1;
+
+  // Specifies the allowed number of retries. This parameter is optional and
+  // defaults to 1. These are the same conditions documented for
+  // :ref:`config_http_filters_router_x-envoy-max-retries`.
+  google.protobuf.UInt32Value num_retries = 2;
+
+  // Specifies a non-zero upstream timeout per retry attempt. This parameter is optional. The
+  // same conditions documented for
+  // :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms` apply.
+  //
+  // .. note::
+  //
+  //   If left unspecified, Envoy will use the global
+  //   :ref:`route timeout <envoy_api_field_route.RouteAction.timeout>` for the request.
+  //   Consequently, when using a :ref:`5xx <config_http_filters_router_x-envoy-retry-on>` based
+  //   retry policy, a request that times out will not be retried as the total timeout budget
+  //   would have been exhausted.
+  google.protobuf.Duration per_try_timeout = 3 [(gogoproto.stdduration) = true];
+
+  message RetryPriority {
+    string name = 1 [(validate.rules).string.min_bytes = 1];
+    oneof config_type {
+      google.protobuf.Struct config = 2 [deprecated = true];
+
+      google.protobuf.Any typed_config = 3;
+    }
+  }
+
+  // Specifies an implementation of a RetryPriority which is used to determine the
+  // distribution of load across priorities used for retries. Refer to
+  // :ref:`retry plugin configuration <arch_overview_http_retry_plugins>` for more details.
+  RetryPriority retry_priority = 4;
+
+  message RetryHostPredicate {
+    string name = 1 [(validate.rules).string.min_bytes = 1];
+    oneof config_type {
+      google.protobuf.Struct config = 2 [deprecated = true];
+
+      google.protobuf.Any typed_config = 3;
+    }
+  }
+
+  // Specifies a collection of RetryHostPredicates that will be consulted when selecting a host
+  // for retries. If any of the predicates reject the host, host selection will be reattempted.
+  // Refer to :ref:`retry plugin configuration <arch_overview_http_retry_plugins>` for more
+  // details.
+  repeated RetryHostPredicate retry_host_predicate = 5;
+
+  // The maximum number of times host selection will be reattempted before giving up, at which
+  // point the host that was last selected will be routed to. If unspecified, this will default to
+  // retrying once.
+  int64 host_selection_retry_max_attempts = 6;
+
+  // HTTP status codes that should trigger a retry in addition to those specified by retry_on.
+  repeated uint32 retriable_status_codes = 7;
 }
 
 message RedirectAction {
diff --git a/api/src/main/proto/envoy/config/accesslog/v2/als.proto b/api/src/main/proto/envoy/config/accesslog/v2/als.proto
index 0c51d123c..fdc5fa12c 100644
--- a/api/src/main/proto/envoy/config/accesslog/v2/als.proto
+++ b/api/src/main/proto/envoy/config/accesslog/v2/als.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.accesslog.v2;
 option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/grpc_service.proto";
diff --git a/api/src/main/proto/envoy/config/accesslog/v2/file.proto b/api/src/main/proto/envoy/config/accesslog/v2/file.proto
index bd22ef2e9..fb5bddceb 100644
--- a/api/src/main/proto/envoy/config/accesslog/v2/file.proto
+++ b/api/src/main/proto/envoy/config/accesslog/v2/file.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.accesslog.v2;
 option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/config/bootstrap/v2/bootstrap.proto b/api/src/main/proto/envoy/config/bootstrap/v2/bootstrap.proto
index 13a88b95a..f6f883b82 100644
--- a/api/src/main/proto/envoy/config/bootstrap/v2/bootstrap.proto
+++ b/api/src/main/proto/envoy/config/bootstrap/v2/bootstrap.proto
@@ -7,7 +7,6 @@ syntax = "proto3";
 
 package envoy.config.bootstrap.v2;
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/address.proto";
diff --git a/api/src/main/proto/envoy/config/filter/accesslog/v2/accesslog.proto b/api/src/main/proto/envoy/config/filter/accesslog/v2/accesslog.proto
index 76f5994af..c85f06efa 100644
--- a/api/src/main/proto/envoy/config/filter/accesslog/v2/accesslog.proto
+++ b/api/src/main/proto/envoy/config/filter/accesslog/v2/accesslog.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.accesslog.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.accesslog.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/base.proto";
@@ -35,9 +34,8 @@ message AccessLog {
   // #. "envoy.http_grpc_access_log": :ref:`HttpGrpcAccessLogConfig
   //    <envoy_api_msg_config.accesslog.v2.HttpGrpcAccessLogConfig>`
   oneof config_type {
-    google.protobuf.Struct config = 3;
+    google.protobuf.Struct config = 3 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 4;
   }
 }
diff --git a/api/src/main/proto/envoy/config/filter/fault/v2/fault.proto b/api/src/main/proto/envoy/config/filter/fault/v2/fault.proto
index 15eefbed7..8462a2f95 100644
--- a/api/src/main/proto/envoy/config/filter/fault/v2/fault.proto
+++ b/api/src/main/proto/envoy/config/filter/fault/v2/fault.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.fault.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.fault.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/type/percent.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/buffer/v2/buffer.proto b/api/src/main/proto/envoy/config/filter/http/buffer/v2/buffer.proto
index b476800b3..fce389c68 100644
--- a/api/src/main/proto/envoy/config/filter/http/buffer/v2/buffer.proto
+++ b/api/src/main/proto/envoy/config/filter/http/buffer/v2/buffer.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.buffer.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.buffer.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "google/protobuf/duration.proto";
@@ -15,16 +14,11 @@ import "gogoproto/gogo.proto";
 // Buffer :ref:`configuration overview <config_http_filters_buffer>`.
 
 message Buffer {
+  reserved 2; // formerly max_request_time
+
   // The maximum request size that the filter will buffer before the connection
   // manager will stop buffering and return a 413 response.
   google.protobuf.UInt32Value max_request_bytes = 1 [(validate.rules).uint32.gt = 0];
-
-  // The maximum number of seconds that the filter will wait for a complete
-  // request before returning a 408 response.
-  // deprecated in favor of http connection manager of :ref:request timeouts
-  // <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.request_timeout>
-  google.protobuf.Duration max_request_time = 2
-      [deprecated = true, (validate.rules).duration = {gt: {}}, (gogoproto.stdduration) = true];
 }
 
 message BufferPerRoute {
diff --git a/api/src/main/proto/envoy/config/filter/http/ext_authz/v2alpha/ext_authz.proto b/api/src/main/proto/envoy/config/filter/http/ext_authz/v2alpha/ext_authz.proto
index 6d8566ad4..d9d476a90 100644
--- a/api/src/main/proto/envoy/config/filter/http/ext_authz/v2alpha/ext_authz.proto
+++ b/api/src/main/proto/envoy/config/filter/http/ext_authz/v2alpha/ext_authz.proto
@@ -2,27 +2,22 @@ syntax = "proto3";
 
 package envoy.config.filter.http.ext_authz.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.filter.http.ext_authz.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/grpc_service.proto";
 import "envoy/api/v2/core/http_uri.proto";
 
+import "envoy/type/matcher/string.proto";
+
 import "validate/validate.proto";
 
 // [#protodoc-title: External Authorization ]
 // The external authorization service configuration
 // :ref:`configuration overview <config_http_filters_ext_authz>`.
 
-// External Authorization filter calls out to an external service over either:
-//
-//  1. gRPC Authorization API defined by :ref:`CheckRequest
-//     <envoy_api_msg_service.auth.v2alpha.CheckRequest>`.
-//  2. Raw HTTP Authorization server by passing the request headers to the service.
-//
-// A failed check will cause this filter to close the HTTP request normally with 403 (Forbidden),
-// unless a different status code has been indicated in the authorization response.
+// External Authorization filter calls out to an external service over either
+// gRPC or raw HTTP clients.
 message ExtAuthz {
 
   oneof services {
@@ -35,39 +30,44 @@ message ExtAuthz {
     HttpService http_service = 3;
   }
 
-  // The filter's behaviour in case the external authorization service does
-  // not respond back. When set to true, Envoy will also allow traffic in cases when
-  // an error occurs during the authorization process.
-  // Defaults to false.
+  // Allows bypassing the filter on errors during the authorization process.
+  //
+  //  1. When *failure_mode_allow* is true, traffic will be allowed in the presence of an error.
+  //  This includes any of the HTTP 5xx errors, or a communication failure between the filter and
+  //  the authorization server.
+  //  2. When *failure_mode_allow* is false, the filter will *always* return a *Forbidden response*
+  //  to the client. It will *not allow* traffic to the upstream in the presence of an error. This
+  //  includes any of the HTTP 5xx errors, or a communication failure between the filter and the
+  //  authorization server.
+  //
+  // Note that filter will produce stats on error. See *Statistics* at :ref:`configuration overview
+  // <config_http_filters_ext_authz>`.
   bool failure_mode_allow = 2;
 }
 
-// External Authorization filter calls out to an upstream authorization server by passing the raw
+// External Authorization filter calls an authorization server by passing the raw
 // HTTP request headers to the server. This allows the authorization service to take a decision
-// whether the request is authorized or not.
+// whether the request should be authorized or not.
 //
 // A successful check allows the authorization service adding or overriding headers from the
-// original request before dispatching it to the upstream. This is done by configuring which headers
-// in the authorization response should be sent to the upstream. See *allowed_authorization_headers*
-// below.
+// original request before dispatching them to the upstream. This is done by configuring which
+// headers in the authorization response should be sent to the upstream. See
+// :ref:`allowed_upstream_headers
+// <envoy_api_field_config.filter.http.ext_authz.v2alpha.AuthorizationResponse.allowed_upstream_headers>`
+// for more details.
 //
 // A failed check will cause this filter to close the HTTP request with 403 (Forbidden),
 // unless a different status code has been indicated by the authorization server via response
-// headers.
+// headers. In addition to the the status code and with exception of the *Authority*, the filter
+// will send all headers from the authorization server back to the client by default. See
+// :ref:`allowed_client_headers
+// <envoy_api_field_config.filter.http.ext_authz.v2alpha.AuthorizationResponse.allowed_client_headers>`
+// for more details.
 //
-// If an error happens during the checking process, two situations may occur depending on the
-// filter's configuration:
+//  .. note::
 //
-//  1. When *failure_mode_allow* is true, traffic will be allowed in the presence of an error. This
-//     includes any of the HTTP 5xx errors, or a communication failure between the filter and the
-//     authorization server.
-//  2. When *failure_mode_allow* is false, the filter will *always* return a *Forbidden response* to
-//     the client. It will *not allow* traffic to the upstream in the presence of an error. This
-//     includes any of the HTTP 5xx errors, or a communication failure between the filter and the
-//     authorization server.
-//
-// Note that filter will produce stats on error. See *Statistics* at :ref:`configuration overview
-// <config_http_filters_ext_authz>`.
+//    Unlike the gRPC client that request and response headers are passed in the message,
+//    headers forwarded by via the raw HTTP client will affect the request or the response.
 message HttpService {
   // Sets the HTTP server URI which the authorization requests must be sent to.
   envoy.api.v2.core.HttpUri server_uri = 1;
@@ -76,21 +76,44 @@ message HttpService {
   string path_prefix = 2;
 
   reserved 3;
+  reserved 4;
+  reserved 5;
+  reserved 6;
+
+  // Settings for controlling request headers forwarded from the filter to the authorization server.
+  AuthorizationRequest authorization_request = 7;
 
-  // Sets a list of headers that can be sent from the authorization server to the upstream service,
-  // or to the downstream client when present in the authorization response. Note that a matched
-  // request header will have its value overridden by the ones sent from the authorization server.
-  repeated string allowed_authorization_headers = 4;
+  // Settings for controlling authorization response forwarded from the filter to a client,
+  // or to an upstream service.
+  AuthorizationResponse authorization_response = 8;
+}
 
-  // Sets a list of headers that should be sent *from the filter* to the authorization server
-  // when they are also present in the client request. Note that *Content-Length*, *Authority*,
-  // *Method* and *Path* are always dispatched to the authorization server by default. The message
-  // will not contain body data and the *Content-Length* will be set to zero.
-  repeated string allowed_request_headers = 5;
+message AuthorizationRequest {
+  // Sets a list of matchers that are used to determine which client request headers should
+  // be forwarded *from the filter* to the authorization server. Note that *Content-Length*,
+  // *Authority*, *Method*, *Path* and *Authorization* are always dispatched to the authorization
+  // server by default. The message will not contain body data and the *Content-Length* will be set
+  // to zero.
+  envoy.type.matcher.ListStringMatcher allowed_headers = 1;
 
   // Sets a list of headers and their values that will be added to the request to external
   // authorization server. Note that these will override the headers coming from the downstream.
-  repeated envoy.api.v2.core.HeaderValue authorization_headers_to_add = 6;
+  repeated envoy.api.v2.core.HeaderValue headers_to_add = 2;
+}
+
+message AuthorizationResponse {
+  // Sets a list of matchers that are used to determine which authorization response headers should
+  // be forwarded *from the filter* to the upstream service only when the HTTP status is a 200 OK.
+  // Note that these headers will override that the original request headers when respectively
+  // matched.
+  envoy.type.matcher.ListStringMatcher allowed_upstream_headers = 1;
+
+  // Sets a list of keys that are used to determine which authorization response headers should
+  // be forwarded *from the filter* to the client when the HTTP status is *NOT* a 200 OK. Note that
+  // when this list is empty, all the authorization response headers, except *Authority* will be
+  // sent to the client (default). When a header is included in this list, *Path*, *Status*,
+  // *Content-Length*, *WWWAuthenticate* and *Location* are automatically added.
+  envoy.type.matcher.ListStringMatcher allowed_client_headers = 2;
 }
 
 // Extra settings on a per virtualhost/route/weighter-cluster level.
diff --git a/api/src/main/proto/envoy/config/filter/http/fault/v2/fault.proto b/api/src/main/proto/envoy/config/filter/http/fault/v2/fault.proto
index e1e24e6f9..134a5424c 100644
--- a/api/src/main/proto/envoy/config/filter/http/fault/v2/fault.proto
+++ b/api/src/main/proto/envoy/config/filter/http/fault/v2/fault.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.fault.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.fault.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/route/route.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/gzip/v2/gzip.proto b/api/src/main/proto/envoy/config/filter/http/gzip/v2/gzip.proto
index 63216c54d..e6609f171 100644
--- a/api/src/main/proto/envoy/config/filter/http/gzip/v2/gzip.proto
+++ b/api/src/main/proto/envoy/config/filter/http/gzip/v2/gzip.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.gzip.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.gzip.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "google/protobuf/wrappers.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto b/api/src/main/proto/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto
index 2adaa8dc7..af9a4d0cf 100644
--- a/api/src/main/proto/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto
+++ b/api/src/main/proto/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.header_to_metadata.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.header_to_metadata.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/health_check/v2/health_check.proto b/api/src/main/proto/envoy/config/filter/http/health_check/v2/health_check.proto
index c3c8290d9..5cb6a9d37 100644
--- a/api/src/main/proto/envoy/config/filter/http/health_check/v2/health_check.proto
+++ b/api/src/main/proto/envoy/config/filter/http/health_check/v2/health_check.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.health_check.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.health_check.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "google/protobuf/duration.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto b/api/src/main/proto/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto
index a8d86d71d..aba17986a 100644
--- a/api/src/main/proto/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto
+++ b/api/src/main/proto/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.ip_tagging.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.ip_tagging.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/address.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/jwt_authn/v2alpha/config.proto b/api/src/main/proto/envoy/config/filter/http/jwt_authn/v2alpha/config.proto
index 1a52ae1cc..b585cb6db 100644
--- a/api/src/main/proto/envoy/config/filter/http/jwt_authn/v2alpha/config.proto
+++ b/api/src/main/proto/envoy/config/filter/http/jwt_authn/v2alpha/config.proto
@@ -3,7 +3,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.jwt_authn.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.filter.http.jwt_authn.v2alpha";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/http_uri.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/lua/v2/lua.proto b/api/src/main/proto/envoy/config/filter/http/lua/v2/lua.proto
index 3c0887b3d..a2bbb3fc7 100644
--- a/api/src/main/proto/envoy/config/filter/http/lua/v2/lua.proto
+++ b/api/src/main/proto/envoy/config/filter/http/lua/v2/lua.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.lua.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.lua.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/rate_limit/v2/rate_limit.proto b/api/src/main/proto/envoy/config/filter/http/rate_limit/v2/rate_limit.proto
index a1cfabbfa..f153e59bf 100644
--- a/api/src/main/proto/envoy/config/filter/http/rate_limit/v2/rate_limit.proto
+++ b/api/src/main/proto/envoy/config/filter/http/rate_limit/v2/rate_limit.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.rate_limit.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.rate_limit.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/ratelimit/v2/rls.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/rbac/v2/rbac.proto b/api/src/main/proto/envoy/config/filter/http/rbac/v2/rbac.proto
index 847372edf..82f92f6ef 100644
--- a/api/src/main/proto/envoy/config/filter/http/rbac/v2/rbac.proto
+++ b/api/src/main/proto/envoy/config/filter/http/rbac/v2/rbac.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.rbac.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.rbac.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/rbac/v2alpha/rbac.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/router/v2/router.proto b/api/src/main/proto/envoy/config/filter/http/router/v2/router.proto
index b8a394c4a..b23624271 100644
--- a/api/src/main/proto/envoy/config/filter/http/router/v2/router.proto
+++ b/api/src/main/proto/envoy/config/filter/http/router/v2/router.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.router.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.router.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/filter/accesslog/v2/accesslog.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/squash/v2/squash.proto b/api/src/main/proto/envoy/config/filter/http/squash/v2/squash.proto
index 472cc9331..f3bdd9d2e 100644
--- a/api/src/main/proto/envoy/config/filter/http/squash/v2/squash.proto
+++ b/api/src/main/proto/envoy/config/filter/http/squash/v2/squash.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.squash.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.squash.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "google/protobuf/duration.proto";
diff --git a/api/src/main/proto/envoy/config/filter/http/transcoder/v2/transcoder.proto b/api/src/main/proto/envoy/config/filter/http/transcoder/v2/transcoder.proto
index 342a8b5c1..ccb455ac2 100644
--- a/api/src/main/proto/envoy/config/filter/http/transcoder/v2/transcoder.proto
+++ b/api/src/main/proto/envoy/config/filter/http/transcoder/v2/transcoder.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.transcoder.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.http.transcoder.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto b/api/src/main/proto/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto
index 7a3a5487d..30bf9910f 100644
--- a/api/src/main/proto/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto
+++ b/api/src/main/proto/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.client_ssl_auth.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.client_ssl_auth.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/address.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto b/api/src/main/proto/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto
index ea98392af..fd7a02009 100644
--- a/api/src/main/proto/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto
+++ b/api/src/main/proto/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.extensions.filters.network.dubbo_proxy.v2alpha1;
 option java_package = "io.envoyproxy.envoy.extensions.filters.network.dubbo_proxy.v2alpha1";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/ext_authz/v2/ext_authz.proto b/api/src/main/proto/envoy/config/filter/network/ext_authz/v2/ext_authz.proto
index 8bfd00df2..0b0346c50 100644
--- a/api/src/main/proto/envoy/config/filter/network/ext_authz/v2/ext_authz.proto
+++ b/api/src/main/proto/envoy/config/filter/network/ext_authz/v2/ext_authz.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.ext_authz.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.ext_authz.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/grpc_service.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto b/api/src/main/proto/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
index 440188ef9..4357ee115 100644
--- a/api/src/main/proto/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
+++ b/api/src/main/proto/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.http_connection_manager.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/config_source.proto";
@@ -410,9 +409,8 @@ message HttpFilter {
   // Filter specific configuration which depends on the filter being instantiated. See the supported
   // filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 4;
   }
 
diff --git a/api/src/main/proto/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto b/api/src/main/proto/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto
index c7756e47f..1149a53ba 100644
--- a/api/src/main/proto/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto
+++ b/api/src/main/proto/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.mongo_proxy.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.mongo_proxy.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/filter/fault/v2/fault.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/rate_limit/v2/rate_limit.proto b/api/src/main/proto/envoy/config/filter/network/rate_limit/v2/rate_limit.proto
index cb390c164..9a89081bf 100644
--- a/api/src/main/proto/envoy/config/filter/network/rate_limit/v2/rate_limit.proto
+++ b/api/src/main/proto/envoy/config/filter/network/rate_limit/v2/rate_limit.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.rate_limit.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.rate_limit.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/ratelimit/ratelimit.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/rbac/v2/rbac.proto b/api/src/main/proto/envoy/config/filter/network/rbac/v2/rbac.proto
index 171c17bcf..4441d5e4e 100644
--- a/api/src/main/proto/envoy/config/filter/network/rbac/v2/rbac.proto
+++ b/api/src/main/proto/envoy/config/filter/network/rbac/v2/rbac.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.rbac.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.rbac.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/rbac/v2alpha/rbac.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto b/api/src/main/proto/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
index 367999b33..a7847be18 100644
--- a/api/src/main/proto/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
+++ b/api/src/main/proto/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.redis_proxy.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.redis_proxy.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "google/protobuf/duration.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto b/api/src/main/proto/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto
index 0cb8c179d..4e1da6f32 100644
--- a/api/src/main/proto/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto
+++ b/api/src/main/proto/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.tcp_proxy.v2;
 option java_package = "io.envoyproxy.envoy.config.filter.network.tcp_proxy.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/filter/accesslog/v2/accesslog.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto b/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto
index 2936f1999..f1d4b457b 100644
--- a/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto
+++ b/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.thrift_proxy.v2alpha1;
 option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v2alpha1";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/base.proto";
diff --git a/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto b/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
index 7d17a6aab..8ca4e64df 100644
--- a/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
+++ b/api/src/main/proto/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.thrift_proxy.v2alpha1;
 option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v2alpha1";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto";
@@ -95,9 +94,8 @@ message ThriftFilter {
   // Filter specific configuration which depends on the filter being instantiated. See the supported
   // filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/src/main/proto/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto b/api/src/main/proto/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto
index dedad6453..e3ced525a 100644
--- a/api/src/main/proto/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto
+++ b/api/src/main/proto/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.thrift.rate_limit.v2alpha1;
 option java_package = "io.envoyproxy.envoy.config.filter.thrift.rate_limit.v2alpha1";
-option java_multiple_files = true;
 option go_package = "v2alpha1";
 
 import "envoy/config/ratelimit/v2/rls.proto";
diff --git a/api/src/main/proto/envoy/config/filter/thrift/router/v2alpha1/router.proto b/api/src/main/proto/envoy/config/filter/thrift/router/v2alpha1/router.proto
index 5c0b60238..d7ac3b02e 100644
--- a/api/src/main/proto/envoy/config/filter/thrift/router/v2alpha1/router.proto
+++ b/api/src/main/proto/envoy/config/filter/thrift/router/v2alpha1/router.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.thrift.router.v2alpha1;
 option java_package = "io.envoyproxy.envoy.config.filter.thrift.router.v2alpha1";
-option java_multiple_files = true;
 option go_package = "v2alpha1";
 
 // [#protodoc-title: Router]
diff --git a/api/src/main/proto/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto b/api/src/main/proto/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto
index 9f1848a20..f210da30a 100644
--- a/api/src/main/proto/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto
+++ b/api/src/main/proto/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto
@@ -5,7 +5,6 @@ syntax = "proto3";
 
 package envoy.config.grpc_credential.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.grpc_credential.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 
 import "envoy/api/v2/core/base.proto";
diff --git a/api/src/main/proto/envoy/config/health_checker/redis/v2/redis.proto b/api/src/main/proto/envoy/config/health_checker/redis/v2/redis.proto
index 9438ff668..2aa323647 100644
--- a/api/src/main/proto/envoy/config/health_checker/redis/v2/redis.proto
+++ b/api/src/main/proto/envoy/config/health_checker/redis/v2/redis.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.health_checker.redis.v2;
 option java_package = "io.envoyproxy.envoy.config.health_checker.redis.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 // [#protodoc-title: Redis]
diff --git a/api/src/main/proto/envoy/config/metrics/v2/metrics_service.proto b/api/src/main/proto/envoy/config/metrics/v2/metrics_service.proto
index fb3e88d34..ae78e8403 100644
--- a/api/src/main/proto/envoy/config/metrics/v2/metrics_service.proto
+++ b/api/src/main/proto/envoy/config/metrics/v2/metrics_service.proto
@@ -4,7 +4,6 @@ syntax = "proto3";
 
 package envoy.config.metrics.v2;
 option java_package = "io.envoyproxy.envoy.config.metrics.v2";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/grpc_service.proto";
 
diff --git a/api/src/main/proto/envoy/config/metrics/v2/stats.proto b/api/src/main/proto/envoy/config/metrics/v2/stats.proto
index 1cd4b146f..0118bcccd 100644
--- a/api/src/main/proto/envoy/config/metrics/v2/stats.proto
+++ b/api/src/main/proto/envoy/config/metrics/v2/stats.proto
@@ -5,7 +5,6 @@ syntax = "proto3";
 
 package envoy.config.metrics.v2;
 option java_package = "io.envoyproxy.envoy.config.metrics.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/address.proto";
@@ -33,9 +32,8 @@ message StatsSink {
   // Stats sink specific configuration which depends on the sink being instantiated. See
   // :ref:`StatsdSink <envoy_api_msg_config.metrics.v2.StatsdSink>` for an example.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/src/main/proto/envoy/config/overload/v2alpha/overload.proto b/api/src/main/proto/envoy/config/overload/v2alpha/overload.proto
index cbb34e17b..925bd9ddb 100644
--- a/api/src/main/proto/envoy/config/overload/v2alpha/overload.proto
+++ b/api/src/main/proto/envoy/config/overload/v2alpha/overload.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.overload.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.overload.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 
 import "google/protobuf/any.proto";
@@ -30,9 +29,8 @@ message ResourceMonitor {
 
   // Configuration for the resource monitor being instantiated.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
-    // [#not-implemented-hide:]
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/src/main/proto/envoy/config/ratelimit/v2/rls.proto b/api/src/main/proto/envoy/config/ratelimit/v2/rls.proto
index 7deeac906..c0d615abc 100644
--- a/api/src/main/proto/envoy/config/ratelimit/v2/rls.proto
+++ b/api/src/main/proto/envoy/config/ratelimit/v2/rls.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.ratelimit.v2;
 option java_package = "io.envoyproxy.envoy.config.ratelimit.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/grpc_service.proto";
diff --git a/api/src/main/proto/envoy/config/rbac/v2alpha/rbac.proto b/api/src/main/proto/envoy/config/rbac/v2alpha/rbac.proto
index 35aea0f04..2856dd037 100644
--- a/api/src/main/proto/envoy/config/rbac/v2alpha/rbac.proto
+++ b/api/src/main/proto/envoy/config/rbac/v2alpha/rbac.proto
@@ -8,7 +8,6 @@ import "envoy/type/matcher/string.proto";
 
 package envoy.config.rbac.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.rbac.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 
 // [#protodoc-title: Role Based Access Control (RBAC)]
diff --git a/api/src/main/proto/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto b/api/src/main/proto/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
index 348322440..96d439c2a 100644
--- a/api/src/main/proto/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
+++ b/api/src/main/proto/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.resource_monitor.fixed_heap.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.fixed_heap.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 
 // [#protodoc-title: Fixed heap]
diff --git a/api/src/main/proto/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto b/api/src/main/proto/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
index beb8f4674..bd364ebbf 100644
--- a/api/src/main/proto/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
+++ b/api/src/main/proto/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.resource_monitor.injected_resource.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.injected_resource.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/config/retry/previous_priorities/previous_priorities_config.proto b/api/src/main/proto/envoy/config/retry/previous_priorities/previous_priorities_config.proto
index ae3c3ea0b..0d84b929f 100644
--- a/api/src/main/proto/envoy/config/retry/previous_priorities/previous_priorities_config.proto
+++ b/api/src/main/proto/envoy/config/retry/previous_priorities/previous_priorities_config.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.retry.previous_priorities;
 option java_package = "io.envoyproxy.envoy.config.retry.previous_priorities";
-option java_multiple_files = true;
 
 // A retry host selector that attempts to spread retries between priorities, even if certain
 // priorities would not normally be attempted due to higher priorities being available.
diff --git a/api/src/main/proto/envoy/config/trace/v2/trace.proto b/api/src/main/proto/envoy/config/trace/v2/trace.proto
index 058bc99bf..4f25ec69b 100644
--- a/api/src/main/proto/envoy/config/trace/v2/trace.proto
+++ b/api/src/main/proto/envoy/config/trace/v2/trace.proto
@@ -5,7 +5,6 @@ syntax = "proto3";
 
 package envoy.config.trace.v2;
 option java_package = "io.envoyproxy.envoy.config.trace.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/grpc_service.proto";
@@ -41,9 +40,8 @@ message Tracing {
     // - :ref:`DynamicOtConfig <envoy_api_msg_config.trace.v2.DynamicOtConfig>`
     // - :ref:`DatadogConfig <envoy_api_msg_config.trace.v2.DatadogConfig>`
     oneof config_type {
-      google.protobuf.Struct config = 2;
+      google.protobuf.Struct config = 2 [deprecated = true];
 
-      // [#not-implemented-hide:]
       google.protobuf.Any typed_config = 3;
     }
   }
diff --git a/api/src/main/proto/envoy/config/transport_socket/alts/v2alpha/alts.proto b/api/src/main/proto/envoy/config/transport_socket/alts/v2alpha/alts.proto
index 5286d94ad..d9cf9b6fc 100644
--- a/api/src/main/proto/envoy/config/transport_socket/alts/v2alpha/alts.proto
+++ b/api/src/main/proto/envoy/config/transport_socket/alts/v2alpha/alts.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.transport_socket.alts.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.transport_socket.alts.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2";
 
 // [#protodoc-title: ALTS]
diff --git a/api/src/main/proto/envoy/config/transport_socket/capture/v2alpha/capture.proto b/api/src/main/proto/envoy/config/transport_socket/capture/v2alpha/capture.proto
index dda6602a8..784905f47 100644
--- a/api/src/main/proto/envoy/config/transport_socket/capture/v2alpha/capture.proto
+++ b/api/src/main/proto/envoy/config/transport_socket/capture/v2alpha/capture.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.config.transport_socket.capture.v2alpha;
 option java_package = "io.envoyproxy.envoy.config.transport_socket.capture.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2";
 
 // [#protodoc-title: Capture]
diff --git a/api/src/main/proto/envoy/data/accesslog/v2/accesslog.proto b/api/src/main/proto/envoy/data/accesslog/v2/accesslog.proto
index 621cf49eb..95763781b 100644
--- a/api/src/main/proto/envoy/data/accesslog/v2/accesslog.proto
+++ b/api/src/main/proto/envoy/data/accesslog/v2/accesslog.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.data.accesslog.v2;
 option java_package = "io.envoyproxy.envoy.data.accesslog.v2";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
diff --git a/api/src/main/proto/envoy/data/core/v2alpha/health_check_event.proto b/api/src/main/proto/envoy/data/core/v2alpha/health_check_event.proto
index 51efb1197..54dc8f38a 100644
--- a/api/src/main/proto/envoy/data/core/v2alpha/health_check_event.proto
+++ b/api/src/main/proto/envoy/data/core/v2alpha/health_check_event.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.data.core.v2alpha;
 option java_package = "io.envoyproxy.envoy.data.core.v2alpha";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/address.proto";
 
@@ -32,6 +31,12 @@ message HealthCheckEvent {
 
     // Host failure.
     HealthCheckFailure health_check_failure_event = 7;
+
+    // Healthy host became degraded.
+    DegradedHealthyHost degraded_healthy_host = 8;
+
+    // A degraded host returned to being healthy.
+    NoLongerDegradedHost no_longer_degraded_host = 9;
   }
 
   // Timestamp for event.
@@ -69,3 +74,9 @@ message HealthCheckFailure {
   // Whether this event is the result of the first ever health check on a host.
   bool first_check = 2;
 }
+
+message DegradedHealthyHost {
+}
+
+message NoLongerDegradedHost {
+}
diff --git a/api/src/main/proto/envoy/data/tap/v2alpha/capture.proto b/api/src/main/proto/envoy/data/tap/v2alpha/capture.proto
index aea51a19a..36f6e9b0b 100644
--- a/api/src/main/proto/envoy/data/tap/v2alpha/capture.proto
+++ b/api/src/main/proto/envoy/data/tap/v2alpha/capture.proto
@@ -6,7 +6,6 @@ syntax = "proto3";
 
 package envoy.data.tap.v2alpha;
 option java_package = "io.envoyproxy.envoy.data.tap.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/address.proto";
diff --git a/api/src/main/proto/envoy/service/accesslog/v2/als.proto b/api/src/main/proto/envoy/service/accesslog/v2/als.proto
index aca6c9382..ebb7013ae 100644
--- a/api/src/main/proto/envoy/service/accesslog/v2/als.proto
+++ b/api/src/main/proto/envoy/service/accesslog/v2/als.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.accesslog.v2;
 option java_package = "io.envoyproxy.envoy.service.accesslog.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/service/auth/v2alpha/attribute_context.proto b/api/src/main/proto/envoy/service/auth/v2alpha/attribute_context.proto
index 8f2e2243a..99e90b9ca 100644
--- a/api/src/main/proto/envoy/service/auth/v2alpha/attribute_context.proto
+++ b/api/src/main/proto/envoy/service/auth/v2alpha/attribute_context.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.auth.v2alpha;
 option java_package = "io.envoyproxy.envoy.service.auth.v2alpha";
-option java_multiple_files = true;
 
 import "envoy/api/v2/core/address.proto";
 
diff --git a/api/src/main/proto/envoy/service/auth/v2alpha/external_auth.proto b/api/src/main/proto/envoy/service/auth/v2alpha/external_auth.proto
index deca67ef0..870de90c2 100644
--- a/api/src/main/proto/envoy/service/auth/v2alpha/external_auth.proto
+++ b/api/src/main/proto/envoy/service/auth/v2alpha/external_auth.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.auth.v2alpha;
 option java_package = "io.envoyproxy.envoy.service.auth.v2alpha";
-option java_multiple_files = true;
 option go_package = "v2alpha";
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/service/discovery/v2/ads.proto b/api/src/main/proto/envoy/service/discovery/v2/ads.proto
index 108fb1da6..e8774dd29 100644
--- a/api/src/main/proto/envoy/service/discovery/v2/ads.proto
+++ b/api/src/main/proto/envoy/service/discovery/v2/ads.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 option java_package = "io.envoyproxy.envoy.service.discovery.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/service/discovery/v2/hds.proto b/api/src/main/proto/envoy/service/discovery/v2/hds.proto
index d19e3cb69..13dd5db43 100644
--- a/api/src/main/proto/envoy/service/discovery/v2/hds.proto
+++ b/api/src/main/proto/envoy/service/discovery/v2/hds.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 option java_package = "io.envoyproxy.envoy.service.discovery.v2";
-option java_multiple_files = true;
 
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/service/discovery/v2/sds.proto b/api/src/main/proto/envoy/service/discovery/v2/sds.proto
index 51b699d65..60d5d2281 100644
--- a/api/src/main/proto/envoy/service/discovery/v2/sds.proto
+++ b/api/src/main/proto/envoy/service/discovery/v2/sds.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 option java_package = "io.envoyproxy.envoy.service.discovery.v2";
-option java_multiple_files = true;
 
 import "envoy/api/v2/discovery.proto";
 
diff --git a/api/src/main/proto/envoy/service/load_stats/v2/lrs.proto b/api/src/main/proto/envoy/service/load_stats/v2/lrs.proto
index 849f69a77..aa3638b63 100644
--- a/api/src/main/proto/envoy/service/load_stats/v2/lrs.proto
+++ b/api/src/main/proto/envoy/service/load_stats/v2/lrs.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.load_stats.v2;
 option java_package = "io.envoyproxy.envoy.service.load_stats.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/service/metrics/v2/metrics_service.proto b/api/src/main/proto/envoy/service/metrics/v2/metrics_service.proto
index 8f9e08c62..6b88148ec 100644
--- a/api/src/main/proto/envoy/service/metrics/v2/metrics_service.proto
+++ b/api/src/main/proto/envoy/service/metrics/v2/metrics_service.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.metrics.v2;
 option java_package = "io.envoyproxy.envoy.service.metrics.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/service/ratelimit/v2/rls.proto b/api/src/main/proto/envoy/service/ratelimit/v2/rls.proto
index 4d4f768a5..07478d198 100644
--- a/api/src/main/proto/envoy/service/ratelimit/v2/rls.proto
+++ b/api/src/main/proto/envoy/service/ratelimit/v2/rls.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.service.ratelimit.v2;
 option java_package = "io.envoyproxy.envoy.service.ratelimit.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 
 import "envoy/api/v2/core/base.proto";
diff --git a/api/src/main/proto/envoy/service/trace/v2/trace_service.proto b/api/src/main/proto/envoy/service/trace/v2/trace_service.proto
index 89ff50e1d..9ab4579a0 100644
--- a/api/src/main/proto/envoy/service/trace/v2/trace_service.proto
+++ b/api/src/main/proto/envoy/service/trace/v2/trace_service.proto
@@ -4,7 +4,6 @@ syntax = "proto3";
 
 package envoy.service.trace.v2;
 option java_package = "io.envoyproxy.envoy.service.trace.v2";
-option java_multiple_files = true;
 option go_package = "v2";
 option java_generic_services = true;
 
diff --git a/api/src/main/proto/envoy/type/http_status.proto b/api/src/main/proto/envoy/type/http_status.proto
index b682ea05a..626805b8d 100644
--- a/api/src/main/proto/envoy/type/http_status.proto
+++ b/api/src/main/proto/envoy/type/http_status.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type;
 option java_package = "io.envoyproxy.envoy.type";
-option java_multiple_files = true;
 
 import "validate/validate.proto";
 
diff --git a/api/src/main/proto/envoy/type/matcher/metadata.proto b/api/src/main/proto/envoy/type/matcher/metadata.proto
index d59f08cee..60df44d7c 100644
--- a/api/src/main/proto/envoy/type/matcher/metadata.proto
+++ b/api/src/main/proto/envoy/type/matcher/metadata.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_multiple_files = true;
 option go_package = "matcher";
 
 import "envoy/type/matcher/value.proto";
diff --git a/api/src/main/proto/envoy/type/matcher/number.proto b/api/src/main/proto/envoy/type/matcher/number.proto
index 78d4beb36..c6e6a26c2 100644
--- a/api/src/main/proto/envoy/type/matcher/number.proto
+++ b/api/src/main/proto/envoy/type/matcher/number.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_multiple_files = true;
 option go_package = "matcher";
 
 import "envoy/type/range.proto";
diff --git a/api/src/main/proto/envoy/type/matcher/string.proto b/api/src/main/proto/envoy/type/matcher/string.proto
index e22e6c7d2..44d4a53f5 100644
--- a/api/src/main/proto/envoy/type/matcher/string.proto
+++ b/api/src/main/proto/envoy/type/matcher/string.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_multiple_files = true;
 option go_package = "matcher";
 
 import "validate/validate.proto";
diff --git a/api/src/main/proto/envoy/type/matcher/value.proto b/api/src/main/proto/envoy/type/matcher/value.proto
index dcd8db017..def4e49d5 100644
--- a/api/src/main/proto/envoy/type/matcher/value.proto
+++ b/api/src/main/proto/envoy/type/matcher/value.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_multiple_files = true;
 option go_package = "matcher";
 
 import "envoy/type/matcher/number.proto";
diff --git a/api/src/main/proto/envoy/type/percent.proto b/api/src/main/proto/envoy/type/percent.proto
index fc12de753..543c0a053 100644
--- a/api/src/main/proto/envoy/type/percent.proto
+++ b/api/src/main/proto/envoy/type/percent.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type;
 option java_package = "io.envoyproxy.envoy.type";
-option java_multiple_files = true;
 
 import "validate/validate.proto";
 import "gogoproto/gogo.proto";
diff --git a/api/src/main/proto/envoy/type/range.proto b/api/src/main/proto/envoy/type/range.proto
index bb0fd19df..3ce3e32b7 100644
--- a/api/src/main/proto/envoy/type/range.proto
+++ b/api/src/main/proto/envoy/type/range.proto
@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package envoy.type;
 option java_package = "io.envoyproxy.envoy.type";
-option java_multiple_files = true;
 option go_package = "envoy_type";
 
 import "gogoproto/gogo.proto";
diff --git a/api/src/main/proto/validate/validate.proto b/api/src/main/proto/validate/validate.proto
index 5d5d96d9e..1c5e04a16 100644
--- a/api/src/main/proto/validate/validate.proto
+++ b/api/src/main/proto/validate/validate.proto
@@ -2,6 +2,7 @@ syntax = "proto2";
 package validate;
 
 option go_package = "github.com/lyft/protoc-gen-validate/validate";
+option java_package = "com.lyft.pgv.validate";
 
 import "google/protobuf/descriptor.proto";
 import "google/protobuf/duration.proto";
@@ -457,6 +458,11 @@ message StringRules {
     // Const specifies that this field must be exactly the specified value
     optional string const = 1;
 
+    // Len specifies that this field must be the specified number of
+    // characters (Unicode code points). Note that the number of
+    // characters may differ from the number of bytes in the string.
+    optional uint64 len = 19;
+
     // MinLen specifies that this field must be the specified number of
     // characters (Unicode code points) at a minimum. Note that the number of
     // characters may differ from the number of bytes in the string.
@@ -467,6 +473,10 @@ message StringRules {
     // characters may differ from the number of bytes in the string.
     optional uint64 max_len = 3;
 
+    // LenBytes specifies that this field must be the specified number of bytes
+    // at a minimum
+    optional uint64 len_bytes = 20;
+
     // MinBytes specifies that this field must be the specified number of bytes
     // at a minimum
     optional uint64 min_bytes = 4;
@@ -538,6 +548,9 @@ message BytesRules {
     // Const specifies that this field must be exactly the specified value
     optional bytes const = 1;
 
+    // Len specifies that this field must be the specified number of bytes
+    optional uint64 len = 13;
+
     // MinLen specifies that this field must be the specified number of bytes
     // at a minimum
     optional uint64 min_len = 2;
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/Cache.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/Cache.java
index 39a1196dc..ec8931a07 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/Cache.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/Cache.java
@@ -1,6 +1,6 @@
 package io.envoyproxy.controlplane.cache;
 
-import io.envoyproxy.envoy.api.v2.core.Node;
+import io.envoyproxy.envoy.api.v2.core.Base.Node;
 import java.util.Collection;
 import javax.annotation.concurrent.ThreadSafe;
 
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/ConfigWatcher.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/ConfigWatcher.java
index 1e557945a..d387d6312 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/ConfigWatcher.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/ConfigWatcher.java
@@ -1,6 +1,6 @@
 package io.envoyproxy.controlplane.cache;
 
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.util.Set;
 import java.util.function.Consumer;
 import javax.annotation.concurrent.ThreadSafe;
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/NodeGroup.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/NodeGroup.java
index 45c9b462f..1cc752afe 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/NodeGroup.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/NodeGroup.java
@@ -1,6 +1,6 @@
 package io.envoyproxy.controlplane.cache;
 
-import io.envoyproxy.envoy.api.v2.core.Node;
+import io.envoyproxy.envoy.api.v2.core.Base.Node;
 import javax.annotation.concurrent.ThreadSafe;
 
 /**
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/Resources.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/Resources.java
index cbcb92f1c..1ea0382f6 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/Resources.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/Resources.java
@@ -1,7 +1,7 @@
 package io.envoyproxy.controlplane.cache;
 
 import static com.google.common.base.Strings.isNullOrEmpty;
-import static io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager.RouteSpecifierCase.RDS;
+import static io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManagerOuterClass.HttpConnectionManager.RouteSpecifierCase.RDS;
 
 import com.google.common.base.Preconditions;
 import com.google.common.collect.ImmutableList;
@@ -12,15 +12,15 @@
 import com.google.protobuf.Message;
 import com.google.protobuf.Struct;
 import com.google.protobuf.util.JsonFormat;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.Cluster.DiscoveryType;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
-import io.envoyproxy.envoy.api.v2.auth.Secret;
-import io.envoyproxy.envoy.api.v2.listener.Filter;
-import io.envoyproxy.envoy.api.v2.listener.FilterChain;
-import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster.DiscoveryType;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.auth.Cert.Secret;
+import io.envoyproxy.envoy.api.v2.listener.Listener.Filter;
+import io.envoyproxy.envoy.api.v2.listener.Listener.FilterChain;
+import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManagerOuterClass.HttpConnectionManager;
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/Response.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/Response.java
index 537485b11..d55cced23 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/Response.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/Response.java
@@ -2,7 +2,7 @@
 
 import com.google.auto.value.AutoValue;
 import com.google.protobuf.Message;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.util.Collection;
 
 /**
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/SimpleCache.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/SimpleCache.java
index 5d14f4081..7ada547c5 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/SimpleCache.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/SimpleCache.java
@@ -3,7 +3,7 @@
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Sets;
 import com.google.protobuf.Message;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/Snapshot.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/Snapshot.java
index 30467cc87..81697b424 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/Snapshot.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/Snapshot.java
@@ -10,11 +10,11 @@
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableMap;
 import com.google.protobuf.Message;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
-import io.envoyproxy.envoy.api.v2.auth.Secret;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.auth.Cert.Secret;
 import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/StatusInfo.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/StatusInfo.java
index eee2a8724..7c98ec017 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/StatusInfo.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/StatusInfo.java
@@ -1,6 +1,6 @@
 package io.envoyproxy.controlplane.cache;
 
-import io.envoyproxy.envoy.api.v2.core.Node;
+import io.envoyproxy.envoy.api.v2.core.Base.Node;
 
 /**
  * {@code StatusInfo} tracks the state for remote envoy nodes.
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/TestResources.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/TestResources.java
index 99fe65729..824123edc 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/TestResources.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/TestResources.java
@@ -6,37 +6,37 @@
 import com.google.protobuf.Struct;
 import com.google.protobuf.util.Durations;
 import com.google.protobuf.util.JsonFormat;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.Cluster.DiscoveryType;
-import io.envoyproxy.envoy.api.v2.Cluster.EdsClusterConfig;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
-import io.envoyproxy.envoy.api.v2.auth.Secret;
-import io.envoyproxy.envoy.api.v2.auth.TlsCertificate;
-import io.envoyproxy.envoy.api.v2.core.Address;
-import io.envoyproxy.envoy.api.v2.core.AggregatedConfigSource;
-import io.envoyproxy.envoy.api.v2.core.ApiConfigSource;
-import io.envoyproxy.envoy.api.v2.core.ApiConfigSource.ApiType;
-import io.envoyproxy.envoy.api.v2.core.ConfigSource;
-import io.envoyproxy.envoy.api.v2.core.DataSource;
-import io.envoyproxy.envoy.api.v2.core.GrpcService;
-import io.envoyproxy.envoy.api.v2.core.GrpcService.EnvoyGrpc;
-import io.envoyproxy.envoy.api.v2.core.SocketAddress;
-import io.envoyproxy.envoy.api.v2.core.SocketAddress.Protocol;
-import io.envoyproxy.envoy.api.v2.endpoint.Endpoint;
-import io.envoyproxy.envoy.api.v2.endpoint.LbEndpoint;
-import io.envoyproxy.envoy.api.v2.endpoint.LocalityLbEndpoints;
-import io.envoyproxy.envoy.api.v2.listener.Filter;
-import io.envoyproxy.envoy.api.v2.listener.FilterChain;
-import io.envoyproxy.envoy.api.v2.route.Route;
-import io.envoyproxy.envoy.api.v2.route.RouteAction;
-import io.envoyproxy.envoy.api.v2.route.RouteMatch;
-import io.envoyproxy.envoy.api.v2.route.VirtualHost;
-import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager;
-import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager.CodecType;
-import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpFilter;
-import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.Rds;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster.DiscoveryType;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster.EdsClusterConfig;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.auth.Cert.Secret;
+import io.envoyproxy.envoy.api.v2.auth.Cert.TlsCertificate;
+import io.envoyproxy.envoy.api.v2.core.AddressOuterClass.Address;
+import io.envoyproxy.envoy.api.v2.core.AddressOuterClass.SocketAddress;
+import io.envoyproxy.envoy.api.v2.core.AddressOuterClass.SocketAddress.Protocol;
+import io.envoyproxy.envoy.api.v2.core.Base.DataSource;
+import io.envoyproxy.envoy.api.v2.core.ConfigSourceOuterClass.AggregatedConfigSource;
+import io.envoyproxy.envoy.api.v2.core.ConfigSourceOuterClass.ApiConfigSource;
+import io.envoyproxy.envoy.api.v2.core.ConfigSourceOuterClass.ApiConfigSource.ApiType;
+import io.envoyproxy.envoy.api.v2.core.ConfigSourceOuterClass.ConfigSource;
+import io.envoyproxy.envoy.api.v2.core.GrpcServiceOuterClass.GrpcService;
+import io.envoyproxy.envoy.api.v2.core.GrpcServiceOuterClass.GrpcService.EnvoyGrpc;
+import io.envoyproxy.envoy.api.v2.endpoint.EndpointOuterClass.Endpoint;
+import io.envoyproxy.envoy.api.v2.endpoint.EndpointOuterClass.LbEndpoint;
+import io.envoyproxy.envoy.api.v2.endpoint.EndpointOuterClass.LocalityLbEndpoints;
+import io.envoyproxy.envoy.api.v2.listener.Listener.Filter;
+import io.envoyproxy.envoy.api.v2.listener.Listener.FilterChain;
+import io.envoyproxy.envoy.api.v2.route.RouteOuterClass.Route;
+import io.envoyproxy.envoy.api.v2.route.RouteOuterClass.RouteAction;
+import io.envoyproxy.envoy.api.v2.route.RouteOuterClass.RouteMatch;
+import io.envoyproxy.envoy.api.v2.route.RouteOuterClass.VirtualHost;
+import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManagerOuterClass.HttpConnectionManager;
+import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManagerOuterClass.HttpConnectionManager.CodecType;
+import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManagerOuterClass.HttpFilter;
+import io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManagerOuterClass.Rds;
 
 /**
  * {@code TestResources} provides helper methods for generating resource messages for testing. It is not intended to be
diff --git a/cache/src/main/java/io/envoyproxy/controlplane/cache/Watch.java b/cache/src/main/java/io/envoyproxy/controlplane/cache/Watch.java
index 5db48a401..738b1f661 100644
--- a/cache/src/main/java/io/envoyproxy/controlplane/cache/Watch.java
+++ b/cache/src/main/java/io/envoyproxy/controlplane/cache/Watch.java
@@ -1,6 +1,6 @@
 package io.envoyproxy.controlplane.cache;
 
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Consumer;
 
diff --git a/cache/src/test/java/io/envoyproxy/controlplane/cache/CacheStatusInfoTest.java b/cache/src/test/java/io/envoyproxy/controlplane/cache/CacheStatusInfoTest.java
index 55b9641a2..3376b3346 100644
--- a/cache/src/test/java/io/envoyproxy/controlplane/cache/CacheStatusInfoTest.java
+++ b/cache/src/test/java/io/envoyproxy/controlplane/cache/CacheStatusInfoTest.java
@@ -2,8 +2,8 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.core.Node;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.core.Base.Node;
 import java.util.Collection;
 import java.util.UUID;
 import java.util.concurrent.ThreadLocalRandom;
diff --git a/cache/src/test/java/io/envoyproxy/controlplane/cache/ResourcesTest.java b/cache/src/test/java/io/envoyproxy/controlplane/cache/ResourcesTest.java
index d80d25e7d..d9094f25c 100644
--- a/cache/src/test/java/io/envoyproxy/controlplane/cache/ResourcesTest.java
+++ b/cache/src/test/java/io/envoyproxy/controlplane/cache/ResourcesTest.java
@@ -9,12 +9,12 @@
 import com.google.protobuf.Any;
 import com.google.protobuf.Message;
 import com.google.type.Color;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.Cluster.DiscoveryType;
-import io.envoyproxy.envoy.api.v2.Cluster.EdsClusterConfig;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster.DiscoveryType;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster.EdsClusterConfig;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
 import java.util.Collection;
 import java.util.Map;
 import java.util.Set;
diff --git a/cache/src/test/java/io/envoyproxy/controlplane/cache/SimpleCacheTest.java b/cache/src/test/java/io/envoyproxy/controlplane/cache/SimpleCacheTest.java
index 0bee27e75..40398bf7e 100644
--- a/cache/src/test/java/io/envoyproxy/controlplane/cache/SimpleCacheTest.java
+++ b/cache/src/test/java/io/envoyproxy/controlplane/cache/SimpleCacheTest.java
@@ -4,13 +4,13 @@
 
 import com.google.common.collect.ImmutableList;
 import com.google.protobuf.Message;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
-import io.envoyproxy.envoy.api.v2.auth.Secret;
-import io.envoyproxy.envoy.api.v2.core.Node;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.auth.Cert.Secret;
+import io.envoyproxy.envoy.api.v2.core.Base.Node;
 import java.util.Collections;
 import java.util.LinkedList;
 import java.util.Map;
diff --git a/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotResourcesTest.java b/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotResourcesTest.java
index 5339b0e8b..efb7cecd1 100644
--- a/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotResourcesTest.java
+++ b/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotResourcesTest.java
@@ -3,7 +3,7 @@
 import static org.assertj.core.api.Assertions.assertThat;
 
 import com.google.common.collect.ImmutableList;
-import io.envoyproxy.envoy.api.v2.Cluster;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
 import java.util.UUID;
 import org.junit.Test;
 
diff --git a/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotTest.java b/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotTest.java
index 99c5d51d3..2448acede 100644
--- a/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotTest.java
+++ b/cache/src/test/java/io/envoyproxy/controlplane/cache/SnapshotTest.java
@@ -10,11 +10,11 @@
 
 import com.google.common.collect.ImmutableList;
 import com.google.protobuf.Message;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
-import io.envoyproxy.envoy.api.v2.auth.Secret;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.auth.Cert.Secret;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.ThreadLocalRandom;
diff --git a/cache/src/test/java/io/envoyproxy/controlplane/cache/WatchTest.java b/cache/src/test/java/io/envoyproxy/controlplane/cache/WatchTest.java
index e1d9a8a4b..4eb8047d5 100644
--- a/cache/src/test/java/io/envoyproxy/controlplane/cache/WatchTest.java
+++ b/cache/src/test/java/io/envoyproxy/controlplane/cache/WatchTest.java
@@ -5,7 +5,7 @@
 import static org.assertj.core.api.Assertions.fail;
 
 import com.google.common.collect.ImmutableList;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.UUID;
diff --git a/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServer.java b/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServer.java
index 2c261f31a..b175de637 100644
--- a/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServer.java
+++ b/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServer.java
@@ -9,8 +9,8 @@
 import io.envoyproxy.controlplane.cache.Response;
 import io.envoyproxy.controlplane.cache.Watch;
 import io.envoyproxy.envoy.api.v2.ClusterDiscoveryServiceGrpc.ClusterDiscoveryServiceImplBase;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.DiscoveryResponse;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryResponse;
 import io.envoyproxy.envoy.api.v2.EndpointDiscoveryServiceGrpc.EndpointDiscoveryServiceImplBase;
 import io.envoyproxy.envoy.api.v2.ListenerDiscoveryServiceGrpc.ListenerDiscoveryServiceImplBase;
 import io.envoyproxy.envoy.api.v2.RouteDiscoveryServiceGrpc.RouteDiscoveryServiceImplBase;
diff --git a/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServerCallbacks.java b/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServerCallbacks.java
index dfebf28ca..d98ba0405 100644
--- a/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServerCallbacks.java
+++ b/server/src/main/java/io/envoyproxy/controlplane/server/DiscoveryServerCallbacks.java
@@ -1,7 +1,7 @@
 package io.envoyproxy.controlplane.server;
 
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.DiscoveryResponse;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryResponse;
 
 /**
  * {@code DiscoveryServerCallbacks} defines the callbacks that are exposed by the {@link DiscoveryServer}. The callbacks
diff --git a/server/src/main/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallback.java b/server/src/main/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallback.java
index 1b8cecd14..516ba7cf1 100644
--- a/server/src/main/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallback.java
+++ b/server/src/main/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallback.java
@@ -6,7 +6,7 @@
 import io.envoyproxy.controlplane.cache.Snapshot;
 import io.envoyproxy.controlplane.cache.SnapshotCache;
 import io.envoyproxy.controlplane.server.DiscoveryServerCallbacks;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.time.Clock;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerAdsIT.java b/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerAdsIT.java
index 07e13a0fe..d23770874 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerAdsIT.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerAdsIT.java
@@ -7,8 +7,8 @@
 import static org.hamcrest.Matchers.containsString;
 
 import io.envoyproxy.controlplane.cache.SimpleCache;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.DiscoveryResponse;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryResponse;
 import io.grpc.netty.NettyServerBuilder;
 import io.restassured.http.ContentType;
 import java.util.concurrent.CountDownLatch;
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerTest.java b/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerTest.java
index 29adfab63..0f966bf78 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerTest.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerTest.java
@@ -16,22 +16,22 @@
 import io.envoyproxy.controlplane.cache.TestResources;
 import io.envoyproxy.controlplane.cache.Watch;
 import io.envoyproxy.controlplane.cache.WatchCancelledException;
-import io.envoyproxy.envoy.api.v2.Cluster;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
 import io.envoyproxy.envoy.api.v2.ClusterDiscoveryServiceGrpc;
 import io.envoyproxy.envoy.api.v2.ClusterDiscoveryServiceGrpc.ClusterDiscoveryServiceStub;
-import io.envoyproxy.envoy.api.v2.ClusterLoadAssignment;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.DiscoveryResponse;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryResponse;
+import io.envoyproxy.envoy.api.v2.Eds.ClusterLoadAssignment;
 import io.envoyproxy.envoy.api.v2.EndpointDiscoveryServiceGrpc;
 import io.envoyproxy.envoy.api.v2.EndpointDiscoveryServiceGrpc.EndpointDiscoveryServiceStub;
-import io.envoyproxy.envoy.api.v2.Listener;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
 import io.envoyproxy.envoy.api.v2.ListenerDiscoveryServiceGrpc;
 import io.envoyproxy.envoy.api.v2.ListenerDiscoveryServiceGrpc.ListenerDiscoveryServiceStub;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
 import io.envoyproxy.envoy.api.v2.RouteDiscoveryServiceGrpc;
 import io.envoyproxy.envoy.api.v2.RouteDiscoveryServiceGrpc.RouteDiscoveryServiceStub;
-import io.envoyproxy.envoy.api.v2.auth.Secret;
-import io.envoyproxy.envoy.api.v2.core.Node;
+import io.envoyproxy.envoy.api.v2.auth.Cert.Secret;
+import io.envoyproxy.envoy.api.v2.core.Base.Node;
 import io.envoyproxy.envoy.service.discovery.v2.AggregatedDiscoveryServiceGrpc;
 import io.envoyproxy.envoy.service.discovery.v2.AggregatedDiscoveryServiceGrpc.AggregatedDiscoveryServiceStub;
 import io.envoyproxy.envoy.service.discovery.v2.SecretDiscoveryServiceGrpc;
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerXdsIT.java b/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerXdsIT.java
index 844d7fe6b..ffa9e2861 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerXdsIT.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/DiscoveryServerXdsIT.java
@@ -7,8 +7,8 @@
 import static org.hamcrest.Matchers.containsString;
 
 import io.envoyproxy.controlplane.cache.SimpleCache;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
-import io.envoyproxy.envoy.api.v2.DiscoveryResponse;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryResponse;
 import io.grpc.netty.NettyServerBuilder;
 import io.restassured.http.ContentType;
 import java.util.concurrent.CountDownLatch;
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/TestMain.java b/server/src/test/java/io/envoyproxy/controlplane/server/TestMain.java
index 8576aad71..b8592f586 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/TestMain.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/TestMain.java
@@ -4,10 +4,10 @@
 import com.google.protobuf.Duration;
 import io.envoyproxy.controlplane.cache.SimpleCache;
 import io.envoyproxy.controlplane.cache.Snapshot;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.Cluster.DiscoveryType;
-import io.envoyproxy.envoy.api.v2.core.Address;
-import io.envoyproxy.envoy.api.v2.core.SocketAddress;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster.DiscoveryType;
+import io.envoyproxy.envoy.api.v2.core.AddressOuterClass.Address;
+import io.envoyproxy.envoy.api.v2.core.AddressOuterClass.SocketAddress;
 import io.grpc.Server;
 import io.grpc.ServerBuilder;
 import io.grpc.netty.NettyServerBuilder;
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/TestSnapshots.java b/server/src/test/java/io/envoyproxy/controlplane/server/TestSnapshots.java
index aed5aeca2..9718ba8fc 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/TestSnapshots.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/TestSnapshots.java
@@ -2,9 +2,9 @@
 
 import io.envoyproxy.controlplane.cache.Snapshot;
 import io.envoyproxy.controlplane.cache.TestResources;
-import io.envoyproxy.envoy.api.v2.Cluster;
-import io.envoyproxy.envoy.api.v2.Listener;
-import io.envoyproxy.envoy.api.v2.RouteConfiguration;
+import io.envoyproxy.envoy.api.v2.Cds.Cluster;
+import io.envoyproxy.envoy.api.v2.Lds.Listener;
+import io.envoyproxy.envoy.api.v2.Rds.RouteConfiguration;
 import org.testcontainers.shaded.com.google.common.collect.ImmutableList;
 
 class TestSnapshots {
diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallbackTest.java b/server/src/test/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallbackTest.java
index 8810daee4..02d3ffe8d 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallbackTest.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/callback/SnapshotCollectingCallbackTest.java
@@ -6,7 +6,7 @@
 import io.envoyproxy.controlplane.cache.NodeGroup;
 import io.envoyproxy.controlplane.cache.SimpleCache;
 import io.envoyproxy.controlplane.cache.Snapshot;
-import io.envoyproxy.envoy.api.v2.DiscoveryRequest;
+import io.envoyproxy.envoy.api.v2.Discovery.DiscoveryRequest;
 import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
diff --git a/tools/API_SHAS b/tools/API_SHAS
index 65bb6f178..41758c833 100644
--- a/tools/API_SHAS
+++ b/tools/API_SHAS
@@ -1,11 +1,11 @@
 # Update the versions here and run update-api.sh
 
 # envoy (source: SHA from https://github.com/envoyproxy/envoy)
-ENVOY_SHA="02659d411332e9f20d229f482931c15304ea17fd" # Jan 02, 2019
+ENVOY_SHA="ca7aed40c2354847f5bbd5fc2540a74cad182ff9" # Jan 18, 2019
 
 # dependencies (source: https://github.com/envoyproxy/envoy/blob/<DATA_PLANE_API_SHA>/api/bazel/repositories.bzl)
 GOGOPROTO_SHA="4cbf7e384e768b4e01799441fdf2a706a5635ae7" # v1.2.0
 GOOGLEAPIS_SHA="d642131a6e6582fc226caf9893cb7fe7885b3411" # May 23, 2018
 OPENCENSUS_SHA="7f2434bc10da710debe5c4315ed6d4df454b4024" # Nov 3, 2018 (tag v0.1.0)
-PGV_GIT_SHA="9f600c2cd2d7031fdc8e25e1c9f5ad81c8cab4fe" # Apr 24, 2018
+PGV_GIT_SHA="7d810e6d5cad3664143ecc9f9ef4d5d6e0567787" # Dec 18, 2018  (tag v0.0.12)
 PROMETHEUS_SHA="99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c" # Nov 17, 2017