diff --git a/include/envoy/config/BUILD b/include/envoy/config/BUILD
index adc456e7a6ee..68bbc2d24579 100644
--- a/include/envoy/config/BUILD
+++ b/include/envoy/config/BUILD
@@ -44,7 +44,7 @@ envoy_cc_library(
     hdrs = ["subscription_factory.h"],
     deps = [
         ":subscription_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -54,7 +54,7 @@ envoy_cc_library(
     deps = [
         "//include/envoy/stats:stats_macros",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/config/subscription.h b/include/envoy/config/subscription.h
index 009c4a265dc6..fe1e26a588c4 100644
--- a/include/envoy/config/subscription.h
+++ b/include/envoy/config/subscription.h
@@ -3,9 +3,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/pure.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/stats_macros.h"
 
 #include "common/protobuf/protobuf.h"
@@ -50,7 +50,8 @@ class SubscriptionCallbacks {
    *        are accepted. Accepted changes have their version_info reflected in subsequent requests.
    */
   virtual void
-  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
                  const Protobuf::RepeatedPtrField<std::string>& removed_resources,
                  const std::string& system_version_info) PURE;
 
diff --git a/include/envoy/config/subscription_factory.h b/include/envoy/config/subscription_factory.h
index b1733afda6c4..70f45ce2158e 100644
--- a/include/envoy/config/subscription_factory.h
+++ b/include/envoy/config/subscription_factory.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/stats/scope.h"
 
@@ -22,7 +22,7 @@ class SubscriptionFactory {
    * @return SubscriptionPtr subscription object corresponding for config and type_url.
    */
   virtual SubscriptionPtr
-  subscriptionFromConfigSource(const envoy::api::v2::core::ConfigSource& config,
+  subscriptionFromConfigSource(const envoy::config::core::v3alpha::ConfigSource& config,
                                absl::string_view type_url, Stats::Scope& scope,
                                SubscriptionCallbacks& callbacks) PURE;
 };
diff --git a/include/envoy/grpc/BUILD b/include/envoy/grpc/BUILD
index 6070ca012270..41b93c7b7a81 100644
--- a/include/envoy/grpc/BUILD
+++ b/include/envoy/grpc/BUILD
@@ -29,7 +29,7 @@ envoy_cc_library(
     deps = [
         ":async_client_interface",
         "//include/envoy/stats:stats_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -50,7 +50,7 @@ envoy_cc_library(
     ],
     deps = [
         "//include/envoy/api:api_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/grpc/async_client_manager.h b/include/envoy/grpc/async_client_manager.h
index 18c3e3923eab..b0ebaada33d0 100644
--- a/include/envoy/grpc/async_client_manager.h
+++ b/include/envoy/grpc/async_client_manager.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/stats/scope.h"
 
@@ -40,8 +40,8 @@ class AsyncClientManager {
    * @throws EnvoyException when grpc_service validation fails.
    */
   virtual AsyncClientFactoryPtr
-  factoryForGrpcService(const envoy::api::v2::core::GrpcService& grpc_service, Stats::Scope& scope,
-                        bool skip_cluster_check) PURE;
+  factoryForGrpcService(const envoy::config::core::v3alpha::GrpcService& grpc_service,
+                        Stats::Scope& scope, bool skip_cluster_check) PURE;
 };
 
 using AsyncClientManagerPtr = std::unique_ptr<AsyncClientManager>;
diff --git a/include/envoy/grpc/google_grpc_creds.h b/include/envoy/grpc/google_grpc_creds.h
index f201c6d6a9ba..00a20440bf91 100644
--- a/include/envoy/grpc/google_grpc_creds.h
+++ b/include/envoy/grpc/google_grpc_creds.h
@@ -3,8 +3,8 @@
 #include <memory>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "grpcpp/grpcpp.h"
 
@@ -31,7 +31,7 @@ class GoogleGrpcCredentialsFactory {
    * channel.
    */
   virtual std::shared_ptr<grpc::ChannelCredentials>
-  getChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  getChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                         Api::Api& api) PURE;
 
   /**
diff --git a/include/envoy/http/BUILD b/include/envoy/http/BUILD
index e722ab74d3b7..cb201b76a631 100644
--- a/include/envoy/http/BUILD
+++ b/include/envoy/http/BUILD
@@ -17,7 +17,7 @@ envoy_cc_library(
         "//include/envoy/event:dispatcher_interface",
         "//include/envoy/tracing:http_tracer_interface",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/http/async_client.h b/include/envoy/http/async_client.h
index 3fa3c25cd5f8..917648a6d862 100644
--- a/include/envoy/http/async_client.h
+++ b/include/envoy/http/async_client.h
@@ -3,7 +3,7 @@
 #include <chrono>
 #include <memory>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/http/message.h"
 #include "envoy/tracing/http_tracer.h"
@@ -163,7 +163,8 @@ class AsyncClient {
       return *this;
     }
     StreamOptions& setHashPolicy(
-        const Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy>& v) {
+        const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy>&
+            v) {
       hash_policy = v;
       return *this;
     }
@@ -188,7 +189,7 @@ class AsyncClient {
     bool send_xff{true};
 
     // Provides the hash policy for hashing load balancing strategies.
-    Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy> hash_policy;
+    Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy> hash_policy;
   };
 
   /**
@@ -212,7 +213,8 @@ class AsyncClient {
       return *this;
     }
     RequestOptions& setHashPolicy(
-        const Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy>& v) {
+        const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy>&
+            v) {
       StreamOptions::setHashPolicy(v);
       return *this;
     }
diff --git a/include/envoy/local_info/BUILD b/include/envoy/local_info/BUILD
index 351a969b6f96..33d4a0f86ba2 100644
--- a/include/envoy/local_info/BUILD
+++ b/include/envoy/local_info/BUILD
@@ -13,6 +13,6 @@ envoy_cc_library(
     hdrs = ["local_info.h"],
     deps = [
         "//include/envoy/network:address_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/include/envoy/local_info/local_info.h b/include/envoy/local_info/local_info.h
index 54f1ea556ae5..8fdf3a246131 100644
--- a/include/envoy/local_info/local_info.h
+++ b/include/envoy/local_info/local_info.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/address.h"
 
 namespace Envoy {
@@ -39,7 +39,7 @@ class LocalInfo {
   /**
    * v2 API Node protobuf. This is the full node identity presented to management servers.
    */
-  virtual const envoy::api::v2::core::Node& node() const PURE;
+  virtual const envoy::config::core::v3alpha::Node& node() const PURE;
 };
 
 using LocalInfoPtr = std::unique_ptr<LocalInfo>;
diff --git a/include/envoy/network/BUILD b/include/envoy/network/BUILD
index c4c89fee0caa..6fac77627a13 100644
--- a/include/envoy/network/BUILD
+++ b/include/envoy/network/BUILD
@@ -88,7 +88,7 @@ envoy_cc_library(
     deps = [
         ":address_interface",
         ":io_handle_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -118,7 +118,7 @@ envoy_cc_library(
         ":connection_interface",
         ":listen_socket_interface",
         "//include/envoy/stats:stats_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -127,6 +127,6 @@ envoy_cc_library(
     hdrs = ["resolver.h"],
     deps = [
         ":address_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/include/envoy/network/listen_socket.h b/include/envoy/network/listen_socket.h
index 85754a1885cd..2b799a18f313 100644
--- a/include/envoy/network/listen_socket.h
+++ b/include/envoy/network/listen_socket.h
@@ -4,9 +4,9 @@
 #include <tuple>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/io_handle.h"
 
@@ -101,8 +101,9 @@ class Socket {
      *        set for some particular state of the socket.
      * @return true if succeeded, false otherwise.
      */
-    virtual bool setOption(Socket& socket,
-                           envoy::api::v2::core::SocketOption::SocketState state) const PURE;
+    virtual bool
+    setOption(Socket& socket,
+              envoy::config::core::v3alpha::SocketOption::SocketState state) const PURE;
 
     /**
      * @param vector of bytes to which the option should append hash key data that will be used
@@ -130,7 +131,7 @@ class Socket {
      */
     virtual absl::optional<Details>
     getOptionDetails(const Socket& socket,
-                     envoy::api::v2::core::SocketOption::SocketState state) const PURE;
+                     envoy::config::core::v3alpha::SocketOption::SocketState state) const PURE;
   };
 
   using OptionConstSharedPtr = std::shared_ptr<const Option>;
@@ -143,7 +144,7 @@ class Socket {
   }
 
   static bool applyOptions(const OptionsSharedPtr& options, Socket& socket,
-                           envoy::api::v2::core::SocketOption::SocketState state) {
+                           envoy::config::core::v3alpha::SocketOption::SocketState state) {
     if (options == nullptr) {
       return true;
     }
diff --git a/include/envoy/network/listener.h b/include/envoy/network/listener.h
index 5d57b9cd6c7d..e981333b5b76 100644
--- a/include/envoy/network/listener.h
+++ b/include/envoy/network/listener.h
@@ -5,8 +5,8 @@
 #include <string>
 
 #include "envoy/api/io_error.h"
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/connection_balancer.h"
 #include "envoy/network/listen_socket.h"
@@ -135,7 +135,7 @@ class ListenerConfig {
   /**
    * @return traffic direction of the listener.
    */
-  virtual envoy::api::v2::core::TrafficDirection direction() const PURE;
+  virtual envoy::config::core::v3alpha::TrafficDirection direction() const PURE;
 
   /**
    * @return the connection balancer for this listener. All listeners have a connection balancer,
diff --git a/include/envoy/network/resolver.h b/include/envoy/network/resolver.h
index 24a25045f18a..ac8f3943d3c7 100644
--- a/include/envoy/network/resolver.h
+++ b/include/envoy/network/resolver.h
@@ -5,8 +5,8 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/network/address.h"
 
 namespace Envoy {
@@ -26,7 +26,7 @@ class Resolver {
    * @return InstanceConstSharedPtr appropriate Address::Instance.
    */
   virtual InstanceConstSharedPtr
-  resolve(const envoy::api::v2::core::SocketAddress& socket_address) PURE;
+  resolve(const envoy::config::core::v3alpha::SocketAddress& socket_address) PURE;
 
   /**
    * @return std::string the identifying name for a particular implementation of
diff --git a/include/envoy/router/BUILD b/include/envoy/router/BUILD
index 09236c3c7e1d..95bb2187e430 100644
--- a/include/envoy/router/BUILD
+++ b/include/envoy/router/BUILD
@@ -13,7 +13,7 @@ envoy_cc_library(
     hdrs = ["rds.h"],
     deps = [
         ":router_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -30,8 +30,8 @@ envoy_cc_library(
         "//include/envoy/stats:stats_interface",
         "//include/envoy/thread_local:thread_local_interface",
         "//include/envoy/upstream:cluster_manager_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -43,7 +43,8 @@ envoy_cc_library(
         ":rds_interface",
         "//include/envoy/common:time_interface",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -64,8 +65,8 @@ envoy_cc_library(
         "//include/envoy/upstream:retry_interface",
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/router/rds.h b/include/envoy/router/rds.h
index 978ffa6fe9da..efa2e52edadc 100644
--- a/include/envoy/router/rds.h
+++ b/include/envoy/router/rds.h
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/api/v2/rds.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/router/router.h"
 
 namespace Envoy {
@@ -16,7 +16,7 @@ class RouteConfigProvider {
   struct ConfigInfo {
     // A reference to the currently loaded route configuration. Do not hold this reference beyond
     // the caller of configInfo()'s scope.
-    const envoy::api::v2::RouteConfiguration& config_;
+    const envoy::config::route::v3alpha::RouteConfiguration& config_;
 
     // The discovery version that supplied this route. This will be set to "" in the case of
     // static clusters.
@@ -52,7 +52,8 @@ class RouteConfigProvider {
   /**
    * Validate if the route configuration can be applied to the context of the route config provider.
    */
-  virtual void validateConfig(const envoy::api::v2::RouteConfiguration& config) const PURE;
+  virtual void
+  validateConfig(const envoy::config::route::v3alpha::RouteConfiguration& config) const PURE;
 };
 
 using RouteConfigProviderPtr = std::unique_ptr<RouteConfigProvider>;
diff --git a/include/envoy/router/route_config_provider_manager.h b/include/envoy/router/route_config_provider_manager.h
index 8c79d5a01daf..aecc0daf68e5 100644
--- a/include/envoy/router/route_config_provider_manager.h
+++ b/include/envoy/router/route_config_provider_manager.h
@@ -2,9 +2,9 @@
 
 #include <string>
 
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/json/json_object.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/router/rds.h"
@@ -38,7 +38,7 @@ class RouteConfigProviderManager {
    * subscription.
    */
   virtual RouteConfigProviderSharedPtr createRdsRouteConfigProvider(
-      const envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
       Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
       Init::Manager& init_manager) PURE;
 
@@ -49,9 +49,9 @@ class RouteConfigProviderManager {
    * @param runtime supplies the runtime loader.
    * @param cm supplies the ClusterManager.
    */
-  virtual RouteConfigProviderPtr
-  createStaticRouteConfigProvider(const envoy::api::v2::RouteConfiguration& route_config,
-                                  Server::Configuration::FactoryContext& factory_context) PURE;
+  virtual RouteConfigProviderPtr createStaticRouteConfigProvider(
+      const envoy::config::route::v3alpha::RouteConfiguration& route_config,
+      Server::Configuration::FactoryContext& factory_context) PURE;
 };
 
 } // namespace Router
diff --git a/include/envoy/router/route_config_update_receiver.h b/include/envoy/router/route_config_update_receiver.h
index 33826cfd9355..8d66770b1bd4 100644
--- a/include/envoy/router/route_config_update_receiver.h
+++ b/include/envoy/router/route_config_update_receiver.h
@@ -2,11 +2,11 @@
 
 #include <memory>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
 #include "envoy/common/pure.h"
 #include "envoy/common/time.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/router/rds.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -28,7 +28,7 @@ class RouteConfigUpdateReceiver {
    * @param version_info supplies RouteConfiguration version.
    * @return bool whether RouteConfiguration has been updated.
    */
-  virtual bool onRdsUpdate(const envoy::api::v2::RouteConfiguration& rc,
+  virtual bool onRdsUpdate(const envoy::config::route::v3alpha::RouteConfiguration& rc,
                            const std::string& version_info) PURE;
 
   /**
@@ -40,7 +40,8 @@ class RouteConfigUpdateReceiver {
    * @return bool whether RouteConfiguration has been updated.
    */
   virtual bool
-  onVhdsUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+  onVhdsUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                   added_resources,
                const Protobuf::RepeatedPtrField<std::string>& removed_resources,
                const std::string& version_info) PURE;
 
@@ -69,7 +70,7 @@ class RouteConfigUpdateReceiver {
   /**
    * @return envoy::api::v2::RouteConfiguration& current RouteConfiguration.
    */
-  virtual const envoy::api::v2::RouteConfiguration& routeConfiguration() PURE;
+  virtual const envoy::config::route::v3alpha::RouteConfiguration& routeConfiguration() PURE;
 
   /**
    * @return SystemTime the time of the last update.
diff --git a/include/envoy/router/router.h b/include/envoy/router/router.h
index 98291b2ecdc9..32ff74108771 100644
--- a/include/envoy/router/router.h
+++ b/include/envoy/router/router.h
@@ -9,15 +9,15 @@
 #include <string>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/matchers.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/http/codec.h"
 #include "envoy/http/codes.h"
 #include "envoy/http/hash_policy.h"
 #include "envoy/http/header_map.h"
 #include "envoy/tracing/http_tracer.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/resource_manager.h"
 #include "envoy/upstream/retry.h"
 
@@ -360,7 +360,7 @@ class ShadowPolicy {
    * @return the default fraction of traffic the should be shadowed, if the runtime key is not
    *         present.
    */
-  virtual const envoy::type::FractionalPercent& defaultValue() const PURE;
+  virtual const envoy::type::v3alpha::FractionalPercent& defaultValue() const PURE;
 };
 
 using ShadowPolicyPtr = std::unique_ptr<ShadowPolicy>;
@@ -467,7 +467,7 @@ class HedgePolicy {
    * @return percent chance that an additional upstream request should be sent
    * on top of the value from initialRequests().
    */
-  virtual const envoy::type::FractionalPercent& additionalRequestChance() const PURE;
+  virtual const envoy::type::v3alpha::FractionalPercent& additionalRequestChance() const PURE;
 
   /**
    * @return bool indicating whether request hedging should occur when a request
@@ -718,7 +718,7 @@ class RouteEntry : public ResponseEntry {
    * @return const envoy::api::v2::core::Metadata& return the metadata provided in the config for
    * this route.
    */
-  virtual const envoy::api::v2::core::Metadata& metadata() const PURE;
+  virtual const envoy::config::core::v3alpha::Metadata& metadata() const PURE;
 
   /**
    * @return TlsContextMatchCriteria* the tls context match criterion for this route. If there is no
@@ -813,19 +813,19 @@ class RouteTracing {
    * This method returns the client sampling percentage.
    * @return the client sampling percentage
    */
-  virtual const envoy::type::FractionalPercent& getClientSampling() const PURE;
+  virtual const envoy::type::v3alpha::FractionalPercent& getClientSampling() const PURE;
 
   /**
    * This method returns the random sampling percentage.
    * @return the random sampling percentage
    */
-  virtual const envoy::type::FractionalPercent& getRandomSampling() const PURE;
+  virtual const envoy::type::v3alpha::FractionalPercent& getRandomSampling() const PURE;
 
   /**
    * This method returns the overall sampling percentage.
    * @return the overall sampling percentage
    */
-  virtual const envoy::type::FractionalPercent& getOverallSampling() const PURE;
+  virtual const envoy::type::v3alpha::FractionalPercent& getOverallSampling() const PURE;
 
   /**
    * This method returns the route level tracing custom tags.
diff --git a/include/envoy/runtime/BUILD b/include/envoy/runtime/BUILD
index 1136b7617c3b..8e12cd1e8dd9 100644
--- a/include/envoy/runtime/BUILD
+++ b/include/envoy/runtime/BUILD
@@ -15,6 +15,6 @@ envoy_cc_library(
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/singleton:threadsafe_singleton",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/include/envoy/runtime/runtime.h b/include/envoy/runtime/runtime.h
index 7eda91473c90..ffaf40b7e0ce 100644
--- a/include/envoy/runtime/runtime.h
+++ b/include/envoy/runtime/runtime.h
@@ -8,7 +8,7 @@
 #include <vector>
 
 #include "envoy/common/pure.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/common/assert.h"
 #include "common/singleton/threadsafe_singleton.h"
@@ -76,7 +76,7 @@ class Snapshot {
     std::string raw_string_value_;
     absl::optional<uint64_t> uint_value_;
     absl::optional<double> double_value_;
-    absl::optional<envoy::type::FractionalPercent> fractional_percent_value_;
+    absl::optional<envoy::type::v3alpha::FractionalPercent> fractional_percent_value_;
     absl::optional<bool> bool_value_;
   };
 
@@ -179,8 +179,9 @@ class Snapshot {
    *        does not exist or it is not a fractional percent.
    * @return true if the feature is enabled.
    */
-  virtual bool featureEnabled(const std::string& key,
-                              const envoy::type::FractionalPercent& default_value) const PURE;
+  virtual bool
+  featureEnabled(const std::string& key,
+                 const envoy::type::v3alpha::FractionalPercent& default_value) const PURE;
 
   /**
    * Test if a feature is enabled using a supplied stable random value. This variant is used if
@@ -197,7 +198,7 @@ class Snapshot {
    * @return true if the feature is enabled.
    */
   virtual bool featureEnabled(const std::string& key,
-                              const envoy::type::FractionalPercent& default_value,
+                              const envoy::type::v3alpha::FractionalPercent& default_value,
                               uint64_t random_value) const PURE;
 
   /**
diff --git a/include/envoy/secret/BUILD b/include/envoy/secret/BUILD
index dd4bca328091..7662e9fe5743 100644
--- a/include/envoy/secret/BUILD
+++ b/include/envoy/secret/BUILD
@@ -21,7 +21,7 @@ envoy_cc_library(
         "//include/envoy/common:callback",
         "//include/envoy/ssl:certificate_validation_context_config_interface",
         "//include/envoy/ssl:tls_certificate_config_interface",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -30,7 +30,7 @@ envoy_cc_library(
     hdrs = ["secret_manager.h"],
     deps = [
         ":secret_provider_interface",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/include/envoy/secret/secret_manager.h b/include/envoy/secret/secret_manager.h
index e8cf0994f17b..6ac441f8520e 100644
--- a/include/envoy/secret/secret_manager.h
+++ b/include/envoy/secret/secret_manager.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/secret/secret_provider.h"
 
 namespace Envoy {
@@ -27,7 +27,8 @@ class SecretManager {
    * @param add a static secret from envoy::api::v2::auth::Secret.
    * @throw an EnvoyException if the secret is invalid or not supported, or there is duplicate.
    */
-  virtual void addStaticSecret(const envoy::api::v2::auth::Secret& secret) PURE;
+  virtual void
+  addStaticSecret(const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) PURE;
 
   /**
    * @param name a name of the static TlsCertificateConfigProvider.
@@ -58,7 +59,8 @@ class SecretManager {
    * @return a TlsCertificateConfigProviderSharedPtr created from tls_certificate.
    */
   virtual TlsCertificateConfigProviderSharedPtr createInlineTlsCertificateProvider(
-      const envoy::api::v2::auth::TlsCertificate& tls_certificate) PURE;
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& tls_certificate)
+      PURE;
 
   /**
    * @param certificate_validation_context the protobuf config of the certificate validation
@@ -68,15 +70,16 @@ class SecretManager {
    */
   virtual CertificateValidationContextConfigProviderSharedPtr
   createInlineCertificateValidationContextProvider(
-      const envoy::api::v2::auth::CertificateValidationContext& certificate_validation_context)
-      PURE;
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+          certificate_validation_context) PURE;
 
   /**
    * @param tls_certificate the protobuf config of the TLS session ticket keys.
    * @return a TlsSessionTicketKeysConfigProviderSharedPtr created from session_ticket_keys.
    */
   virtual TlsSessionTicketKeysConfigProviderSharedPtr createInlineTlsSessionTicketKeysProvider(
-      const envoy::api::v2::auth::TlsSessionTicketKeys& tls_certificate) PURE;
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&
+          tls_certificate) PURE;
 
   /**
    * Finds and returns a dynamic secret provider associated to SDS config. Create
@@ -89,7 +92,8 @@ class SecretManager {
    * @return TlsCertificateConfigProviderSharedPtr the dynamic TLS secret provider.
    */
   virtual TlsCertificateConfigProviderSharedPtr findOrCreateTlsCertificateProvider(
-      const envoy::api::v2::core::ConfigSource& config_source, const std::string& config_name,
+      const envoy::config::core::v3alpha::ConfigSource& config_source,
+      const std::string& config_name,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context) PURE;
 
   /**
@@ -105,7 +109,8 @@ class SecretManager {
    */
   virtual CertificateValidationContextConfigProviderSharedPtr
   findOrCreateCertificateValidationContextProvider(
-      const envoy::api::v2::core::ConfigSource& config_source, const std::string& config_name,
+      const envoy::config::core::v3alpha::ConfigSource& config_source,
+      const std::string& config_name,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context) PURE;
 
   /**
@@ -121,7 +126,8 @@ class SecretManager {
    */
   virtual TlsSessionTicketKeysConfigProviderSharedPtr
   findOrCreateTlsSessionTicketKeysContextProvider(
-      const envoy::api::v2::core::ConfigSource& config_source, const std::string& config_name,
+      const envoy::config::core::v3alpha::ConfigSource& config_source,
+      const std::string& config_name,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context) PURE;
 };
 
diff --git a/include/envoy/secret/secret_provider.h b/include/envoy/secret/secret_provider.h
index 8608dba94a16..2e9d099d373c 100644
--- a/include/envoy/secret/secret_provider.h
+++ b/include/envoy/secret/secret_provider.h
@@ -2,9 +2,9 @@
 
 #include <functional>
 
-#include "envoy/api/v2/auth/cert.pb.h"
 #include "envoy/common/callback.h"
 #include "envoy/common/pure.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/ssl/certificate_validation_context_config.h"
 #include "envoy/ssl/tls_certificate_config.h"
 
@@ -43,21 +43,24 @@ template <class SecretType> class SecretProvider {
   virtual Common::CallbackHandle* addUpdateCallback(std::function<void()> callback) PURE;
 };
 
-using TlsCertificatePtr = std::unique_ptr<envoy::api::v2::auth::TlsCertificate>;
-using CertificateValidationContextPtr =
-    std::unique_ptr<envoy::api::v2::auth::CertificateValidationContext>;
-using TlsSessionTicketKeysPtr = std::unique_ptr<envoy::api::v2::auth::TlsSessionTicketKeys>;
+using TlsCertificatePtr =
+    std::unique_ptr<envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate>;
+using CertificateValidationContextPtr = std::unique_ptr<
+    envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>;
+using TlsSessionTicketKeysPtr =
+    std::unique_ptr<envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys>;
 
-using TlsCertificateConfigProvider = SecretProvider<envoy::api::v2::auth::TlsCertificate>;
+using TlsCertificateConfigProvider =
+    SecretProvider<envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate>;
 using TlsCertificateConfigProviderSharedPtr = std::shared_ptr<TlsCertificateConfigProvider>;
 
-using CertificateValidationContextConfigProvider =
-    SecretProvider<envoy::api::v2::auth::CertificateValidationContext>;
+using CertificateValidationContextConfigProvider = SecretProvider<
+    envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>;
 using CertificateValidationContextConfigProviderSharedPtr =
     std::shared_ptr<CertificateValidationContextConfigProvider>;
 
 using TlsSessionTicketKeysConfigProvider =
-    SecretProvider<envoy::api::v2::auth::TlsSessionTicketKeys>;
+    SecretProvider<envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys>;
 using TlsSessionTicketKeysConfigProviderSharedPtr =
     std::shared_ptr<TlsSessionTicketKeysConfigProvider>;
 
diff --git a/include/envoy/server/BUILD b/include/envoy/server/BUILD
index 657643e74a86..e476795442a1 100644
--- a/include/envoy/server/BUILD
+++ b/include/envoy/server/BUILD
@@ -40,7 +40,7 @@ envoy_cc_library(
         "//include/envoy/ratelimit:ratelimit_interface",
         "//include/envoy/tracing:http_tracer_interface",
         "//include/envoy/upstream:cluster_manager_interface",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -74,7 +74,7 @@ envoy_cc_library(
     hdrs = ["health_checker_config.h"],
     deps = [
         "//include/envoy/upstream:health_checker_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -122,8 +122,8 @@ envoy_cc_library(
     deps = [
         "//include/envoy/network:address_interface",
         "//include/envoy/stats:stats_interface",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -171,7 +171,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/common:macros",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -194,10 +194,9 @@ envoy_cc_library(
         "//include/envoy/network:listen_socket_interface",
         "//include/envoy/ssl:context_interface",
         "//source/common/protobuf",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/server/configuration.h b/include/envoy/server/configuration.h
index 0c7d6dc969da..a342e38b03f5 100644
--- a/include/envoy/server/configuration.h
+++ b/include/envoy/server/configuration.h
@@ -7,7 +7,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/stats/sink.h"
 #include "envoy/tracing/http_tracer.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -121,7 +121,7 @@ class Initial {
    * @return const envoy::config::bootstrap::v2::LayeredRuntime& runtime
    *         configuration.
    */
-  virtual const envoy::config::bootstrap::v2::LayeredRuntime& runtime() PURE;
+  virtual const envoy::config::bootstrap::v3alpha::LayeredRuntime& runtime() PURE;
 };
 
 } // namespace Configuration
diff --git a/include/envoy/server/filter_config.h b/include/envoy/server/filter_config.h
index 89cce4b54827..8a1e49123e67 100644
--- a/include/envoy/server/filter_config.h
+++ b/include/envoy/server/filter_config.h
@@ -3,7 +3,7 @@
 #include <functional>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/grpc/context.h"
 #include "envoy/http/codes.h"
 #include "envoy/http/context.h"
@@ -128,7 +128,7 @@ class FactoryContext : public virtual CommonFactoryContext {
    * @return envoy::api::v2::core::TrafficDirection the direction of the traffic relative to the
    * local proxy.
    */
-  virtual envoy::api::v2::core::TrafficDirection direction() const PURE;
+  virtual envoy::config::core::v3alpha::TrafficDirection direction() const PURE;
 
   /**
    * @return const Network::DrainDecision& a drain decision that filters can use to determine if
@@ -170,7 +170,7 @@ class FactoryContext : public virtual CommonFactoryContext {
    * @return const envoy::api::v2::core::Metadata& the config metadata associated with this
    * listener.
    */
-  virtual const envoy::api::v2::core::Metadata& listenerMetadata() const PURE;
+  virtual const envoy::config::core::v3alpha::Metadata& listenerMetadata() const PURE;
 
   /**
    * @return OverloadManager& the overload manager for the server.
diff --git a/include/envoy/server/health_checker_config.h b/include/envoy/server/health_checker_config.h
index 4fe695e929d6..0d3e54481ae8 100644
--- a/include/envoy/server/health_checker_config.h
+++ b/include/envoy/server/health_checker_config.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/health_check.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/upstream/health_checker.h"
 
@@ -69,7 +69,7 @@ class CustomHealthCheckerFactory {
    * @return HealthCheckerSharedPtr the pointer of a health checker instance.
    */
   virtual Upstream::HealthCheckerSharedPtr
-  createCustomHealthChecker(const envoy::api::v2::core::HealthCheck& config,
+  createCustomHealthChecker(const envoy::config::core::v3alpha::HealthCheck& config,
                             HealthCheckerFactoryContext& context) PURE;
 
   /**
diff --git a/include/envoy/server/listener_manager.h b/include/envoy/server/listener_manager.h
index 6709adcfc875..b45efcfe0294 100644
--- a/include/envoy/server/listener_manager.h
+++ b/include/envoy/server/listener_manager.h
@@ -2,10 +2,10 @@
 
 #include <vector>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/network/filter.h"
 #include "envoy/network/listen_socket.h"
 #include "envoy/network/listener.h"
@@ -58,7 +58,7 @@ class ListenerComponentFactory {
    * @return an LDS API provider.
    * @param lds_config supplies the management server configuration.
    */
-  virtual LdsApiPtr createLdsApi(const envoy::api::v2::core::ConfigSource& lds_config) PURE;
+  virtual LdsApiPtr createLdsApi(const envoy::config::core::v3alpha::ConfigSource& lds_config) PURE;
 
   /**
    * Creates a socket.
@@ -81,7 +81,7 @@ class ListenerComponentFactory {
    * @return std::vector<Network::FilterFactoryCb> the list of filter factories.
    */
   virtual std::vector<Network::FilterFactoryCb> createNetworkFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
       Configuration::FactoryContext& context) PURE;
 
   /**
@@ -91,7 +91,7 @@ class ListenerComponentFactory {
    * @return std::vector<Network::ListenerFilterFactoryCb> the list of filter factories.
    */
   virtual std::vector<Network::ListenerFilterFactoryCb> createListenerFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context) PURE;
 
   /**
@@ -101,14 +101,15 @@ class ListenerComponentFactory {
    * @return std::vector<Network::UdpListenerFilterFactoryCb> the list of filter factories.
    */
   virtual std::vector<Network::UdpListenerFilterFactoryCb> createUdpListenerFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context) PURE;
 
   /**
    * @return DrainManagerPtr a new drain manager.
    * @param drain_type supplies the type of draining to do for the owning listener.
    */
-  virtual DrainManagerPtr createDrainManager(envoy::api::v2::Listener::DrainType drain_type) PURE;
+  virtual DrainManagerPtr
+  createDrainManager(envoy::config::listener::v3alpha::Listener::DrainType drain_type) PURE;
 
   /**
    * @return uint64_t a listener tag usable for connection handler tracking.
@@ -147,7 +148,7 @@ class ListenerManager {
    *         a duplicate of the existing listener. This routine will throw an EnvoyException if
    *         there is a fundamental error preventing the listener from being added or updated.
    */
-  virtual bool addOrUpdateListener(const envoy::api::v2::Listener& config,
+  virtual bool addOrUpdateListener(const envoy::config::listener::v3alpha::Listener& config,
                                    const std::string& version_info, bool modifiable) PURE;
 
   /**
@@ -156,7 +157,7 @@ class ListenerManager {
    * pieces of the server existing.
    * @param lds_config supplies the management server configuration.
    */
-  virtual void createLdsApi(const envoy::api::v2::core::ConfigSource& lds_config) PURE;
+  virtual void createLdsApi(const envoy::config::core::v3alpha::ConfigSource& lds_config) PURE;
 
   /**
    * @return std::vector<std::reference_wrapper<Network::ListenerConfig>> a list of the currently
@@ -209,7 +210,7 @@ class ListenerManager {
    * Inform the listener manager that the update has completed, and informs the listener of any
    * errors handled by the reload source.
    */
-  using FailureStates = std::vector<std::unique_ptr<envoy::admin::v2alpha::UpdateFailureState>>;
+  using FailureStates = std::vector<std::unique_ptr<envoy::admin::v3alpha::UpdateFailureState>>;
   virtual void endListenerUpdate(FailureStates&& failure_states) PURE;
 };
 
diff --git a/include/envoy/server/options.h b/include/envoy/server/options.h
index 57dacdeff8ae..93fc7cb6e4f1 100644
--- a/include/envoy/server/options.h
+++ b/include/envoy/server/options.h
@@ -4,9 +4,9 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/admin/v2alpha/server_info.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
 #include "envoy/common/pure.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/network/address.h"
 
 #include "spdlog/spdlog.h"
@@ -41,7 +41,7 @@ enum class Mode {
   // to be validated in a non-prod environment.
 };
 
-using CommandLineOptionsPtr = std::unique_ptr<envoy::admin::v2alpha::CommandLineOptions>;
+using CommandLineOptionsPtr = std::unique_ptr<envoy::admin::v3alpha::CommandLineOptions>;
 
 /**
  * General options for the server.
@@ -83,7 +83,7 @@ class Options {
    * @return const envoy::config::bootstrap::v2::Bootstrap& a bootstrap proto object
    * that merges into the config last, after configYaml and configPath.
    */
-  virtual const envoy::config::bootstrap::v2::Bootstrap& configProto() const PURE;
+  virtual const envoy::config::bootstrap::v3alpha::Bootstrap& configProto() const PURE;
 
   /**
    * @return bool allow unknown fields in the static configuration?
diff --git a/include/envoy/ssl/BUILD b/include/envoy/ssl/BUILD
index 110d7a46a9d7..301b11616b64 100644
--- a/include/envoy/ssl/BUILD
+++ b/include/envoy/ssl/BUILD
@@ -20,7 +20,7 @@ envoy_cc_library(
 envoy_cc_library(
     name = "context_interface",
     hdrs = ["context.h"],
-    deps = ["@envoy_api//envoy/admin/v2alpha:pkg_cc_proto"],
+    deps = ["@envoy_api//envoy/admin/v3alpha:pkg_cc_proto"],
 )
 
 envoy_cc_library(
@@ -56,6 +56,6 @@ envoy_cc_library(
     hdrs = ["certificate_validation_context_config.h"],
     deps = [
         "//source/common/common:matchers_lib",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/include/envoy/ssl/certificate_validation_context_config.h b/include/envoy/ssl/certificate_validation_context_config.h
index 061528fc9380..d50b4e3c3465 100644
--- a/include/envoy/ssl/certificate_validation_context_config.h
+++ b/include/envoy/ssl/certificate_validation_context_config.h
@@ -5,7 +5,7 @@
 #include <vector>
 
 #include "envoy/common/pure.h"
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 namespace Envoy {
 namespace Ssl {
@@ -44,7 +44,7 @@ class CertificateValidationContextConfig {
   /**
    * @return The subject alt name matchers to be verified, if enabled.
    */
-  virtual const std::vector<::envoy::type::matcher::StringMatcher>&
+  virtual const std::vector<envoy::type::matcher::v3alpha::StringMatcher>&
   subjectAltNameMatchers() const PURE;
 
   /**
diff --git a/include/envoy/ssl/context.h b/include/envoy/ssl/context.h
index 6b7a3600331f..e917dbe387fa 100644
--- a/include/envoy/ssl/context.h
+++ b/include/envoy/ssl/context.h
@@ -3,13 +3,13 @@
 #include <memory>
 #include <string>
 
-#include "envoy/admin/v2alpha/certs.pb.h"
+#include "envoy/admin/v3alpha/certs.pb.h"
 #include "envoy/common/pure.h"
 
 namespace Envoy {
 namespace Ssl {
 
-using CertificateDetailsPtr = std::unique_ptr<envoy::admin::v2alpha::CertificateDetails>;
+using CertificateDetailsPtr = std::unique_ptr<envoy::admin::v3alpha::CertificateDetails>;
 
 /**
  * SSL Context is used as a template for SSL connection configuration.
diff --git a/include/envoy/ssl/private_key/BUILD b/include/envoy/ssl/private_key/BUILD
index 07bb3271816b..a4fc20eb3940 100644
--- a/include/envoy/ssl/private_key/BUILD
+++ b/include/envoy/ssl/private_key/BUILD
@@ -15,7 +15,7 @@ envoy_cc_library(
     deps = [
         ":private_key_callbacks_interface",
         "//include/envoy/event:dispatcher_interface",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -25,7 +25,7 @@ envoy_cc_library(
     deps = [
         ":private_key_interface",
         "//include/envoy/registry",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/ssl/private_key/private_key.h b/include/envoy/ssl/private_key/private_key.h
index 001980ec2edb..5c3bb0a5ab4f 100644
--- a/include/envoy/ssl/private_key/private_key.h
+++ b/include/envoy/ssl/private_key/private_key.h
@@ -3,9 +3,9 @@
 #include <functional>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
 #include "envoy/common/pure.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/ssl/private_key/private_key_callbacks.h"
 
 #include "openssl/ssl.h"
@@ -81,7 +81,7 @@ class PrivateKeyMethodManager {
    * no provider can be used with the context configuration.
    */
   virtual PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProvider(
-      const envoy::api::v2::auth::PrivateKeyProvider& config,
+      const envoy::extensions::transport_sockets::tls::v3alpha::PrivateKeyProvider& config,
       Envoy::Server::Configuration::TransportSocketFactoryContext& factory_context) PURE;
 };
 
diff --git a/include/envoy/ssl/private_key/private_key_config.h b/include/envoy/ssl/private_key/private_key_config.h
index 6f6eef9ac0e2..b7bf1a038bee 100644
--- a/include/envoy/ssl/private_key/private_key_config.h
+++ b/include/envoy/ssl/private_key/private_key_config.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/ssl/private_key/private_key.h"
 
@@ -21,7 +21,7 @@ class PrivateKeyMethodProviderInstanceFactory {
    * @param context supplies the factory context
    */
   virtual PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
-      const envoy::api::v2::auth::PrivateKeyProvider& config,
+      const envoy::extensions::transport_sockets::tls::v3alpha::PrivateKeyProvider& config,
       Server::Configuration::TransportSocketFactoryContext& factory_context) PURE;
 
   /**
diff --git a/include/envoy/stream_info/BUILD b/include/envoy/stream_info/BUILD
index 288f467f6ff8..45843e25d0db 100644
--- a/include/envoy/stream_info/BUILD
+++ b/include/envoy/stream_info/BUILD
@@ -22,7 +22,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/protobuf",
         "//source/common/singleton:const_singleton",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/include/envoy/stream_info/stream_info.h b/include/envoy/stream_info/stream_info.h
index ccf5778be575..941375ee0624 100644
--- a/include/envoy/stream_info/stream_info.h
+++ b/include/envoy/stream_info/stream_info.h
@@ -4,9 +4,9 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/pure.h"
 #include "envoy/common/time.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/http/protocol.h"
 #include "envoy/ssl/connection.h"
@@ -464,8 +464,8 @@ class StreamInfo {
   /**
    * @return const envoy::api::v2::core::Metadata& the dynamic metadata associated with this request
    */
-  virtual envoy::api::v2::core::Metadata& dynamicMetadata() PURE;
-  virtual const envoy::api::v2::core::Metadata& dynamicMetadata() const PURE;
+  virtual envoy::config::core::v3alpha::Metadata& dynamicMetadata() PURE;
+  virtual const envoy::config::core::v3alpha::Metadata& dynamicMetadata() const PURE;
 
   /**
    * @param name the namespace used in the metadata in reverse DNS format, for example:
diff --git a/include/envoy/upstream/BUILD b/include/envoy/upstream/BUILD
index cb30f9994bc4..806d785f55e3 100644
--- a/include/envoy/upstream/BUILD
+++ b/include/envoy/upstream/BUILD
@@ -29,9 +29,9 @@ envoy_cc_library(
         "//include/envoy/singleton:manager_interface",
         "//include/envoy/tcp:conn_pool_interface",
         "//include/envoy/thread_local:thread_local_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -40,7 +40,7 @@ envoy_cc_library(
     hdrs = ["health_checker.h"],
     deps = [
         ":upstream_interface",
-        "@envoy_api//envoy/data/core/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -59,7 +59,7 @@ envoy_cc_library(
         "//include/envoy/network:transport_socket_interface",
         "//include/envoy/stats:primitive_stats_macros",
         "//include/envoy/stats:stats_macros",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -78,7 +78,7 @@ envoy_cc_library(
     hdrs = ["load_balancer_type.h"],
     deps = [
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -87,7 +87,7 @@ envoy_cc_library(
     hdrs = ["locality.h"],
     deps = [
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -150,8 +150,8 @@ envoy_cc_library(
         "//include/envoy/ssl:context_interface",
         "//include/envoy/ssl:context_manager_interface",
         "//include/envoy/upstream:types_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -173,6 +173,6 @@ envoy_cc_library(
         "//include/envoy/runtime:runtime_interface",
         "//include/envoy/ssl:context_interface",
         "//include/envoy/ssl:context_manager_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/include/envoy/upstream/cluster_factory.h b/include/envoy/upstream/cluster_factory.h
index 5c6ee9787ed8..45773a759fcd 100644
--- a/include/envoy/upstream/cluster_factory.h
+++ b/include/envoy/upstream/cluster_factory.h
@@ -10,7 +10,7 @@
 
 #include "envoy/access_log/access_log.h"
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/network/dns.h"
@@ -136,7 +136,8 @@ class ClusterFactory {
    *         balancer if this cluster has an integrated load balancer.
    */
   virtual std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-  create(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context) PURE;
+  create(const envoy::config::cluster::v3alpha::Cluster& cluster,
+         ClusterFactoryContext& context) PURE;
 
   /**
    * @return std::string the identifying name for a particular implementation of a cluster factory.
diff --git a/include/envoy/upstream/cluster_manager.h b/include/envoy/upstream/cluster_manager.h
index 1993ef0672b1..b9b8ed59612e 100644
--- a/include/envoy/upstream/cluster_manager.h
+++ b/include/envoy/upstream/cluster_manager.h
@@ -8,10 +8,10 @@
 
 #include "envoy/access_log/access_log.h"
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/grpc_mux.h"
 #include "envoy/config/subscription_factory.h"
 #include "envoy/grpc/async_client_manager.h"
@@ -88,7 +88,7 @@ class ClusterManager {
    * @param version_info supplies the xDS version of the cluster.
    * @return true if the action results in an add/update of a cluster.
    */
-  virtual bool addOrUpdateCluster(const envoy::api::v2::Cluster& cluster,
+  virtual bool addOrUpdateCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
                                   const std::string& version_info) PURE;
 
   /**
@@ -177,7 +177,7 @@ class ClusterManager {
    * @return const envoy::api::v2::core::BindConfig& cluster manager wide bind configuration for new
    *         upstream connections.
    */
-  virtual const envoy::api::v2::core::BindConfig& bindConfig() const PURE;
+  virtual const envoy::config::core::v3alpha::BindConfig& bindConfig() const PURE;
 
   /**
    * Returns a shared_ptr to the singleton xDS-over-gRPC provider for upstream control plane muxing
@@ -268,7 +268,7 @@ class ClusterManagerFactory {
    * Allocate a cluster manager from configuration proto.
    */
   virtual ClusterManagerPtr
-  clusterManagerFromProto(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) PURE;
+  clusterManagerFromProto(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) PURE;
 
   /**
    * Allocate an HTTP connection pool for the host. Pools are separated by 'priority',
@@ -294,13 +294,13 @@ class ClusterManagerFactory {
    * Allocate a cluster from configuration proto.
    */
   virtual std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-  clusterFromProto(const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+  clusterFromProto(const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
                    Outlier::EventLoggerSharedPtr outlier_event_logger, bool added_via_api) PURE;
 
   /**
    * Create a CDS API provider from configuration proto.
    */
-  virtual CdsApiPtr createCds(const envoy::api::v2::core::ConfigSource& cds_config,
+  virtual CdsApiPtr createCds(const envoy::config::core::v3alpha::ConfigSource& cds_config,
                               ClusterManager& cm) PURE;
 
   /**
@@ -322,8 +322,8 @@ class ClusterInfoFactory {
   struct CreateClusterInfoParams {
     Server::Admin& admin_;
     Runtime::Loader& runtime_;
-    const envoy::api::v2::Cluster& cluster_;
-    const envoy::api::v2::core::BindConfig& bind_config_;
+    const envoy::config::cluster::v3alpha::Cluster& cluster_;
+    const envoy::config::core::v3alpha::BindConfig& bind_config_;
     Stats::Store& stats_;
     Ssl::ContextManager& ssl_context_manager_;
     const bool added_via_api_;
diff --git a/include/envoy/upstream/health_checker.h b/include/envoy/upstream/health_checker.h
index b9f7e9cbb837..4583e6cd365f 100644
--- a/include/envoy/upstream/health_checker.h
+++ b/include/envoy/upstream/health_checker.h
@@ -3,7 +3,7 @@
 #include <functional>
 #include <memory>
 
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 #include "envoy/upstream/upstream.h"
 
 namespace Envoy {
@@ -75,9 +75,9 @@ class HealthCheckEventLogger {
    * @param failure_type supplies the type of health check failure.
    */
   virtual void
-  logEjectUnhealthy(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  logEjectUnhealthy(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                     const HostDescriptionConstSharedPtr& host,
-                    envoy::data::core::v2alpha::HealthCheckFailureType failure_type) PURE;
+                    envoy::data::core::v3alpha::HealthCheckFailureType failure_type) PURE;
 
   /**
    * Log an unhealthy host event.
@@ -86,9 +86,9 @@ class HealthCheckEventLogger {
    * @param failure_type supplies the type of health check failure.
    * @param first_check whether this is a failure on the first health check for this host.
    */
-  virtual void logUnhealthy(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  virtual void logUnhealthy(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                             const HostDescriptionConstSharedPtr& host,
-                            envoy::data::core::v2alpha::HealthCheckFailureType failure_type,
+                            envoy::data::core::v3alpha::HealthCheckFailureType failure_type,
                             bool first_check) PURE;
 
   /**
@@ -98,7 +98,7 @@ class HealthCheckEventLogger {
    * @param healthy_threshold supplied the configured healthy threshold for this health check.
    * @param first_check whether this is a fast path success on the first health check for this host.
    */
-  virtual void logAddHealthy(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  virtual void logAddHealthy(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                              const HostDescriptionConstSharedPtr& host, bool first_check) PURE;
 
   /**
@@ -106,7 +106,7 @@ class HealthCheckEventLogger {
    * @param health_checker_type supplies the type of health checker that generated the event.
    * @param host supplies the host that generated the event.
    */
-  virtual void logDegraded(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  virtual void logDegraded(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                            const HostDescriptionConstSharedPtr& host) PURE;
   /**
    * Log a no degraded healthy host event.
@@ -114,7 +114,7 @@ class HealthCheckEventLogger {
    * @param host supplies the host that generated the event.
    */
   virtual void
-  logNoLongerDegraded(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  logNoLongerDegraded(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                       const HostDescriptionConstSharedPtr& host) PURE;
 };
 
diff --git a/include/envoy/upstream/host_description.h b/include/envoy/upstream/host_description.h
index 90cb856f9082..241c5bec97d7 100644
--- a/include/envoy/upstream/host_description.h
+++ b/include/envoy/upstream/host_description.h
@@ -4,7 +4,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/transport_socket.h"
 #include "envoy/stats/primitive_stats_macros.h"
@@ -73,12 +73,12 @@ class HostDescription {
   /**
    * @return the metadata associated with this host
    */
-  virtual const std::shared_ptr<envoy::api::v2::core::Metadata> metadata() const PURE;
+  virtual const std::shared_ptr<envoy::config::core::v3alpha::Metadata> metadata() const PURE;
 
   /**
    * Set the current metadata.
    */
-  virtual void metadata(const envoy::api::v2::core::Metadata& new_metadata) PURE;
+  virtual void metadata(const envoy::config::core::v3alpha::Metadata& new_metadata) PURE;
 
   /**
    * @return the cluster the host is a member of.
@@ -120,7 +120,7 @@ class HostDescription {
    * @return the locality of the host (deployment specific). This will be the default instance if
    *         unknown.
    */
-  virtual const envoy::api::v2::core::Locality& locality() const PURE;
+  virtual const envoy::config::core::v3alpha::Locality& locality() const PURE;
 
   /**
    * @return the human readable name of the host's locality zone as a StatName.
@@ -174,7 +174,7 @@ class TransportSocketMatcher {
    * @param metadata the metadata of the given host.
    * @return the match information of the transport socket selected.
    */
-  virtual MatchData resolve(const envoy::api::v2::core::Metadata& metadata) const PURE;
+  virtual MatchData resolve(const envoy::config::core::v3alpha::Metadata& metadata) const PURE;
 };
 
 using TransportSocketMatcherPtr = std::unique_ptr<TransportSocketMatcher>;
diff --git a/include/envoy/upstream/load_balancer_type.h b/include/envoy/upstream/load_balancer_type.h
index 45f9165479d5..9e06aa6f25f5 100644
--- a/include/envoy/upstream/load_balancer_type.h
+++ b/include/envoy/upstream/load_balancer_type.h
@@ -4,8 +4,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -40,8 +40,9 @@ class SubsetSelector {
   /**
    * @return fallback policy defined for this selector, or NOT_DEFINED
    */
-  virtual envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-  fallbackPolicy() const PURE;
+  virtual envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+      LbSubsetSelectorFallbackPolicy
+      fallbackPolicy() const PURE;
 
   /**
    * @return fallback keys subset defined for this selector, or empty set
@@ -67,7 +68,7 @@ class LoadBalancerSubsetInfo {
    * @return LbSubsetFallbackPolicy the fallback policy used when
    * route metadata does not match any subset.
    */
-  virtual envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy
+  virtual envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy
   fallbackPolicy() const PURE;
 
   /**
diff --git a/include/envoy/upstream/locality.h b/include/envoy/upstream/locality.h
index f4ff0948cfbd..c074a942b252 100644
--- a/include/envoy/upstream/locality.h
+++ b/include/envoy/upstream/locality.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -9,21 +9,21 @@ namespace Upstream {
 
 // TODO(htuch): should these be templated in protobuf/utility.h?
 struct LocalityHash {
-  size_t operator()(const envoy::api::v2::core::Locality& locality) const {
+  size_t operator()(const envoy::config::core::v3alpha::Locality& locality) const {
     return MessageUtil::hash(locality);
   }
 };
 
 struct LocalityEqualTo {
-  bool operator()(const envoy::api::v2::core::Locality& lhs,
-                  const envoy::api::v2::core::Locality& rhs) const {
+  bool operator()(const envoy::config::core::v3alpha::Locality& lhs,
+                  const envoy::config::core::v3alpha::Locality& rhs) const {
     return Protobuf::util::MessageDifferencer::Equivalent(lhs, rhs);
   }
 };
 
 struct LocalityLess {
-  bool operator()(const envoy::api::v2::core::Locality& lhs,
-                  const envoy::api::v2::core::Locality& rhs) const {
+  bool operator()(const envoy::config::core::v3alpha::Locality& lhs,
+                  const envoy::config::core::v3alpha::Locality& rhs) const {
     using LocalityTuple = std::tuple<const std::string&, const std::string&, const std::string&>;
     const LocalityTuple lhs_tuple = LocalityTuple(lhs.region(), lhs.zone(), lhs.sub_zone());
     const LocalityTuple rhs_tuple = LocalityTuple(rhs.region(), rhs.zone(), rhs.sub_zone());
@@ -32,9 +32,9 @@ struct LocalityLess {
 };
 
 // For tests etc. where this is convenient.
-static inline envoy::api::v2::core::Locality
+static inline envoy::config::core::v3alpha::Locality
 Locality(const std::string& region, const std::string& zone, const std::string sub_zone) {
-  envoy::api::v2::core::Locality locality;
+  envoy::config::core::v3alpha::Locality locality;
   locality.set_region(region);
   locality.set_zone(zone);
   locality.set_sub_zone(sub_zone);
@@ -46,16 +46,16 @@ Locality(const std::string& region, const std::string& zone, const std::string s
 
 // Something heinous this way comes. Required to allow == for LocalityWeightsMap.h in eds.h.
 namespace envoy {
-namespace api {
-namespace v2 {
+namespace config {
 namespace core {
+namespace v3alpha {
 
-inline bool operator==(const envoy::api::v2::core::Locality& x,
-                       const envoy::api::v2::core::Locality& y) {
+inline bool operator==(const envoy::config::core::v3alpha::Locality& x,
+                       const envoy::config::core::v3alpha::Locality& y) {
   return Envoy::Upstream::LocalityEqualTo()(x, y);
 }
 
+} // namespace v3alpha
 } // namespace core
-} // namespace v2
-} // namespace api
+} // namespace config
 } // namespace envoy
diff --git a/include/envoy/upstream/upstream.h b/include/envoy/upstream/upstream.h
index 30193e3edf82..476906843b8a 100644
--- a/include/envoy/upstream/upstream.h
+++ b/include/envoy/upstream/upstream.h
@@ -8,9 +8,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/callback.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/http/codec.h"
 #include "envoy/network/connection.h"
@@ -213,8 +213,8 @@ using DegradedHostVectorConstSharedPtr = std::shared_ptr<const DegradedHostVecto
 using ExcludedHostVectorConstSharedPtr = std::shared_ptr<const ExcludedHostVector>;
 
 using HostListPtr = std::unique_ptr<HostVector>;
-using LocalityWeightsMap =
-    std::unordered_map<envoy::api::v2::core::Locality, uint32_t, LocalityHash, LocalityEqualTo>;
+using LocalityWeightsMap = std::unordered_map<envoy::config::core::v3alpha::Locality, uint32_t,
+                                              LocalityHash, LocalityEqualTo>;
 using PriorityState = std::vector<std::pair<HostListPtr, LocalityWeightsMap>>;
 
 /**
@@ -721,7 +721,7 @@ class ClusterInfo {
    * @return const envoy::api::v2::Cluster::CommonLbConfig& the common configuration for all
    *         load balancers for this cluster.
    */
-  virtual const envoy::api::v2::Cluster::CommonLbConfig& lbConfig() const PURE;
+  virtual const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& lbConfig() const PURE;
 
   /**
    * @return the type of load balancing that the cluster should use.
@@ -731,24 +731,24 @@ class ClusterInfo {
   /**
    * @return the service discovery type to use for resolving the cluster.
    */
-  virtual envoy::api::v2::Cluster::DiscoveryType type() const PURE;
+  virtual envoy::config::cluster::v3alpha::Cluster::DiscoveryType type() const PURE;
 
   /**
    * @return the type of cluster, only used for custom discovery types.
    */
-  virtual const absl::optional<envoy::api::v2::Cluster::CustomClusterType>&
+  virtual const absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType>&
   clusterType() const PURE;
 
   /**
    * @return configuration for least request load balancing, only used if LB type is least request.
    */
-  virtual const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig>&
+  virtual const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>&
   lbLeastRequestConfig() const PURE;
 
   /**
    * @return configuration for ring hash load balancing, only used if type is set to ring_hash_lb.
    */
-  virtual const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>&
+  virtual const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>&
   lbRingHashConfig() const PURE;
 
   /**
@@ -756,7 +756,7 @@ class ClusterInfo {
    *         for the Original Destination load balancing policy, only used if type is set to
    *         ORIGINAL_DST_LB.
    */
-  virtual const absl::optional<envoy::api::v2::Cluster::OriginalDstLbConfig>&
+  virtual const absl::optional<envoy::config::cluster::v3alpha::Cluster::OriginalDstLbConfig>&
   lbOriginalDstConfig() const PURE;
 
   /**
@@ -828,7 +828,7 @@ class ClusterInfo {
   /**
    * @return const envoy::api::v2::core::Metadata& the configuration metadata for this cluster.
    */
-  virtual const envoy::api::v2::core::Metadata& metadata() const PURE;
+  virtual const envoy::config::core::v3alpha::Metadata& metadata() const PURE;
 
   /**
    * @return const Envoy::Config::TypedMetadata&& the typed metadata for this cluster.
diff --git a/source/common/access_log/BUILD b/source/common/access_log/BUILD
index 76c225d52c4d..2202f5b42623 100644
--- a/source/common/access_log/BUILD
+++ b/source/common/access_log/BUILD
@@ -31,8 +31,8 @@ envoy_cc_library(
         "//source/common/runtime:uuid_util_lib",
         "//source/common/stream_info:stream_info_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/config/filter/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -50,7 +50,7 @@ envoy_cc_library(
         "//source/common/http:utility_lib",
         "//source/common/protobuf:message_validator_lib",
         "//source/common/stream_info:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/access_log/access_log_formatter.cc b/source/common/access_log/access_log_formatter.cc
index 53c991a6701f..f038163546c6 100644
--- a/source/common/access_log/access_log_formatter.cc
+++ b/source/common/access_log/access_log_formatter.cc
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -843,7 +843,7 @@ MetadataFormatter::MetadataFormatter(const std::string& filter_namespace,
     : filter_namespace_(filter_namespace), path_(path), max_length_(max_length) {}
 
 std::string
-MetadataFormatter::formatMetadata(const envoy::api::v2::core::Metadata& metadata) const {
+MetadataFormatter::formatMetadata(const envoy::config::core::v3alpha::Metadata& metadata) const {
   ProtobufWkt::Value value = formatMetadataValue(metadata);
   if (value.kind_case() == ProtobufWkt::Value::kNullValue) {
     return UnspecifiedValueString;
@@ -854,8 +854,8 @@ MetadataFormatter::formatMetadata(const envoy::api::v2::core::Metadata& metadata
   return json;
 }
 
-ProtobufWkt::Value
-MetadataFormatter::formatMetadataValue(const envoy::api::v2::core::Metadata& metadata) const {
+ProtobufWkt::Value MetadataFormatter::formatMetadataValue(
+    const envoy::config::core::v3alpha::Metadata& metadata) const {
   if (path_.empty()) {
     const auto filter_it = metadata.filter_metadata().find(filter_namespace_);
     if (filter_it == metadata.filter_metadata().end()) {
diff --git a/source/common/access_log/access_log_formatter.h b/source/common/access_log/access_log_formatter.h
index a48d21d0de46..868b758a9b63 100644
--- a/source/common/access_log/access_log_formatter.h
+++ b/source/common/access_log/access_log_formatter.h
@@ -6,8 +6,8 @@
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/time.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/stream_info/stream_info.h"
 
 #include "common/common/utility.h"
@@ -243,8 +243,9 @@ class MetadataFormatter {
                     absl::optional<size_t> max_length);
 
 protected:
-  std::string formatMetadata(const envoy::api::v2::core::Metadata& metadata) const;
-  ProtobufWkt::Value formatMetadataValue(const envoy::api::v2::core::Metadata& metadata) const;
+  std::string formatMetadata(const envoy::config::core::v3alpha::Metadata& metadata) const;
+  ProtobufWkt::Value
+  formatMetadataValue(const envoy::config::core::v3alpha::Metadata& metadata) const;
 
 private:
   std::string filter_namespace_;
diff --git a/source/common/access_log/access_log_impl.cc b/source/common/access_log/access_log_impl.cc
index 8b4a0f3b7512..d2960279a376 100644
--- a/source/common/access_log/access_log_impl.cc
+++ b/source/common/access_log/access_log_impl.cc
@@ -4,8 +4,8 @@
 #include <string>
 
 #include "envoy/common/time.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.validate.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.validate.h"
 #include "envoy/filesystem/filesystem.h"
 #include "envoy/http/header_map.h"
 #include "envoy/runtime/runtime.h"
@@ -30,7 +30,8 @@ namespace Envoy {
 namespace AccessLog {
 
 ComparisonFilter::ComparisonFilter(
-    const envoy::config::filter::accesslog::v2::ComparisonFilter& config, Runtime::Loader& runtime)
+    const envoy::config::filter::accesslog::v3alpha::ComparisonFilter& config,
+    Runtime::Loader& runtime)
     : config_(config), runtime_(runtime) {}
 
 bool ComparisonFilter::compareAgainstValue(uint64_t lhs) {
@@ -41,11 +42,11 @@ bool ComparisonFilter::compareAgainstValue(uint64_t lhs) {
   }
 
   switch (config_.op()) {
-  case envoy::config::filter::accesslog::v2::ComparisonFilter::GE:
+  case envoy::config::filter::accesslog::v3alpha::ComparisonFilter::GE:
     return lhs >= value;
-  case envoy::config::filter::accesslog::v2::ComparisonFilter::EQ:
+  case envoy::config::filter::accesslog::v3alpha::ComparisonFilter::EQ:
     return lhs == value;
-  case envoy::config::filter::accesslog::v2::ComparisonFilter::LE:
+  case envoy::config::filter::accesslog::v3alpha::ComparisonFilter::LE:
     return lhs <= value;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
@@ -53,33 +54,42 @@ bool ComparisonFilter::compareAgainstValue(uint64_t lhs) {
 }
 
 FilterPtr
-FilterFactory::fromProto(const envoy::config::filter::accesslog::v2::AccessLogFilter& config,
+FilterFactory::fromProto(const envoy::config::filter::accesslog::v3alpha::AccessLogFilter& config,
                          Runtime::Loader& runtime, Runtime::RandomGenerator& random,
                          ProtobufMessage::ValidationVisitor& validation_visitor) {
   switch (config.filter_specifier_case()) {
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kStatusCodeFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kStatusCodeFilter:
     return FilterPtr{new StatusCodeFilter(config.status_code_filter(), runtime)};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kDurationFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kDurationFilter:
     return FilterPtr{new DurationFilter(config.duration_filter(), runtime)};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kNotHealthCheckFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kNotHealthCheckFilter:
     return FilterPtr{new NotHealthCheckFilter()};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kTraceableFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kTraceableFilter:
     return FilterPtr{new TraceableRequestFilter()};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kRuntimeFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kRuntimeFilter:
     return FilterPtr{new RuntimeFilter(config.runtime_filter(), runtime, random)};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kAndFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::kAndFilter:
     return FilterPtr{new AndFilter(config.and_filter(), runtime, random, validation_visitor)};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kOrFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::kOrFilter:
     return FilterPtr{new OrFilter(config.or_filter(), runtime, random, validation_visitor)};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kHeaderFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kHeaderFilter:
     return FilterPtr{new HeaderFilter(config.header_filter())};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kResponseFlagFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kResponseFlagFilter:
     MessageUtil::validate(config, validation_visitor);
     return FilterPtr{new ResponseFlagFilter(config.response_flag_filter())};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kGrpcStatusFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kGrpcStatusFilter:
     MessageUtil::validate(config, validation_visitor);
     return FilterPtr{new GrpcStatusFilter(config.grpc_status_filter())};
-  case envoy::config::filter::accesslog::v2::AccessLogFilter::kExtensionFilter:
+  case envoy::config::filter::accesslog::v3alpha::AccessLogFilter::FilterSpecifierCase::
+      kExtensionFilter:
     MessageUtil::validate(config, validation_visitor);
     {
       auto& factory = Config::Utility::getAndCheckFactory<ExtensionFilterFactory>(
@@ -117,7 +127,7 @@ bool DurationFilter::evaluate(const StreamInfo::StreamInfo& info, const Http::He
       std::chrono::duration_cast<std::chrono::milliseconds>(final.value()).count());
 }
 
-RuntimeFilter::RuntimeFilter(const envoy::config::filter::accesslog::v2::RuntimeFilter& config,
+RuntimeFilter::RuntimeFilter(const envoy::config::filter::accesslog::v3alpha::RuntimeFilter& config,
                              Runtime::Loader& runtime, Runtime::RandomGenerator& random)
     : runtime_(runtime), random_(random), runtime_key_(config.runtime_key()),
       percent_(config.percent_sampled()),
@@ -140,21 +150,22 @@ bool RuntimeFilter::evaluate(const StreamInfo::StreamInfo&, const Http::HeaderMa
       ProtobufPercentHelper::fractionalPercentDenominatorToInt(percent_.denominator()));
 }
 
-OperatorFilter::OperatorFilter(const Protobuf::RepeatedPtrField<
-                                   envoy::config::filter::accesslog::v2::AccessLogFilter>& configs,
-                               Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                               ProtobufMessage::ValidationVisitor& validation_visitor) {
+OperatorFilter::OperatorFilter(
+    const Protobuf::RepeatedPtrField<envoy::config::filter::accesslog::v3alpha::AccessLogFilter>&
+        configs,
+    Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+    ProtobufMessage::ValidationVisitor& validation_visitor) {
   for (const auto& config : configs) {
     filters_.emplace_back(FilterFactory::fromProto(config, runtime, random, validation_visitor));
   }
 }
 
-OrFilter::OrFilter(const envoy::config::filter::accesslog::v2::OrFilter& config,
+OrFilter::OrFilter(const envoy::config::filter::accesslog::v3alpha::OrFilter& config,
                    Runtime::Loader& runtime, Runtime::RandomGenerator& random,
                    ProtobufMessage::ValidationVisitor& validation_visitor)
     : OperatorFilter(config.filters(), runtime, random, validation_visitor) {}
 
-AndFilter::AndFilter(const envoy::config::filter::accesslog::v2::AndFilter& config,
+AndFilter::AndFilter(const envoy::config::filter::accesslog::v3alpha::AndFilter& config,
                      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
                      ProtobufMessage::ValidationVisitor& validation_visitor)
     : OperatorFilter(config.filters(), runtime, random, validation_visitor) {}
@@ -194,7 +205,7 @@ bool NotHealthCheckFilter::evaluate(const StreamInfo::StreamInfo& info, const Ht
   return !info.healthCheck();
 }
 
-HeaderFilter::HeaderFilter(const envoy::config::filter::accesslog::v2::HeaderFilter& config)
+HeaderFilter::HeaderFilter(const envoy::config::filter::accesslog::v3alpha::HeaderFilter& config)
     : header_data_(std::make_unique<Http::HeaderUtility::HeaderData>(config.header())) {}
 
 bool HeaderFilter::evaluate(const StreamInfo::StreamInfo&, const Http::HeaderMap& request_headers,
@@ -203,7 +214,7 @@ bool HeaderFilter::evaluate(const StreamInfo::StreamInfo&, const Http::HeaderMap
 }
 
 ResponseFlagFilter::ResponseFlagFilter(
-    const envoy::config::filter::accesslog::v2::ResponseFlagFilter& config) {
+    const envoy::config::filter::accesslog::v3alpha::ResponseFlagFilter& config) {
   for (int i = 0; i < config.flags_size(); i++) {
     absl::optional<StreamInfo::ResponseFlag> response_flag =
         StreamInfo::ResponseFlagUtils::toResponseFlag(config.flags(i));
@@ -222,7 +233,7 @@ bool ResponseFlagFilter::evaluate(const StreamInfo::StreamInfo& info, const Http
 }
 
 GrpcStatusFilter::GrpcStatusFilter(
-    const envoy::config::filter::accesslog::v2::GrpcStatusFilter& config) {
+    const envoy::config::filter::accesslog::v3alpha::GrpcStatusFilter& config) {
   for (int i = 0; i < config.statuses_size(); i++) {
     statuses_.insert(protoToGrpcStatus(config.statuses(i)));
   }
@@ -263,12 +274,12 @@ bool GrpcStatusFilter::evaluate(const StreamInfo::StreamInfo& info, const Http::
 }
 
 Grpc::Status::GrpcStatus GrpcStatusFilter::protoToGrpcStatus(
-    envoy::config::filter::accesslog::v2::GrpcStatusFilter_Status status) const {
+    envoy::config::filter::accesslog::v3alpha::GrpcStatusFilter::Status status) const {
   return static_cast<Grpc::Status::GrpcStatus>(status);
 }
 
 InstanceSharedPtr
-AccessLogFactory::fromProto(const envoy::config::filter::accesslog::v2::AccessLog& config,
+AccessLogFactory::fromProto(const envoy::config::filter::accesslog::v3alpha::AccessLog& config,
                             Server::Configuration::FactoryContext& context) {
   FilterPtr filter;
   if (config.has_filter()) {
diff --git a/source/common/access_log/access_log_impl.h b/source/common/access_log/access_log_impl.h
index fae56dcf0944..a0be72506fe2 100644
--- a/source/common/access_log/access_log_impl.h
+++ b/source/common/access_log/access_log_impl.h
@@ -6,10 +6,10 @@
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/server/access_log_config.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/grpc/status.h"
 #include "common/http/header_utility.h"
@@ -28,9 +28,10 @@ class FilterFactory {
   /**
    * Read a filter definition from proto and instantiate a concrete filter class.
    */
-  static FilterPtr fromProto(const envoy::config::filter::accesslog::v2::AccessLogFilter& config,
-                             Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                             ProtobufMessage::ValidationVisitor& validation_visitor);
+  static FilterPtr
+  fromProto(const envoy::config::filter::accesslog::v3alpha::AccessLogFilter& config,
+            Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+            ProtobufMessage::ValidationVisitor& validation_visitor);
 };
 
 /**
@@ -38,12 +39,12 @@ class FilterFactory {
  */
 class ComparisonFilter : public Filter {
 protected:
-  ComparisonFilter(const envoy::config::filter::accesslog::v2::ComparisonFilter& config,
+  ComparisonFilter(const envoy::config::filter::accesslog::v3alpha::ComparisonFilter& config,
                    Runtime::Loader& runtime);
 
   bool compareAgainstValue(uint64_t lhs);
 
-  envoy::config::filter::accesslog::v2::ComparisonFilter config_;
+  envoy::config::filter::accesslog::v3alpha::ComparisonFilter config_;
   Runtime::Loader& runtime_;
 };
 
@@ -52,7 +53,7 @@ class ComparisonFilter : public Filter {
  */
 class StatusCodeFilter : public ComparisonFilter {
 public:
-  StatusCodeFilter(const envoy::config::filter::accesslog::v2::StatusCodeFilter& config,
+  StatusCodeFilter(const envoy::config::filter::accesslog::v3alpha::StatusCodeFilter& config,
                    Runtime::Loader& runtime)
       : ComparisonFilter(config.comparison(), runtime) {}
 
@@ -67,7 +68,7 @@ class StatusCodeFilter : public ComparisonFilter {
  */
 class DurationFilter : public ComparisonFilter {
 public:
-  DurationFilter(const envoy::config::filter::accesslog::v2::DurationFilter& config,
+  DurationFilter(const envoy::config::filter::accesslog::v3alpha::DurationFilter& config,
                  Runtime::Loader& runtime)
       : ComparisonFilter(config.comparison(), runtime) {}
 
@@ -83,7 +84,7 @@ class DurationFilter : public ComparisonFilter {
 class OperatorFilter : public Filter {
 public:
   OperatorFilter(const Protobuf::RepeatedPtrField<
-                     envoy::config::filter::accesslog::v2::AccessLogFilter>& configs,
+                     envoy::config::filter::accesslog::v3alpha::AccessLogFilter>& configs,
                  Runtime::Loader& runtime, Runtime::RandomGenerator& random,
                  ProtobufMessage::ValidationVisitor& validation_visitor);
 
@@ -96,8 +97,8 @@ class OperatorFilter : public Filter {
  */
 class AndFilter : public OperatorFilter {
 public:
-  AndFilter(const envoy::config::filter::accesslog::v2::AndFilter& config, Runtime::Loader& runtime,
-            Runtime::RandomGenerator& random,
+  AndFilter(const envoy::config::filter::accesslog::v3alpha::AndFilter& config,
+            Runtime::Loader& runtime, Runtime::RandomGenerator& random,
             ProtobufMessage::ValidationVisitor& validation_visitor);
 
   // AccessLog::Filter
@@ -111,8 +112,8 @@ class AndFilter : public OperatorFilter {
  */
 class OrFilter : public OperatorFilter {
 public:
-  OrFilter(const envoy::config::filter::accesslog::v2::OrFilter& config, Runtime::Loader& runtime,
-           Runtime::RandomGenerator& random,
+  OrFilter(const envoy::config::filter::accesslog::v3alpha::OrFilter& config,
+           Runtime::Loader& runtime, Runtime::RandomGenerator& random,
            ProtobufMessage::ValidationVisitor& validation_visitor);
 
   // AccessLog::Filter
@@ -150,7 +151,7 @@ class TraceableRequestFilter : public Filter {
  */
 class RuntimeFilter : public Filter {
 public:
-  RuntimeFilter(const envoy::config::filter::accesslog::v2::RuntimeFilter& config,
+  RuntimeFilter(const envoy::config::filter::accesslog::v3alpha::RuntimeFilter& config,
                 Runtime::Loader& runtime, Runtime::RandomGenerator& random);
 
   // AccessLog::Filter
@@ -162,7 +163,7 @@ class RuntimeFilter : public Filter {
   Runtime::Loader& runtime_;
   Runtime::RandomGenerator& random_;
   const std::string runtime_key_;
-  const envoy::type::FractionalPercent percent_;
+  const envoy::type::v3alpha::FractionalPercent percent_;
   const bool use_independent_randomness_;
 };
 
@@ -171,7 +172,7 @@ class RuntimeFilter : public Filter {
  */
 class HeaderFilter : public Filter {
 public:
-  HeaderFilter(const envoy::config::filter::accesslog::v2::HeaderFilter& config);
+  HeaderFilter(const envoy::config::filter::accesslog::v3alpha::HeaderFilter& config);
 
   // AccessLog::Filter
   bool evaluate(const StreamInfo::StreamInfo& info, const Http::HeaderMap& request_headers,
@@ -187,7 +188,7 @@ class HeaderFilter : public Filter {
  */
 class ResponseFlagFilter : public Filter {
 public:
-  ResponseFlagFilter(const envoy::config::filter::accesslog::v2::ResponseFlagFilter& config);
+  ResponseFlagFilter(const envoy::config::filter::accesslog::v3alpha::ResponseFlagFilter& config);
 
   // AccessLog::Filter
   bool evaluate(const StreamInfo::StreamInfo& info, const Http::HeaderMap& request_headers,
@@ -208,7 +209,7 @@ class GrpcStatusFilter : public Filter {
   using GrpcStatusHashSet =
       std::unordered_set<Grpc::Status::GrpcStatus, absl::Hash<Grpc::Status::GrpcStatus>>;
 
-  GrpcStatusFilter(const envoy::config::filter::accesslog::v2::GrpcStatusFilter& config);
+  GrpcStatusFilter(const envoy::config::filter::accesslog::v3alpha::GrpcStatusFilter& config);
 
   // AccessLog::Filter
   bool evaluate(const StreamInfo::StreamInfo& info, const Http::HeaderMap& request_headers,
@@ -223,8 +224,8 @@ class GrpcStatusFilter : public Filter {
    * Converts a Protobuf representation of a gRPC status into the equivalent code version of a gRPC
    * status.
    */
-  Grpc::Status::GrpcStatus
-  protoToGrpcStatus(envoy::config::filter::accesslog::v2::GrpcStatusFilter_Status status) const;
+  Grpc::Status::GrpcStatus protoToGrpcStatus(
+      envoy::config::filter::accesslog::v3alpha::GrpcStatusFilter::Status status) const;
 };
 
 /**
@@ -244,7 +245,7 @@ class ExtensionFilterFactory {
    * @return an instance of extension filter implementation from a config proto.
    */
   virtual FilterPtr
-  createFilter(const envoy::config::filter::accesslog::v2::ExtensionFilter& config,
+  createFilter(const envoy::config::filter::accesslog::v3alpha::ExtensionFilter& config,
                Runtime::Loader& runtime, Runtime::RandomGenerator& random) PURE;
 
   /**
@@ -276,8 +277,9 @@ class AccessLogFactory {
   /**
    * Read a filter definition from proto and instantiate an Instance.
    */
-  static InstanceSharedPtr fromProto(const envoy::config::filter::accesslog::v2::AccessLog& config,
-                                     Server::Configuration::FactoryContext& context);
+  static InstanceSharedPtr
+  fromProto(const envoy::config::filter::accesslog::v3alpha::AccessLog& config,
+            Server::Configuration::FactoryContext& context);
 };
 
 } // namespace AccessLog
diff --git a/source/common/common/BUILD b/source/common/common/BUILD
index 389cbf2eec35..f0d5de500ff5 100644
--- a/source/common/common/BUILD
+++ b/source/common/common/BUILD
@@ -180,8 +180,8 @@ envoy_cc_library(
         "//source/common/common:regex_lib",
         "//source/common/config:metadata_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -194,7 +194,7 @@ envoy_cc_library(
         "//include/envoy/common:regex_interface",
         "//source/common/protobuf:utility_lib",
         "@com_googlesource_code_re2//:re2",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/common/matchers.cc b/source/common/common/matchers.cc
index cce97a2636e0..0814b41c2118 100644
--- a/source/common/common/matchers.cc
+++ b/source/common/common/matchers.cc
@@ -1,10 +1,10 @@
 #include "common/common/matchers.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/type/matcher/metadata.pb.h"
-#include "envoy/type/matcher/number.pb.h"
-#include "envoy/type/matcher/string.pb.h"
-#include "envoy/type/matcher/value.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/type/matcher/v3alpha/metadata.pb.h"
+#include "envoy/type/matcher/v3alpha/number.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
+#include "envoy/type/matcher/v3alpha/value.pb.h"
 
 #include "common/common/regex.h"
 #include "common/config/metadata.h"
@@ -14,19 +14,20 @@
 namespace Envoy {
 namespace Matchers {
 
-ValueMatcherConstSharedPtr ValueMatcher::create(const envoy::type::matcher::ValueMatcher& v) {
+ValueMatcherConstSharedPtr
+ValueMatcher::create(const envoy::type::matcher::v3alpha::ValueMatcher& v) {
   switch (v.match_pattern_case()) {
-  case envoy::type::matcher::ValueMatcher::kNullMatch:
+  case envoy::type::matcher::v3alpha::ValueMatcher::MatchPatternCase::kNullMatch:
     return std::make_shared<const NullMatcher>();
-  case envoy::type::matcher::ValueMatcher::kDoubleMatch:
+  case envoy::type::matcher::v3alpha::ValueMatcher::MatchPatternCase::kDoubleMatch:
     return std::make_shared<const DoubleMatcher>(v.double_match());
-  case envoy::type::matcher::ValueMatcher::kStringMatch:
+  case envoy::type::matcher::v3alpha::ValueMatcher::MatchPatternCase::kStringMatch:
     return std::make_shared<const StringMatcherImpl>(v.string_match());
-  case envoy::type::matcher::ValueMatcher::kBoolMatch:
+  case envoy::type::matcher::v3alpha::ValueMatcher::MatchPatternCase::kBoolMatch:
     return std::make_shared<const BoolMatcher>(v.bool_match());
-  case envoy::type::matcher::ValueMatcher::kPresentMatch:
+  case envoy::type::matcher::v3alpha::ValueMatcher::MatchPatternCase::kPresentMatch:
     return std::make_shared<const PresentMatcher>(v.present_match());
-  case envoy::type::matcher::ValueMatcher::kListMatch:
+  case envoy::type::matcher::v3alpha::ValueMatcher::MatchPatternCase::kListMatch:
     return std::make_shared<const ListMatcher>(v.list_match());
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
@@ -52,20 +53,23 @@ bool DoubleMatcher::match(const ProtobufWkt::Value& value) const {
 
   const double v = value.number_value();
   switch (matcher_.match_pattern_case()) {
-  case envoy::type::matcher::DoubleMatcher::kRange:
+  case envoy::type::matcher::v3alpha::DoubleMatcher::MatchPatternCase::kRange:
     return matcher_.range().start() <= v && v < matcher_.range().end();
-  case envoy::type::matcher::DoubleMatcher::kExact:
+  case envoy::type::matcher::v3alpha::DoubleMatcher::MatchPatternCase::kExact:
     return matcher_.exact() == v;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
   };
 }
 
-StringMatcherImpl::StringMatcherImpl(const envoy::type::matcher::StringMatcher& matcher)
+StringMatcherImpl::StringMatcherImpl(const envoy::type::matcher::v3alpha::StringMatcher& matcher)
     : matcher_(matcher) {
-  if (matcher.match_pattern_case() == envoy::type::matcher::StringMatcher::kRegex) {
-    regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(matcher_.regex());
-  } else if (matcher.match_pattern_case() == envoy::type::matcher::StringMatcher::kSafeRegex) {
+  if (matcher.match_pattern_case() ==
+      envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kHiddenEnvoyDeprecatedRegex) {
+    regex_ =
+        Regex::Utility::parseStdRegexAsCompiledMatcher(matcher_.hidden_envoy_deprecated_regex());
+  } else if (matcher.match_pattern_case() ==
+             envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kSafeRegex) {
     regex_ = Regex::Utility::parseRegex(matcher_.safe_regex());
   }
 }
@@ -80,14 +84,14 @@ bool StringMatcherImpl::match(const ProtobufWkt::Value& value) const {
 
 bool StringMatcherImpl::match(const absl::string_view value) const {
   switch (matcher_.match_pattern_case()) {
-  case envoy::type::matcher::StringMatcher::kExact:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kExact:
     return matcher_.exact() == value;
-  case envoy::type::matcher::StringMatcher::kPrefix:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kPrefix:
     return absl::StartsWith(value, matcher_.prefix());
-  case envoy::type::matcher::StringMatcher::kSuffix:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kSuffix:
     return absl::EndsWith(value, matcher_.suffix());
-  case envoy::type::matcher::StringMatcher::kRegex:
-  case envoy::type::matcher::StringMatcher::kSafeRegex:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kHiddenEnvoyDeprecatedRegex:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kSafeRegex:
     return regex_->match(value);
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
@@ -102,20 +106,21 @@ bool LowerCaseStringMatcher::match(const ProtobufWkt::Value& value) const {
   return matcher_.match(value);
 }
 
-envoy::type::matcher::StringMatcher
-LowerCaseStringMatcher::toLowerCase(const envoy::type::matcher::StringMatcher& matcher) {
-  envoy::type::matcher::StringMatcher lowercase;
+envoy::type::matcher::v3alpha::StringMatcher
+LowerCaseStringMatcher::toLowerCase(const envoy::type::matcher::v3alpha::StringMatcher& matcher) {
+  envoy::type::matcher::v3alpha::StringMatcher lowercase;
   switch (matcher.match_pattern_case()) {
-  case envoy::type::matcher::StringMatcher::kRegex:
-    lowercase.set_regex(StringUtil::toLower(matcher.regex()));
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kHiddenEnvoyDeprecatedRegex:
+    lowercase.set_hidden_envoy_deprecated_regex(
+        StringUtil::toLower(matcher.hidden_envoy_deprecated_regex()));
     break;
-  case envoy::type::matcher::StringMatcher::kExact:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kExact:
     lowercase.set_exact(StringUtil::toLower(matcher.exact()));
     break;
-  case envoy::type::matcher::StringMatcher::kPrefix:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kPrefix:
     lowercase.set_prefix(StringUtil::toLower(matcher.prefix()));
     break;
-  case envoy::type::matcher::StringMatcher::kSuffix:
+  case envoy::type::matcher::v3alpha::StringMatcher::MatchPatternCase::kSuffix:
     lowercase.set_suffix(StringUtil::toLower(matcher.suffix()));
     break;
   default:
@@ -124,8 +129,10 @@ LowerCaseStringMatcher::toLowerCase(const envoy::type::matcher::StringMatcher& m
   return lowercase;
 }
 
-ListMatcher::ListMatcher(const envoy::type::matcher::ListMatcher& matcher) : matcher_(matcher) {
-  ASSERT(matcher_.match_pattern_case() == envoy::type::matcher::ListMatcher::kOneOf);
+ListMatcher::ListMatcher(const envoy::type::matcher::v3alpha::ListMatcher& matcher)
+    : matcher_(matcher) {
+  ASSERT(matcher_.match_pattern_case() ==
+         envoy::type::matcher::v3alpha::ListMatcher::MatchPatternCase::kOneOf);
 
   oneof_value_matcher_ = ValueMatcher::create(matcher_.one_of());
 }
@@ -145,7 +152,7 @@ bool ListMatcher::match(const ProtobufWkt::Value& value) const {
   return false;
 }
 
-MetadataMatcher::MetadataMatcher(const envoy::type::matcher::MetadataMatcher& matcher)
+MetadataMatcher::MetadataMatcher(const envoy::type::matcher::v3alpha::MetadataMatcher& matcher)
     : matcher_(matcher) {
   for (const auto& seg : matcher.path()) {
     path_.push_back(seg.key());
@@ -154,7 +161,7 @@ MetadataMatcher::MetadataMatcher(const envoy::type::matcher::MetadataMatcher& ma
   value_matcher_ = ValueMatcher::create(v);
 }
 
-bool MetadataMatcher::match(const envoy::api::v2::core::Metadata& metadata) const {
+bool MetadataMatcher::match(const envoy::config::core::v3alpha::Metadata& metadata) const {
   const auto& value = Envoy::Config::Metadata::metadataValue(metadata, matcher_.filter(), path_);
   return value_matcher_ && value_matcher_->match(value);
 }
diff --git a/source/common/common/matchers.h b/source/common/common/matchers.h
index bb89941f3d0e..87c7d0f3eeb4 100644
--- a/source/common/common/matchers.h
+++ b/source/common/common/matchers.h
@@ -2,13 +2,13 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/matchers.h"
 #include "envoy/common/regex.h"
-#include "envoy/type/matcher/metadata.pb.h"
-#include "envoy/type/matcher/number.pb.h"
-#include "envoy/type/matcher/string.pb.h"
-#include "envoy/type/matcher/value.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/type/matcher/v3alpha/metadata.pb.h"
+#include "envoy/type/matcher/v3alpha/number.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
+#include "envoy/type/matcher/v3alpha/value.pb.h"
 
 #include "common/common/utility.h"
 #include "common/protobuf/protobuf.h"
@@ -31,7 +31,8 @@ class ValueMatcher {
   /**
    * Create the matcher object.
    */
-  static ValueMatcherConstSharedPtr create(const envoy::type::matcher::ValueMatcher& value);
+  static ValueMatcherConstSharedPtr
+  create(const envoy::type::matcher::v3alpha::ValueMatcher& value);
 };
 
 class NullMatcher : public ValueMatcher {
@@ -64,29 +65,29 @@ class PresentMatcher : public ValueMatcher {
 
 class DoubleMatcher : public ValueMatcher {
 public:
-  DoubleMatcher(const envoy::type::matcher::DoubleMatcher& matcher) : matcher_(matcher) {}
+  DoubleMatcher(const envoy::type::matcher::v3alpha::DoubleMatcher& matcher) : matcher_(matcher) {}
 
   bool match(const ProtobufWkt::Value& value) const override;
 
 private:
-  const envoy::type::matcher::DoubleMatcher matcher_;
+  const envoy::type::matcher::v3alpha::DoubleMatcher matcher_;
 };
 
 class StringMatcherImpl : public ValueMatcher, public StringMatcher {
 public:
-  explicit StringMatcherImpl(const envoy::type::matcher::StringMatcher& matcher);
+  explicit StringMatcherImpl(const envoy::type::matcher::v3alpha::StringMatcher& matcher);
 
   bool match(const absl::string_view value) const override;
   bool match(const ProtobufWkt::Value& value) const override;
 
 private:
-  const envoy::type::matcher::StringMatcher matcher_;
+  const envoy::type::matcher::v3alpha::StringMatcher matcher_;
   Regex::CompiledMatcherPtr regex_;
 };
 
 class LowerCaseStringMatcher : public ValueMatcher {
 public:
-  LowerCaseStringMatcher(const envoy::type::matcher::StringMatcher& matcher)
+  LowerCaseStringMatcher(const envoy::type::matcher::v3alpha::StringMatcher& matcher)
       : matcher_(toLowerCase(matcher)) {}
 
   bool match(const absl::string_view value) const;
@@ -94,8 +95,8 @@ class LowerCaseStringMatcher : public ValueMatcher {
   bool match(const ProtobufWkt::Value& value) const override;
 
 private:
-  envoy::type::matcher::StringMatcher
-  toLowerCase(const envoy::type::matcher::StringMatcher& matcher);
+  envoy::type::matcher::v3alpha::StringMatcher
+  toLowerCase(const envoy::type::matcher::v3alpha::StringMatcher& matcher);
 
   const StringMatcherImpl matcher_;
 };
@@ -104,29 +105,29 @@ using LowerCaseStringMatcherPtr = std::unique_ptr<LowerCaseStringMatcher>;
 
 class ListMatcher : public ValueMatcher {
 public:
-  ListMatcher(const envoy::type::matcher::ListMatcher& matcher);
+  ListMatcher(const envoy::type::matcher::v3alpha::ListMatcher& matcher);
 
   bool match(const ProtobufWkt::Value& value) const override;
 
 private:
-  const envoy::type::matcher::ListMatcher matcher_;
+  const envoy::type::matcher::v3alpha::ListMatcher matcher_;
 
   ValueMatcherConstSharedPtr oneof_value_matcher_;
 };
 
 class MetadataMatcher {
 public:
-  MetadataMatcher(const envoy::type::matcher::MetadataMatcher& matcher);
+  MetadataMatcher(const envoy::type::matcher::v3alpha::MetadataMatcher& matcher);
 
   /**
    * Check whether the metadata is matched to the matcher.
    * @param metadata the metadata to check.
    * @return true if it's matched otherwise false.
    */
-  bool match(const envoy::api::v2::core::Metadata& metadata) const;
+  bool match(const envoy::config::core::v3alpha::Metadata& metadata) const;
 
 private:
-  const envoy::type::matcher::MetadataMatcher matcher_;
+  const envoy::type::matcher::v3alpha::MetadataMatcher matcher_;
   std::vector<std::string> path_;
 
   ValueMatcherConstSharedPtr value_matcher_;
diff --git a/source/common/common/regex.cc b/source/common/common/regex.cc
index 50a37431da5e..881e3947cb90 100644
--- a/source/common/common/regex.cc
+++ b/source/common/common/regex.cc
@@ -1,7 +1,7 @@
 #include "common/common/regex.h"
 
 #include "envoy/common/exception.h"
-#include "envoy/type/matcher/regex.pb.h"
+#include "envoy/type/matcher/v3alpha/regex.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -28,7 +28,7 @@ class CompiledStdMatcher : public CompiledMatcher {
 
 class CompiledGoogleReMatcher : public CompiledMatcher {
 public:
-  CompiledGoogleReMatcher(const envoy::type::matcher::RegexMatcher& config)
+  CompiledGoogleReMatcher(const envoy::type::matcher::v3alpha::RegexMatcher& config)
       : regex_(config.regex(), re2::RE2::Quiet) {
     if (!regex_.ok()) {
       throw EnvoyException(regex_.error());
@@ -54,7 +54,7 @@ class CompiledGoogleReMatcher : public CompiledMatcher {
 
 } // namespace
 
-CompiledMatcherPtr Utility::parseRegex(const envoy::type::matcher::RegexMatcher& matcher) {
+CompiledMatcherPtr Utility::parseRegex(const envoy::type::matcher::v3alpha::RegexMatcher& matcher) {
   // Google Re is the only currently supported engine.
   ASSERT(matcher.has_google_re2());
   return std::make_unique<CompiledGoogleReMatcher>(matcher);
diff --git a/source/common/common/regex.h b/source/common/common/regex.h
index a88c4739addb..eb8e0d2108f7 100644
--- a/source/common/common/regex.h
+++ b/source/common/common/regex.h
@@ -4,7 +4,7 @@
 #include <regex>
 
 #include "envoy/common/regex.h"
-#include "envoy/type/matcher/regex.pb.h"
+#include "envoy/type/matcher/v3alpha/regex.pb.h"
 
 namespace Envoy {
 namespace Regex {
@@ -37,7 +37,7 @@ class Utility {
   /**
    * Construct a compiled regex matcher from a match config.
    */
-  static CompiledMatcherPtr parseRegex(const envoy::type::matcher::RegexMatcher& matcher);
+  static CompiledMatcherPtr parseRegex(const envoy::type::matcher::v3alpha::RegexMatcher& matcher);
 };
 
 } // namespace Regex
diff --git a/source/common/config/BUILD b/source/common/config/BUILD
index 3fa7358bb8de..a2f4e3ac0e33 100644
--- a/source/common/config/BUILD
+++ b/source/common/config/BUILD
@@ -55,7 +55,7 @@ envoy_cc_library(
         "//source/common/common:empty_string",
         "//source/common/init:target_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -75,7 +75,7 @@ envoy_cc_library(
         "//source/common/common:minimal_logger_lib",
         "//source/common/common:token_bucket_impl_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -93,7 +93,7 @@ envoy_cc_library(
         "//source/common/common:token_bucket_impl_lib",
         "//source/common/grpc:common_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -110,7 +110,7 @@ envoy_cc_library(
         "//source/common/protobuf",
         "//source/common/protobuf:message_validator_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -143,7 +143,7 @@ envoy_cc_library(
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/common:minimal_logger_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -185,7 +185,7 @@ envoy_cc_library(
         ":watch_map_lib",
         "//include/envoy/event:dispatcher_interface",
         "//include/envoy/grpc:async_client_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -206,7 +206,7 @@ envoy_cc_library(
         "//source/common/http:rest_api_fetcher_lib",
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -220,7 +220,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/type/metadata/v2:pkg_cc_proto",
     ],
 )
@@ -239,8 +239,10 @@ envoy_cc_library(
     name = "protobuf_link_hacks",
     hdrs = ["protobuf_link_hacks.h"],
     deps = [
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/ratelimit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/ratelimit/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/runtime/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/secret/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -253,7 +255,7 @@ envoy_cc_library(
         "//source/common/common:hex_lib",
         "//source/common/crypto:utility_lib",
         "//source/common/http:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -267,7 +269,7 @@ envoy_cc_library(
     name = "runtime_utility_lib",
     srcs = ["runtime_utility.cc"],
     hdrs = ["runtime_utility.h"],
-    deps = ["@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto"],
+    deps = ["@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto"],
 )
 
 envoy_cc_library(
@@ -286,7 +288,7 @@ envoy_cc_library(
         "//include/envoy/config:subscription_interface",
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -330,10 +332,10 @@ envoy_cc_library(
         "//source/common/stats:stats_matcher_lib",
         "//source/common/stats:tag_producer_lib",
         "@com_github_cncf_udpa//udpa/type/v1:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -356,7 +358,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/common:minimal_logger_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/config/datasource.cc b/source/common/config/datasource.cc
index b527ec88c6d6..51f43975c1dc 100644
--- a/source/common/config/datasource.cc
+++ b/source/common/config/datasource.cc
@@ -1,6 +1,6 @@
 #include "common/config/datasource.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "fmt/format.h"
 
@@ -8,13 +8,14 @@ namespace Envoy {
 namespace Config {
 namespace DataSource {
 
-std::string read(const envoy::api::v2::core::DataSource& source, bool allow_empty, Api::Api& api) {
+std::string read(const envoy::config::core::v3alpha::DataSource& source, bool allow_empty,
+                 Api::Api& api) {
   switch (source.specifier_case()) {
-  case envoy::api::v2::core::DataSource::kFilename:
+  case envoy::config::core::v3alpha::DataSource::SpecifierCase::kFilename:
     return api.fileSystem().fileReadToEnd(source.filename());
-  case envoy::api::v2::core::DataSource::kInlineBytes:
+  case envoy::config::core::v3alpha::DataSource::SpecifierCase::kInlineBytes:
     return source.inline_bytes();
-  case envoy::api::v2::core::DataSource::kInlineString:
+  case envoy::config::core::v3alpha::DataSource::SpecifierCase::kInlineString:
     return source.inline_string();
   default:
     if (!allow_empty) {
@@ -25,8 +26,9 @@ std::string read(const envoy::api::v2::core::DataSource& source, bool allow_empt
   }
 }
 
-absl::optional<std::string> getPath(const envoy::api::v2::core::DataSource& source) {
-  return source.specifier_case() == envoy::api::v2::core::DataSource::kFilename
+absl::optional<std::string> getPath(const envoy::config::core::v3alpha::DataSource& source) {
+  return source.specifier_case() ==
+                 envoy::config::core::v3alpha::DataSource::SpecifierCase::kFilename
              ? absl::make_optional(source.filename())
              : absl::nullopt;
 }
diff --git a/source/common/config/datasource.h b/source/common/config/datasource.h
index be0313b4bfb7..b8c49cd68951 100644
--- a/source/common/config/datasource.h
+++ b/source/common/config/datasource.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/init/manager.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -24,13 +24,14 @@ namespace DataSource {
  * @return std::string with DataSource contents.
  * @throw EnvoyException if no DataSource case is specified and !allow_empty.
  */
-std::string read(const envoy::api::v2::core::DataSource& source, bool allow_empty, Api::Api& api);
+std::string read(const envoy::config::core::v3alpha::DataSource& source, bool allow_empty,
+                 Api::Api& api);
 
 /**
  * @param source data source.
  * @return absl::optional<std::string> path to DataSource if a filename, otherwise absl::nullopt.
  */
-absl::optional<std::string> getPath(const envoy::api::v2::core::DataSource& source);
+absl::optional<std::string> getPath(const envoy::config::core::v3alpha::DataSource& source);
 
 /**
  * Callback for async data source.
@@ -39,8 +40,9 @@ using AsyncDataSourceCb = std::function<void(const std::string&)>;
 
 class LocalAsyncDataProvider {
 public:
-  LocalAsyncDataProvider(Init::Manager& manager, const envoy::api::v2::core::DataSource& source,
-                         bool allow_empty, Api::Api& api, AsyncDataSourceCb&& callback)
+  LocalAsyncDataProvider(Init::Manager& manager,
+                         const envoy::config::core::v3alpha::DataSource& source, bool allow_empty,
+                         Api::Api& api, AsyncDataSourceCb&& callback)
       : init_target_("LocalAsyncDataProvider", [this, &source, allow_empty, &api, callback]() {
           callback(DataSource::read(source, allow_empty, api));
           init_target_.ready();
@@ -60,8 +62,8 @@ class RemoteAsyncDataProvider : public Config::DataFetcher::RemoteDataFetcherCal
                                 public Logger::Loggable<Logger::Id::config> {
 public:
   RemoteAsyncDataProvider(Upstream::ClusterManager& cm, Init::Manager& manager,
-                          const envoy::api::v2::core::RemoteDataSource& source, bool allow_empty,
-                          AsyncDataSourceCb&& callback)
+                          const envoy::config::core::v3alpha::RemoteDataSource& source,
+                          bool allow_empty, AsyncDataSourceCb&& callback)
       : allow_empty_(allow_empty), callback_(std::move(callback)),
         fetcher_(std::make_unique<Config::DataFetcher::RemoteDataFetcher>(cm, source.http_uri(),
                                                                           source.sha256(), *this)),
diff --git a/source/common/config/delta_subscription_impl.cc b/source/common/config/delta_subscription_impl.cc
index 537929bc5f34..56835f1387ef 100644
--- a/source/common/config/delta_subscription_impl.cc
+++ b/source/common/config/delta_subscription_impl.cc
@@ -1,6 +1,6 @@
 #include "common/config/delta_subscription_impl.h"
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 namespace Envoy {
 namespace Config {
@@ -52,7 +52,7 @@ void DeltaSubscriptionImpl::onConfigUpdate(
 }
 
 void DeltaSubscriptionImpl::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& system_version_info) {
   stats_.update_attempt_.inc();
diff --git a/source/common/config/delta_subscription_impl.h b/source/common/config/delta_subscription_impl.h
index cbc53fb25484..90d62be087bb 100644
--- a/source/common/config/delta_subscription_impl.h
+++ b/source/common/config/delta_subscription_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/config/subscription.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/new_grpc_mux_impl.h"
 #include "common/config/utility.h"
@@ -48,9 +48,11 @@ class DeltaSubscriptionImpl : public Subscription, public SubscriptionCallbacks
   // Config::SubscriptionCallbacks (all pass through to callbacks_!)
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& system_version_info) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string& system_version_info) override;
   void onConfigUpdateFailed(ConfigUpdateFailureReason reason, const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override;
 
diff --git a/source/common/config/delta_subscription_state.cc b/source/common/config/delta_subscription_state.cc
index cebfbb3cc5c7..5ae88beaae89 100644
--- a/source/common/config/delta_subscription_state.cc
+++ b/source/common/config/delta_subscription_state.cc
@@ -1,6 +1,6 @@
 #include "common/config/delta_subscription_state.h"
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/hash.h"
@@ -53,8 +53,8 @@ bool DeltaSubscriptionState::subscriptionUpdatePending() const {
          !any_request_sent_yet_in_current_stream_;
 }
 
-UpdateAck
-DeltaSubscriptionState::handleResponse(const envoy::api::v2::DeltaDiscoveryResponse& message) {
+UpdateAck DeltaSubscriptionState::handleResponse(
+    const envoy::service::discovery::v3alpha::DeltaDiscoveryResponse& message) {
   // We *always* copy the response's nonce into the next request, even if we're going to make that
   // request a NACK by setting error_detail.
   UpdateAck ack(message.nonce(), type_url_);
@@ -67,7 +67,7 @@ DeltaSubscriptionState::handleResponse(const envoy::api::v2::DeltaDiscoveryRespo
 }
 
 void DeltaSubscriptionState::handleGoodResponse(
-    const envoy::api::v2::DeltaDiscoveryResponse& message) {
+    const envoy::service::discovery::v3alpha::DeltaDiscoveryResponse& message) {
   disableInitFetchTimeoutTimer();
   absl::flat_hash_set<std::string> names_added_removed;
   for (const auto& resource : message.resources()) {
@@ -124,8 +124,9 @@ void DeltaSubscriptionState::handleEstablishmentFailure() {
                                   nullptr);
 }
 
-envoy::api::v2::DeltaDiscoveryRequest DeltaSubscriptionState::getNextRequestAckless() {
-  envoy::api::v2::DeltaDiscoveryRequest request;
+envoy::service::discovery::v3alpha::DeltaDiscoveryRequest
+DeltaSubscriptionState::getNextRequestAckless() {
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest request;
   if (!any_request_sent_yet_in_current_stream_) {
     any_request_sent_yet_in_current_stream_ = true;
     // initial_resource_versions "must be populated for first request in a stream".
@@ -156,9 +157,9 @@ envoy::api::v2::DeltaDiscoveryRequest DeltaSubscriptionState::getNextRequestAckl
   return request;
 }
 
-envoy::api::v2::DeltaDiscoveryRequest
+envoy::service::discovery::v3alpha::DeltaDiscoveryRequest
 DeltaSubscriptionState::getNextRequestWithAck(const UpdateAck& ack) {
-  envoy::api::v2::DeltaDiscoveryRequest request = getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest request = getNextRequestAckless();
   request.set_response_nonce(ack.nonce_);
   if (ack.error_detail_.code() != Grpc::Status::WellKnownGrpcStatus::Ok) {
     // Don't needlessly make the field present-but-empty if status is ok.
diff --git a/source/common/config/delta_subscription_state.h b/source/common/config/delta_subscription_state.h
index 6477bdd01496..3a275e169f37 100644
--- a/source/common/config/delta_subscription_state.h
+++ b/source/common/config/delta_subscription_state.h
@@ -1,10 +1,10 @@
 #pragma once
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/grpc/status.h"
 #include "envoy/local_info/local_info.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/logger.h"
@@ -33,21 +33,24 @@ class DeltaSubscriptionState : public Logger::Loggable<Logger::Id::config> {
 
   void markStreamFresh() { any_request_sent_yet_in_current_stream_ = false; }
 
-  UpdateAck handleResponse(const envoy::api::v2::DeltaDiscoveryResponse& message);
+  UpdateAck
+  handleResponse(const envoy::service::discovery::v3alpha::DeltaDiscoveryResponse& message);
 
   void handleEstablishmentFailure();
 
   // Returns the next gRPC request proto to be sent off to the server, based on this object's
   // understanding of the current protocol state, and new resources that Envoy wants to request.
-  envoy::api::v2::DeltaDiscoveryRequest getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest getNextRequestAckless();
   // The WithAck version first calls the Ack-less version, then adds in the passed-in ack.
-  envoy::api::v2::DeltaDiscoveryRequest getNextRequestWithAck(const UpdateAck& ack);
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest
+  getNextRequestWithAck(const UpdateAck& ack);
 
   DeltaSubscriptionState(const DeltaSubscriptionState&) = delete;
   DeltaSubscriptionState& operator=(const DeltaSubscriptionState&) = delete;
 
 private:
-  void handleGoodResponse(const envoy::api::v2::DeltaDiscoveryResponse& message);
+  void
+  handleGoodResponse(const envoy::service::discovery::v3alpha::DeltaDiscoveryResponse& message);
   void handleBadResponse(const EnvoyException& e, UpdateAck& ack);
   void disableInitFetchTimeoutTimer();
 
diff --git a/source/common/config/filesystem_subscription_impl.cc b/source/common/config/filesystem_subscription_impl.cc
index 83d060a53871..6c8d9ee60431 100644
--- a/source/common/config/filesystem_subscription_impl.cc
+++ b/source/common/config/filesystem_subscription_impl.cc
@@ -1,6 +1,6 @@
 #include "common/config/filesystem_subscription_impl.h"
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/macros.h"
 #include "common/config/utility.h"
@@ -46,7 +46,7 @@ void FilesystemSubscriptionImpl::refresh() {
   ENVOY_LOG(debug, "Filesystem config refresh for {}", path_);
   stats_.update_attempt_.inc();
   bool config_update_available = false;
-  envoy::api::v2::DiscoveryResponse message;
+  envoy::service::discovery::v3alpha::DiscoveryResponse message;
   try {
     MessageUtil::loadFromFile(path_, message, validation_visitor_, api_);
     config_update_available = true;
diff --git a/source/common/config/grpc_mux_impl.cc b/source/common/config/grpc_mux_impl.cc
index f1d4dc1c7b0f..a14eb0056297 100644
--- a/source/common/config/grpc_mux_impl.cc
+++ b/source/common/config/grpc_mux_impl.cc
@@ -2,7 +2,7 @@
 
 #include <unordered_set>
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/utility.h"
 #include "common/protobuf/protobuf.h"
@@ -129,7 +129,7 @@ bool GrpcMuxImpl::paused(const std::string& type_url) const {
 }
 
 void GrpcMuxImpl::onDiscoveryResponse(
-    std::unique_ptr<envoy::api::v2::DiscoveryResponse>&& message) {
+    std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse>&& message) {
   const std::string& type_url = message->type_url();
   ENVOY_LOG(debug, "Received gRPC message for {} at version {}", type_url, message->version_info());
   if (api_state_.count(type_url) == 0) {
diff --git a/source/common/config/grpc_mux_impl.h b/source/common/config/grpc_mux_impl.h
index d37826a4a871..075943a604e5 100644
--- a/source/common/config/grpc_mux_impl.h
+++ b/source/common/config/grpc_mux_impl.h
@@ -3,12 +3,12 @@
 #include <queue>
 #include <unordered_map>
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/common/time.h"
 #include "envoy/config/grpc_mux.h"
 #include "envoy/config/subscription.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/grpc/status.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "common/common/cleanup.h"
@@ -22,9 +22,10 @@ namespace Config {
 /**
  * ADS API implementation that fetches via gRPC.
  */
-class GrpcMuxImpl : public GrpcMux,
-                    public GrpcStreamCallbacks<envoy::api::v2::DiscoveryResponse>,
-                    public Logger::Loggable<Logger::Id::config> {
+class GrpcMuxImpl
+    : public GrpcMux,
+      public GrpcStreamCallbacks<envoy::service::discovery::v3alpha::DiscoveryResponse>,
+      public Logger::Loggable<Logger::Id::config> {
 public:
   GrpcMuxImpl(const LocalInfo::LocalInfo& local_info, Grpc::RawAsyncClientPtr async_client,
               Event::Dispatcher& dispatcher, const Protobuf::MethodDescriptor& service_method,
@@ -49,17 +50,20 @@ class GrpcMuxImpl : public GrpcMux,
   }
   void removeWatch(const std::string&, Watch*) override { NOT_IMPLEMENTED_GCOVR_EXCL_LINE; }
 
-  void handleDiscoveryResponse(std::unique_ptr<envoy::api::v2::DiscoveryResponse>&& message);
+  void handleDiscoveryResponse(
+      std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse>&& message);
 
   void sendDiscoveryRequest(const std::string& type_url);
 
   // Config::GrpcStreamCallbacks
   void onStreamEstablished() override;
   void onEstablishmentFailure() override;
-  void onDiscoveryResponse(std::unique_ptr<envoy::api::v2::DiscoveryResponse>&& message) override;
+  void onDiscoveryResponse(
+      std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse>&& message) override;
   void onWriteable() override;
 
-  GrpcStream<envoy::api::v2::DiscoveryRequest, envoy::api::v2::DiscoveryResponse>&
+  GrpcStream<envoy::service::discovery::v3alpha::DiscoveryRequest,
+             envoy::service::discovery::v3alpha::DiscoveryResponse>&
   grpcStreamForTest() {
     return grpc_stream_;
   }
@@ -102,7 +106,7 @@ class GrpcMuxImpl : public GrpcMux,
     // Watches on the returned resources for the API;
     std::list<GrpcMuxWatchImpl*> watches_;
     // Current DiscoveryRequest for API.
-    envoy::api::v2::DiscoveryRequest request_;
+    envoy::service::discovery::v3alpha::DiscoveryRequest request_;
     // Paused via pause()?
     bool paused_{};
     // Was a DiscoveryRequest elided during a pause?
@@ -115,7 +119,9 @@ class GrpcMuxImpl : public GrpcMux,
   void queueDiscoveryRequest(const std::string& queue_item);
   void clearRequestQueue();
 
-  GrpcStream<envoy::api::v2::DiscoveryRequest, envoy::api::v2::DiscoveryResponse> grpc_stream_;
+  GrpcStream<envoy::service::discovery::v3alpha::DiscoveryRequest,
+             envoy::service::discovery::v3alpha::DiscoveryResponse>
+      grpc_stream_;
   const LocalInfo::LocalInfo& local_info_;
   const bool skip_subsequent_node_;
   bool first_stream_request_;
@@ -129,7 +135,8 @@ class GrpcMuxImpl : public GrpcMux,
   std::queue<std::string> request_queue_;
 };
 
-class NullGrpcMuxImpl : public GrpcMux, GrpcStreamCallbacks<envoy::api::v2::DiscoveryResponse> {
+class NullGrpcMuxImpl : public GrpcMux,
+                        GrpcStreamCallbacks<envoy::service::discovery::v3alpha::DiscoveryResponse> {
 public:
   void start() override {}
   GrpcMuxWatchPtr subscribe(const std::string&, const std::set<std::string>&,
@@ -153,7 +160,8 @@ class NullGrpcMuxImpl : public GrpcMux, GrpcStreamCallbacks<envoy::api::v2::Disc
   void onWriteable() override {}
   void onStreamEstablished() override {}
   void onEstablishmentFailure() override {}
-  void onDiscoveryResponse(std::unique_ptr<envoy::api::v2::DiscoveryResponse>&&) override {}
+  void onDiscoveryResponse(
+      std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse>&&) override {}
 };
 
 } // namespace Config
diff --git a/source/common/config/http_subscription_impl.cc b/source/common/config/http_subscription_impl.cc
index 5fe413a12da7..75b0e4f426e4 100644
--- a/source/common/config/http_subscription_impl.cc
+++ b/source/common/config/http_subscription_impl.cc
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/assert.h"
@@ -72,7 +72,7 @@ void HttpSubscriptionImpl::createRequest(Http::Message& request) {
 
 void HttpSubscriptionImpl::parseResponse(const Http::Message& response) {
   disableInitFetchTimeoutTimer();
-  envoy::api::v2::DiscoveryResponse message;
+  envoy::service::discovery::v3alpha::DiscoveryResponse message;
   try {
     MessageUtil::loadFromJson(response.bodyAsString(), message, validation_visitor_);
   } catch (const EnvoyException& e) {
diff --git a/source/common/config/http_subscription_impl.h b/source/common/config/http_subscription_impl.h
index 14af5d8240c1..00861e5de577 100644
--- a/source/common/config/http_subscription_impl.h
+++ b/source/common/config/http_subscription_impl.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/http/rest_api_fetcher.h"
 
@@ -45,7 +45,7 @@ class HttpSubscriptionImpl : public Http::RestApiFetcher,
 
   std::string path_;
   Protobuf::RepeatedPtrField<std::string> resources_;
-  envoy::api::v2::DiscoveryRequest request_;
+  envoy::service::discovery::v3alpha::DiscoveryRequest request_;
   Config::SubscriptionCallbacks& callbacks_;
   SubscriptionStats stats_;
   Event::Dispatcher& dispatcher_;
diff --git a/source/common/config/metadata.cc b/source/common/config/metadata.cc
index 48b9c08f2f08..a358d71b286b 100644
--- a/source/common/config/metadata.cc
+++ b/source/common/config/metadata.cc
@@ -1,6 +1,6 @@
 #include "common/config/metadata.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/type/metadata/v2/metadata.pb.h"
 
 #include "common/protobuf/utility.h"
@@ -15,14 +15,15 @@ MetadataKey::MetadataKey(const envoy::type::metadata::v2::MetadataKey& metadata_
   }
 }
 
-const ProtobufWkt::Value& Metadata::metadataValue(const envoy::api::v2::core::Metadata& metadata,
-                                                  const MetadataKey& metadata_key) {
+const ProtobufWkt::Value&
+Metadata::metadataValue(const envoy::config::core::v3alpha::Metadata& metadata,
+                        const MetadataKey& metadata_key) {
   return metadataValue(metadata, metadata_key.key_, metadata_key.path_);
 }
 
-const ProtobufWkt::Value& Metadata::metadataValue(const envoy::api::v2::core::Metadata& metadata,
-                                                  const std::string& filter,
-                                                  const std::vector<std::string>& path) {
+const ProtobufWkt::Value&
+Metadata::metadataValue(const envoy::config::core::v3alpha::Metadata& metadata,
+                        const std::string& filter, const std::vector<std::string>& path) {
   const auto filter_it = metadata.filter_metadata().find(filter);
   if (filter_it == metadata.filter_metadata().end()) {
     return ProtobufWkt::Value::default_instance();
@@ -51,21 +52,21 @@ const ProtobufWkt::Value& Metadata::metadataValue(const envoy::api::v2::core::Me
   return *val;
 }
 
-const ProtobufWkt::Value& Metadata::metadataValue(const envoy::api::v2::core::Metadata& metadata,
-                                                  const std::string& filter,
-                                                  const std::string& key) {
+const ProtobufWkt::Value&
+Metadata::metadataValue(const envoy::config::core::v3alpha::Metadata& metadata,
+                        const std::string& filter, const std::string& key) {
   const std::vector<std::string> path{key};
   return metadataValue(metadata, filter, path);
 }
 
-ProtobufWkt::Value& Metadata::mutableMetadataValue(envoy::api::v2::core::Metadata& metadata,
+ProtobufWkt::Value& Metadata::mutableMetadataValue(envoy::config::core::v3alpha::Metadata& metadata,
                                                    const std::string& filter,
                                                    const std::string& key) {
   return (*(*metadata.mutable_filter_metadata())[filter].mutable_fields())[key];
 }
 
 bool Metadata::metadataLabelMatch(const LabelSet& label_set,
-                                  const envoy::api::v2::core::Metadata& host_metadata,
+                                  const envoy::config::core::v3alpha::Metadata& host_metadata,
                                   const std::string& filter_key, bool list_as_any) {
   const auto filter_it = host_metadata.filter_metadata().find(filter_key);
   if (filter_it == host_metadata.filter_metadata().end()) {
diff --git a/source/common/config/metadata.h b/source/common/config/metadata.h
index e6894860b06b..1d9e51f86010 100644
--- a/source/common/config/metadata.h
+++ b/source/common/config/metadata.h
@@ -4,7 +4,7 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/registry/registry.h"
 #include "envoy/type/metadata/v2/metadata.pb.h"
@@ -36,8 +36,9 @@ class Metadata {
    * @param key for filter metadata.
    * @return const ProtobufWkt::Value& value if found, empty if not found.
    */
-  static const ProtobufWkt::Value& metadataValue(const envoy::api::v2::core::Metadata& metadata,
-                                                 const std::string& filter, const std::string& key);
+  static const ProtobufWkt::Value&
+  metadataValue(const envoy::config::core::v3alpha::Metadata& metadata, const std::string& filter,
+                const std::string& key);
   /**
    * Lookup value by a multi-key path for a given filter in Metadata. If path is empty
    * will return the empty struct.
@@ -46,17 +47,18 @@ class Metadata {
    * @param path multi-key path.
    * @return const ProtobufWkt::Value& value if found, empty if not found.
    */
-  static const ProtobufWkt::Value& metadataValue(const envoy::api::v2::core::Metadata& metadata,
-                                                 const std::string& filter,
-                                                 const std::vector<std::string>& path);
+  static const ProtobufWkt::Value&
+  metadataValue(const envoy::config::core::v3alpha::Metadata& metadata, const std::string& filter,
+                const std::vector<std::string>& path);
   /**
    * Lookup the value by a metadata key from a Metadata.
    * @param metadata reference.
    * @param metadata_key with key name and path to retrieve the value.
    * @return const ProtobufWkt::Value& value if found, empty if not found.
    */
-  static const ProtobufWkt::Value& metadataValue(const envoy::api::v2::core::Metadata& metadata,
-                                                 const MetadataKey& metadata_key);
+  static const ProtobufWkt::Value&
+  metadataValue(const envoy::config::core::v3alpha::Metadata& metadata,
+                const MetadataKey& metadata_key);
 
   /**
    * Obtain mutable reference to metadata value for a given filter and key.
@@ -65,7 +67,7 @@ class Metadata {
    * @param key for filter metadata.
    * @return ProtobufWkt::Value&. A Value message is created if not found.
    */
-  static ProtobufWkt::Value& mutableMetadataValue(envoy::api::v2::core::Metadata& metadata,
+  static ProtobufWkt::Value& mutableMetadataValue(envoy::config::core::v3alpha::Metadata& metadata,
                                                   const std::string& filter,
                                                   const std::string& key);
 
@@ -80,7 +82,7 @@ class Metadata {
    * the element equals to the input label_set, it's considered as match.
    */
   static bool metadataLabelMatch(const LabelSet& label_set,
-                                 const envoy::api::v2::core::Metadata& host_metadata,
+                                 const envoy::config::core::v3alpha::Metadata& host_metadata,
                                  const std::string& filter_key, bool list_as_any);
 };
 
@@ -88,7 +90,9 @@ template <typename factoryClass> class TypedMetadataImpl : public TypedMetadata
 public:
   static_assert(std::is_base_of<Config::TypedMetadataFactory, factoryClass>::value,
                 "Factory type must be inherited from Envoy::Config::TypedMetadataFactory.");
-  TypedMetadataImpl(const envoy::api::v2::core::Metadata& metadata) { populateFrom(metadata); }
+  TypedMetadataImpl(const envoy::config::core::v3alpha::Metadata& metadata) {
+    populateFrom(metadata);
+  }
 
   const TypedMetadata::Object* getData(const std::string& key) const override {
     const auto& it = data_.find(key);
@@ -99,7 +103,7 @@ template <typename factoryClass> class TypedMetadataImpl : public TypedMetadata
   /* Attempt to run each of the registered factories for TypedMetadata, to
    * populate the data_ map.
    */
-  void populateFrom(const envoy::api::v2::core::Metadata& metadata) {
+  void populateFrom(const envoy::config::core::v3alpha::Metadata& metadata) {
     auto& data_by_key = metadata.filter_metadata();
     for (const auto& it : Registry::FactoryRegistry<factoryClass>::factories()) {
       const auto& meta_iter = data_by_key.find(it.first);
diff --git a/source/common/config/new_grpc_mux_impl.cc b/source/common/config/new_grpc_mux_impl.cc
index 9c468e35e6a2..3a6fd886b920 100644
--- a/source/common/config/new_grpc_mux_impl.cc
+++ b/source/common/config/new_grpc_mux_impl.cc
@@ -1,6 +1,6 @@
 #include "common/config/new_grpc_mux_impl.h"
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/backoff_strategy.h"
@@ -54,7 +54,7 @@ bool NewGrpcMuxImpl::paused(const std::string& type_url) const {
 }
 
 void NewGrpcMuxImpl::onDiscoveryResponse(
-    std::unique_ptr<envoy::api::v2::DeltaDiscoveryResponse>&& message) {
+    std::unique_ptr<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>&& message) {
   ENVOY_LOG(debug, "Received DeltaDiscoveryResponse for {} at version {}", message->type_url(),
             message->system_version_info());
   auto sub = subscriptions_.find(message->type_url());
diff --git a/source/common/config/new_grpc_mux_impl.h b/source/common/config/new_grpc_mux_impl.h
index 4315138b0d44..b0e0f6c50542 100644
--- a/source/common/config/new_grpc_mux_impl.h
+++ b/source/common/config/new_grpc_mux_impl.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/common/token_bucket.h"
 #include "envoy/config/grpc_mux.h"
 #include "envoy/config/subscription.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/logger.h"
 #include "common/config/delta_subscription_state.h"
@@ -20,9 +20,10 @@ namespace Config {
 // This class owns the GrpcStream used to talk to the server, maintains queuing
 // logic to properly order the subscription(s)' various messages, and allows
 // starting/stopping/pausing of the subscriptions.
-class NewGrpcMuxImpl : public GrpcMux,
-                       public GrpcStreamCallbacks<envoy::api::v2::DeltaDiscoveryResponse>,
-                       Logger::Loggable<Logger::Id::config> {
+class NewGrpcMuxImpl
+    : public GrpcMux,
+      public GrpcStreamCallbacks<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>,
+      Logger::Loggable<Logger::Id::config> {
 public:
   NewGrpcMuxImpl(Grpc::RawAsyncClientPtr&& async_client, Event::Dispatcher& dispatcher,
                  const Protobuf::MethodDescriptor& service_method, Runtime::RandomGenerator& random,
@@ -40,8 +41,9 @@ class NewGrpcMuxImpl : public GrpcMux,
   void pause(const std::string& type_url) override;
   void resume(const std::string& type_url) override;
   bool paused(const std::string& type_url) const override;
-  void
-  onDiscoveryResponse(std::unique_ptr<envoy::api::v2::DeltaDiscoveryResponse>&& message) override;
+  void onDiscoveryResponse(
+      std::unique_ptr<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>&& message)
+      override;
 
   void onStreamEstablished() override;
 
@@ -110,7 +112,8 @@ class NewGrpcMuxImpl : public GrpcMux,
   // the order of Envoy's dependency ordering).
   std::list<std::string> subscription_ordering_;
 
-  GrpcStream<envoy::api::v2::DeltaDiscoveryRequest, envoy::api::v2::DeltaDiscoveryResponse>
+  GrpcStream<envoy::service::discovery::v3alpha::DeltaDiscoveryRequest,
+             envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>
       grpc_stream_;
 };
 
diff --git a/source/common/config/protobuf_link_hacks.h b/source/common/config/protobuf_link_hacks.h
index 90682dcac177..d1e4a915b8c3 100644
--- a/source/common/config/protobuf_link_hacks.h
+++ b/source/common/config/protobuf_link_hacks.h
@@ -1,16 +1,16 @@
 #pragma once
 
-#include "envoy/service/discovery/v2/ads.pb.h"
-#include "envoy/service/discovery/v2/rtds.pb.h"
-#include "envoy/service/discovery/v2/sds.pb.h"
-#include "envoy/service/ratelimit/v2/rls.pb.h"
+#include "envoy/service/discovery/v3alpha/ads.pb.h"
+#include "envoy/service/ratelimit/v3alpha/rls.pb.h"
+#include "envoy/service/runtime/v3alpha/rtds.pb.h"
+#include "envoy/service/secret/v3alpha/sds.pb.h"
 
 namespace Envoy {
 
 // Hack to force linking of the service: https://github.com/google/protobuf/issues/4221.
 // This file should be included ONLY if this hack is required.
-const envoy::service::discovery::v2::AdsDummy _ads_dummy;
-const envoy::service::ratelimit::v2::RateLimitRequest _rls_dummy;
-const envoy::service::discovery::v2::SdsDummy _sds_dummy;
-const envoy::service::discovery::v2::RtdsDummy _tds_dummy;
+const envoy::service::discovery::v3alpha::AdsDummy _ads_dummy;
+const envoy::service::ratelimit::v3alpha::RateLimitRequest _rls_dummy;
+const envoy::service::secret::v3alpha::SdsDummy _sds_dummy;
+const envoy::service::runtime::v3alpha::RtdsDummy _tds_dummy;
 } // namespace Envoy
diff --git a/source/common/config/remote_data_fetcher.cc b/source/common/config/remote_data_fetcher.cc
index 1993b522ceaa..29fb854be34e 100644
--- a/source/common/config/remote_data_fetcher.cc
+++ b/source/common/config/remote_data_fetcher.cc
@@ -1,6 +1,6 @@
 #include "common/config/remote_data_fetcher.h"
 
-#include "envoy/api/v2/core/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
 
 #include "common/common/enum_to_int.h"
 #include "common/common/hex.h"
@@ -13,7 +13,7 @@ namespace Config {
 namespace DataFetcher {
 
 RemoteDataFetcher::RemoteDataFetcher(Upstream::ClusterManager& cm,
-                                     const ::envoy::api::v2::core::HttpUri& uri,
+                                     const envoy::config::core::v3alpha::HttpUri& uri,
                                      const std::string& content_hash,
                                      RemoteDataFetcherCallback& callback)
     : cm_(cm), uri_(uri), content_hash_(content_hash), callback_(callback) {}
diff --git a/source/common/config/remote_data_fetcher.h b/source/common/config/remote_data_fetcher.h
index 280e37b89330..3fdbcaa76742 100644
--- a/source/common/config/remote_data_fetcher.h
+++ b/source/common/config/remote_data_fetcher.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/http_uri.pb.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 namespace Envoy {
@@ -44,7 +44,7 @@ class RemoteDataFetcherCallback {
 class RemoteDataFetcher : public Logger::Loggable<Logger::Id::config>,
                           public Http::AsyncClient::Callbacks {
 public:
-  RemoteDataFetcher(Upstream::ClusterManager& cm, const ::envoy::api::v2::core::HttpUri& uri,
+  RemoteDataFetcher(Upstream::ClusterManager& cm, const envoy::config::core::v3alpha::HttpUri& uri,
                     const std::string& content_hash, RemoteDataFetcherCallback& callback);
 
   ~RemoteDataFetcher() override;
@@ -68,7 +68,7 @@ class RemoteDataFetcher : public Logger::Loggable<Logger::Id::config>,
 
 private:
   Upstream::ClusterManager& cm_;
-  const envoy::api::v2::core::HttpUri uri_;
+  const envoy::config::core::v3alpha::HttpUri uri_;
   const std::string content_hash_;
   RemoteDataFetcherCallback& callback_;
 
diff --git a/source/common/config/runtime_utility.cc b/source/common/config/runtime_utility.cc
index 500f2439e48c..28dca96257a6 100644
--- a/source/common/config/runtime_utility.cc
+++ b/source/common/config/runtime_utility.cc
@@ -1,12 +1,12 @@
 #include "common/config/runtime_utility.h"
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 namespace Envoy {
 namespace Config {
 
-void translateRuntime(const envoy::config::bootstrap::v2::Runtime& runtime_config,
-                      envoy::config::bootstrap::v2::LayeredRuntime& layered_runtime_config) {
+void translateRuntime(const envoy::config::bootstrap::v3alpha::Runtime& runtime_config,
+                      envoy::config::bootstrap::v3alpha::LayeredRuntime& layered_runtime_config) {
   {
     auto* layer = layered_runtime_config.add_layers();
     layer->set_name("base");
diff --git a/source/common/config/runtime_utility.h b/source/common/config/runtime_utility.h
index 003ac0a0bec5..9bd2e2e1702b 100644
--- a/source/common/config/runtime_utility.h
+++ b/source/common/config/runtime_utility.h
@@ -1,13 +1,13 @@
 #pragma once
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 namespace Envoy {
 namespace Config {
 
 // Translate from old fixed runtime to new layered runtime configuration.
-void translateRuntime(const envoy::config::bootstrap::v2::Runtime& runtime_config,
-                      envoy::config::bootstrap::v2::LayeredRuntime& layered_runtime_config);
+void translateRuntime(const envoy::config::bootstrap::v3alpha::Runtime& runtime_config,
+                      envoy::config::bootstrap::v3alpha::LayeredRuntime& layered_runtime_config);
 
 } // namespace Config
 } // namespace Envoy
diff --git a/source/common/config/subscription_factory_impl.cc b/source/common/config/subscription_factory_impl.cc
index 601efc790335..891888cd2c06 100644
--- a/source/common/config/subscription_factory_impl.cc
+++ b/source/common/config/subscription_factory_impl.cc
@@ -1,6 +1,6 @@
 #include "common/config/subscription_factory_impl.h"
 
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 
 #include "common/config/delta_subscription_impl.h"
 #include "common/config/filesystem_subscription_impl.h"
@@ -23,35 +23,37 @@ SubscriptionFactoryImpl::SubscriptionFactoryImpl(
       validation_visitor_(validation_visitor), api_(api) {}
 
 SubscriptionPtr SubscriptionFactoryImpl::subscriptionFromConfigSource(
-    const envoy::api::v2::core::ConfigSource& config, absl::string_view type_url,
+    const envoy::config::core::v3alpha::ConfigSource& config, absl::string_view type_url,
     Stats::Scope& scope, SubscriptionCallbacks& callbacks) {
   Config::Utility::checkLocalInfo(type_url, local_info_);
   std::unique_ptr<Subscription> result;
   SubscriptionStats stats = Utility::generateStats(scope);
   switch (config.config_source_specifier_case()) {
-  case envoy::api::v2::core::ConfigSource::kPath: {
+  case envoy::config::core::v3alpha::ConfigSource::ConfigSourceSpecifierCase::kPath: {
     Utility::checkFilesystemSubscriptionBackingPath(config.path(), api_);
     result = std::make_unique<Config::FilesystemSubscriptionImpl>(
         dispatcher_, config.path(), callbacks, stats, validation_visitor_, api_);
     break;
   }
-  case envoy::api::v2::core::ConfigSource::kApiConfigSource: {
-    const envoy::api::v2::core::ApiConfigSource& api_config_source = config.api_config_source();
+  case envoy::config::core::v3alpha::ConfigSource::ConfigSourceSpecifierCase::kApiConfigSource: {
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source =
+        config.api_config_source();
     Utility::checkApiConfigSourceSubscriptionBackingCluster(cm_.clusters(), api_config_source);
     switch (api_config_source.api_type()) {
-    case envoy::api::v2::core::ApiConfigSource::UNSUPPORTED_REST_LEGACY:
+    case envoy::config::core::v3alpha::ApiConfigSource::
+        hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY:
       throw EnvoyException(
           "REST_LEGACY no longer a supported ApiConfigSource. "
           "Please specify an explicit supported api_type in the following config:\n" +
           config.DebugString());
-    case envoy::api::v2::core::ApiConfigSource::REST:
+    case envoy::config::core::v3alpha::ApiConfigSource::REST:
       result = std::make_unique<HttpSubscriptionImpl>(
           local_info_, cm_, api_config_source.cluster_names()[0], dispatcher_, random_,
           Utility::apiConfigSourceRefreshDelay(api_config_source),
           Utility::apiConfigSourceRequestTimeout(api_config_source), restMethod(type_url),
           callbacks, stats, Utility::configSourceInitialFetchTimeout(config), validation_visitor_);
       break;
-    case envoy::api::v2::core::ApiConfigSource::GRPC:
+    case envoy::config::core::v3alpha::ApiConfigSource::GRPC:
       result = std::make_unique<GrpcSubscriptionImpl>(
           local_info_,
           Config::Utility::factoryForGrpcApiConfigSource(cm_.grpcAsyncClientManager(),
@@ -62,7 +64,7 @@ SubscriptionPtr SubscriptionFactoryImpl::subscriptionFromConfigSource(
           Utility::configSourceInitialFetchTimeout(config),
           api_config_source.set_node_on_first_message_only());
       break;
-    case envoy::api::v2::core::ApiConfigSource::DELTA_GRPC: {
+    case envoy::config::core::v3alpha::ApiConfigSource::DELTA_GRPC: {
       Utility::checkApiConfigSourceSubscriptionBackingCluster(cm_.clusters(), api_config_source);
       result = std::make_unique<DeltaSubscriptionImpl>(
           std::make_shared<Config::NewGrpcMuxImpl>(
@@ -79,7 +81,7 @@ SubscriptionPtr SubscriptionFactoryImpl::subscriptionFromConfigSource(
     }
     break;
   }
-  case envoy::api::v2::core::ConfigSource::kAds: {
+  case envoy::config::core::v3alpha::ConfigSource::ConfigSourceSpecifierCase::kAds: {
     if (cm_.adsMux()->isDelta()) {
       result = std::make_unique<DeltaSubscriptionImpl>(
           cm_.adsMux(), type_url, callbacks, stats,
diff --git a/source/common/config/subscription_factory_impl.h b/source/common/config/subscription_factory_impl.h
index 60ddaf549aa0..2789efbd8bf5 100644
--- a/source/common/config/subscription_factory_impl.h
+++ b/source/common/config/subscription_factory_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/config/subscription_factory.h"
 #include "envoy/stats/scope.h"
@@ -17,9 +17,10 @@ class SubscriptionFactoryImpl : public SubscriptionFactory {
                           ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api);
 
   // Config::SubscriptionFactory
-  SubscriptionPtr subscriptionFromConfigSource(const envoy::api::v2::core::ConfigSource& config,
-                                               absl::string_view type_url, Stats::Scope& scope,
-                                               SubscriptionCallbacks& callbacks) override;
+  SubscriptionPtr
+  subscriptionFromConfigSource(const envoy::config::core::v3alpha::ConfigSource& config,
+                               absl::string_view type_url, Stats::Scope& scope,
+                               SubscriptionCallbacks& callbacks) override;
 
 private:
   const LocalInfo::LocalInfo& local_info_;
diff --git a/source/common/config/utility.cc b/source/common/config/utility.cc
index 0221a4104716..f032b5a519bb 100644
--- a/source/common/config/utility.cc
+++ b/source/common/config/utility.cc
@@ -2,13 +2,13 @@
 
 #include <unordered_set>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/assert.h"
@@ -29,21 +29,21 @@
 namespace Envoy {
 namespace Config {
 
-void Utility::translateApiConfigSource(const std::string& cluster, uint32_t refresh_delay_ms,
-                                       const std::string& api_type,
-                                       envoy::api::v2::core::ApiConfigSource& api_config_source) {
+void Utility::translateApiConfigSource(
+    const std::string& cluster, uint32_t refresh_delay_ms, const std::string& api_type,
+    envoy::config::core::v3alpha::ApiConfigSource& api_config_source) {
   // TODO(junr03): document the option to chose an api type once we have created
   // stronger constraints around v2.
   if (api_type == ApiType::get().Grpc) {
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
-    envoy::api::v2::core::GrpcService* grpc_service = api_config_source.add_grpc_services();
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::GrpcService* grpc_service = api_config_source.add_grpc_services();
     grpc_service->mutable_envoy_grpc()->set_cluster_name(cluster);
   } else {
     if (api_type == ApiType::get().UnsupportedRestLegacy) {
-      api_config_source.set_api_type(
-          envoy::api::v2::core::ApiConfigSource::UNSUPPORTED_REST_LEGACY);
+      api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::
+                                         hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY);
     } else if (api_type == ApiType::get().Rest) {
-      api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+      api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
     }
     api_config_source.add_cluster_names(cluster);
   }
@@ -94,10 +94,10 @@ void Utility::checkFilesystemSubscriptionBackingPath(const std::string& path, Ap
 }
 
 void Utility::checkApiConfigSourceNames(
-    const envoy::api::v2::core::ApiConfigSource& api_config_source) {
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source) {
   const bool is_grpc =
-      (api_config_source.api_type() == envoy::api::v2::core::ApiConfigSource::GRPC ||
-       api_config_source.api_type() == envoy::api::v2::core::ApiConfigSource::DELTA_GRPC);
+      (api_config_source.api_type() == envoy::config::core::v3alpha::ApiConfigSource::GRPC ||
+       api_config_source.api_type() == envoy::config::core::v3alpha::ApiConfigSource::DELTA_GRPC);
 
   if (api_config_source.cluster_names().empty() && api_config_source.grpc_services().empty()) {
     throw EnvoyException(
@@ -136,7 +136,7 @@ void Utility::validateClusterName(const Upstream::ClusterManager::ClusterInfoMap
   const auto& it = clusters.find(cluster_name);
 
   if (it == clusters.end() || it->second.get().info()->addedViaApi() ||
-      it->second.get().info()->type() == envoy::api::v2::Cluster::EDS) {
+      it->second.get().info()->type() == envoy::config::cluster::v3alpha::Cluster::EDS) {
     throw EnvoyException(fmt::format(
         "envoy::api::v2::core::ConfigSource must have a statically "
         "defined non-EDS cluster: '{}' does not exist, was added via api, or is an EDS cluster",
@@ -146,11 +146,11 @@ void Utility::validateClusterName(const Upstream::ClusterManager::ClusterInfoMap
 
 void Utility::checkApiConfigSourceSubscriptionBackingCluster(
     const Upstream::ClusterManager::ClusterInfoMap& clusters,
-    const envoy::api::v2::core::ApiConfigSource& api_config_source) {
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source) {
   Utility::checkApiConfigSourceNames(api_config_source);
 
   const bool is_grpc =
-      (api_config_source.api_type() == envoy::api::v2::core::ApiConfigSource::GRPC);
+      (api_config_source.api_type() == envoy::config::core::v3alpha::ApiConfigSource::GRPC);
 
   if (!api_config_source.cluster_names().empty()) {
     // All API configs of type REST and UNSUPPORTED_REST_LEGACY should have cluster names.
@@ -170,7 +170,7 @@ void Utility::checkApiConfigSourceSubscriptionBackingCluster(
 }
 
 std::chrono::milliseconds Utility::apiConfigSourceRefreshDelay(
-    const envoy::api::v2::core::ApiConfigSource& api_config_source) {
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source) {
   if (!api_config_source.has_refresh_delay()) {
     throw EnvoyException("refresh_delay is required for REST API configuration sources");
   }
@@ -180,19 +180,19 @@ std::chrono::milliseconds Utility::apiConfigSourceRefreshDelay(
 }
 
 std::chrono::milliseconds Utility::apiConfigSourceRequestTimeout(
-    const envoy::api::v2::core::ApiConfigSource& api_config_source) {
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source) {
   return std::chrono::milliseconds(
       PROTOBUF_GET_MS_OR_DEFAULT(api_config_source, request_timeout, 1000));
 }
 
-std::chrono::milliseconds
-Utility::configSourceInitialFetchTimeout(const envoy::api::v2::core::ConfigSource& config_source) {
+std::chrono::milliseconds Utility::configSourceInitialFetchTimeout(
+    const envoy::config::core::v3alpha::ConfigSource& config_source) {
   return std::chrono::milliseconds(
       PROTOBUF_GET_MS_OR_DEFAULT(config_source, initial_fetch_timeout, 15000));
 }
 
-RateLimitSettings
-Utility::parseRateLimitSettings(const envoy::api::v2::core::ApiConfigSource& api_config_source) {
+RateLimitSettings Utility::parseRateLimitSettings(
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source) {
   RateLimitSettings rate_limit_settings;
   if (api_config_source.has_rate_limit_settings()) {
     rate_limit_settings.enabled_ = true;
@@ -207,41 +207,42 @@ Utility::parseRateLimitSettings(const envoy::api::v2::core::ApiConfigSource& api
 }
 
 Stats::TagProducerPtr
-Utility::createTagProducer(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+Utility::createTagProducer(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
   return std::make_unique<Stats::TagProducerImpl>(bootstrap.stats_config());
 }
 
 Stats::StatsMatcherPtr
-Utility::createStatsMatcher(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+Utility::createStatsMatcher(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
   return std::make_unique<Stats::StatsMatcherImpl>(bootstrap.stats_config());
 }
 
 Grpc::AsyncClientFactoryPtr Utility::factoryForGrpcApiConfigSource(
     Grpc::AsyncClientManager& async_client_manager,
-    const envoy::api::v2::core::ApiConfigSource& api_config_source, Stats::Scope& scope) {
+    const envoy::config::core::v3alpha::ApiConfigSource& api_config_source, Stats::Scope& scope) {
   Utility::checkApiConfigSourceNames(api_config_source);
 
-  if (api_config_source.api_type() != envoy::api::v2::core::ApiConfigSource::GRPC &&
-      api_config_source.api_type() != envoy::api::v2::core::ApiConfigSource::DELTA_GRPC) {
+  if (api_config_source.api_type() != envoy::config::core::v3alpha::ApiConfigSource::GRPC &&
+      api_config_source.api_type() != envoy::config::core::v3alpha::ApiConfigSource::DELTA_GRPC) {
     throw EnvoyException(fmt::format("envoy::api::v2::core::ConfigSource type must be gRPC: {}",
                                      api_config_source.DebugString()));
   }
 
-  envoy::api::v2::core::GrpcService grpc_service;
+  envoy::config::core::v3alpha::GrpcService grpc_service;
   grpc_service.MergeFrom(api_config_source.grpc_services(0));
 
   return async_client_manager.factoryForGrpcService(grpc_service, scope, false);
 }
 
-envoy::api::v2::ClusterLoadAssignment Utility::translateClusterHosts(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::Address>& hosts) {
-  envoy::api::v2::ClusterLoadAssignment load_assignment;
-  envoy::api::v2::endpoint::LocalityLbEndpoints* locality_lb_endpoints =
+envoy::config::endpoint::v3alpha::ClusterLoadAssignment Utility::translateClusterHosts(
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::Address>& hosts) {
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment;
+  envoy::config::endpoint::v3alpha::LocalityLbEndpoints* locality_lb_endpoints =
       load_assignment.add_endpoints();
   // Since this LocalityLbEndpoints is built from hosts list, set the default weight to 1.
   locality_lb_endpoints->mutable_load_balancing_weight()->set_value(1);
-  for (const envoy::api::v2::core::Address& host : hosts) {
-    envoy::api::v2::endpoint::LbEndpoint* lb_endpoint = locality_lb_endpoints->add_lb_endpoints();
+  for (const envoy::config::core::v3alpha::Address& host : hosts) {
+    envoy::config::endpoint::v3alpha::LbEndpoint* lb_endpoint =
+        locality_lb_endpoints->add_lb_endpoints();
     lb_endpoint->mutable_endpoint()->mutable_address()->MergeFrom(host);
     lb_endpoint->mutable_load_balancing_weight()->set_value(1);
   }
@@ -288,9 +289,10 @@ void Utility::translateOpaqueConfig(const ProtobufWkt::Any& typed_config,
   }
 }
 
-BackOffStrategyPtr Utility::prepareDnsRefreshStrategy(const envoy::api::v2::Cluster& cluster,
-                                                      const uint64_t dns_refresh_rate_ms,
-                                                      Runtime::RandomGenerator& random) {
+BackOffStrategyPtr
+Utility::prepareDnsRefreshStrategy(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                                   const uint64_t dns_refresh_rate_ms,
+                                   Runtime::RandomGenerator& random) {
   if (cluster.has_dns_failure_refresh_rate()) {
     uint64_t base_interval_ms =
         PROTOBUF_GET_MS_REQUIRED(cluster.dns_failure_refresh_rate(), base_interval);
diff --git a/source/common/config/utility.h b/source/common/config/utility.h
index 865f839b8b91..016e94e88e16 100644
--- a/source/common/config/utility.h
+++ b/source/common/config/utility.h
@@ -1,11 +1,11 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 #include "envoy/config/grpc_mux.h"
 #include "envoy/config/subscription.h"
 #include "envoy/json/json_object.h"
@@ -76,16 +76,16 @@ class Utility {
    * Extract refresh_delay as a std::chrono::milliseconds from
    * envoy::api::v2::core::ApiConfigSource.
    */
-  static std::chrono::milliseconds
-  apiConfigSourceRefreshDelay(const envoy::api::v2::core::ApiConfigSource& api_config_source);
+  static std::chrono::milliseconds apiConfigSourceRefreshDelay(
+      const envoy::config::core::v3alpha::ApiConfigSource& api_config_source);
 
   /**
    * Extract request_timeout as a std::chrono::milliseconds from
    * envoy::api::v2::core::ApiConfigSource. If request_timeout isn't set in the config source, a
    * default value of 1s will be returned.
    */
-  static std::chrono::milliseconds
-  apiConfigSourceRequestTimeout(const envoy::api::v2::core::ApiConfigSource& api_config_source);
+  static std::chrono::milliseconds apiConfigSourceRequestTimeout(
+      const envoy::config::core::v3alpha::ApiConfigSource& api_config_source);
 
   /**
    * Extract initial_fetch_timeout as a std::chrono::milliseconds from
@@ -93,7 +93,7 @@ class Utility {
    * default value of 0s will be returned.
    */
   static std::chrono::milliseconds
-  configSourceInitialFetchTimeout(const envoy::api::v2::core::ConfigSource& config_source);
+  configSourceInitialFetchTimeout(const envoy::config::core::v3alpha::ConfigSource& config_source);
 
   /**
    * Populate an envoy::api::v2::core::ApiConfigSource.
@@ -103,9 +103,10 @@ class Utility {
    * @param api_config_source a reference to the envoy::api::v2::core::ApiConfigSource object to
    * populate.
    */
-  static void translateApiConfigSource(const std::string& cluster, uint32_t refresh_delay_ms,
-                                       const std::string& api_type,
-                                       envoy::api::v2::core::ApiConfigSource& api_config_source);
+  static void
+  translateApiConfigSource(const std::string& cluster, uint32_t refresh_delay_ms,
+                           const std::string& api_type,
+                           envoy::config::core::v3alpha::ApiConfigSource& api_config_source);
 
   /**
    * Check cluster info for API config sanity. Throws on error.
@@ -149,7 +150,7 @@ class Utility {
    * services or cluster names, depending on expectations set by its API type.
    */
   static void
-  checkApiConfigSourceNames(const envoy::api::v2::core::ApiConfigSource& api_config_source);
+  checkApiConfigSourceNames(const envoy::config::core::v3alpha::ApiConfigSource& api_config_source);
 
   /**
    * Check the validity of a cluster backing an api config source. Throws on error.
@@ -168,7 +169,7 @@ class Utility {
    */
   static void checkApiConfigSourceSubscriptionBackingCluster(
       const Upstream::ClusterManager::ClusterInfoMap& clusters,
-      const envoy::api::v2::core::ApiConfigSource& api_config_source);
+      const envoy::config::core::v3alpha::ApiConfigSource& api_config_source);
 
   /**
    * Parses RateLimit configuration from envoy::api::v2::core::ApiConfigSource to RateLimitSettings.
@@ -176,7 +177,7 @@ class Utility {
    * @return RateLimitSettings.
    */
   static RateLimitSettings
-  parseRateLimitSettings(const envoy::api::v2::core::ApiConfigSource& api_config_source);
+  parseRateLimitSettings(const envoy::config::core::v3alpha::ApiConfigSource& api_config_source);
 
   /**
    * Generate a SubscriptionStats object from stats scope.
@@ -224,13 +225,11 @@ class Utility {
                            ProtobufMessage::ValidationVisitor& validation_visitor,
                            Factory& factory) {
     ProtobufTypes::MessagePtr config = factory.createEmptyConfigProto();
-
     // Fail in an obvious way if a plugin does not return a proto.
     RELEASE_ASSERT(config != nullptr, "");
-
-    translateOpaqueConfig(enclosing_message.typed_config(), enclosing_message.config(),
-                          validation_visitor, *config);
-
+    translateOpaqueConfig(enclosing_message.typed_config(),
+                          enclosing_message.hidden_envoy_deprecated_config(), validation_visitor,
+                          *config);
     return config;
   }
 
@@ -241,13 +240,13 @@ class Utility {
    * @throws EnvoyException when the conflict of tag names is found.
    */
   static Stats::TagProducerPtr
-  createTagProducer(const envoy::config::bootstrap::v2::Bootstrap& bootstrap);
+  createTagProducer(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap);
 
   /**
    * Create StatsMatcher instance.
    */
   static Stats::StatsMatcherPtr
-  createStatsMatcher(const envoy::config::bootstrap::v2::Bootstrap& bootstrap);
+  createStatsMatcher(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap);
 
   /**
    * Obtain gRPC async client factory from a envoy::api::v2::core::ApiConfigSource.
@@ -255,18 +254,17 @@ class Utility {
    * @param api_config_source envoy::api::v2::core::ApiConfigSource. Must have config type GRPC.
    * @return Grpc::AsyncClientFactoryPtr gRPC async client factory.
    */
-  static Grpc::AsyncClientFactoryPtr
-  factoryForGrpcApiConfigSource(Grpc::AsyncClientManager& async_client_manager,
-                                const envoy::api::v2::core::ApiConfigSource& api_config_source,
-                                Stats::Scope& scope);
+  static Grpc::AsyncClientFactoryPtr factoryForGrpcApiConfigSource(
+      Grpc::AsyncClientManager& async_client_manager,
+      const envoy::config::core::v3alpha::ApiConfigSource& api_config_source, Stats::Scope& scope);
 
   /**
    * Translate a set of cluster's hosts into a load assignment configuration.
    * @param hosts cluster's list of hosts.
    * @return envoy::api::v2::ClusterLoadAssignment a load assignment configuration.
    */
-  static envoy::api::v2::ClusterLoadAssignment
-  translateClusterHosts(const Protobuf::RepeatedPtrField<envoy::api::v2::core::Address>& hosts);
+  static envoy::config::endpoint::v3alpha::ClusterLoadAssignment translateClusterHosts(
+      const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::Address>& hosts);
 
   /**
    * Translate opaque config from google.protobuf.Any or google.protobuf.Struct to defined proto
@@ -308,9 +306,9 @@ class Utility {
    * @param random the random generator.
    * @return BackOffStrategyPtr for scheduling refreshes.
    */
-  static BackOffStrategyPtr prepareDnsRefreshStrategy(const envoy::api::v2::Cluster& cluster,
-                                                      uint64_t dns_refresh_rate_ms,
-                                                      Runtime::RandomGenerator& random);
+  static BackOffStrategyPtr
+  prepareDnsRefreshStrategy(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                            uint64_t dns_refresh_rate_ms, Runtime::RandomGenerator& random);
 };
 
 } // namespace Config
diff --git a/source/common/config/watch_map.cc b/source/common/config/watch_map.cc
index 53a06f94864a..b03bd52cd0a1 100644
--- a/source/common/config/watch_map.cc
+++ b/source/common/config/watch_map.cc
@@ -1,6 +1,6 @@
 #include "common/config/watch_map.h"
 
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 namespace Envoy {
 namespace Config {
@@ -96,13 +96,15 @@ void WatchMap::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>
 }
 
 void WatchMap::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& system_version_info) {
   // Build a pair of maps: from watches, to the set of resources {added,removed} that each watch
   // cares about. Each entry in the map-pair is then a nice little bundle that can be fed directly
   // into the individual onConfigUpdate()s.
-  absl::flat_hash_map<Watch*, Protobuf::RepeatedPtrField<envoy::api::v2::Resource>> per_watch_added;
+  absl::flat_hash_map<Watch*,
+                      Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>>
+      per_watch_added;
   for (const auto& r : added_resources) {
     const absl::flat_hash_set<Watch*>& interested_in_r = watchesInterestedIn(r.name());
     for (const auto& interested_watch : interested_in_r) {
diff --git a/source/common/config/watch_map.h b/source/common/config/watch_map.h
index 4119f31aa6c1..6234bd4f0066 100644
--- a/source/common/config/watch_map.h
+++ b/source/common/config/watch_map.h
@@ -4,8 +4,8 @@
 #include <string>
 #include <utility>
 
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/config/subscription.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/logger.h"
@@ -80,9 +80,11 @@ class WatchMap : public SubscriptionCallbacks, public Logger::Loggable<Logger::I
   // SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& system_version_info) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string& system_version_info) override;
 
   void onConfigUpdateFailed(ConfigUpdateFailureReason reason, const EnvoyException* e) override;
 
diff --git a/source/common/grpc/BUILD b/source/common/grpc/BUILD
index 7e3e8c21a0e8..297a4ba484a1 100644
--- a/source/common/grpc/BUILD
+++ b/source/common/grpc/BUILD
@@ -34,7 +34,7 @@ envoy_cc_library(
         "//include/envoy/grpc:async_client_interface",
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/http:async_client_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -158,7 +158,7 @@ envoy_cc_library(
         "//source/common/common:linked_object",
         "//source/common/common:thread_annotations",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -184,6 +184,6 @@ envoy_cc_library(
         "//include/envoy/grpc:google_grpc_creds_interface",
         "//include/envoy/registry",
         "//source/common/config:datasource_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/grpc/async_client_impl.cc b/source/common/grpc/async_client_impl.cc
index a2ed465c39bd..868f7deb454d 100644
--- a/source/common/grpc/async_client_impl.cc
+++ b/source/common/grpc/async_client_impl.cc
@@ -1,6 +1,6 @@
 #include "common/grpc/async_client_impl.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/common/enum_to_int.h"
@@ -13,7 +13,7 @@ namespace Envoy {
 namespace Grpc {
 
 AsyncClientImpl::AsyncClientImpl(Upstream::ClusterManager& cm,
-                                 const envoy::api::v2::core::GrpcService& config,
+                                 const envoy::config::core::v3alpha::GrpcService& config,
                                  TimeSource& time_source)
     : cm_(cm), remote_cluster_name_(config.envoy_grpc().cluster_name()),
       initial_metadata_(config.initial_metadata()), time_source_(time_source) {}
diff --git a/source/common/grpc/async_client_impl.h b/source/common/grpc/async_client_impl.h
index a0c88e142847..cf3da929ce40 100644
--- a/source/common/grpc/async_client_impl.h
+++ b/source/common/grpc/async_client_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/async_client.h"
 
 #include "common/common/linked_object.h"
@@ -17,8 +17,8 @@ class AsyncStreamImpl;
 
 class AsyncClientImpl final : public RawAsyncClient {
 public:
-  AsyncClientImpl(Upstream::ClusterManager& cm, const envoy::api::v2::core::GrpcService& config,
-                  TimeSource& time_source);
+  AsyncClientImpl(Upstream::ClusterManager& cm,
+                  const envoy::config::core::v3alpha::GrpcService& config, TimeSource& time_source);
   ~AsyncClientImpl() override;
 
   // Grpc::AsyncClient
@@ -33,7 +33,7 @@ class AsyncClientImpl final : public RawAsyncClient {
 private:
   Upstream::ClusterManager& cm_;
   const std::string remote_cluster_name_;
-  const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue> initial_metadata_;
+  const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue> initial_metadata_;
   std::list<std::unique_ptr<AsyncStreamImpl>> active_streams_;
   TimeSource& time_source_;
 
diff --git a/source/common/grpc/async_client_manager_impl.cc b/source/common/grpc/async_client_manager_impl.cc
index d198d8a4a7ba..a44a0f1f5779 100644
--- a/source/common/grpc/async_client_manager_impl.cc
+++ b/source/common/grpc/async_client_manager_impl.cc
@@ -1,6 +1,6 @@
 #include "common/grpc/async_client_manager_impl.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/grpc/async_client_impl.h"
@@ -12,9 +12,9 @@
 namespace Envoy {
 namespace Grpc {
 
-AsyncClientFactoryImpl::AsyncClientFactoryImpl(Upstream::ClusterManager& cm,
-                                               const envoy::api::v2::core::GrpcService& config,
-                                               bool skip_cluster_check, TimeSource& time_source)
+AsyncClientFactoryImpl::AsyncClientFactoryImpl(
+    Upstream::ClusterManager& cm, const envoy::config::core::v3alpha::GrpcService& config,
+    bool skip_cluster_check, TimeSource& time_source)
     : cm_(cm), config_(config), time_source_(time_source) {
   if (skip_cluster_check) {
     return;
@@ -50,7 +50,7 @@ RawAsyncClientPtr AsyncClientFactoryImpl::create() {
 
 GoogleAsyncClientFactoryImpl::GoogleAsyncClientFactoryImpl(
     ThreadLocal::Instance& tls, ThreadLocal::Slot* google_tls_slot, Stats::Scope& scope,
-    const envoy::api::v2::core::GrpcService& config, Api::Api& api)
+    const envoy::config::core::v3alpha::GrpcService& config, Api::Api& api)
     : tls_(tls), google_tls_slot_(google_tls_slot),
       scope_(scope.createScope(fmt::format("grpc.{}.", config.google_grpc().stat_prefix()))),
       config_(config), api_(api) {
@@ -78,13 +78,13 @@ RawAsyncClientPtr GoogleAsyncClientFactoryImpl::create() {
 #endif
 }
 
-AsyncClientFactoryPtr
-AsyncClientManagerImpl::factoryForGrpcService(const envoy::api::v2::core::GrpcService& config,
-                                              Stats::Scope& scope, bool skip_cluster_check) {
+AsyncClientFactoryPtr AsyncClientManagerImpl::factoryForGrpcService(
+    const envoy::config::core::v3alpha::GrpcService& config, Stats::Scope& scope,
+    bool skip_cluster_check) {
   switch (config.target_specifier_case()) {
-  case envoy::api::v2::core::GrpcService::kEnvoyGrpc:
+  case envoy::config::core::v3alpha::GrpcService::TargetSpecifierCase::kEnvoyGrpc:
     return std::make_unique<AsyncClientFactoryImpl>(cm_, config, skip_cluster_check, time_source_);
-  case envoy::api::v2::core::GrpcService::kGoogleGrpc:
+  case envoy::config::core::v3alpha::GrpcService::TargetSpecifierCase::kGoogleGrpc:
     return std::make_unique<GoogleAsyncClientFactoryImpl>(tls_, google_tls_slot_.get(), scope,
                                                           config, api_);
   default:
diff --git a/source/common/grpc/async_client_manager_impl.h b/source/common/grpc/async_client_manager_impl.h
index 59bfba3bb974..ba731e02cb3b 100644
--- a/source/common/grpc/async_client_manager_impl.h
+++ b/source/common/grpc/async_client_manager_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/singleton/manager.h"
 #include "envoy/stats/scope.h"
@@ -14,21 +14,22 @@ namespace Grpc {
 class AsyncClientFactoryImpl : public AsyncClientFactory {
 public:
   AsyncClientFactoryImpl(Upstream::ClusterManager& cm,
-                         const envoy::api::v2::core::GrpcService& config, bool skip_cluster_check,
-                         TimeSource& time_source);
+                         const envoy::config::core::v3alpha::GrpcService& config,
+                         bool skip_cluster_check, TimeSource& time_source);
 
   RawAsyncClientPtr create() override;
 
 private:
   Upstream::ClusterManager& cm_;
-  const envoy::api::v2::core::GrpcService config_;
+  const envoy::config::core::v3alpha::GrpcService config_;
   TimeSource& time_source_;
 };
 
 class GoogleAsyncClientFactoryImpl : public AsyncClientFactory {
 public:
   GoogleAsyncClientFactoryImpl(ThreadLocal::Instance& tls, ThreadLocal::Slot* google_tls_slot,
-                               Stats::Scope& scope, const envoy::api::v2::core::GrpcService& config,
+                               Stats::Scope& scope,
+                               const envoy::config::core::v3alpha::GrpcService& config,
                                Api::Api& api);
 
   RawAsyncClientPtr create() override;
@@ -37,7 +38,7 @@ class GoogleAsyncClientFactoryImpl : public AsyncClientFactory {
   ThreadLocal::Instance& tls_;
   ThreadLocal::Slot* google_tls_slot_;
   Stats::ScopeSharedPtr scope_;
-  const envoy::api::v2::core::GrpcService config_;
+  const envoy::config::core::v3alpha::GrpcService config_;
   Api::Api& api_;
 };
 
@@ -47,9 +48,9 @@ class AsyncClientManagerImpl : public AsyncClientManager {
                          TimeSource& time_source, Api::Api& api);
 
   // Grpc::AsyncClientManager
-  AsyncClientFactoryPtr factoryForGrpcService(const envoy::api::v2::core::GrpcService& config,
-                                              Stats::Scope& scope,
-                                              bool skip_cluster_check) override;
+  AsyncClientFactoryPtr
+  factoryForGrpcService(const envoy::config::core::v3alpha::GrpcService& config,
+                        Stats::Scope& scope, bool skip_cluster_check) override;
 
 private:
   Upstream::ClusterManager& cm_;
diff --git a/source/common/grpc/common.h b/source/common/grpc/common.h
index a44117a82161..041066b04519 100644
--- a/source/common/grpc/common.h
+++ b/source/common/grpc/common.h
@@ -15,6 +15,7 @@
 #include "common/protobuf/protobuf.h"
 
 #include "absl/types/optional.h"
+#include "google/rpc/status.pb.h"
 
 namespace Envoy {
 namespace Grpc {
diff --git a/source/common/grpc/google_async_client_impl.cc b/source/common/grpc/google_async_client_impl.cc
index 58856ead1e97..5580c8a9c033 100644
--- a/source/common/grpc/google_async_client_impl.cc
+++ b/source/common/grpc/google_async_client_impl.cc
@@ -1,6 +1,6 @@
 #include "common/grpc/google_async_client_impl.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/base64.h"
@@ -68,12 +68,10 @@ void GoogleAsyncClientThreadLocal::completionThread() {
   ENVOY_LOG(debug, "completionThread exiting");
 }
 
-GoogleAsyncClientImpl::GoogleAsyncClientImpl(Event::Dispatcher& dispatcher,
-                                             GoogleAsyncClientThreadLocal& tls,
-                                             GoogleStubFactory& stub_factory,
-                                             Stats::ScopeSharedPtr scope,
-                                             const envoy::api::v2::core::GrpcService& config,
-                                             Api::Api& api)
+GoogleAsyncClientImpl::GoogleAsyncClientImpl(
+    Event::Dispatcher& dispatcher, GoogleAsyncClientThreadLocal& tls,
+    GoogleStubFactory& stub_factory, Stats::ScopeSharedPtr scope,
+    const envoy::config::core::v3alpha::GrpcService& config, Api::Api& api)
     : dispatcher_(dispatcher), tls_(tls), stat_prefix_(config.google_grpc().stat_prefix()),
       initial_metadata_(config.initial_metadata()), scope_(scope) {
   // We rebuild the channel each time we construct the channel. It appears that the gRPC library is
diff --git a/source/common/grpc/google_async_client_impl.h b/source/common/grpc/google_async_client_impl.h
index 5157fc18e6b7..3407851ce456 100644
--- a/source/common/grpc/google_async_client_impl.h
+++ b/source/common/grpc/google_async_client_impl.h
@@ -3,9 +3,9 @@
 #include <queue>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/stats/scope.h"
 #include "envoy/thread/thread.h"
@@ -169,7 +169,7 @@ class GoogleAsyncClientImpl final : public RawAsyncClient, Logger::Loggable<Logg
 public:
   GoogleAsyncClientImpl(Event::Dispatcher& dispatcher, GoogleAsyncClientThreadLocal& tls,
                         GoogleStubFactory& stub_factory, Stats::ScopeSharedPtr scope,
-                        const envoy::api::v2::core::GrpcService& config, Api::Api& api);
+                        const envoy::config::core::v3alpha::GrpcService& config, Api::Api& api);
   ~GoogleAsyncClientImpl() override;
 
   // Grpc::AsyncClient
@@ -185,7 +185,7 @@ class GoogleAsyncClientImpl final : public RawAsyncClient, Logger::Loggable<Logg
 
 private:
   static std::shared_ptr<grpc::Channel>
-  createChannel(const envoy::api::v2::core::GrpcService::GoogleGrpc& config);
+  createChannel(const envoy::config::core::v3alpha::GrpcService::GoogleGrpc& config);
 
   Event::Dispatcher& dispatcher_;
   GoogleAsyncClientThreadLocal& tls_;
@@ -195,7 +195,7 @@ class GoogleAsyncClientImpl final : public RawAsyncClient, Logger::Loggable<Logg
   std::shared_ptr<GoogleStub> stub_;
   std::list<std::unique_ptr<GoogleAsyncStreamImpl>> active_streams_;
   const std::string stat_prefix_;
-  const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue> initial_metadata_;
+  const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue> initial_metadata_;
   Stats::ScopeSharedPtr scope_;
   GoogleAsyncClientStats stats_;
 
diff --git a/source/common/grpc/google_grpc_creds_impl.cc b/source/common/grpc/google_grpc_creds_impl.cc
index 86187ee3cb4a..b32c0edfad4d 100644
--- a/source/common/grpc/google_grpc_creds_impl.cc
+++ b/source/common/grpc/google_grpc_creds_impl.cc
@@ -1,6 +1,6 @@
 #include "common/grpc/google_grpc_creds_impl.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/google_grpc_creds.h"
 #include "envoy/registry/registry.h"
 
@@ -10,10 +10,11 @@ namespace Envoy {
 namespace Grpc {
 
 std::shared_ptr<grpc::ChannelCredentials> CredsUtility::getChannelCredentials(
-    const envoy::api::v2::core::GrpcService::GoogleGrpc& google_grpc, Api::Api& api) {
+    const envoy::config::core::v3alpha::GrpcService::GoogleGrpc& google_grpc, Api::Api& api) {
   if (google_grpc.has_channel_credentials()) {
     switch (google_grpc.channel_credentials().credential_specifier_case()) {
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::ChannelCredentials::kSslCredentials: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::ChannelCredentials::
+        CredentialSpecifierCase::kSslCredentials: {
       const auto& ssl_credentials = google_grpc.channel_credentials().ssl_credentials();
       const grpc::SslCredentialsOptions ssl_credentials_options = {
           Config::DataSource::read(ssl_credentials.root_certs(), true, api),
@@ -22,10 +23,12 @@ std::shared_ptr<grpc::ChannelCredentials> CredsUtility::getChannelCredentials(
       };
       return grpc::SslCredentials(ssl_credentials_options);
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::ChannelCredentials::kLocalCredentials: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::ChannelCredentials::
+        CredentialSpecifierCase::kLocalCredentials: {
       return grpc::experimental::LocalCredentials(UDS);
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::ChannelCredentials::kGoogleDefault: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::ChannelCredentials::
+        CredentialSpecifierCase::kGoogleDefault: {
       return grpc::GoogleDefaultCredentials();
     }
     default:
@@ -36,7 +39,7 @@ std::shared_ptr<grpc::ChannelCredentials> CredsUtility::getChannelCredentials(
 }
 
 std::shared_ptr<grpc::ChannelCredentials> CredsUtility::defaultSslChannelCredentials(
-    const envoy::api::v2::core::GrpcService& grpc_service_config, Api::Api& api) {
+    const envoy::config::core::v3alpha::GrpcService& grpc_service_config, Api::Api& api) {
   auto creds = getChannelCredentials(grpc_service_config.google_grpc(), api);
   if (creds != nullptr) {
     return creds;
@@ -44,36 +47,42 @@ std::shared_ptr<grpc::ChannelCredentials> CredsUtility::defaultSslChannelCredent
   return grpc::SslCredentials({});
 }
 
-std::vector<std::shared_ptr<grpc::CallCredentials>>
-CredsUtility::callCredentials(const envoy::api::v2::core::GrpcService::GoogleGrpc& google_grpc) {
+std::vector<std::shared_ptr<grpc::CallCredentials>> CredsUtility::callCredentials(
+    const envoy::config::core::v3alpha::GrpcService::GoogleGrpc& google_grpc) {
   std::vector<std::shared_ptr<grpc::CallCredentials>> creds;
   for (const auto& credential : google_grpc.call_credentials()) {
     std::shared_ptr<grpc::CallCredentials> new_call_creds;
     switch (credential.credential_specifier_case()) {
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kAccessToken: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kAccessToken: {
       new_call_creds = grpc::AccessTokenCredentials(credential.access_token());
       break;
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kGoogleComputeEngine: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kGoogleComputeEngine: {
       new_call_creds = grpc::GoogleComputeEngineCredentials();
       break;
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kGoogleRefreshToken: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kGoogleRefreshToken: {
       new_call_creds = grpc::GoogleRefreshTokenCredentials(credential.google_refresh_token());
       break;
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kServiceAccountJwtAccess: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kServiceAccountJwtAccess: {
       new_call_creds = grpc::ServiceAccountJWTAccessCredentials(
           credential.service_account_jwt_access().json_key(),
           credential.service_account_jwt_access().token_lifetime_seconds());
       break;
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kGoogleIam: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kGoogleIam: {
       new_call_creds = grpc::GoogleIAMCredentials(credential.google_iam().authorization_token(),
                                                   credential.google_iam().authority_selector());
       break;
     }
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kStsService: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kStsService: {
       grpc::experimental::StsCredentialsOptions options = {
           credential.sts_service().token_exchange_service_uri(),
           credential.sts_service().resource(),
@@ -102,7 +111,7 @@ CredsUtility::callCredentials(const envoy::api::v2::core::GrpcService::GoogleGrp
 }
 
 std::shared_ptr<grpc::ChannelCredentials> CredsUtility::defaultChannelCredentials(
-    const envoy::api::v2::core::GrpcService& grpc_service_config, Api::Api& api) {
+    const envoy::config::core::v3alpha::GrpcService& grpc_service_config, Api::Api& api) {
   std::shared_ptr<grpc::ChannelCredentials> channel_creds =
       getChannelCredentials(grpc_service_config.google_grpc(), api);
   if (channel_creds == nullptr) {
@@ -130,7 +139,7 @@ class DefaultGoogleGrpcCredentialsFactory : public GoogleGrpcCredentialsFactory
 
 public:
   std::shared_ptr<grpc::ChannelCredentials>
-  getChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  getChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                         Api::Api& api) override {
     return CredsUtility::defaultChannelCredentials(grpc_service_config, api);
   }
@@ -144,7 +153,7 @@ class DefaultGoogleGrpcCredentialsFactory : public GoogleGrpcCredentialsFactory
 REGISTER_FACTORY(DefaultGoogleGrpcCredentialsFactory, GoogleGrpcCredentialsFactory);
 
 std::shared_ptr<grpc::ChannelCredentials>
-getGoogleGrpcChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service,
+getGoogleGrpcChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service,
                                 Api::Api& api) {
   GoogleGrpcCredentialsFactory* credentials_factory = nullptr;
   const std::string& google_grpc_credentials_factory_name =
diff --git a/source/common/grpc/google_grpc_creds_impl.h b/source/common/grpc/google_grpc_creds_impl.h
index 485a6ba75ad8..5647d492bf1e 100644
--- a/source/common/grpc/google_grpc_creds_impl.h
+++ b/source/common/grpc/google_grpc_creds_impl.h
@@ -1,8 +1,8 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "grpcpp/grpcpp.h"
 
@@ -10,10 +10,10 @@ namespace Envoy {
 namespace Grpc {
 
 grpc::SslCredentialsOptions buildSslOptionsFromConfig(
-    const envoy::api::v2::core::GrpcService::GoogleGrpc::SslCredentials& ssl_config);
+    const envoy::config::core::v3alpha::GrpcService::GoogleGrpc::SslCredentials& ssl_config);
 
 std::shared_ptr<grpc::ChannelCredentials>
-getGoogleGrpcChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service,
+getGoogleGrpcChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service,
                                 Api::Api& api);
 
 class CredsUtility {
@@ -27,7 +27,7 @@ class CredsUtility {
    *         will be returned in the absence of any configured credentials.
    */
   static std::shared_ptr<grpc::ChannelCredentials>
-  getChannelCredentials(const envoy::api::v2::core::GrpcService::GoogleGrpc& google_grpc,
+  getChannelCredentials(const envoy::config::core::v3alpha::GrpcService::GoogleGrpc& google_grpc,
                         Api::Api& api);
 
   /**
@@ -37,7 +37,7 @@ class CredsUtility {
    * @return std::vector<std::shared_ptr<grpc::CallCredentials>> call credentials.
    */
   static std::vector<std::shared_ptr<grpc::CallCredentials>>
-  callCredentials(const envoy::api::v2::core::GrpcService::GoogleGrpc& google_grpc);
+  callCredentials(const envoy::config::core::v3alpha::GrpcService::GoogleGrpc& google_grpc);
 
   /**
    * Default translation from envoy::api::v2::core::GrpcService to grpc::ChannelCredentials for SSL
@@ -49,7 +49,7 @@ class CredsUtility {
    *         forcing the channel to SSL.
    */
   static std::shared_ptr<grpc::ChannelCredentials>
-  defaultSslChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  defaultSslChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                                Api::Api& api);
 
   /**
@@ -62,7 +62,7 @@ class CredsUtility {
    *         channel to SSL.
    */
   static std::shared_ptr<grpc::ChannelCredentials>
-  defaultChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  defaultChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                             Api::Api& api);
 };
 
diff --git a/source/common/http/BUILD b/source/common/http/BUILD
index f82cad602bf7..ac0e8960f5c6 100644
--- a/source/common/http/BUILD
+++ b/source/common/http/BUILD
@@ -29,9 +29,9 @@ envoy_cc_library(
         "//source/common/router:router_lib",
         "//source/common/stream_info:stream_info_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -129,8 +129,8 @@ envoy_cc_library(
         "//include/envoy/http:filter_interface",
         "//include/envoy/router:rds_interface",
         "//source/common/network:utility_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -198,8 +198,8 @@ envoy_cc_library(
         "//source/common/stats:timespan_lib",
         "//source/common/stream_info:stream_info_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -232,7 +232,7 @@ envoy_cc_library(
     deps = [
         ":utility_lib",
         "//include/envoy/http:hash_policy_interface",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -331,7 +331,7 @@ envoy_cc_library(
         "//source/common/json:json_loader_lib",
         "//source/common/network:utility_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -350,8 +350,8 @@ envoy_cc_library(
         "//source/common/common:regex_lib",
         "//source/common/common:utility_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/http/async_client_impl.cc b/source/common/http/async_client_impl.cc
index a1516aaf77ea..dc35c694a9b0 100644
--- a/source/common/http/async_client_impl.cc
+++ b/source/common/http/async_client_impl.cc
@@ -6,7 +6,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/grpc/common.h"
 #include "common/http/utility.h"
@@ -25,7 +25,7 @@ const AsyncStreamImpl::NullVirtualHost AsyncStreamImpl::RouteEntryImpl::virtual_
 const AsyncStreamImpl::NullRateLimitPolicy AsyncStreamImpl::NullVirtualHost::rate_limit_policy_;
 const AsyncStreamImpl::NullConfig AsyncStreamImpl::NullVirtualHost::route_configuration_;
 const std::multimap<std::string, std::string> AsyncStreamImpl::RouteEntryImpl::opaque_config_;
-const envoy::api::v2::core::Metadata AsyncStreamImpl::RouteEntryImpl::metadata_;
+const envoy::config::core::v3alpha::Metadata AsyncStreamImpl::RouteEntryImpl::metadata_;
 const Config::TypedMetadataImpl<Envoy::Config::TypedMetadataFactory>
     AsyncStreamImpl::RouteEntryImpl::typed_metadata_({});
 const AsyncStreamImpl::NullPathMatchCriterion
diff --git a/source/common/http/async_client_impl.h b/source/common/http/async_client_impl.h
index 166457e6628a..82ff8a1bab1f 100644
--- a/source/common/http/async_client_impl.h
+++ b/source/common/http/async_client_impl.h
@@ -9,9 +9,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
 #include "envoy/common/scope_tracker.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/http/async_client.h"
@@ -25,7 +25,7 @@
 #include "envoy/server/filter_config.h"
 #include "envoy/ssl/connection.h"
 #include "envoy/tracing/http_tracer.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/load_balancer.h"
 #include "envoy/upstream/upstream.h"
 
@@ -100,12 +100,12 @@ class AsyncStreamImpl : public AsyncClient::Stream,
   struct NullHedgePolicy : public Router::HedgePolicy {
     // Router::HedgePolicy
     uint32_t initialRequests() const override { return 1; }
-    const envoy::type::FractionalPercent& additionalRequestChance() const override {
+    const envoy::type::v3alpha::FractionalPercent& additionalRequestChance() const override {
       return additional_request_chance_;
     }
     bool hedgeOnPerTryTimeout() const override { return false; }
 
-    const envoy::type::FractionalPercent additional_request_chance_;
+    const envoy::type::v3alpha::FractionalPercent additional_request_chance_;
   };
 
   struct NullRateLimitPolicy : public Router::RateLimitPolicy {
@@ -192,10 +192,10 @@ class AsyncStreamImpl : public AsyncClient::Stream,
   };
 
   struct RouteEntryImpl : public Router::RouteEntry {
-    RouteEntryImpl(const std::string& cluster_name,
-                   const absl::optional<std::chrono::milliseconds>& timeout,
-                   const Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy>&
-                       hash_policy)
+    RouteEntryImpl(
+        const std::string& cluster_name, const absl::optional<std::chrono::milliseconds>& timeout,
+        const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy>&
+            hash_policy)
         : cluster_name_(cluster_name), timeout_(timeout) {
       if (!hash_policy.empty()) {
         hash_policy_ = std::make_unique<HashPolicyImpl>(hash_policy);
@@ -251,7 +251,7 @@ class AsyncStreamImpl : public AsyncClient::Stream,
     const Router::VirtualHost& virtualHost() const override { return virtual_host_; }
     bool autoHostRewrite() const override { return false; }
     bool includeVirtualHostRateLimits() const override { return true; }
-    const envoy::api::v2::core::Metadata& metadata() const override { return metadata_; }
+    const envoy::config::core::v3alpha::Metadata& metadata() const override { return metadata_; }
     const Config::TypedMetadata& typedMetadata() const override { return typed_metadata_; }
     const Router::PathMatchCriterion& pathMatchCriterion() const override {
       return path_match_criterion_;
@@ -274,7 +274,7 @@ class AsyncStreamImpl : public AsyncClient::Stream,
     static const std::vector<Router::ShadowPolicyPtr> shadow_policies_;
     static const NullVirtualHost virtual_host_;
     static const std::multimap<std::string, std::string> opaque_config_;
-    static const envoy::api::v2::core::Metadata metadata_;
+    static const envoy::config::core::v3alpha::Metadata metadata_;
     // Async client doesn't require metadata.
     static const Config::TypedMetadataImpl<Config::TypedMetadataFactory> typed_metadata_;
     static const NullPathMatchCriterion path_match_criterion_;
@@ -286,10 +286,10 @@ class AsyncStreamImpl : public AsyncClient::Stream,
   };
 
   struct RouteImpl : public Router::Route {
-    RouteImpl(const std::string& cluster_name,
-              const absl::optional<std::chrono::milliseconds>& timeout,
-              const Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy>&
-                  hash_policy)
+    RouteImpl(
+        const std::string& cluster_name, const absl::optional<std::chrono::milliseconds>& timeout,
+        const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy>&
+            hash_policy)
         : route_entry_(cluster_name, timeout, hash_policy) {}
 
     // Router::Route
diff --git a/source/common/http/conn_manager_config.h b/source/common/http/conn_manager_config.h
index cb17f00bb1de..8cff70807c84 100644
--- a/source/common/http/conn_manager_config.h
+++ b/source/common/http/conn_manager_config.h
@@ -1,11 +1,11 @@
 #pragma once
 
 #include "envoy/config/config_provider.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/router/rds.h"
 #include "envoy/stats/scope.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/http/date_provider.h"
 #include "common/network/utility.h"
@@ -109,9 +109,9 @@ struct ConnectionManagerTracingStats {
 struct TracingConnectionManagerConfig {
   Tracing::OperationName operation_name_;
   Tracing::CustomTagMap custom_tags_;
-  envoy::type::FractionalPercent client_sampling_;
-  envoy::type::FractionalPercent random_sampling_;
-  envoy::type::FractionalPercent overall_sampling_;
+  envoy::type::v3alpha::FractionalPercent client_sampling_;
+  envoy::type::v3alpha::FractionalPercent random_sampling_;
+  envoy::type::v3alpha::FractionalPercent overall_sampling_;
   bool verbose_;
   uint32_t max_path_tag_length_;
 };
@@ -178,7 +178,7 @@ class DefaultInternalAddressConfig : public Http::InternalAddressConfig {
 class ConnectionManagerConfig {
 public:
   using HttpConnectionManagerProto =
-      envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager;
+      envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager;
 
   virtual ~ConnectionManagerConfig() = default;
 
diff --git a/source/common/http/conn_manager_impl.cc b/source/common/http/conn_manager_impl.cc
index 3061e0daca2b..f0a8c10b2a4c 100644
--- a/source/common/http/conn_manager_impl.cc
+++ b/source/common/http/conn_manager_impl.cc
@@ -9,15 +9,15 @@
 
 #include "envoy/buffer/buffer.h"
 #include "envoy/common/time.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/network/drain_decision.h"
 #include "envoy/router/router.h"
 #include "envoy/ssl/connection.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stream_info/filter_state.h"
 #include "envoy/tracing/http_tracer.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/assert.h"
@@ -311,7 +311,7 @@ Network::FilterStatus ConnectionManagerImpl::onData(Buffer::Instance& data, bool
       // level logging in the HCM, similar to what we have in tcp_proxy. This will allow abuse
       // indicators to be stored in the connection level stream info, and then matched, sampled,
       // etc. when logged.
-      const envoy::type::FractionalPercent default_value; // 0
+      const envoy::type::v3alpha::FractionalPercent default_value; // 0
       if (runtime_.snapshot().featureEnabled("http.connection_manager.log_flood_exception",
                                              default_value)) {
         ENVOY_CONN_LOG(warn, "downstream HTTP flood from IP '{}': {}",
diff --git a/source/common/http/conn_manager_utility.cc b/source/common/http/conn_manager_utility.cc
index c60efd398849..5aba0f2cc1fb 100644
--- a/source/common/http/conn_manager_utility.cc
+++ b/source/common/http/conn_manager_utility.cc
@@ -4,7 +4,7 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/access_log/access_log_formatter.h"
 #include "common/common/empty_string.h"
@@ -246,9 +246,11 @@ void ConnectionManagerUtility::mutateTracingRequestHeader(HeaderMap& request_hea
     return;
   }
 
-  const envoy::type::FractionalPercent* client_sampling = &config.tracingConfig()->client_sampling_;
-  const envoy::type::FractionalPercent* random_sampling = &config.tracingConfig()->random_sampling_;
-  const envoy::type::FractionalPercent* overall_sampling =
+  const envoy::type::v3alpha::FractionalPercent* client_sampling =
+      &config.tracingConfig()->client_sampling_;
+  const envoy::type::v3alpha::FractionalPercent* random_sampling =
+      &config.tracingConfig()->random_sampling_;
+  const envoy::type::v3alpha::FractionalPercent* overall_sampling =
       &config.tracingConfig()->overall_sampling_;
 
   if (route && route->tracingConfig()) {
diff --git a/source/common/http/hash_policy.cc b/source/common/http/hash_policy.cc
index 4a9bd9cceb45..7c8487e171dc 100644
--- a/source/common/http/hash_policy.cc
+++ b/source/common/http/hash_policy.cc
@@ -1,6 +1,6 @@
 #include "common/http/hash_policy.h"
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/http/utility.h"
 
@@ -111,17 +111,17 @@ class QueryParameterHashMethod : public HashMethodImplBase {
 };
 
 HashPolicyImpl::HashPolicyImpl(
-    absl::Span<const envoy::api::v2::route::RouteAction::HashPolicy* const> hash_policies) {
+    absl::Span<const envoy::config::route::v3alpha::RouteAction::HashPolicy* const> hash_policies) {
   // TODO(htuch): Add support for cookie hash policies, #1295
   hash_impls_.reserve(hash_policies.size());
 
   for (auto* hash_policy : hash_policies) {
     switch (hash_policy->policy_specifier_case()) {
-    case envoy::api::v2::route::RouteAction::HashPolicy::kHeader:
+    case envoy::config::route::v3alpha::RouteAction::HashPolicy::PolicySpecifierCase::kHeader:
       hash_impls_.emplace_back(
           new HeaderHashMethod(hash_policy->header().header_name(), hash_policy->terminal()));
       break;
-    case envoy::api::v2::route::RouteAction::HashPolicy::kCookie: {
+    case envoy::config::route::v3alpha::RouteAction::HashPolicy::PolicySpecifierCase::kCookie: {
       absl::optional<std::chrono::seconds> ttl;
       if (hash_policy->cookie().has_ttl()) {
         ttl = std::chrono::seconds(hash_policy->cookie().ttl().seconds());
@@ -131,12 +131,14 @@ HashPolicyImpl::HashPolicyImpl(
                                                     hash_policy->terminal()));
       break;
     }
-    case envoy::api::v2::route::RouteAction::HashPolicy::kConnectionProperties:
+    case envoy::config::route::v3alpha::RouteAction::HashPolicy::PolicySpecifierCase::
+        kConnectionProperties:
       if (hash_policy->connection_properties().source_ip()) {
         hash_impls_.emplace_back(new IpHashMethod(hash_policy->terminal()));
       }
       break;
-    case envoy::api::v2::route::RouteAction::HashPolicy::kQueryParameter:
+    case envoy::config::route::v3alpha::RouteAction::HashPolicy::PolicySpecifierCase::
+        kQueryParameter:
       hash_impls_.emplace_back(new QueryParameterHashMethod(hash_policy->query_parameter().name(),
                                                             hash_policy->terminal()));
       break;
diff --git a/source/common/http/hash_policy.h b/source/common/http/hash_policy.h
index 9dd0f510f71e..bc616ca0cf18 100644
--- a/source/common/http/hash_policy.h
+++ b/source/common/http/hash_policy.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/hash_policy.h"
 
 namespace Envoy {
@@ -13,7 +13,7 @@ namespace Http {
 class HashPolicyImpl : public HashPolicy {
 public:
   explicit HashPolicyImpl(
-      absl::Span<const envoy::api::v2::route::RouteAction::HashPolicy* const> hash_policy);
+      absl::Span<const envoy::config::route::v3alpha::RouteAction::HashPolicy* const> hash_policy);
 
   // Http::HashPolicy
   absl::optional<uint64_t> generateHash(const Network::Address::Instance* downstream_addr,
diff --git a/source/common/http/header_utility.cc b/source/common/http/header_utility.cc
index 36213f1dedc1..3f200b090ce3 100644
--- a/source/common/http/header_utility.cc
+++ b/source/common/http/header_utility.cc
@@ -1,6 +1,6 @@
 #include "common/http/header_utility.h"
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/common/regex.h"
 #include "common/common/utility.h"
@@ -25,38 +25,41 @@ namespace Http {
 //   d.present_match: Match will succeed if the header is present.
 //   f.prefix_match: Match will succeed if header value matches the prefix value specified here.
 //   g.suffix_match: Match will succeed if header value matches the suffix value specified here.
-HeaderUtility::HeaderData::HeaderData(const envoy::api::v2::route::HeaderMatcher& config)
+HeaderUtility::HeaderData::HeaderData(const envoy::config::route::v3alpha::HeaderMatcher& config)
     : name_(config.name()), invert_match_(config.invert_match()) {
   switch (config.header_match_specifier_case()) {
-  case envoy::api::v2::route::HeaderMatcher::kExactMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::kExactMatch:
     header_match_type_ = HeaderMatchType::Value;
     value_ = config.exact_match();
     break;
-  case envoy::api::v2::route::HeaderMatcher::kRegexMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::
+      kHiddenEnvoyDeprecatedRegexMatch:
     header_match_type_ = HeaderMatchType::Regex;
-    regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(config.regex_match());
+    regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(
+        config.hidden_envoy_deprecated_regex_match());
     break;
-  case envoy::api::v2::route::HeaderMatcher::kSafeRegexMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::kSafeRegexMatch:
     header_match_type_ = HeaderMatchType::Regex;
     regex_ = Regex::Utility::parseRegex(config.safe_regex_match());
     break;
-  case envoy::api::v2::route::HeaderMatcher::kRangeMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::kRangeMatch:
     header_match_type_ = HeaderMatchType::Range;
     range_.set_start(config.range_match().start());
     range_.set_end(config.range_match().end());
     break;
-  case envoy::api::v2::route::HeaderMatcher::kPresentMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::kPresentMatch:
     header_match_type_ = HeaderMatchType::Present;
     break;
-  case envoy::api::v2::route::HeaderMatcher::kPrefixMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::kPrefixMatch:
     header_match_type_ = HeaderMatchType::Prefix;
     value_ = config.prefix_match();
     break;
-  case envoy::api::v2::route::HeaderMatcher::kSuffixMatch:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::kSuffixMatch:
     header_match_type_ = HeaderMatchType::Suffix;
     value_ = config.suffix_match();
     break;
-  case envoy::api::v2::route::HeaderMatcher::HEADER_MATCH_SPECIFIER_NOT_SET:
+  case envoy::config::route::v3alpha::HeaderMatcher::HeaderMatchSpecifierCase::
+      HEADER_MATCH_SPECIFIER_NOT_SET:
     FALLTHRU;
   default:
     header_match_type_ = HeaderMatchType::Present;
diff --git a/source/common/http/header_utility.h b/source/common/http/header_utility.h
index aa2a92e3ece3..e0d7916117bc 100644
--- a/source/common/http/header_utility.h
+++ b/source/common/http/header_utility.h
@@ -2,11 +2,11 @@
 
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
 #include "envoy/common/regex.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/json/json_object.h"
-#include "envoy/type/range.pb.h"
+#include "envoy/type/v3alpha/range.pb.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -36,13 +36,13 @@ class HeaderUtility {
   // to match in a request's header, specified in the header_match_type_ member.
   // It is the runtime equivalent of the HeaderMatchSpecifier proto in RDS API.
   struct HeaderData : public HeaderMatcher {
-    HeaderData(const envoy::api::v2::route::HeaderMatcher& config);
+    HeaderData(const envoy::config::route::v3alpha::HeaderMatcher& config);
 
     const LowerCaseString name_;
     HeaderMatchType header_match_type_;
     std::string value_;
     Regex::CompiledMatcherPtr regex_;
-    envoy::type::Int64Range range_;
+    envoy::type::v3alpha::Int64Range range_;
     const bool invert_match_;
 
     // HeaderMatcher
@@ -57,7 +57,8 @@ class HeaderUtility {
    * Build a vector of HeaderDataPtr given input config.
    */
   static std::vector<HeaderUtility::HeaderDataPtr> buildHeaderDataVector(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::route::HeaderMatcher>& header_matchers) {
+      const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::HeaderMatcher>&
+          header_matchers) {
     std::vector<HeaderUtility::HeaderDataPtr> ret;
     for (const auto& header_matcher : header_matchers) {
       ret.emplace_back(std::make_unique<HeaderUtility::HeaderData>(header_matcher));
@@ -69,7 +70,8 @@ class HeaderUtility {
    * Build a vector of HeaderMatcherSharedPtr given input config.
    */
   static std::vector<Http::HeaderMatcherSharedPtr> buildHeaderMatcherVector(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::route::HeaderMatcher>& header_matchers) {
+      const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::HeaderMatcher>&
+          header_matchers) {
     std::vector<Http::HeaderMatcherSharedPtr> ret;
     for (const auto& header_matcher : header_matchers) {
       ret.emplace_back(std::make_shared<HeaderUtility::HeaderData>(header_matcher));
diff --git a/source/common/http/utility.cc b/source/common/http/utility.cc
index d1347ccfa46d..0668bd272f33 100644
--- a/source/common/http/utility.cc
+++ b/source/common/http/utility.cc
@@ -6,8 +6,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/http_uri.pb.h"
-#include "envoy/api/v2/core/protocol.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/protocol.pb.h"
 #include "envoy/http/header_map.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -241,7 +241,7 @@ bool Utility::isWebSocketUpgradeRequest(const HeaderMap& headers) {
 }
 
 Http2Settings
-Utility::parseHttp2Settings(const envoy::api::v2::core::Http2ProtocolOptions& config) {
+Utility::parseHttp2Settings(const envoy::config::core::v3alpha::Http2ProtocolOptions& config) {
   Http2Settings ret;
   ret.hpack_table_size_ = PROTOBUF_GET_WRAPPED_OR_DEFAULT(
       config, hpack_table_size, Http::Http2Settings::DEFAULT_HPACK_TABLE_SIZE);
@@ -273,7 +273,7 @@ Utility::parseHttp2Settings(const envoy::api::v2::core::Http2ProtocolOptions& co
 }
 
 Http1Settings
-Utility::parseHttp1Settings(const envoy::api::v2::core::Http1ProtocolOptions& config) {
+Utility::parseHttp1Settings(const envoy::config::core::v3alpha::Http1ProtocolOptions& config) {
   Http1Settings ret;
   ret.allow_absolute_url_ = PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, allow_absolute_url, true);
   ret.accept_http_10_ = config.accept_http_10();
@@ -555,7 +555,7 @@ void Utility::extractHostPathFromUri(const absl::string_view& uri, absl::string_
   }
 }
 
-MessagePtr Utility::prepareHeaders(const ::envoy::api::v2::core::HttpUri& http_uri) {
+MessagePtr Utility::prepareHeaders(const envoy::config::core::v3alpha::HttpUri& http_uri) {
   absl::string_view host, path;
   extractHostPathFromUri(http_uri.uri(), host, path);
 
diff --git a/source/common/http/utility.h b/source/common/http/utility.h
index 420f20dad142..966c257954c4 100644
--- a/source/common/http/utility.h
+++ b/source/common/http/utility.h
@@ -4,8 +4,8 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/api/v2/core/http_uri.pb.h"
-#include "envoy/api/v2/core/protocol.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/protocol.pb.h"
 #include "envoy/grpc/status.h"
 #include "envoy/http/codes.h"
 #include "envoy/http/filter.h"
@@ -167,13 +167,13 @@ bool isWebSocketUpgradeRequest(const HeaderMap& headers);
  * @return Http2Settings An Http2Settings populated from the
  * envoy::api::v2::core::Http2ProtocolOptions config.
  */
-Http2Settings parseHttp2Settings(const envoy::api::v2::core::Http2ProtocolOptions& config);
+Http2Settings parseHttp2Settings(const envoy::config::core::v3alpha::Http2ProtocolOptions& config);
 
 /**
  * @return Http1Settings An Http1Settings populated from the
  * envoy::api::v2::core::Http1ProtocolOptions config.
  */
-Http1Settings parseHttp1Settings(const envoy::api::v2::core::Http1ProtocolOptions& config);
+Http1Settings parseHttp1Settings(const envoy::config::core::v3alpha::Http1ProtocolOptions& config);
 
 /**
  * Create a locally generated response using filter callbacks.
@@ -261,7 +261,7 @@ void extractHostPathFromUri(const absl::string_view& uri, absl::string_view& hos
 /**
  * Prepare headers for a HttpUri.
  */
-MessagePtr prepareHeaders(const ::envoy::api::v2::core::HttpUri& http_uri);
+MessagePtr prepareHeaders(const envoy::config::core::v3alpha::HttpUri& http_uri);
 
 /**
  * Serialize query-params into a string.
diff --git a/source/common/local_info/BUILD b/source/common/local_info/BUILD
index 0016d66e9f7a..8b73c33a441a 100644
--- a/source/common/local_info/BUILD
+++ b/source/common/local_info/BUILD
@@ -13,6 +13,6 @@ envoy_cc_library(
     hdrs = ["local_info_impl.h"],
     deps = [
         "//include/envoy/local_info:local_info_interface",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/local_info/local_info_impl.h b/source/common/local_info/local_info_impl.h
index 6ab957e38474..9305b7c33bce 100644
--- a/source/common/local_info/local_info_impl.h
+++ b/source/common/local_info/local_info_impl.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/local_info/local_info.h"
 
 namespace Envoy {
@@ -10,7 +10,7 @@ namespace LocalInfo {
 
 class LocalInfoImpl : public LocalInfo {
 public:
-  LocalInfoImpl(const envoy::api::v2::core::Node& node,
+  LocalInfoImpl(const envoy::config::core::v3alpha::Node& node,
                 const Network::Address::InstanceConstSharedPtr& address,
                 absl::string_view zone_name, absl::string_view cluster_name,
                 absl::string_view node_name)
@@ -30,10 +30,10 @@ class LocalInfoImpl : public LocalInfo {
   const std::string& zoneName() const override { return node_.locality().zone(); }
   const std::string& clusterName() const override { return node_.cluster(); }
   const std::string& nodeName() const override { return node_.id(); }
-  const envoy::api::v2::core::Node& node() const override { return node_; }
+  const envoy::config::core::v3alpha::Node& node() const override { return node_; }
 
 private:
-  envoy::api::v2::core::Node node_;
+  envoy::config::core::v3alpha::Node node_;
   Network::Address::InstanceConstSharedPtr address_;
 };
 
diff --git a/source/common/network/BUILD b/source/common/network/BUILD
index 87202a478e34..29ff1c0eeb52 100644
--- a/source/common/network/BUILD
+++ b/source/common/network/BUILD
@@ -51,7 +51,6 @@ envoy_cc_library(
         "//include/envoy/network:address_interface",
         "//source/common/common:assert_lib",
         "//source/common/common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
         "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
@@ -98,7 +97,7 @@ envoy_cc_library(
         "//source/common/event:libevent_lib",
         "//source/common/network:listen_socket_lib",
         "//source/common/stream_info:stream_info_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -145,7 +144,7 @@ envoy_cc_library(
     deps = [
         "//include/envoy/network:hash_policy_interface",
         "//source/common/common:hash_lib",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -180,7 +179,7 @@ envoy_cc_library(
         ":utility_lib",
         "//include/envoy/network:listen_socket_interface",
         "//source/common/common:assert_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -210,7 +209,7 @@ envoy_cc_library(
         "//source/common/common:linked_object",
         "//source/common/event:dispatcher_includes",
         "//source/common/event:libevent_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -240,7 +239,7 @@ envoy_cc_library(
         "//source/common/config:well_known_names",
         "//source/common/network:address_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -257,7 +256,7 @@ envoy_cc_library(
         "//source/common/api:os_sys_calls_lib",
         "//source/common/common:assert_lib",
         "//source/common/common:minimal_logger_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -273,7 +272,7 @@ envoy_cc_library(
         "//source/common/api:os_sys_calls_lib",
         "//source/common/common:assert_lib",
         "//source/common/common:logger_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -288,7 +287,7 @@ envoy_cc_library(
         ":socket_option_lib",
         "//include/envoy/network:listen_socket_interface",
         "//source/common/common:logger_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -307,7 +306,7 @@ envoy_cc_library(
         "//source/common/common:cleanup_lib",
         "//source/common/common:utility_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/network/addr_family_aware_socket_option_impl.cc b/source/common/network/addr_family_aware_socket_option_impl.cc
index b7552f4162f1..0cedae463494 100644
--- a/source/common/network/addr_family_aware_socket_option_impl.cc
+++ b/source/common/network/addr_family_aware_socket_option_impl.cc
@@ -1,8 +1,8 @@
 #include "common/network/addr_family_aware_socket_option_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/api/os_sys_calls_impl.h"
 #include "common/common/assert.h"
@@ -63,12 +63,12 @@ getOptionForSocket(const Socket& socket, SocketOptionImpl& ipv4_option,
 } // namespace
 
 bool AddrFamilyAwareSocketOptionImpl::setOption(
-    Socket& socket, envoy::api::v2::core::SocketOption::SocketState state) const {
+    Socket& socket, envoy::config::core::v3alpha::SocketOption::SocketState state) const {
   return setIpSocketOption(socket, state, ipv4_option_, ipv6_option_);
 }
 
 absl::optional<Socket::Option::Details> AddrFamilyAwareSocketOptionImpl::getOptionDetails(
-    const Socket& socket, envoy::api::v2::core::SocketOption::SocketState state) const {
+    const Socket& socket, envoy::config::core::v3alpha::SocketOption::SocketState state) const {
   auto option = getOptionForSocket(socket, *ipv4_option_, *ipv6_option_);
 
   if (!option.has_value()) {
@@ -79,7 +79,7 @@ absl::optional<Socket::Option::Details> AddrFamilyAwareSocketOptionImpl::getOpti
 }
 
 bool AddrFamilyAwareSocketOptionImpl::setIpSocketOption(
-    Socket& socket, envoy::api::v2::core::SocketOption::SocketState state,
+    Socket& socket, envoy::config::core::v3alpha::SocketOption::SocketState state,
     const std::unique_ptr<SocketOptionImpl>& ipv4_option,
     const std::unique_ptr<SocketOptionImpl>& ipv6_option) {
   auto option = getOptionForSocket(socket, *ipv4_option, *ipv6_option);
diff --git a/source/common/network/addr_family_aware_socket_option_impl.h b/source/common/network/addr_family_aware_socket_option_impl.h
index 202e56779416..493b150c6959 100644
--- a/source/common/network/addr_family_aware_socket_option_impl.h
+++ b/source/common/network/addr_family_aware_socket_option_impl.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/listen_socket.h"
 
 #include "common/common/logger.h"
@@ -15,7 +15,7 @@ namespace Network {
 class AddrFamilyAwareSocketOptionImpl : public Socket::Option,
                                         Logger::Loggable<Logger::Id::connection> {
 public:
-  AddrFamilyAwareSocketOptionImpl(envoy::api::v2::core::SocketOption::SocketState in_state,
+  AddrFamilyAwareSocketOptionImpl(envoy::config::core::v3alpha::SocketOption::SocketState in_state,
                                   SocketOptionName ipv4_optname, SocketOptionName ipv6_optname,
                                   int value)
       : ipv4_option_(std::make_unique<SocketOptionImpl>(in_state, ipv4_optname, value)),
@@ -23,13 +23,13 @@ class AddrFamilyAwareSocketOptionImpl : public Socket::Option,
 
   // Socket::Option
   bool setOption(Socket& socket,
-                 envoy::api::v2::core::SocketOption::SocketState state) const override;
+                 envoy::config::core::v3alpha::SocketOption::SocketState state) const override;
   // The common socket options don't require a hash key.
   void hashKey(std::vector<uint8_t>&) const override {}
 
   absl::optional<Details>
   getOptionDetails(const Socket& socket,
-                   envoy::api::v2::core::SocketOption::SocketState state) const override;
+                   envoy::config::core::v3alpha::SocketOption::SocketState state) const override;
 
   /**
    * Set a socket option that applies at both IPv4 and IPv6 socket levels. When the underlying FD
@@ -47,7 +47,7 @@ class AddrFamilyAwareSocketOptionImpl : public Socket::Option,
    *         socket is non-IP.
    */
   static bool setIpSocketOption(Socket& socket,
-                                envoy::api::v2::core::SocketOption::SocketState state,
+                                envoy::config::core::v3alpha::SocketOption::SocketState state,
                                 const std::unique_ptr<SocketOptionImpl>& ipv4_option,
                                 const std::unique_ptr<SocketOptionImpl>& ipv6_option);
 
diff --git a/source/common/network/cidr_range.cc b/source/common/network/cidr_range.cc
index d4c5459cb5d2..becc23ca49d2 100644
--- a/source/common/network/cidr_range.cc
+++ b/source/common/network/cidr_range.cc
@@ -5,7 +5,6 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
 #include "envoy/config/core/v3alpha/address.pb.h"
@@ -112,10 +111,6 @@ CidrRange CidrRange::create(const std::string& address, int length) {
   return create(Utility::parseInternetAddress(address), length);
 }
 
-CidrRange CidrRange::create(const envoy::api::v2::core::CidrRange& cidr) {
-  return create(Utility::parseInternetAddress(cidr.address_prefix()), cidr.prefix_len().value());
-}
-
 CidrRange CidrRange::create(const envoy::config::core::v3alpha::CidrRange& cidr) {
   return create(Utility::parseInternetAddress(cidr.address_prefix()), cidr.prefix_len().value());
 }
@@ -207,8 +202,8 @@ IpList::IpList(const std::vector<std::string>& subnets) {
   }
 }
 
-IpList::IpList(const Protobuf::RepeatedPtrField<envoy::api::v2::core::CidrRange>& cidrs) {
-  for (const envoy::api::v2::core::CidrRange& entry : cidrs) {
+IpList::IpList(const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::CidrRange>& cidrs) {
+  for (const envoy::config::core::v3alpha::CidrRange& entry : cidrs) {
     CidrRange list_entry = CidrRange::create(entry);
     if (list_entry.isValid()) {
       ip_list_.push_back(list_entry);
diff --git a/source/common/network/cidr_range.h b/source/common/network/cidr_range.h
index 30ce6bda45b8..75b6aae7751a 100644
--- a/source/common/network/cidr_range.h
+++ b/source/common/network/cidr_range.h
@@ -3,7 +3,6 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/json/json_object.h"
 #include "envoy/network/address.h"
@@ -99,9 +98,6 @@ class CidrRange {
    * Constructs a CidrRange from envoy::api::v2::core::CidrRange.
    * TODO(ccaraman): Update CidrRange::create to support only constructing valid ranges.
    */
-  static CidrRange create(const envoy::api::v2::core::CidrRange& cidr);
-  // The ::v2 and ::v3alpha variants will merge once we land API boosting
-  // automation. TODO(htuch): make sure this happens.
   static CidrRange create(const envoy::config::core::v3alpha::CidrRange& cidr);
 
   /**
@@ -132,7 +128,7 @@ class IpList {
 public:
   IpList(const std::vector<std::string>& subnets);
   IpList(const Json::Object& config, const std::string& member_name);
-  IpList(const Protobuf::RepeatedPtrField<envoy::api::v2::core::CidrRange>& cidrs);
+  IpList(const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::CidrRange>& cidrs);
   IpList() = default;
 
   bool contains(const Instance& address) const;
diff --git a/source/common/network/connection_impl.cc b/source/common/network/connection_impl.cc
index 6070f8587fd6..0e38ac61c17b 100644
--- a/source/common/network/connection_impl.cc
+++ b/source/common/network/connection_impl.cc
@@ -4,9 +4,9 @@
 #include <cstdint>
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/network/filter.h"
 
@@ -641,7 +641,7 @@ ClientConnectionImpl::ClientConnectionImpl(
   // non-IP sockets, so skip.
   if (remote_address->ip() != nullptr) {
     if (!Network::Socket::applyOptions(options, *socket_,
-                                       envoy::api::v2::core::SocketOption::STATE_PREBIND)) {
+                                       envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)) {
       // Set a special error state to ensure asynchronous close to give the owner of the
       // ConnectionImpl a chance to add callbacks and detect the "disconnect".
       immediate_error_event_ = ConnectionEvent::LocalClose;
diff --git a/source/common/network/hash_policy.cc b/source/common/network/hash_policy.cc
index 77cc9a0a3252..4bacac020049 100644
--- a/source/common/network/hash_policy.cc
+++ b/source/common/network/hash_policy.cc
@@ -1,7 +1,7 @@
 #include "common/network/hash_policy.h"
 
 #include "envoy/common/exception.h"
-#include "envoy/type/hash_policy.pb.h"
+#include "envoy/type/v3alpha/hash_policy.pb.h"
 
 #include "common/common/assert.h"
 
@@ -22,10 +22,10 @@ class SourceIpHashMethod : public HashPolicyImpl::HashMethod {
 };
 
 HashPolicyImpl::HashPolicyImpl(
-    const absl::Span<const envoy::type::HashPolicy* const>& hash_policies) {
+    const absl::Span<const envoy::type::v3alpha::HashPolicy* const>& hash_policies) {
   ASSERT(hash_policies.size() == 1);
   switch (hash_policies[0]->policy_specifier_case()) {
-  case envoy::type::HashPolicy::kSourceIp:
+  case envoy::type::v3alpha::HashPolicy::PolicySpecifierCase::kSourceIp:
     hash_impl_ = std::make_unique<SourceIpHashMethod>();
     break;
   default:
diff --git a/source/common/network/hash_policy.h b/source/common/network/hash_policy.h
index 0880d8bce386..6f5899595148 100644
--- a/source/common/network/hash_policy.h
+++ b/source/common/network/hash_policy.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/network/hash_policy.h"
-#include "envoy/type/hash_policy.pb.h"
+#include "envoy/type/v3alpha/hash_policy.pb.h"
 
 #include "common/common/hash.h"
 
@@ -12,7 +12,8 @@ namespace Network {
  */
 class HashPolicyImpl : public Network::HashPolicy {
 public:
-  explicit HashPolicyImpl(const absl::Span<const envoy::type::HashPolicy* const>& hash_policy);
+  explicit HashPolicyImpl(
+      const absl::Span<const envoy::type::v3alpha::HashPolicy* const>& hash_policy);
 
   // Network::HashPolicy
   absl::optional<uint64_t>
diff --git a/source/common/network/listen_socket_impl.cc b/source/common/network/listen_socket_impl.cc
index 2126a1676a1e..0e5cce80a08a 100644
--- a/source/common/network/listen_socket_impl.cc
+++ b/source/common/network/listen_socket_impl.cc
@@ -4,9 +4,9 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/api/os_sys_calls_impl.h"
 #include "common/common/assert.h"
@@ -34,7 +34,7 @@ void ListenSocketImpl::doBind() {
 
 void ListenSocketImpl::setListenSocketOptions(const Network::Socket::OptionsSharedPtr& options) {
   if (!Network::Socket::applyOptions(options, *this,
-                                     envoy::api::v2::core::SocketOption::STATE_PREBIND)) {
+                                     envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)) {
     throw EnvoyException("ListenSocket: Setting socket options failed");
   }
 }
diff --git a/source/common/network/listener_impl.cc b/source/common/network/listener_impl.cc
index c25d82c9f6d1..250f61d54351 100644
--- a/source/common/network/listener_impl.cc
+++ b/source/common/network/listener_impl.cc
@@ -1,8 +1,8 @@
 #include "common/network/listener_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/empty_string.h"
@@ -57,7 +57,7 @@ void ListenerImpl::setupServerSocket(Event::DispatcherImpl& dispatcher, Socket&
   }
 
   if (!Network::Socket::applyOptions(socket.options(), socket,
-                                     envoy::api::v2::core::SocketOption::STATE_LISTENING)) {
+                                     envoy::config::core::v3alpha::SocketOption::STATE_LISTENING)) {
     throw CreateListenerException(fmt::format("cannot set post-listen socket option on socket: {}",
                                               socket.localAddress()->asString()));
   }
diff --git a/source/common/network/resolver_impl.cc b/source/common/network/resolver_impl.cc
index f07bc304ae2a..5a955237c24b 100644
--- a/source/common/network/resolver_impl.cc
+++ b/source/common/network/resolver_impl.cc
@@ -1,7 +1,7 @@
 #include "common/network/resolver_impl.h"
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/resolver.h"
 #include "envoy/registry/registry.h"
@@ -21,11 +21,11 @@ class IpResolver : public Resolver {
 
 public:
   InstanceConstSharedPtr
-  resolve(const envoy::api::v2::core::SocketAddress& socket_address) override {
+  resolve(const envoy::config::core::v3alpha::SocketAddress& socket_address) override {
     switch (socket_address.port_specifier_case()) {
-    case envoy::api::v2::core::SocketAddress::kPortValue:
+    case envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::kPortValue:
     // Default to port 0 if no port value is specified.
-    case envoy::api::v2::core::SocketAddress::PORT_SPECIFIER_NOT_SET:
+    case envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::PORT_SPECIFIER_NOT_SET:
       return Network::Utility::parseInternetAddress(
           socket_address.address(), socket_address.port_value(), !socket_address.ipv4_compat());
 
@@ -43,11 +43,11 @@ class IpResolver : public Resolver {
  */
 REGISTER_FACTORY(IpResolver, Resolver);
 
-InstanceConstSharedPtr resolveProtoAddress(const envoy::api::v2::core::Address& address) {
+InstanceConstSharedPtr resolveProtoAddress(const envoy::config::core::v3alpha::Address& address) {
   switch (address.address_case()) {
-  case envoy::api::v2::core::Address::kSocketAddress:
+  case envoy::config::core::v3alpha::Address::AddressCase::kSocketAddress:
     return resolveProtoSocketAddress(address.socket_address());
-  case envoy::api::v2::core::Address::kPipe:
+  case envoy::config::core::v3alpha::Address::AddressCase::kPipe:
     return InstanceConstSharedPtr{new PipeInstance(address.pipe().path())};
   default:
     throw EnvoyException("Address must be a socket or pipe: " + address.DebugString());
@@ -55,7 +55,7 @@ InstanceConstSharedPtr resolveProtoAddress(const envoy::api::v2::core::Address&
 }
 
 InstanceConstSharedPtr
-resolveProtoSocketAddress(const envoy::api::v2::core::SocketAddress& socket_address) {
+resolveProtoSocketAddress(const envoy::config::core::v3alpha::SocketAddress& socket_address) {
   Resolver* resolver = nullptr;
   const std::string& resolver_name = socket_address.resolver_name();
   if (resolver_name.empty()) {
diff --git a/source/common/network/resolver_impl.h b/source/common/network/resolver_impl.h
index 7341bdc46d04..5d68b3c9fec7 100644
--- a/source/common/network/resolver_impl.h
+++ b/source/common/network/resolver_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/address.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/resolver.h"
@@ -15,7 +15,8 @@ namespace Address {
  * @param address supplies the address proto to resolve.
  * @return pointer to the Instance.
  */
-Address::InstanceConstSharedPtr resolveProtoAddress(const envoy::api::v2::core::Address& address);
+Address::InstanceConstSharedPtr
+resolveProtoAddress(const envoy::config::core::v3alpha::Address& address);
 
 /**
  * Create an Instance from a envoy::api::v2::core::SocketAddress.
@@ -23,7 +24,7 @@ Address::InstanceConstSharedPtr resolveProtoAddress(const envoy::api::v2::core::
  * @return pointer to the Instance.
  */
 Address::InstanceConstSharedPtr
-resolveProtoSocketAddress(const envoy::api::v2::core::SocketAddress& address);
+resolveProtoSocketAddress(const envoy::config::core::v3alpha::SocketAddress& address);
 } // namespace Address
 } // namespace Network
 } // namespace Envoy
diff --git a/source/common/network/socket_option_factory.cc b/source/common/network/socket_option_factory.cc
index 12fca95088fd..52dc5b4f817a 100644
--- a/source/common/network/socket_option_factory.cc
+++ b/source/common/network/socket_option_factory.cc
@@ -1,6 +1,6 @@
 #include "common/network/socket_option_factory.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/network/addr_family_aware_socket_option_impl.h"
@@ -13,21 +13,21 @@ std::unique_ptr<Socket::Options>
 SocketOptionFactory::buildTcpKeepaliveOptions(Network::TcpKeepaliveConfig keepalive_config) {
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
   options->push_back(std::make_shared<Network::SocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_SO_KEEPALIVE, 1));
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_SO_KEEPALIVE, 1));
 
   if (keepalive_config.keepalive_probes_.has_value()) {
     options->push_back(std::make_shared<Network::SocketOptionImpl>(
-        envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_TCP_KEEPCNT,
+        envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_TCP_KEEPCNT,
         keepalive_config.keepalive_probes_.value()));
   }
   if (keepalive_config.keepalive_interval_.has_value()) {
     options->push_back(std::make_shared<Network::SocketOptionImpl>(
-        envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_TCP_KEEPINTVL,
+        envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_TCP_KEEPINTVL,
         keepalive_config.keepalive_interval_.value()));
   }
   if (keepalive_config.keepalive_time_.has_value()) {
     options->push_back(std::make_shared<Network::SocketOptionImpl>(
-        envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_TCP_KEEPIDLE,
+        envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_TCP_KEEPIDLE,
         keepalive_config.keepalive_time_.value()));
   }
   return options;
@@ -36,7 +36,7 @@ SocketOptionFactory::buildTcpKeepaliveOptions(Network::TcpKeepaliveConfig keepal
 std::unique_ptr<Socket::Options> SocketOptionFactory::buildIpFreebindOptions() {
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
   options->push_back(std::make_shared<Network::AddrFamilyAwareSocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_IP_FREEBIND,
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_IP_FREEBIND,
       ENVOY_SOCKET_IPV6_FREEBIND, 1));
   return options;
 }
@@ -44,10 +44,10 @@ std::unique_ptr<Socket::Options> SocketOptionFactory::buildIpFreebindOptions() {
 std::unique_ptr<Socket::Options> SocketOptionFactory::buildIpTransparentOptions() {
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
   options->push_back(std::make_shared<Network::AddrFamilyAwareSocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_IP_TRANSPARENT,
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_IP_TRANSPARENT,
       ENVOY_SOCKET_IPV6_TRANSPARENT, 1));
   options->push_back(std::make_shared<Network::AddrFamilyAwareSocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_BOUND, ENVOY_SOCKET_IP_TRANSPARENT,
+      envoy::config::core::v3alpha::SocketOption::STATE_BOUND, ENVOY_SOCKET_IP_TRANSPARENT,
       ENVOY_SOCKET_IPV6_TRANSPARENT, 1));
   return options;
 }
@@ -57,22 +57,22 @@ std::unique_ptr<Socket::Options> SocketOptionFactory::buildSocketMarkOptions(uin
   // we need this to happen prior to binding or prior to connecting. In both cases, PREBIND will
   // fire.
   options->push_back(std::make_shared<Network::SocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_SO_MARK, mark));
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_SO_MARK, mark));
   return options;
 }
 
 std::unique_ptr<Socket::Options> SocketOptionFactory::buildLiteralOptions(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::SocketOption>& socket_options) {
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::SocketOption>& socket_options) {
   auto options = std::make_unique<Socket::Options>();
   for (const auto& socket_option : socket_options) {
     std::string buf;
     int int_value;
     switch (socket_option.value_case()) {
-    case envoy::api::v2::core::SocketOption::kIntValue:
+    case envoy::config::core::v3alpha::SocketOption::ValueCase::kIntValue:
       int_value = socket_option.int_value();
       buf.append(reinterpret_cast<char*>(&int_value), sizeof(int_value));
       break;
-    case envoy::api::v2::core::SocketOption::kBufValue:
+    case envoy::config::core::v3alpha::SocketOption::ValueCase::kBufValue:
       buf.append(socket_option.buf_value());
       break;
     default:
@@ -94,7 +94,7 @@ std::unique_ptr<Socket::Options>
 SocketOptionFactory::buildTcpFastOpenOptions(uint32_t queue_length) {
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
   options->push_back(std::make_shared<Network::SocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_LISTENING, ENVOY_SOCKET_TCP_FASTOPEN,
+      envoy::config::core::v3alpha::SocketOption::STATE_LISTENING, ENVOY_SOCKET_TCP_FASTOPEN,
       queue_length));
   return options;
 }
@@ -102,8 +102,8 @@ SocketOptionFactory::buildTcpFastOpenOptions(uint32_t queue_length) {
 std::unique_ptr<Socket::Options> SocketOptionFactory::buildIpPacketInfoOptions() {
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
   options->push_back(std::make_shared<AddrFamilyAwareSocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_BOUND, ENVOY_SELF_IP_ADDR, ENVOY_SELF_IPV6_ADDR,
-      1));
+      envoy::config::core::v3alpha::SocketOption::STATE_BOUND, ENVOY_SELF_IP_ADDR,
+      ENVOY_SELF_IPV6_ADDR, 1));
   return options;
 }
 
@@ -111,7 +111,7 @@ std::unique_ptr<Socket::Options> SocketOptionFactory::buildRxQueueOverFlowOption
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
 #ifdef SO_RXQ_OVFL
   options->push_back(std::make_shared<Network::SocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_BOUND,
+      envoy::config::core::v3alpha::SocketOption::STATE_BOUND,
       ENVOY_MAKE_SOCKET_OPTION_NAME(SOL_SOCKET, SO_RXQ_OVFL), 1));
 #endif
   return options;
@@ -120,7 +120,7 @@ std::unique_ptr<Socket::Options> SocketOptionFactory::buildRxQueueOverFlowOption
 std::unique_ptr<Socket::Options> SocketOptionFactory::buildReusePortOptions() {
   std::unique_ptr<Socket::Options> options = std::make_unique<Socket::Options>();
   options->push_back(std::make_shared<Network::SocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, ENVOY_SOCKET_SO_REUSEPORT, 1));
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, ENVOY_SOCKET_SO_REUSEPORT, 1));
   return options;
 }
 
diff --git a/source/common/network/socket_option_factory.h b/source/common/network/socket_option_factory.h
index ff7c9b962c80..40690041a50d 100644
--- a/source/common/network/socket_option_factory.h
+++ b/source/common/network/socket_option_factory.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/listen_socket.h"
 
 #include "common/common/logger.h"
@@ -28,7 +28,7 @@ class SocketOptionFactory : Logger::Loggable<Logger::Id::connection> {
   static std::unique_ptr<Socket::Options> buildSocketMarkOptions(uint32_t mark);
   static std::unique_ptr<Socket::Options> buildTcpFastOpenOptions(uint32_t queue_length);
   static std::unique_ptr<Socket::Options> buildLiteralOptions(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::core::SocketOption>& socket_options);
+      const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::SocketOption>& socket_options);
   static std::unique_ptr<Socket::Options> buildIpPacketInfoOptions();
   static std::unique_ptr<Socket::Options> buildRxQueueOverFlowOptions();
   static std::unique_ptr<Socket::Options> buildReusePortOptions();
diff --git a/source/common/network/socket_option_impl.cc b/source/common/network/socket_option_impl.cc
index b8439976009a..7e48bb033503 100644
--- a/source/common/network/socket_option_impl.cc
+++ b/source/common/network/socket_option_impl.cc
@@ -1,7 +1,7 @@
 #include "common/network/socket_option_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/api/os_sys_calls_impl.h"
 #include "common/common/assert.h"
@@ -11,8 +11,8 @@ namespace Envoy {
 namespace Network {
 
 // Socket::Option
-bool SocketOptionImpl::setOption(Socket& socket,
-                                 envoy::api::v2::core::SocketOption::SocketState state) const {
+bool SocketOptionImpl::setOption(
+    Socket& socket, envoy::config::core::v3alpha::SocketOption::SocketState state) const {
   if (in_state_ == state) {
     if (!optname_.has_value()) {
       ENVOY_LOG(warn, "Failed to set unsupported option on socket");
@@ -31,9 +31,8 @@ bool SocketOptionImpl::setOption(Socket& socket,
   return true;
 }
 
-absl::optional<Socket::Option::Details>
-SocketOptionImpl::getOptionDetails(const Socket&,
-                                   envoy::api::v2::core::SocketOption::SocketState state) const {
+absl::optional<Socket::Option::Details> SocketOptionImpl::getOptionDetails(
+    const Socket&, envoy::config::core::v3alpha::SocketOption::SocketState state) const {
   if (state != in_state_ || !isSupported()) {
     return absl::nullopt;
   }
diff --git a/source/common/network/socket_option_impl.h b/source/common/network/socket_option_impl.h
index 9262131c4daf..1e74c0c1feb3 100644
--- a/source/common/network/socket_option_impl.h
+++ b/source/common/network/socket_option_impl.h
@@ -1,8 +1,8 @@
 #pragma once
 
 #include "envoy/api/os_sys_calls.h"
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/listen_socket.h"
 
 #include "common/common/assert.h"
@@ -100,13 +100,13 @@ static_assert(IP_RECVDSTADDR == IP_SENDSRCADDR);
 
 class SocketOptionImpl : public Socket::Option, Logger::Loggable<Logger::Id::connection> {
 public:
-  SocketOptionImpl(envoy::api::v2::core::SocketOption::SocketState in_state,
+  SocketOptionImpl(envoy::config::core::v3alpha::SocketOption::SocketState in_state,
                    Network::SocketOptionName optname,
                    int value) // Yup, int. See setsockopt(2).
       : SocketOptionImpl(in_state, optname,
                          absl::string_view(reinterpret_cast<char*>(&value), sizeof(value))) {}
 
-  SocketOptionImpl(envoy::api::v2::core::SocketOption::SocketState in_state,
+  SocketOptionImpl(envoy::config::core::v3alpha::SocketOption::SocketState in_state,
                    Network::SocketOptionName optname, absl::string_view value)
       : in_state_(in_state), optname_(optname), value_(value.begin(), value.end()) {
     ASSERT(reinterpret_cast<uintptr_t>(value_.data()) % alignof(void*) == 0);
@@ -114,14 +114,14 @@ class SocketOptionImpl : public Socket::Option, Logger::Loggable<Logger::Id::con
 
   // Socket::Option
   bool setOption(Socket& socket,
-                 envoy::api::v2::core::SocketOption::SocketState state) const override;
+                 envoy::config::core::v3alpha::SocketOption::SocketState state) const override;
 
   // The common socket options don't require a hash key.
   void hashKey(std::vector<uint8_t>&) const override {}
 
   absl::optional<Details>
   getOptionDetails(const Socket& socket,
-                   envoy::api::v2::core::SocketOption::SocketState state) const override;
+                   envoy::config::core::v3alpha::SocketOption::SocketState state) const override;
 
   bool isSupported() const;
 
@@ -139,7 +139,7 @@ class SocketOptionImpl : public Socket::Option, Logger::Loggable<Logger::Id::con
                                                const void* value, size_t size);
 
 private:
-  const envoy::api::v2::core::SocketOption::SocketState in_state_;
+  const envoy::config::core::v3alpha::SocketOption::SocketState in_state_;
   const Network::SocketOptionName optname_;
   // This has to be a std::vector<uint8_t> but not std::string because std::string might inline
   // the buffer so its data() is not aligned in to alignof(void*).
diff --git a/source/common/network/udp_listener_impl.cc b/source/common/network/udp_listener_impl.cc
index 87e4df71a468..c3b8621624ac 100644
--- a/source/common/network/udp_listener_impl.cc
+++ b/source/common/network/udp_listener_impl.cc
@@ -4,10 +4,10 @@
 #include <csetjmp>
 #include <cstring>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/buffer/buffer.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/api/os_sys_calls_impl.h"
 #include "common/common/assert.h"
@@ -37,7 +37,7 @@ UdpListenerImpl::UdpListenerImpl(Event::DispatcherImpl& dispatcher, SocketShared
   ASSERT(file_event_);
 
   if (!Network::Socket::applyOptions(socket_->options(), *socket_,
-                                     envoy::api::v2::core::SocketOption::STATE_BOUND)) {
+                                     envoy::config::core::v3alpha::SocketOption::STATE_BOUND)) {
     throw CreateListenerException(fmt::format("cannot set post-bound socket option on socket: {}",
                                               socket_->localAddress()->asString()));
   }
diff --git a/source/common/network/utility.cc b/source/common/network/utility.cc
index aa04f122ccbb..4aa2bfb4f37d 100644
--- a/source/common/network/utility.cc
+++ b/source/common/network/utility.cc
@@ -6,9 +6,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/network/connection.h"
 
 #include "common/api/os_sys_calls_impl.h"
@@ -448,13 +448,13 @@ absl::uint128 Utility::flipOrder(const absl::uint128& input) {
 }
 
 Address::InstanceConstSharedPtr
-Utility::protobufAddressToAddress(const envoy::api::v2::core::Address& proto_address) {
+Utility::protobufAddressToAddress(const envoy::config::core::v3alpha::Address& proto_address) {
   switch (proto_address.address_case()) {
-  case envoy::api::v2::core::Address::kSocketAddress:
+  case envoy::config::core::v3alpha::Address::AddressCase::kSocketAddress:
     return Utility::parseInternetAddress(proto_address.socket_address().address(),
                                          proto_address.socket_address().port_value(),
                                          !proto_address.socket_address().ipv4_compat());
-  case envoy::api::v2::core::Address::kPipe:
+  case envoy::config::core::v3alpha::Address::AddressCase::kPipe:
     return std::make_shared<Address::PipeInstance>(proto_address.pipe().path(),
                                                    proto_address.pipe().mode());
   default:
@@ -463,7 +463,7 @@ Utility::protobufAddressToAddress(const envoy::api::v2::core::Address& proto_add
 }
 
 void Utility::addressToProtobufAddress(const Address::Instance& address,
-                                       envoy::api::v2::core::Address& proto_address) {
+                                       envoy::config::core::v3alpha::Address& proto_address) {
   if (address.type() == Address::Type::Pipe) {
     proto_address.mutable_pipe()->set_path(address.asString());
   } else {
@@ -475,20 +475,20 @@ void Utility::addressToProtobufAddress(const Address::Instance& address,
 }
 
 Address::SocketType
-Utility::protobufAddressSocketType(const envoy::api::v2::core::Address& proto_address) {
+Utility::protobufAddressSocketType(const envoy::config::core::v3alpha::Address& proto_address) {
   switch (proto_address.address_case()) {
-  case envoy::api::v2::core::Address::kSocketAddress: {
+  case envoy::config::core::v3alpha::Address::AddressCase::kSocketAddress: {
     const auto protocol = proto_address.socket_address().protocol();
     switch (protocol) {
-    case envoy::api::v2::core::SocketAddress::TCP:
+    case envoy::config::core::v3alpha::SocketAddress::TCP:
       return Address::SocketType::Stream;
-    case envoy::api::v2::core::SocketAddress::UDP:
+    case envoy::config::core::v3alpha::SocketAddress::UDP:
       return Address::SocketType::Datagram;
     default:
       NOT_REACHED_GCOVR_EXCL_LINE;
     }
   }
-  case envoy::api::v2::core::Address::kPipe:
+  case envoy::config::core::v3alpha::Address::AddressCase::kPipe:
     return Address::SocketType::Stream;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
diff --git a/source/common/network/utility.h b/source/common/network/utility.h
index 0d14c94b2d31..960062615942 100644
--- a/source/common/network/utility.h
+++ b/source/common/network/utility.h
@@ -4,8 +4,8 @@
 #include <list>
 #include <string>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/listener.h"
 
@@ -270,7 +270,7 @@ class Utility {
   static absl::uint128 Ip6htonl(const absl::uint128& address);
 
   static Address::InstanceConstSharedPtr
-  protobufAddressToAddress(const envoy::api::v2::core::Address& proto_address);
+  protobufAddressToAddress(const envoy::config::core::v3alpha::Address& proto_address);
 
   /**
    * Copies the address instance into the protobuf representation of an address.
@@ -278,7 +278,7 @@ class Utility {
    * @param proto_address is the protobuf address to which the address instance is copied into.
    */
   static void addressToProtobufAddress(const Address::Instance& address,
-                                       envoy::api::v2::core::Address& proto_address);
+                                       envoy::config::core::v3alpha::Address& proto_address);
 
   /**
    * Returns socket type corresponding to SocketAddress.protocol value of the
@@ -287,7 +287,7 @@ class Utility {
    * @return socket type
    */
   static Address::SocketType
-  protobufAddressSocketType(const envoy::api::v2::core::Address& proto_address);
+  protobufAddressSocketType(const envoy::config::core::v3alpha::Address& proto_address);
 
   /**
    * Send a packet via given UDP socket with specific source address.
diff --git a/source/common/protobuf/BUILD b/source/common/protobuf/BUILD
index 3f7f69b3c010..b4bc060c0c40 100644
--- a/source/common/protobuf/BUILD
+++ b/source/common/protobuf/BUILD
@@ -67,6 +67,6 @@ envoy_cc_library(
         "//source/common/common:utility_lib",
         "//source/common/config:api_type_oracle_lib",
         "//source/common/config:version_converter_lib",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/protobuf/utility.cc b/source/common/protobuf/utility.cc
index c352ee66409d..9a51c3882eff 100644
--- a/source/common/protobuf/utility.cc
+++ b/source/common/protobuf/utility.cc
@@ -4,7 +4,7 @@
 #include <numeric>
 
 #include "envoy/protobuf/message_validator.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -170,19 +170,20 @@ uint64_t convertPercent(double percent, uint64_t max_value) {
   return max_value * (percent / 100.0);
 }
 
-bool evaluateFractionalPercent(envoy::type::FractionalPercent percent, uint64_t random_value) {
+bool evaluateFractionalPercent(envoy::type::v3alpha::FractionalPercent percent,
+                               uint64_t random_value) {
   return random_value % fractionalPercentDenominatorToInt(percent.denominator()) <
          percent.numerator();
 }
 
 uint64_t fractionalPercentDenominatorToInt(
-    const envoy::type::FractionalPercent::DenominatorType& denominator) {
+    const envoy::type::v3alpha::FractionalPercent::DenominatorType& denominator) {
   switch (denominator) {
-  case envoy::type::FractionalPercent::HUNDRED:
+  case envoy::type::v3alpha::FractionalPercent::HUNDRED:
     return 100;
-  case envoy::type::FractionalPercent::TEN_THOUSAND:
+  case envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND:
     return 10000;
-  case envoy::type::FractionalPercent::MILLION:
+  case envoy::type::v3alpha::FractionalPercent::MILLION:
     return 1000000;
   default:
     // Checked by schema.
diff --git a/source/common/protobuf/utility.h b/source/common/protobuf/utility.h
index 9dde4e419950..02a4e838f50b 100644
--- a/source/common/protobuf/utility.h
+++ b/source/common/protobuf/utility.h
@@ -6,7 +6,7 @@
 #include "envoy/common/exception.h"
 #include "envoy/protobuf/message_validator.h"
 #include "envoy/runtime/runtime.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/common/hash.h"
 #include "common/common/utility.h"
@@ -71,7 +71,8 @@ uint64_t convertPercent(double percent, uint64_t max_value);
  * @param random_value supplies a numerical value to use to evaluate the event.
  * @return bool decision about whether the event should occur.
  */
-bool evaluateFractionalPercent(envoy::type::FractionalPercent percent, uint64_t random_value);
+bool evaluateFractionalPercent(envoy::type::v3alpha::FractionalPercent percent,
+                               uint64_t random_value);
 
 /**
  * Convert a fractional percent denominator enum into an integer.
@@ -79,7 +80,7 @@ bool evaluateFractionalPercent(envoy::type::FractionalPercent percent, uint64_t
  * @return the converted denominator.
  */
 uint64_t fractionalPercentDenominatorToInt(
-    const envoy::type::FractionalPercent::DenominatorType& denominator);
+    const envoy::type::v3alpha::FractionalPercent::DenominatorType& denominator);
 
 } // namespace ProtobufPercentHelper
 } // namespace Envoy
diff --git a/source/common/router/BUILD b/source/common/router/BUILD
index bd846a2e4e68..b0e044d842ee 100644
--- a/source/common/router/BUILD
+++ b/source/common/router/BUILD
@@ -23,7 +23,7 @@ envoy_cc_library(
     hdrs = ["tls_context_match_criteria_impl.h"],
     deps = [
         "//include/envoy/router:router_interface",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -61,11 +61,10 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/filters/http:well_known_names",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -82,9 +81,9 @@ envoy_cc_library(
         "//source/common/http:headers_lib",
         "//source/common/http:utility_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -110,8 +109,8 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/common:minimal_logger_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -136,9 +135,10 @@ envoy_cc_library(
         "//source/common/init:target_lib",
         "//source/common/protobuf:utility_lib",
         "//source/common/router:route_config_update_impl_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
         "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -170,11 +170,12 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/router:route_config_update_impl_lib",
         "//source/common/router:vhds_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -190,8 +191,8 @@ envoy_cc_library(
         "//include/envoy/router:rds_interface",
         "//include/envoy/router:scopes_interface",
         "//include/envoy/thread_local:thread_local_interface",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -213,11 +214,12 @@ envoy_cc_library(
         "//source/common/config:config_provider_lib",
         "//source/common/init:manager_lib",
         "//source/common/init:watcher_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -241,7 +243,7 @@ envoy_cc_library(
         "//source/common/http:header_utility_lib",
         "//source/common/http:headers_lib",
         "//source/common/http:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -291,7 +293,7 @@ envoy_cc_library(
         "//source/common/stream_info:stream_info_lib",
         "//source/common/tracing:http_tracer_lib",
         "//source/common/upstream:load_balancer_lib",
-        "@envoy_api//envoy/config/filter/http/router/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/router/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -307,7 +309,7 @@ envoy_cc_library(
         "//source/common/common:empty_string",
         "//source/common/http:header_utility_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -332,7 +334,7 @@ envoy_cc_library(
         "//include/envoy/http:header_map_interface",
         "//source/common/http:headers_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/router/config_impl.cc b/source/common/router/config_impl.cc
index 9689bfb1940e..6088635795c9 100644
--- a/source/common/router/config_impl.cc
+++ b/source/common/router/config_impl.cc
@@ -8,13 +8,13 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/runtime/runtime.h"
-#include "envoy/type/matcher/string.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 #include "envoy/upstream/upstream.h"
 
@@ -44,11 +44,11 @@ namespace Router {
 namespace {
 
 InternalRedirectAction
-convertInternalRedirectAction(const envoy::api::v2::route::RouteAction& route) {
+convertInternalRedirectAction(const envoy::config::route::v3alpha::RouteAction& route) {
   switch (route.internal_redirect_action()) {
-  case envoy::api::v2::route::RouteAction::PASS_THROUGH_INTERNAL_REDIRECT:
+  case envoy::config::route::v3alpha::RouteAction::PASS_THROUGH_INTERNAL_REDIRECT:
     return InternalRedirectAction::PassThrough;
-  case envoy::api::v2::route::RouteAction::HANDLE_INTERNAL_REDIRECT:
+  case envoy::config::route::v3alpha::RouteAction::HANDLE_INTERNAL_REDIRECT:
     return InternalRedirectAction::Handle;
   default:
     return InternalRedirectAction::PassThrough;
@@ -61,14 +61,14 @@ std::string SslRedirector::newPath(const Http::HeaderMap& headers) const {
   return Http::Utility::createSslRedirectPath(headers);
 }
 
-HedgePolicyImpl::HedgePolicyImpl(const envoy::api::v2::route::HedgePolicy& hedge_policy)
+HedgePolicyImpl::HedgePolicyImpl(const envoy::config::route::v3alpha::HedgePolicy& hedge_policy)
     : initial_requests_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(hedge_policy, initial_requests, 1)),
       additional_request_chance_(hedge_policy.additional_request_chance()),
       hedge_on_per_try_timeout_(hedge_policy.hedge_on_per_try_timeout()) {}
 
 HedgePolicyImpl::HedgePolicyImpl() : initial_requests_(1), hedge_on_per_try_timeout_(false) {}
 
-RetryPolicyImpl::RetryPolicyImpl(const envoy::api::v2::route::RetryPolicy& retry_policy,
+RetryPolicyImpl::RetryPolicyImpl(const envoy::config::route::v3alpha::RetryPolicy& retry_policy,
                                  ProtobufMessage::ValidationVisitor& validation_visitor)
     : retriable_headers_(
           Http::HeaderUtility::buildHeaderMatcherVector(retry_policy.retriable_headers())),
@@ -153,20 +153,22 @@ Upstream::RetryPrioritySharedPtr RetryPolicyImpl::retryPriority() const {
                                      num_retries_);
 }
 
-CorsPolicyImpl::CorsPolicyImpl(const envoy::api::v2::route::CorsPolicy& config,
+CorsPolicyImpl::CorsPolicyImpl(const envoy::config::route::v3alpha::CorsPolicy& config,
                                Runtime::Loader& loader)
     : config_(config), loader_(loader), allow_methods_(config.allow_methods()),
       allow_headers_(config.allow_headers()), expose_headers_(config.expose_headers()),
       max_age_(config.max_age()),
-      legacy_enabled_(config.has_enabled() ? config.enabled().value() : true) {
-  for (const auto& origin : config.allow_origin()) {
-    envoy::type::matcher::StringMatcher matcher_config;
+      legacy_enabled_(config.has_hidden_envoy_deprecated_enabled()
+                          ? config.hidden_envoy_deprecated_enabled().value()
+                          : true) {
+  for (const auto& origin : config.hidden_envoy_deprecated_allow_origin()) {
+    envoy::type::matcher::v3alpha::StringMatcher matcher_config;
     matcher_config.set_exact(origin);
     allow_origins_.push_back(std::make_unique<Matchers::StringMatcherImpl>(matcher_config));
   }
-  for (const auto& regex : config.allow_origin_regex()) {
-    envoy::type::matcher::StringMatcher matcher_config;
-    matcher_config.set_regex(regex);
+  for (const auto& regex : config.hidden_envoy_deprecated_allow_origin_regex()) {
+    envoy::type::matcher::v3alpha::StringMatcher matcher_config;
+    matcher_config.set_hidden_envoy_deprecated_regex(regex);
     allow_origins_.push_back(std::make_unique<Matchers::StringMatcherImpl>(matcher_config));
   }
   for (const auto& string_match : config.allow_origin_string_match()) {
@@ -185,12 +187,12 @@ ShadowPolicyImpl::ShadowPolicyImpl(const RequestMirrorPolicy& config) {
     runtime_key_ = config.runtime_fraction().runtime_key();
     default_value_ = config.runtime_fraction().default_value();
   } else {
-    runtime_key_ = config.runtime_key();
+    runtime_key_ = config.hidden_envoy_deprecated_runtime_key();
     default_value_.set_numerator(0);
   }
 }
 
-DecoratorImpl::DecoratorImpl(const envoy::api::v2::route::Decorator& decorator)
+DecoratorImpl::DecoratorImpl(const envoy::config::route::v3alpha::Decorator& decorator)
     : operation_(decorator.operation()) {}
 
 void DecoratorImpl::apply(Tracing::Span& span) const {
@@ -201,22 +203,22 @@ void DecoratorImpl::apply(Tracing::Span& span) const {
 
 const std::string& DecoratorImpl::getOperation() const { return operation_; }
 
-RouteTracingImpl::RouteTracingImpl(const envoy::api::v2::route::Tracing& tracing) {
+RouteTracingImpl::RouteTracingImpl(const envoy::config::route::v3alpha::Tracing& tracing) {
   if (!tracing.has_client_sampling()) {
     client_sampling_.set_numerator(100);
-    client_sampling_.set_denominator(envoy::type::FractionalPercent::HUNDRED);
+    client_sampling_.set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   } else {
     client_sampling_ = tracing.client_sampling();
   }
   if (!tracing.has_random_sampling()) {
     random_sampling_.set_numerator(100);
-    random_sampling_.set_denominator(envoy::type::FractionalPercent::HUNDRED);
+    random_sampling_.set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   } else {
     random_sampling_ = tracing.random_sampling();
   }
   if (!tracing.has_overall_sampling()) {
     overall_sampling_.set_numerator(100);
-    overall_sampling_.set_denominator(envoy::type::FractionalPercent::HUNDRED);
+    overall_sampling_.set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   } else {
     overall_sampling_ = tracing.overall_sampling();
   }
@@ -225,30 +227,30 @@ RouteTracingImpl::RouteTracingImpl(const envoy::api::v2::route::Tracing& tracing
   }
 }
 
-const envoy::type::FractionalPercent& RouteTracingImpl::getClientSampling() const {
+const envoy::type::v3alpha::FractionalPercent& RouteTracingImpl::getClientSampling() const {
   return client_sampling_;
 }
 
-const envoy::type::FractionalPercent& RouteTracingImpl::getRandomSampling() const {
+const envoy::type::v3alpha::FractionalPercent& RouteTracingImpl::getRandomSampling() const {
   return random_sampling_;
 }
 
-const envoy::type::FractionalPercent& RouteTracingImpl::getOverallSampling() const {
+const envoy::type::v3alpha::FractionalPercent& RouteTracingImpl::getOverallSampling() const {
   return overall_sampling_;
 }
 const Tracing::CustomTagMap& RouteTracingImpl::getCustomTags() const { return custom_tags_; }
 
 RouteEntryImplBase::RouteEntryImplBase(const VirtualHostImpl& vhost,
-                                       const envoy::api::v2::route::Route& route,
+                                       const envoy::config::route::v3alpha::Route& route,
                                        Server::Configuration::ServerFactoryContext& factory_context,
                                        ProtobufMessage::ValidationVisitor& validator)
     : case_sensitive_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(route.match(), case_sensitive, true)),
-      prefix_rewrite_(route.route().prefix_rewrite()), host_rewrite_(route.route().host_rewrite()),
-      vhost_(vhost),
+      prefix_rewrite_(route.route().prefix_rewrite()),
+      host_rewrite_(route.route().host_rewrite_literal()), vhost_(vhost),
       auto_host_rewrite_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(route.route(), auto_host_rewrite, false)),
-      auto_host_rewrite_header_(!route.route().auto_host_rewrite_header().empty()
+      auto_host_rewrite_header_(!route.route().host_rewrite_header().empty()
                                     ? absl::optional<Http::LowerCaseString>(Http::LowerCaseString(
-                                          route.route().auto_host_rewrite_header()))
+                                          route.route().host_rewrite_header()))
                                     : absl::nullopt),
       cluster_name_(route.route().cluster()), cluster_header_name_(route.route().cluster_header()),
       cluster_not_found_response_code_(ConfigUtility::parseClusterNotFoundResponseCode(
@@ -285,8 +287,9 @@ RouteEntryImplBase::RouteEntryImplBase(const VirtualHostImpl& vhost,
       decorator_(parseDecorator(route)), route_tracing_(parseRouteTracing(route)),
       direct_response_code_(ConfigUtility::parseDirectResponseCode(route)),
       direct_response_body_(ConfigUtility::parseDirectResponseBody(route, factory_context.api())),
-      per_filter_configs_(route.typed_per_filter_config(), route.per_filter_config(),
-                          factory_context, validator),
+      per_filter_configs_(route.typed_per_filter_config(),
+                          route.hidden_envoy_deprecated_per_filter_config(), factory_context,
+                          validator),
       route_name_(route.name()), time_source_(factory_context.dispatcher().timeSource()),
       internal_redirect_action_(convertInternalRedirectAction(route.route())) {
   if (route.route().has_metadata_match()) {
@@ -298,7 +301,7 @@ RouteEntryImplBase::RouteEntryImplBase(const VirtualHostImpl& vhost,
   }
 
   if (!route.route().request_mirror_policies().empty()) {
-    if (route.route().has_request_mirror_policy()) {
+    if (route.route().has_hidden_envoy_deprecated_request_mirror_policy()) {
       // protobuf does not allow `oneof` to contain a field labeled `repeated`, so we do our own
       // xor-like check.
       // https://github.com/protocolbuffers/protobuf/issues/2592
@@ -310,9 +313,9 @@ RouteEntryImplBase::RouteEntryImplBase(const VirtualHostImpl& vhost,
     for (const auto& mirror_policy_config : route.route().request_mirror_policies()) {
       shadow_policies_.push_back(std::make_unique<ShadowPolicyImpl>(mirror_policy_config));
     }
-  } else if (route.route().has_request_mirror_policy()) {
-    shadow_policies_.push_back(
-        std::make_unique<ShadowPolicyImpl>(route.route().request_mirror_policy()));
+  } else if (route.route().has_hidden_envoy_deprecated_request_mirror_policy()) {
+    shadow_policies_.push_back(std::make_unique<ShadowPolicyImpl>(
+        route.route().hidden_envoy_deprecated_request_mirror_policy()));
   }
 
   // If this is a weighted_cluster, we create N internal route entries
@@ -321,7 +324,7 @@ RouteEntryImplBase::RouteEntryImplBase(const VirtualHostImpl& vhost,
   // from the weighted cluster (if any) are merged with and override
   // the criteria from the route.
   if (route.route().cluster_specifier_case() ==
-      envoy::api::v2::route::RouteAction::kWeightedClusters) {
+      envoy::config::route::v3alpha::RouteAction::ClusterSpecifierCase::kWeightedClusters) {
     ASSERT(total_cluster_weight_ > 0);
 
     uint64_t total_weight = 0UL;
@@ -488,7 +491,7 @@ void RouteEntryImplBase::finalizeResponseHeaders(Http::HeaderMap& headers,
 }
 
 absl::optional<RouteEntryImplBase::RuntimeData>
-RouteEntryImplBase::loadRuntimeData(const envoy::api::v2::route::RouteMatch& route_match) {
+RouteEntryImplBase::loadRuntimeData(const envoy::config::route::v3alpha::RouteMatch& route_match) {
   absl::optional<RuntimeData> runtime;
   RuntimeData runtime_data;
 
@@ -604,7 +607,7 @@ std::string RouteEntryImplBase::newPath(const Http::HeaderMap& headers) const {
 }
 
 std::multimap<std::string, std::string>
-RouteEntryImplBase::parseOpaqueConfig(const envoy::api::v2::route::Route& route) {
+RouteEntryImplBase::parseOpaqueConfig(const envoy::config::route::v3alpha::Route& route) {
   std::multimap<std::string, std::string> ret;
   if (route.has_metadata()) {
     const auto filter_metadata = route.metadata().filter_metadata().find(
@@ -622,8 +625,8 @@ RouteEntryImplBase::parseOpaqueConfig(const envoy::api::v2::route::Route& route)
 }
 
 HedgePolicyImpl RouteEntryImplBase::buildHedgePolicy(
-    const absl::optional<envoy::api::v2::route::HedgePolicy>& vhost_hedge_policy,
-    const envoy::api::v2::route::RouteAction& route_config) const {
+    const absl::optional<envoy::config::route::v3alpha::HedgePolicy>& vhost_hedge_policy,
+    const envoy::config::route::v3alpha::RouteAction& route_config) const {
   // Route specific policy wins, if available.
   if (route_config.has_hedge_policy()) {
     return HedgePolicyImpl(route_config.hedge_policy());
@@ -639,8 +642,8 @@ HedgePolicyImpl RouteEntryImplBase::buildHedgePolicy(
 }
 
 RetryPolicyImpl RouteEntryImplBase::buildRetryPolicy(
-    const absl::optional<envoy::api::v2::route::RetryPolicy>& vhost_retry_policy,
-    const envoy::api::v2::route::RouteAction& route_config,
+    const absl::optional<envoy::config::route::v3alpha::RetryPolicy>& vhost_retry_policy,
+    const envoy::config::route::v3alpha::RouteAction& route_config,
     ProtobufMessage::ValidationVisitor& validation_visitor) const {
   // Route specific policy wins, if available.
   if (route_config.has_retry_policy()) {
@@ -656,7 +659,8 @@ RetryPolicyImpl RouteEntryImplBase::buildRetryPolicy(
   return RetryPolicyImpl();
 }
 
-DecoratorConstPtr RouteEntryImplBase::parseDecorator(const envoy::api::v2::route::Route& route) {
+DecoratorConstPtr
+RouteEntryImplBase::parseDecorator(const envoy::config::route::v3alpha::Route& route) {
   DecoratorConstPtr ret;
   if (route.has_decorator()) {
     ret = DecoratorConstPtr(new DecoratorImpl(route.decorator()));
@@ -665,7 +669,7 @@ DecoratorConstPtr RouteEntryImplBase::parseDecorator(const envoy::api::v2::route
 }
 
 RouteTracingConstPtr
-RouteEntryImplBase::parseRouteTracing(const envoy::api::v2::route::Route& route) {
+RouteEntryImplBase::parseRouteTracing(const envoy::config::route::v3alpha::Route& route) {
   RouteTracingConstPtr ret;
   if (route.has_tracing()) {
     ret = RouteTracingConstPtr(new RouteTracingImpl(route.tracing()));
@@ -753,7 +757,7 @@ RouteEntryImplBase::WeightedClusterEntry::WeightedClusterEntry(
     const RouteEntryImplBase* parent, const std::string& runtime_key,
     Server::Configuration::ServerFactoryContext& factory_context,
     ProtobufMessage::ValidationVisitor& validator,
-    const envoy::api::v2::route::WeightedCluster_ClusterWeight& cluster)
+    const envoy::config::route::v3alpha::WeightedCluster::ClusterWeight& cluster)
     : DynamicRouteEntry(parent, cluster.name()), runtime_key_(runtime_key),
       loader_(factory_context.runtime()),
       cluster_weight_(PROTOBUF_GET_WRAPPED_REQUIRED(cluster, weight)),
@@ -761,8 +765,9 @@ RouteEntryImplBase::WeightedClusterEntry::WeightedClusterEntry(
                                                       cluster.request_headers_to_remove())),
       response_headers_parser_(HeaderParser::configure(cluster.response_headers_to_add(),
                                                        cluster.response_headers_to_remove())),
-      per_filter_configs_(cluster.typed_per_filter_config(), cluster.per_filter_config(),
-                          factory_context, validator) {
+      per_filter_configs_(cluster.typed_per_filter_config(),
+                          cluster.hidden_envoy_deprecated_per_filter_config(), factory_context,
+                          validator) {
   if (cluster.has_metadata_match()) {
     const auto filter_it = cluster.metadata_match().filter_metadata().find(
         Envoy::Config::MetadataFilters::get().ENVOY_LB);
@@ -785,7 +790,7 @@ RouteEntryImplBase::WeightedClusterEntry::perFilterConfig(const std::string& nam
 }
 
 PrefixRouteEntryImpl::PrefixRouteEntryImpl(
-    const VirtualHostImpl& vhost, const envoy::api::v2::route::Route& route,
+    const VirtualHostImpl& vhost, const envoy::config::route::v3alpha::Route& route,
     Server::Configuration::ServerFactoryContext& factory_context,
     ProtobufMessage::ValidationVisitor& validator)
     : RouteEntryImplBase(vhost, route, factory_context, validator),
@@ -809,7 +814,7 @@ RouteConstSharedPtr PrefixRouteEntryImpl::matches(const Http::HeaderMap& headers
 }
 
 PathRouteEntryImpl::PathRouteEntryImpl(const VirtualHostImpl& vhost,
-                                       const envoy::api::v2::route::Route& route,
+                                       const envoy::config::route::v3alpha::Route& route,
                                        Server::Configuration::ServerFactoryContext& factory_context,
                                        ProtobufMessage::ValidationVisitor& validator)
     : RouteEntryImplBase(vhost, route, factory_context, validator), path_(route.match().path()) {}
@@ -850,15 +855,18 @@ RouteConstSharedPtr PathRouteEntryImpl::matches(const Http::HeaderMap& headers,
 }
 
 RegexRouteEntryImpl::RegexRouteEntryImpl(
-    const VirtualHostImpl& vhost, const envoy::api::v2::route::Route& route,
+    const VirtualHostImpl& vhost, const envoy::config::route::v3alpha::Route& route,
     Server::Configuration::ServerFactoryContext& factory_context,
     ProtobufMessage::ValidationVisitor& validator)
     : RouteEntryImplBase(vhost, route, factory_context, validator) {
-  if (route.match().path_specifier_case() == envoy::api::v2::route::RouteMatch::kRegex) {
-    regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(route.match().regex());
-    regex_str_ = route.match().regex();
+  if (route.match().path_specifier_case() ==
+      envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kHiddenEnvoyDeprecatedRegex) {
+    regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(
+        route.match().hidden_envoy_deprecated_regex());
+    regex_str_ = route.match().hidden_envoy_deprecated_regex();
   } else {
-    ASSERT(route.match().path_specifier_case() == envoy::api::v2::route::RouteMatch::kSafeRegex);
+    ASSERT(route.match().path_specifier_case() ==
+           envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kSafeRegex);
     regex_ = Regex::Utility::parseRegex(route.match().safe_regex());
     regex_str_ = route.match().safe_regex().regex();
   }
@@ -890,7 +898,7 @@ RouteConstSharedPtr RegexRouteEntryImpl::matches(const Http::HeaderMap& headers,
   return nullptr;
 }
 
-VirtualHostImpl::VirtualHostImpl(const envoy::api::v2::route::VirtualHost& virtual_host,
+VirtualHostImpl::VirtualHostImpl(const envoy::config::route::v3alpha::VirtualHost& virtual_host,
                                  const ConfigImpl& global_route_config,
                                  Server::Configuration::ServerFactoryContext& factory_context,
                                  ProtobufMessage::ValidationVisitor& validator,
@@ -902,21 +910,22 @@ VirtualHostImpl::VirtualHostImpl(const envoy::api::v2::route::VirtualHost& virtu
                                                       virtual_host.request_headers_to_remove())),
       response_headers_parser_(HeaderParser::configure(virtual_host.response_headers_to_add(),
                                                        virtual_host.response_headers_to_remove())),
-      per_filter_configs_(virtual_host.typed_per_filter_config(), virtual_host.per_filter_config(),
-                          factory_context, validator),
+      per_filter_configs_(virtual_host.typed_per_filter_config(),
+                          virtual_host.hidden_envoy_deprecated_per_filter_config(), factory_context,
+                          validator),
       retry_shadow_buffer_limit_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
           virtual_host, per_request_buffer_limit_bytes, std::numeric_limits<uint32_t>::max())),
       include_attempt_count_(virtual_host.include_request_attempt_count()),
       virtual_cluster_catch_all_(stat_name_pool_) {
 
   switch (virtual_host.require_tls()) {
-  case envoy::api::v2::route::VirtualHost::NONE:
+  case envoy::config::route::v3alpha::VirtualHost::NONE:
     ssl_requirements_ = SslRequirements::None;
     break;
-  case envoy::api::v2::route::VirtualHost::EXTERNAL_ONLY:
+  case envoy::config::route::v3alpha::VirtualHost::EXTERNAL_ONLY:
     ssl_requirements_ = SslRequirements::ExternalOnly;
     break;
-  case envoy::api::v2::route::VirtualHost::ALL:
+  case envoy::config::route::v3alpha::VirtualHost::ALL:
     ssl_requirements_ = SslRequirements::All;
     break;
   default:
@@ -933,20 +942,20 @@ VirtualHostImpl::VirtualHostImpl(const envoy::api::v2::route::VirtualHost& virtu
 
   for (const auto& route : virtual_host.routes()) {
     switch (route.match().path_specifier_case()) {
-    case envoy::api::v2::route::RouteMatch::kPrefix: {
+    case envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kPrefix: {
       routes_.emplace_back(new PrefixRouteEntryImpl(*this, route, factory_context, validator));
       break;
     }
-    case envoy::api::v2::route::RouteMatch::kPath: {
+    case envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kPath: {
       routes_.emplace_back(new PathRouteEntryImpl(*this, route, factory_context, validator));
       break;
     }
-    case envoy::api::v2::route::RouteMatch::kRegex:
-    case envoy::api::v2::route::RouteMatch::kSafeRegex: {
+    case envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kHiddenEnvoyDeprecatedRegex:
+    case envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kSafeRegex: {
       routes_.emplace_back(new RegexRouteEntryImpl(*this, route, factory_context, validator));
       break;
     }
-    case envoy::api::v2::route::RouteMatch::PATH_SPECIFIER_NOT_SET:
+    case envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::PATH_SPECIFIER_NOT_SET:
       NOT_REACHED_GCOVR_EXCL_LINE;
     }
 
@@ -972,27 +981,30 @@ VirtualHostImpl::VirtualHostImpl(const envoy::api::v2::route::VirtualHost& virtu
 }
 
 VirtualHostImpl::VirtualClusterEntry::VirtualClusterEntry(
-    const envoy::api::v2::route::VirtualCluster& virtual_cluster, Stats::StatNamePool& pool)
+    const envoy::config::route::v3alpha::VirtualCluster& virtual_cluster, Stats::StatNamePool& pool)
     : stat_name_(pool.add(virtual_cluster.name())) {
-  if (virtual_cluster.pattern().empty() == virtual_cluster.headers().empty()) {
+  if (virtual_cluster.hidden_envoy_deprecated_pattern().empty() ==
+      virtual_cluster.headers().empty()) {
     throw EnvoyException("virtual clusters must define either 'pattern' or 'headers'");
   }
 
-  if (!virtual_cluster.pattern().empty()) {
-    envoy::api::v2::route::HeaderMatcher matcher_config;
+  if (!virtual_cluster.hidden_envoy_deprecated_pattern().empty()) {
+    envoy::config::route::v3alpha::HeaderMatcher matcher_config;
     matcher_config.set_name(Http::Headers::get().Path.get());
-    matcher_config.set_regex_match(virtual_cluster.pattern());
+    matcher_config.set_hidden_envoy_deprecated_regex_match(
+        virtual_cluster.hidden_envoy_deprecated_pattern());
     headers_.push_back(std::make_unique<Http::HeaderUtility::HeaderData>(matcher_config));
   } else {
     ASSERT(!virtual_cluster.headers().empty());
     headers_ = Http::HeaderUtility::buildHeaderDataVector(virtual_cluster.headers());
   }
 
-  if (virtual_cluster.method() != envoy::api::v2::core::RequestMethod::METHOD_UNSPECIFIED) {
-    envoy::api::v2::route::HeaderMatcher matcher_config;
+  if (virtual_cluster.hidden_envoy_deprecated_method() !=
+      envoy::config::core::v3alpha::METHOD_UNSPECIFIED) {
+    envoy::config::route::v3alpha::HeaderMatcher matcher_config;
     matcher_config.set_name(Http::Headers::get().Method.get());
-    matcher_config.set_exact_match(
-        envoy::api::v2::core::RequestMethod_Name(virtual_cluster.method()));
+    matcher_config.set_exact_match(envoy::config::core::v3alpha::RequestMethod_Name(
+        virtual_cluster.hidden_envoy_deprecated_method()));
     headers_.push_back(std::make_unique<Http::HeaderUtility::HeaderData>(matcher_config));
   }
 }
@@ -1025,7 +1037,7 @@ const VirtualHostImpl* RouteMatcher::findWildcardVirtualHost(
   return nullptr;
 }
 
-RouteMatcher::RouteMatcher(const envoy::api::v2::RouteConfiguration& route_config,
+RouteMatcher::RouteMatcher(const envoy::config::route::v3alpha::RouteConfiguration& route_config,
                            const ConfigImpl& global_route_config,
                            Server::Configuration::ServerFactoryContext& factory_context,
                            ProtobufMessage::ValidationVisitor& validator, bool validate_clusters) {
@@ -1158,7 +1170,7 @@ VirtualHostImpl::virtualClusterFromEntries(const Http::HeaderMap& headers) const
   return nullptr;
 }
 
-ConfigImpl::ConfigImpl(const envoy::api::v2::RouteConfiguration& config,
+ConfigImpl::ConfigImpl(const envoy::config::route::v3alpha::RouteConfiguration& config,
                        Server::Configuration::ServerFactoryContext& factory_context,
                        ProtobufMessage::ValidationVisitor& validator,
                        bool validate_clusters_default)
diff --git a/source/common/router/config_impl.h b/source/common/router/config_impl.h
index 3f010bad0f8a..94bba3715fb4 100644
--- a/source/common/router/config_impl.h
+++ b/source/common/router/config_impl.h
@@ -10,13 +10,13 @@
 #include <unordered_map>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/router/router.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/server/filter_config.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "common/config/metadata.h"
@@ -107,7 +107,7 @@ class SslRedirectRoute : public Route {
  */
 class CorsPolicyImpl : public CorsPolicy {
 public:
-  CorsPolicyImpl(const envoy::api::v2::route::CorsPolicy& config, Runtime::Loader& loader);
+  CorsPolicyImpl(const envoy::config::route::v3alpha::CorsPolicy& config, Runtime::Loader& loader);
 
   // Router::CorsPolicy
   const std::vector<Matchers::StringMatcherPtr>& allowOrigins() const override {
@@ -136,7 +136,7 @@ class CorsPolicyImpl : public CorsPolicy {
   };
 
 private:
-  const envoy::api::v2::route::CorsPolicy config_;
+  const envoy::config::route::v3alpha::CorsPolicy config_;
   Runtime::Loader& loader_;
   std::vector<Matchers::StringMatcherPtr> allow_origins_;
   const std::string allow_methods_;
@@ -153,7 +153,7 @@ class ConfigImpl;
  */
 class VirtualHostImpl : public VirtualHost {
 public:
-  VirtualHostImpl(const envoy::api::v2::route::VirtualHost& virtual_host,
+  VirtualHostImpl(const envoy::config::route::v3alpha::VirtualHost& virtual_host,
                   const ConfigImpl& global_route_config,
                   Server::Configuration::ServerFactoryContext& factory_context,
                   ProtobufMessage::ValidationVisitor& validator, bool validate_clusters);
@@ -173,10 +173,10 @@ class VirtualHostImpl : public VirtualHost {
   const Config& routeConfig() const override;
   const RouteSpecificFilterConfig* perFilterConfig(const std::string&) const override;
   bool includeAttemptCount() const override { return include_attempt_count_; }
-  const absl::optional<envoy::api::v2::route::RetryPolicy>& retryPolicy() const {
+  const absl::optional<envoy::config::route::v3alpha::RetryPolicy>& retryPolicy() const {
     return retry_policy_;
   }
-  const absl::optional<envoy::api::v2::route::HedgePolicy>& hedgePolicy() const {
+  const absl::optional<envoy::config::route::v3alpha::HedgePolicy>& hedgePolicy() const {
     return hedge_policy_;
   }
   uint32_t retryShadowBufferLimit() const override { return retry_shadow_buffer_limit_; }
@@ -185,7 +185,7 @@ class VirtualHostImpl : public VirtualHost {
   enum class SslRequirements { None, ExternalOnly, All };
 
   struct VirtualClusterEntry : public VirtualCluster {
-    VirtualClusterEntry(const envoy::api::v2::route::VirtualCluster& virtual_cluster,
+    VirtualClusterEntry(const envoy::config::route::v3alpha::VirtualCluster& virtual_cluster,
                         Stats::StatNamePool& pool);
 
     // Router::VirtualCluster
@@ -222,8 +222,8 @@ class VirtualHostImpl : public VirtualHost {
   PerFilterConfigs per_filter_configs_;
   uint32_t retry_shadow_buffer_limit_{std::numeric_limits<uint32_t>::max()};
   const bool include_attempt_count_;
-  absl::optional<envoy::api::v2::route::RetryPolicy> retry_policy_;
-  absl::optional<envoy::api::v2::route::HedgePolicy> hedge_policy_;
+  absl::optional<envoy::config::route::v3alpha::RetryPolicy> retry_policy_;
+  absl::optional<envoy::config::route::v3alpha::HedgePolicy> hedge_policy_;
   const CatchAllVirtualCluster virtual_cluster_catch_all_;
 };
 
@@ -235,7 +235,7 @@ using VirtualHostSharedPtr = std::shared_ptr<VirtualHostImpl>;
 class RetryPolicyImpl : public RetryPolicy {
 
 public:
-  RetryPolicyImpl(const envoy::api::v2::route::RetryPolicy& retry_policy,
+  RetryPolicyImpl(const envoy::config::route::v3alpha::RetryPolicy& retry_policy,
                   ProtobufMessage::ValidationVisitor& validation_visitor);
   RetryPolicyImpl() = default;
 
@@ -283,18 +283,20 @@ class RetryPolicyImpl : public RetryPolicy {
  */
 class ShadowPolicyImpl : public ShadowPolicy {
 public:
-  using RequestMirrorPolicy = envoy::api::v2::route::RouteAction::RequestMirrorPolicy;
+  using RequestMirrorPolicy = envoy::config::route::v3alpha::RouteAction::RequestMirrorPolicy;
   explicit ShadowPolicyImpl(const RequestMirrorPolicy& config);
 
   // Router::ShadowPolicy
   const std::string& cluster() const override { return cluster_; }
   const std::string& runtimeKey() const override { return runtime_key_; }
-  const envoy::type::FractionalPercent& defaultValue() const override { return default_value_; }
+  const envoy::type::v3alpha::FractionalPercent& defaultValue() const override {
+    return default_value_;
+  }
 
 private:
   std::string cluster_;
   std::string runtime_key_;
-  envoy::type::FractionalPercent default_value_;
+  envoy::type::v3alpha::FractionalPercent default_value_;
 };
 
 /**
@@ -303,19 +305,19 @@ class ShadowPolicyImpl : public ShadowPolicy {
 class HedgePolicyImpl : public HedgePolicy {
 
 public:
-  explicit HedgePolicyImpl(const envoy::api::v2::route::HedgePolicy& hedge_policy);
+  explicit HedgePolicyImpl(const envoy::config::route::v3alpha::HedgePolicy& hedge_policy);
   HedgePolicyImpl();
 
   // Router::HedgePolicy
   uint32_t initialRequests() const override { return initial_requests_; }
-  const envoy::type::FractionalPercent& additionalRequestChance() const override {
+  const envoy::type::v3alpha::FractionalPercent& additionalRequestChance() const override {
     return additional_request_chance_;
   }
   bool hedgeOnPerTryTimeout() const override { return hedge_on_per_try_timeout_; }
 
 private:
   const uint32_t initial_requests_;
-  const envoy::type::FractionalPercent additional_request_chance_;
+  const envoy::type::v3alpha::FractionalPercent additional_request_chance_;
   const bool hedge_on_per_try_timeout_;
 };
 
@@ -324,7 +326,7 @@ class HedgePolicyImpl : public HedgePolicy {
  */
 class DecoratorImpl : public Decorator {
 public:
-  explicit DecoratorImpl(const envoy::api::v2::route::Decorator& decorator);
+  explicit DecoratorImpl(const envoy::config::route::v3alpha::Decorator& decorator);
 
   // Decorator::apply
   void apply(Tracing::Span& span) const override;
@@ -341,23 +343,23 @@ class DecoratorImpl : public Decorator {
  */
 class RouteTracingImpl : public RouteTracing {
 public:
-  explicit RouteTracingImpl(const envoy::api::v2::route::Tracing& tracing);
+  explicit RouteTracingImpl(const envoy::config::route::v3alpha::Tracing& tracing);
 
   // Tracing::getClientSampling
-  const envoy::type::FractionalPercent& getClientSampling() const override;
+  const envoy::type::v3alpha::FractionalPercent& getClientSampling() const override;
 
   // Tracing::getRandomSampling
-  const envoy::type::FractionalPercent& getRandomSampling() const override;
+  const envoy::type::v3alpha::FractionalPercent& getRandomSampling() const override;
 
   // Tracing::getOverallSampling
-  const envoy::type::FractionalPercent& getOverallSampling() const override;
+  const envoy::type::v3alpha::FractionalPercent& getOverallSampling() const override;
 
   const Tracing::CustomTagMap& getCustomTags() const override;
 
 private:
-  envoy::type::FractionalPercent client_sampling_;
-  envoy::type::FractionalPercent random_sampling_;
-  envoy::type::FractionalPercent overall_sampling_;
+  envoy::type::v3alpha::FractionalPercent client_sampling_;
+  envoy::type::v3alpha::FractionalPercent random_sampling_;
+  envoy::type::v3alpha::FractionalPercent overall_sampling_;
   Tracing::CustomTagMap custom_tags_;
 };
 
@@ -375,7 +377,8 @@ class RouteEntryImplBase : public RouteEntry,
   /**
    * @throw EnvoyException with reason if the route configuration contains any errors
    */
-  RouteEntryImplBase(const VirtualHostImpl& vhost, const envoy::api::v2::route::Route& route,
+  RouteEntryImplBase(const VirtualHostImpl& vhost,
+                     const envoy::config::route::v3alpha::Route& route,
                      Server::Configuration::ServerFactoryContext& factory_context,
                      ProtobufMessage::ValidationVisitor& validator);
 
@@ -435,7 +438,7 @@ class RouteEntryImplBase : public RouteEntry,
     return opaque_config_;
   }
   bool includeVirtualHostRateLimits() const override { return include_vh_rate_limits_; }
-  const envoy::api::v2::core::Metadata& metadata() const override { return metadata_; }
+  const envoy::config::core::v3alpha::Metadata& metadata() const override { return metadata_; }
   const Envoy::Config::TypedMetadata& typedMetadata() const override { return typed_metadata_; }
   const PathMatchCriterion& pathMatchCriterion() const override { return *this; }
   bool includeAttemptCount() const override { return vhost_.includeAttemptCount(); }
@@ -480,7 +483,7 @@ class RouteEntryImplBase : public RouteEntry,
 private:
   struct RuntimeData {
     std::string fractional_runtime_key_{};
-    envoy::type::FractionalPercent fractional_runtime_default_{};
+    envoy::type::v3alpha::FractionalPercent fractional_runtime_default_{};
   };
 
   class DynamicRouteEntry : public RouteEntry, public Route {
@@ -544,7 +547,9 @@ class RouteEntryImplBase : public RouteEntry,
     bool includeVirtualHostRateLimits() const override {
       return parent_->includeVirtualHostRateLimits();
     }
-    const envoy::api::v2::core::Metadata& metadata() const override { return parent_->metadata(); }
+    const envoy::config::core::v3alpha::Metadata& metadata() const override {
+      return parent_->metadata();
+    }
     const Envoy::Config::TypedMetadata& typedMetadata() const override {
       return parent_->typedMetadata();
     }
@@ -581,10 +586,11 @@ class RouteEntryImplBase : public RouteEntry,
    */
   class WeightedClusterEntry : public DynamicRouteEntry {
   public:
-    WeightedClusterEntry(const RouteEntryImplBase* parent, const std::string& rutime_key,
-                         Server::Configuration::ServerFactoryContext& factory_context,
-                         ProtobufMessage::ValidationVisitor& validator,
-                         const envoy::api::v2::route::WeightedCluster_ClusterWeight& cluster);
+    WeightedClusterEntry(
+        const RouteEntryImplBase* parent, const std::string& rutime_key,
+        Server::Configuration::ServerFactoryContext& factory_context,
+        ProtobufMessage::ValidationVisitor& validator,
+        const envoy::config::route::v3alpha::WeightedCluster::ClusterWeight& cluster);
 
     uint64_t clusterWeight() const {
       return loader_.snapshot().getInteger(runtime_key_, cluster_weight_);
@@ -622,27 +628,28 @@ class RouteEntryImplBase : public RouteEntry,
 
   using WeightedClusterEntrySharedPtr = std::shared_ptr<WeightedClusterEntry>;
 
-  absl::optional<RuntimeData> loadRuntimeData(const envoy::api::v2::route::RouteMatch& route);
+  absl::optional<RuntimeData>
+  loadRuntimeData(const envoy::config::route::v3alpha::RouteMatch& route);
 
   static std::multimap<std::string, std::string>
-  parseOpaqueConfig(const envoy::api::v2::route::Route& route);
+  parseOpaqueConfig(const envoy::config::route::v3alpha::Route& route);
 
-  static DecoratorConstPtr parseDecorator(const envoy::api::v2::route::Route& route);
+  static DecoratorConstPtr parseDecorator(const envoy::config::route::v3alpha::Route& route);
 
-  static RouteTracingConstPtr parseRouteTracing(const envoy::api::v2::route::Route& route);
+  static RouteTracingConstPtr parseRouteTracing(const envoy::config::route::v3alpha::Route& route);
 
   bool evaluateRuntimeMatch(const uint64_t random_value) const;
 
   bool evaluateTlsContextMatch(const StreamInfo::StreamInfo& stream_info) const;
 
-  HedgePolicyImpl
-  buildHedgePolicy(const absl::optional<envoy::api::v2::route::HedgePolicy>& vhost_hedge_policy,
-                   const envoy::api::v2::route::RouteAction& route_config) const;
+  HedgePolicyImpl buildHedgePolicy(
+      const absl::optional<envoy::config::route::v3alpha::HedgePolicy>& vhost_hedge_policy,
+      const envoy::config::route::v3alpha::RouteAction& route_config) const;
 
-  RetryPolicyImpl
-  buildRetryPolicy(const absl::optional<envoy::api::v2::route::RetryPolicy>& vhost_retry_policy,
-                   const envoy::api::v2::route::RouteAction& route_config,
-                   ProtobufMessage::ValidationVisitor& validation_visitor) const;
+  RetryPolicyImpl buildRetryPolicy(
+      const absl::optional<envoy::config::route::v3alpha::RetryPolicy>& vhost_retry_policy,
+      const envoy::config::route::v3alpha::RouteAction& route_config,
+      ProtobufMessage::ValidationVisitor& validation_visitor) const;
 
   // Default timeout is 15s if nothing is specified in the route config.
   static const uint64_t DEFAULT_ROUTE_TIMEOUT_MS = 15000;
@@ -685,7 +692,7 @@ class RouteEntryImplBase : public RouteEntry,
   HeaderParserPtr request_headers_parser_;
   HeaderParserPtr response_headers_parser_;
   uint32_t retry_shadow_buffer_limit_{std::numeric_limits<uint32_t>::max()};
-  envoy::api::v2::core::Metadata metadata_;
+  envoy::config::core::v3alpha::Metadata metadata_;
   Envoy::Config::TypedMetadataImpl<HttpRouteTypedMetadataFactory> typed_metadata_;
   const bool match_grpc_;
 
@@ -707,7 +714,8 @@ class RouteEntryImplBase : public RouteEntry,
  */
 class PrefixRouteEntryImpl : public RouteEntryImplBase {
 public:
-  PrefixRouteEntryImpl(const VirtualHostImpl& vhost, const envoy::api::v2::route::Route& route,
+  PrefixRouteEntryImpl(const VirtualHostImpl& vhost,
+                       const envoy::config::route::v3alpha::Route& route,
                        Server::Configuration::ServerFactoryContext& factory_context,
                        ProtobufMessage::ValidationVisitor& validator);
 
@@ -732,7 +740,8 @@ class PrefixRouteEntryImpl : public RouteEntryImplBase {
  */
 class PathRouteEntryImpl : public RouteEntryImplBase {
 public:
-  PathRouteEntryImpl(const VirtualHostImpl& vhost, const envoy::api::v2::route::Route& route,
+  PathRouteEntryImpl(const VirtualHostImpl& vhost,
+                     const envoy::config::route::v3alpha::Route& route,
                      Server::Configuration::ServerFactoryContext& factory_context,
                      ProtobufMessage::ValidationVisitor& validator);
 
@@ -757,7 +766,8 @@ class PathRouteEntryImpl : public RouteEntryImplBase {
  */
 class RegexRouteEntryImpl : public RouteEntryImplBase {
 public:
-  RegexRouteEntryImpl(const VirtualHostImpl& vhost, const envoy::api::v2::route::Route& route,
+  RegexRouteEntryImpl(const VirtualHostImpl& vhost,
+                      const envoy::config::route::v3alpha::Route& route,
                       Server::Configuration::ServerFactoryContext& factory_context,
                       ProtobufMessage::ValidationVisitor& validator);
 
@@ -786,7 +796,7 @@ class RegexRouteEntryImpl : public RouteEntryImplBase {
  */
 class RouteMatcher {
 public:
-  RouteMatcher(const envoy::api::v2::RouteConfiguration& config,
+  RouteMatcher(const envoy::config::route::v3alpha::RouteConfiguration& config,
                const ConfigImpl& global_http_config,
                Server::Configuration::ServerFactoryContext& factory_context,
                ProtobufMessage::ValidationVisitor& validator, bool validate_clusters);
@@ -825,7 +835,7 @@ class RouteMatcher {
  */
 class ConfigImpl : public Config {
 public:
-  ConfigImpl(const envoy::api::v2::RouteConfiguration& config,
+  ConfigImpl(const envoy::config::route::v3alpha::RouteConfiguration& config,
              Server::Configuration::ServerFactoryContext& factory_context,
              ProtobufMessage::ValidationVisitor& validator, bool validate_clusters_default);
 
diff --git a/source/common/router/config_utility.cc b/source/common/router/config_utility.cc
index 2134f1524dc8..f947160dd5d6 100644
--- a/source/common/router/config_utility.cc
+++ b/source/common/router/config_utility.cc
@@ -3,9 +3,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/regex.h"
@@ -15,25 +15,29 @@ namespace Router {
 namespace {
 
 absl::optional<Matchers::StringMatcherImpl>
-maybeCreateStringMatcher(const envoy::api::v2::route::QueryParameterMatcher& config) {
+maybeCreateStringMatcher(const envoy::config::route::v3alpha::QueryParameterMatcher& config) {
   switch (config.query_parameter_match_specifier_case()) {
-  case envoy::api::v2::route::QueryParameterMatcher::kStringMatch: {
+  case envoy::config::route::v3alpha::QueryParameterMatcher::QueryParameterMatchSpecifierCase::
+      kStringMatch: {
     return Matchers::StringMatcherImpl(config.string_match());
   }
-  case envoy::api::v2::route::QueryParameterMatcher::kPresentMatch: {
+  case envoy::config::route::v3alpha::QueryParameterMatcher::QueryParameterMatchSpecifierCase::
+      kPresentMatch: {
     return absl::nullopt;
   }
-  case envoy::api::v2::route::QueryParameterMatcher::QUERY_PARAMETER_MATCH_SPECIFIER_NOT_SET: {
-    if (config.value().empty()) {
+  case envoy::config::route::v3alpha::QueryParameterMatcher::QueryParameterMatchSpecifierCase::
+      QUERY_PARAMETER_MATCH_SPECIFIER_NOT_SET: {
+    if (config.hidden_envoy_deprecated_value().empty()) {
       // Present match.
       return absl::nullopt;
     }
 
-    envoy::type::matcher::StringMatcher matcher_config;
-    if (config.has_regex() ? config.regex().value() : false) {
-      matcher_config.set_regex(config.value());
+    envoy::type::matcher::v3alpha::StringMatcher matcher_config;
+    if (config.has_hidden_envoy_deprecated_regex() ? config.hidden_envoy_deprecated_regex().value()
+                                                   : false) {
+      matcher_config.set_hidden_envoy_deprecated_regex(config.hidden_envoy_deprecated_value());
     } else {
-      matcher_config.set_exact(config.value());
+      matcher_config.set_exact(config.hidden_envoy_deprecated_value());
     }
     return Matchers::StringMatcherImpl(matcher_config);
   }
@@ -45,7 +49,7 @@ maybeCreateStringMatcher(const envoy::api::v2::route::QueryParameterMatcher& con
 } // namespace
 
 ConfigUtility::QueryParameterMatcher::QueryParameterMatcher(
-    const envoy::api::v2::route::QueryParameterMatcher& config)
+    const envoy::config::route::v3alpha::QueryParameterMatcher& config)
     : name_(config.name()), matcher_(maybeCreateStringMatcher(config)) {}
 
 bool ConfigUtility::QueryParameterMatcher::matches(
@@ -62,11 +66,11 @@ bool ConfigUtility::QueryParameterMatcher::matches(
 }
 
 Upstream::ResourcePriority
-ConfigUtility::parsePriority(const envoy::api::v2::core::RoutingPriority& priority) {
+ConfigUtility::parsePriority(const envoy::config::core::v3alpha::RoutingPriority& priority) {
   switch (priority) {
-  case envoy::api::v2::core::RoutingPriority::DEFAULT:
+  case envoy::config::core::v3alpha::DEFAULT:
     return Upstream::ResourcePriority::Default;
-  case envoy::api::v2::core::RoutingPriority::HIGH:
+  case envoy::config::core::v3alpha::HIGH:
     return Upstream::ResourcePriority::High;
   default:
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
@@ -86,17 +90,17 @@ bool ConfigUtility::matchQueryParams(
 }
 
 Http::Code ConfigUtility::parseRedirectResponseCode(
-    const envoy::api::v2::route::RedirectAction::RedirectResponseCode& code) {
+    const envoy::config::route::v3alpha::RedirectAction::RedirectResponseCode& code) {
   switch (code) {
-  case envoy::api::v2::route::RedirectAction::MOVED_PERMANENTLY:
+  case envoy::config::route::v3alpha::RedirectAction::MOVED_PERMANENTLY:
     return Http::Code::MovedPermanently;
-  case envoy::api::v2::route::RedirectAction::FOUND:
+  case envoy::config::route::v3alpha::RedirectAction::FOUND:
     return Http::Code::Found;
-  case envoy::api::v2::route::RedirectAction::SEE_OTHER:
+  case envoy::config::route::v3alpha::RedirectAction::SEE_OTHER:
     return Http::Code::SeeOther;
-  case envoy::api::v2::route::RedirectAction::TEMPORARY_REDIRECT:
+  case envoy::config::route::v3alpha::RedirectAction::TEMPORARY_REDIRECT:
     return Http::Code::TemporaryRedirect;
-  case envoy::api::v2::route::RedirectAction::PERMANENT_REDIRECT:
+  case envoy::config::route::v3alpha::RedirectAction::PERMANENT_REDIRECT:
     return Http::Code::PermanentRedirect;
   default:
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
@@ -104,7 +108,7 @@ Http::Code ConfigUtility::parseRedirectResponseCode(
 }
 
 absl::optional<Http::Code>
-ConfigUtility::parseDirectResponseCode(const envoy::api::v2::route::Route& route) {
+ConfigUtility::parseDirectResponseCode(const envoy::config::route::v3alpha::Route& route) {
   if (route.has_redirect()) {
     return parseRedirectResponseCode(route.redirect().response_code());
   } else if (route.has_direct_response()) {
@@ -113,8 +117,9 @@ ConfigUtility::parseDirectResponseCode(const envoy::api::v2::route::Route& route
   return {};
 }
 
-std::string ConfigUtility::parseDirectResponseBody(const envoy::api::v2::route::Route& route,
-                                                   Api::Api& api) {
+std::string
+ConfigUtility::parseDirectResponseBody(const envoy::config::route::v3alpha::Route& route,
+                                       Api::Api& api) {
   static const ssize_t MaxBodySize = 4096;
   if (!route.has_direct_response() || !route.direct_response().has_body()) {
     return EMPTY_STRING;
@@ -145,11 +150,11 @@ std::string ConfigUtility::parseDirectResponseBody(const envoy::api::v2::route::
 }
 
 Http::Code ConfigUtility::parseClusterNotFoundResponseCode(
-    const envoy::api::v2::route::RouteAction::ClusterNotFoundResponseCode& code) {
+    const envoy::config::route::v3alpha::RouteAction::ClusterNotFoundResponseCode& code) {
   switch (code) {
-  case envoy::api::v2::route::RouteAction::SERVICE_UNAVAILABLE:
+  case envoy::config::route::v3alpha::RouteAction::SERVICE_UNAVAILABLE:
     return Http::Code::ServiceUnavailable;
-  case envoy::api::v2::route::RouteAction::NOT_FOUND:
+  case envoy::config::route::v3alpha::RouteAction::NOT_FOUND:
     return Http::Code::NotFound;
   default:
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
diff --git a/source/common/router/config_utility.h b/source/common/router/config_utility.h
index 58ebe215c6f0..367f1cf45260 100644
--- a/source/common/router/config_utility.h
+++ b/source/common/router/config_utility.h
@@ -4,8 +4,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/codes.h"
 #include "envoy/json/json_object.h"
 #include "envoy/upstream/resource_manager.h"
@@ -32,7 +32,7 @@ class ConfigUtility {
   // equivalent of the QueryParameterMatcher proto in the RDS v2 API.
   class QueryParameterMatcher {
   public:
-    QueryParameterMatcher(const envoy::api::v2::route::QueryParameterMatcher& config);
+    QueryParameterMatcher(const envoy::config::route::v3alpha::QueryParameterMatcher& config);
 
     /**
      * Check if the query parameters for a request contain a match for this
@@ -53,7 +53,7 @@ class ConfigUtility {
    * @return the resource priority parsed from proto.
    */
   static Upstream::ResourcePriority
-  parsePriority(const envoy::api::v2::core::RoutingPriority& priority);
+  parsePriority(const envoy::config::core::v3alpha::RoutingPriority& priority);
 
   /**
    * See if the query parameters specified in the config are present in a request.
@@ -71,7 +71,7 @@ class ConfigUtility {
    * @return Returns the Http::Code version of the RedirectResponseCode.
    */
   static Http::Code parseRedirectResponseCode(
-      const envoy::api::v2::route::RedirectAction::RedirectResponseCode& code);
+      const envoy::config::route::v3alpha::RedirectAction::RedirectResponseCode& code);
 
   /**
    * Returns the HTTP Status Code enum parsed from the route's redirect or direct_response.
@@ -81,7 +81,7 @@ class ConfigUtility {
    * absl::optional otherwise.
    */
   static absl::optional<Http::Code>
-  parseDirectResponseCode(const envoy::api::v2::route::Route& route);
+  parseDirectResponseCode(const envoy::config::route::v3alpha::Route& route);
 
   /**
    * Returns the content of the response body to send with direct responses from a route.
@@ -92,7 +92,7 @@ class ConfigUtility {
    *         route's direct_response if specified, or an empty string otherwise.
    * @throw EnvoyException if the route configuration contains an error.
    */
-  static std::string parseDirectResponseBody(const envoy::api::v2::route::Route& route,
+  static std::string parseDirectResponseBody(const envoy::config::route::v3alpha::Route& route,
                                              Api::Api& api);
 
   /**
@@ -101,7 +101,7 @@ class ConfigUtility {
    * @return Returns the Http::Code version of the ClusterNotFoundResponseCode enum.
    */
   static Http::Code parseClusterNotFoundResponseCode(
-      const envoy::api::v2::route::RouteAction::ClusterNotFoundResponseCode& code);
+      const envoy::config::route::v3alpha::RouteAction::ClusterNotFoundResponseCode& code);
 };
 
 } // namespace Router
diff --git a/source/common/router/header_parser.cc b/source/common/router/header_parser.cc
index d9aa1080cdf8..a89059181d44 100644
--- a/source/common/router/header_parser.cc
+++ b/source/common/router/header_parser.cc
@@ -4,7 +4,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/assert.h"
 #include "common/http/headers.h"
@@ -37,7 +37,7 @@ std::string unescape(absl::string_view sv) { return absl::StrReplaceAll(sv, {{"%
 // names of valid variables. Interpretation of the variable name and arguments is delegated to
 // StreamInfoHeaderFormatter.
 HeaderFormatterPtr
-parseInternal(const envoy::api::v2::core::HeaderValueOption& header_value_option) {
+parseInternal(const envoy::config::core::v3alpha::HeaderValueOption& header_value_option) {
   const std::string& key = header_value_option.header().key();
   // PGV constraints provide this guarantee.
   ASSERT(!key.empty());
@@ -222,7 +222,8 @@ parseInternal(const envoy::api::v2::core::HeaderValueOption& header_value_option
 } // namespace
 
 HeaderParserPtr HeaderParser::configure(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers_to_add) {
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>&
+        headers_to_add) {
   HeaderParserPtr header_parser(new HeaderParser());
 
   for (const auto& header_value_option : headers_to_add) {
@@ -236,7 +237,8 @@ HeaderParserPtr HeaderParser::configure(
 }
 
 HeaderParserPtr HeaderParser::configure(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers_to_add,
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>&
+        headers_to_add,
     const Protobuf::RepeatedPtrField<std::string>& headers_to_remove) {
   HeaderParserPtr header_parser = configure(headers_to_add);
 
diff --git a/source/common/router/header_parser.h b/source/common/router/header_parser.h
index 725f78a5e97c..afd0f83f506f 100644
--- a/source/common/router/header_parser.h
+++ b/source/common/router/header_parser.h
@@ -4,7 +4,7 @@
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/http/header_map.h"
 
 #include "common/protobuf/protobuf.h"
@@ -27,17 +27,19 @@ class HeaderParser {
    * @param headers_to_add defines the headers to add during calls to evaluateHeaders
    * @return HeaderParserPtr a configured HeaderParserPtr
    */
-  static HeaderParserPtr configure(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers_to_add);
+  static HeaderParserPtr
+  configure(const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>&
+                headers_to_add);
 
   /*
    * @param headers_to_add defines headers to add during calls to evaluateHeaders
    * @param headers_to_remove defines headers to remove during calls to evaluateHeaders
    * @return HeaderParserPtr a configured HeaderParserPtr
    */
-  static HeaderParserPtr configure(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers_to_add,
-      const Protobuf::RepeatedPtrField<std::string>& headers_to_remove);
+  static HeaderParserPtr
+  configure(const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>&
+                headers_to_add,
+            const Protobuf::RepeatedPtrField<std::string>& headers_to_remove);
 
   void evaluateHeaders(Http::HeaderMap& headers, const StreamInfo::StreamInfo& stream_info) const;
 
diff --git a/source/common/router/rds_impl.cc b/source/common/router/rds_impl.cc
index 3d47b880ae07..066adfdd7be3 100644
--- a/source/common/router/rds_impl.cc
+++ b/source/common/router/rds_impl.cc
@@ -5,12 +5,13 @@
 #include <memory>
 #include <string>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route.pb.validate.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/api/v2/route.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.validate.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -22,17 +23,19 @@
 namespace Envoy {
 namespace Router {
 
-RouteConfigProviderSharedPtr RouteConfigProviderUtil::create(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-        config,
-    Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
-    RouteConfigProviderManager& route_config_provider_manager) {
+RouteConfigProviderSharedPtr
+RouteConfigProviderUtil::create(const envoy::extensions::filters::network::http_connection_manager::
+                                    v3alpha::HttpConnectionManager& config,
+                                Server::Configuration::FactoryContext& factory_context,
+                                const std::string& stat_prefix,
+                                RouteConfigProviderManager& route_config_provider_manager) {
   switch (config.route_specifier_case()) {
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      kRouteConfig:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::RouteSpecifierCase::kRouteConfig:
     return route_config_provider_manager.createStaticRouteConfigProvider(config.route_config(),
                                                                          factory_context);
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::kRds:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::RouteSpecifierCase::kRds:
     return route_config_provider_manager.createRdsRouteConfigProvider(
         config.rds(), factory_context, stat_prefix, factory_context.initManager());
   default:
@@ -41,7 +44,7 @@ RouteConfigProviderSharedPtr RouteConfigProviderUtil::create(
 }
 
 StaticRouteConfigProviderImpl::StaticRouteConfigProviderImpl(
-    const envoy::api::v2::RouteConfiguration& config,
+    const envoy::config::route::v3alpha::RouteConfiguration& config,
     Server::Configuration::FactoryContext& factory_context,
     RouteConfigProviderManagerImpl& route_config_provider_manager)
     : config_(new ConfigImpl(config, factory_context.getServerFactoryContext(),
@@ -58,12 +61,12 @@ StaticRouteConfigProviderImpl::~StaticRouteConfigProviderImpl() {
 
 // TODO(htuch): If support for multiple clusters is added per #1170 cluster_name_
 RdsRouteConfigSubscription::RdsRouteConfigSubscription(
-    const envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
     const uint64_t manager_identifier, Server::Configuration::ServerFactoryContext& factory_context,
     ProtobufMessage::ValidationVisitor& validator, Init::Manager& init_manager,
     const std::string& stat_prefix,
     Envoy::Router::RouteConfigProviderManagerImpl& route_config_provider_manager,
-    envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version)
+    envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version)
     : route_config_name_(rds.route_config_name()), factory_context_(factory_context),
       validator_(validator), init_manager_(init_manager),
       init_target_(fmt::format("RdsRouteConfigSubscription {}", route_config_name_),
@@ -97,7 +100,8 @@ void RdsRouteConfigSubscription::onConfigUpdate(
   if (!validateUpdateSize(resources.size())) {
     return;
   }
-  auto route_config = MessageUtil::anyConvert<envoy::api::v2::RouteConfiguration>(resources[0]);
+  auto route_config =
+      MessageUtil::anyConvert<envoy::config::route::v3alpha::RouteConfiguration>(resources[0]);
   MessageUtil::validate(route_config, validator_);
   if (route_config.name() != route_config_name_) {
     throw EnvoyException(fmt::format("Unexpected RDS configuration (expecting {}): {}",
@@ -162,7 +166,7 @@ void RdsRouteConfigSubscription::maybeCreateInitManager(
 }
 
 void RdsRouteConfigSubscription::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources, const std::string&) {
   if (!removed_resources.empty()) {
     // TODO(#2500) when on-demand resource loading is supported, an RDS removal may make sense (see
@@ -204,11 +208,11 @@ bool RdsRouteConfigSubscription::validateUpdateSize(int num_resources) {
 std::string RdsRouteConfigSubscription::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::RouteConfiguration().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(API_NO_BOOST(
         envoy::config::route::v3alpha::RouteConfiguration().GetDescriptor()->full_name()));
   default:
@@ -261,7 +265,7 @@ void RdsRouteConfigProviderImpl::onConfigUpdate() {
 }
 
 void RdsRouteConfigProviderImpl::validateConfig(
-    const envoy::api::v2::RouteConfiguration& config) const {
+    const envoy::config::route::v3alpha::RouteConfiguration& config) const {
   // TODO(lizan): consider cache the config here until onConfigUpdate.
   ConfigImpl validation_config(config, factory_context_, validator_, false);
 }
@@ -275,7 +279,7 @@ RouteConfigProviderManagerImpl::RouteConfigProviderManagerImpl(Server::Admin& ad
 }
 
 Router::RouteConfigProviderSharedPtr RouteConfigProviderManagerImpl::createRdsRouteConfigProvider(
-    const envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
     Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
     Init::Manager& init_manager) {
   // RdsRouteConfigSubscriptions are unique based on their serialized RDS config.
@@ -309,7 +313,7 @@ Router::RouteConfigProviderSharedPtr RouteConfigProviderManagerImpl::createRdsRo
 }
 
 RouteConfigProviderPtr RouteConfigProviderManagerImpl::createStaticRouteConfigProvider(
-    const envoy::api::v2::RouteConfiguration& route_config,
+    const envoy::config::route::v3alpha::RouteConfiguration& route_config,
     Server::Configuration::FactoryContext& factory_context) {
   auto provider =
       std::make_unique<StaticRouteConfigProviderImpl>(route_config, factory_context, *this);
@@ -317,9 +321,9 @@ RouteConfigProviderPtr RouteConfigProviderManagerImpl::createStaticRouteConfigPr
   return provider;
 }
 
-std::unique_ptr<envoy::admin::v2alpha::RoutesConfigDump>
+std::unique_ptr<envoy::admin::v3alpha::RoutesConfigDump>
 RouteConfigProviderManagerImpl::dumpRouteConfigs() const {
-  auto config_dump = std::make_unique<envoy::admin::v2alpha::RoutesConfigDump>();
+  auto config_dump = std::make_unique<envoy::admin::v3alpha::RoutesConfigDump>();
 
   for (const auto& element : dynamic_route_config_providers_) {
     const auto& subscription = element.second.lock()->subscription_;
diff --git a/source/common/router/rds_impl.h b/source/common/router/rds_impl.h
index ef542c3a2e79..b2d568d8fd82 100644
--- a/source/common/router/rds_impl.h
+++ b/source/common/router/rds_impl.h
@@ -6,12 +6,11 @@
 #include <unordered_map>
 #include <unordered_set>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/config/subscription.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/http/codes.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/router/rds.h"
@@ -19,6 +18,7 @@
 #include "envoy/router/route_config_update_receiver.h"
 #include "envoy/server/admin.h"
 #include "envoy/server/filter_config.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/singleton/instance.h"
 #include "envoy/stats/scope.h"
 #include "envoy/thread_local/thread_local.h"
@@ -50,8 +50,8 @@ class RouteConfigProviderUtil {
    * proto configuration. Notes the provider object could be shared among multiple listeners.
    */
   static RouteConfigProviderSharedPtr
-  create(const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-             config,
+  create(const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& config,
          Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
          RouteConfigProviderManager& route_config_provider_manager);
 };
@@ -63,7 +63,7 @@ class RouteConfigProviderManagerImpl;
  */
 class StaticRouteConfigProviderImpl : public RouteConfigProvider {
 public:
-  StaticRouteConfigProviderImpl(const envoy::api::v2::RouteConfiguration& config,
+  StaticRouteConfigProviderImpl(const envoy::config::route::v3alpha::RouteConfiguration& config,
                                 Server::Configuration::FactoryContext& factory_context,
                                 RouteConfigProviderManagerImpl& route_config_provider_manager);
   ~StaticRouteConfigProviderImpl() override;
@@ -75,11 +75,11 @@ class StaticRouteConfigProviderImpl : public RouteConfigProvider {
   }
   SystemTime lastUpdated() const override { return last_updated_; }
   void onConfigUpdate() override {}
-  void validateConfig(const envoy::api::v2::RouteConfiguration&) const override {}
+  void validateConfig(const envoy::config::route::v3alpha::RouteConfiguration&) const override {}
 
 private:
   ConfigConstSharedPtr config_;
-  envoy::api::v2::RouteConfiguration route_config_proto_;
+  envoy::config::route::v3alpha::RouteConfiguration route_config_proto_;
   SystemTime last_updated_;
   RouteConfigProviderManagerImpl& route_config_provider_manager_;
 };
@@ -122,13 +122,16 @@ class RdsRouteConfigSubscription : Envoy::Config::SubscriptionCallbacks,
   // Config::SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string&) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string&) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::RouteConfiguration>(resource).name();
+    return MessageUtil::anyConvert<envoy::config::route::v3alpha::RouteConfiguration>(resource)
+        .name();
   }
 
   Common::CallbackHandle* addUpdateCallback(std::function<void()> callback) {
@@ -136,13 +139,13 @@ class RdsRouteConfigSubscription : Envoy::Config::SubscriptionCallbacks,
   }
 
   RdsRouteConfigSubscription(
-      const envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
       const uint64_t manager_identifier,
       Server::Configuration::ServerFactoryContext& factory_context,
       ProtobufMessage::ValidationVisitor& validator, Init::Manager& init_manager,
       const std::string& stat_prefix, RouteConfigProviderManagerImpl& route_config_provider_manager,
-      const envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version =
-          envoy::api::v2::core::ConfigSource::AUTO);
+      const envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version =
+          envoy::config::core::v3alpha::ConfigSource::AUTO);
 
   bool validateUpdateSize(int num_resources);
   std::string loadTypeUrl();
@@ -165,7 +168,7 @@ class RdsRouteConfigSubscription : Envoy::Config::SubscriptionCallbacks,
   VhdsSubscriptionPtr vhds_subscription_;
   RouteConfigUpdatePtr config_update_info_;
   Common::CallbackManager<> update_callback_manager_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 
   friend class RouteConfigProviderManagerImpl;
   // Access to addUpdateCallback
@@ -192,7 +195,8 @@ class RdsRouteConfigProviderImpl : public RouteConfigProvider,
   }
   SystemTime lastUpdated() const override { return config_update_info_->lastUpdated(); }
   void onConfigUpdate() override;
-  void validateConfig(const envoy::api::v2::RouteConfiguration& config) const override;
+  void
+  validateConfig(const envoy::config::route::v3alpha::RouteConfiguration& config) const override;
 
 private:
   struct ThreadLocalConfig : public ThreadLocal::ThreadLocalObject {
@@ -217,17 +221,17 @@ class RouteConfigProviderManagerImpl : public RouteConfigProviderManager,
 public:
   RouteConfigProviderManagerImpl(Server::Admin& admin);
 
-  std::unique_ptr<envoy::admin::v2alpha::RoutesConfigDump> dumpRouteConfigs() const;
+  std::unique_ptr<envoy::admin::v3alpha::RoutesConfigDump> dumpRouteConfigs() const;
 
   // RouteConfigProviderManager
   RouteConfigProviderSharedPtr createRdsRouteConfigProvider(
-      const envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
       Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
       Init::Manager& init_manager) override;
 
-  RouteConfigProviderPtr
-  createStaticRouteConfigProvider(const envoy::api::v2::RouteConfiguration& route_config,
-                                  Server::Configuration::FactoryContext& factory_context) override;
+  RouteConfigProviderPtr createStaticRouteConfigProvider(
+      const envoy::config::route::v3alpha::RouteConfiguration& route_config,
+      Server::Configuration::FactoryContext& factory_context) override;
 
 private:
   // TODO(jsedgwick) These two members are prime candidates for the owned-entry list/map
diff --git a/source/common/router/retry_state_impl.cc b/source/common/router/retry_state_impl.cc
index de3787d9bfa6..be5f5d323790 100644
--- a/source/common/router/retry_state_impl.cc
+++ b/source/common/router/retry_state_impl.cc
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/utility.h"
@@ -129,7 +129,7 @@ RetryStateImpl::RetryStateImpl(const RetryPolicy& route_policy, Http::HeaderMap&
     // header. Anything more sophisticated needs to be provided via config.
     for (const auto header_name : StringUtil::splitToken(
              request_headers.EnvoyRetriableHeaderNames()->value().getStringView(), ",")) {
-      envoy::api::v2::route::HeaderMatcher header_matcher;
+      envoy::config::route::v3alpha::HeaderMatcher header_matcher;
       header_matcher.set_name(std::string(absl::StripAsciiWhitespace(header_name)));
       retriable_headers_.emplace_back(
           std::make_shared<Http::HeaderUtility::HeaderData>(header_matcher));
diff --git a/source/common/router/route_config_update_receiver_impl.cc b/source/common/router/route_config_update_receiver_impl.cc
index e1aed3652cb9..7b67b6559999 100644
--- a/source/common/router/route_config_update_receiver_impl.cc
+++ b/source/common/router/route_config_update_receiver_impl.cc
@@ -2,10 +2,10 @@
 
 #include <string>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/api/v2/route/route_components.pb.validate.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.validate.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -15,8 +15,8 @@
 namespace Envoy {
 namespace Router {
 
-bool RouteConfigUpdateReceiverImpl::onRdsUpdate(const envoy::api::v2::RouteConfiguration& rc,
-                                                const std::string& version_info) {
+bool RouteConfigUpdateReceiverImpl::onRdsUpdate(
+    const envoy::config::route::v3alpha::RouteConfiguration& rc, const std::string& version_info) {
   const uint64_t new_hash = MessageUtil::hash(rc);
   if (new_hash == last_config_hash_) {
     return false;
@@ -32,7 +32,7 @@ bool RouteConfigUpdateReceiverImpl::onRdsUpdate(const envoy::api::v2::RouteConfi
 }
 
 bool RouteConfigUpdateReceiverImpl::onVhdsUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& version_info) {
   removeVhosts(virtual_hosts_, removed_resources);
@@ -43,7 +43,7 @@ bool RouteConfigUpdateReceiverImpl::onVhdsUpdate(
 }
 
 void RouteConfigUpdateReceiverImpl::initializeVhosts(
-    const envoy::api::v2::RouteConfiguration& route_configuration) {
+    const envoy::config::route::v3alpha::RouteConfiguration& route_configuration) {
   virtual_hosts_.clear();
   for (const auto& vhost : route_configuration.virtual_hosts()) {
     virtual_hosts_.emplace(vhost.name(), vhost);
@@ -51,7 +51,7 @@ void RouteConfigUpdateReceiverImpl::initializeVhosts(
 }
 
 void RouteConfigUpdateReceiverImpl::removeVhosts(
-    std::unordered_map<std::string, envoy::api::v2::route::VirtualHost>& vhosts,
+    std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost>& vhosts,
     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names) {
   for (const auto& vhost_name : removed_vhost_names) {
     vhosts.erase(vhost_name);
@@ -59,11 +59,12 @@ void RouteConfigUpdateReceiverImpl::removeVhosts(
 }
 
 void RouteConfigUpdateReceiverImpl::updateVhosts(
-    std::unordered_map<std::string, envoy::api::v2::route::VirtualHost>& vhosts,
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources) {
+    std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost>& vhosts,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+        added_resources) {
   for (const auto& resource : added_resources) {
-    envoy::api::v2::route::VirtualHost vhost =
-        MessageUtil::anyConvert<envoy::api::v2::route::VirtualHost>(resource.resource());
+    envoy::config::route::v3alpha::VirtualHost vhost =
+        MessageUtil::anyConvert<envoy::config::route::v3alpha::VirtualHost>(resource.resource());
     MessageUtil::validate(vhost, validation_visitor_);
     auto found = vhosts.find(vhost.name());
     if (found != vhosts.end()) {
@@ -74,8 +75,8 @@ void RouteConfigUpdateReceiverImpl::updateVhosts(
 }
 
 void RouteConfigUpdateReceiverImpl::rebuildRouteConfig(
-    const std::unordered_map<std::string, envoy::api::v2::route::VirtualHost>& vhosts,
-    envoy::api::v2::RouteConfiguration& route_config) {
+    const std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost>& vhosts,
+    envoy::config::route::v3alpha::RouteConfiguration& route_config) {
   route_config.clear_virtual_hosts();
   for (const auto& vhost : vhosts) {
     route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
diff --git a/source/common/router/route_config_update_receiver_impl.h b/source/common/router/route_config_update_receiver_impl.h
index 80ae2d407fa5..2cf3ead863e6 100644
--- a/source/common/router/route_config_update_receiver_impl.h
+++ b/source/common/router/route_config_update_receiver_impl.h
@@ -3,11 +3,11 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/router/rds.h"
 #include "envoy/router/route_config_update_receiver.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/logger.h"
 #include "common/protobuf/utility.h"
@@ -22,19 +22,24 @@ class RouteConfigUpdateReceiverImpl : public RouteConfigUpdateReceiver {
       : time_source_(time_source), last_config_hash_(0ull),
         validation_visitor_(validation_visitor) {}
 
-  void initializeVhosts(const envoy::api::v2::RouteConfiguration& route_configuration);
-  void removeVhosts(std::unordered_map<std::string, envoy::api::v2::route::VirtualHost>& vhosts,
-                    const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names);
-  void updateVhosts(std::unordered_map<std::string, envoy::api::v2::route::VirtualHost>& vhosts,
-                    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources);
+  void
+  initializeVhosts(const envoy::config::route::v3alpha::RouteConfiguration& route_configuration);
+  void
+  removeVhosts(std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost>& vhosts,
+               const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names);
+  void
+  updateVhosts(std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost>& vhosts,
+               const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                   added_resources);
   void rebuildRouteConfig(
-      const std::unordered_map<std::string, envoy::api::v2::route::VirtualHost>& vhosts,
-      envoy::api::v2::RouteConfiguration& route_config);
+      const std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost>& vhosts,
+      envoy::config::route::v3alpha::RouteConfiguration& route_config);
 
   // Router::RouteConfigUpdateReceiver
-  bool onRdsUpdate(const envoy::api::v2::RouteConfiguration& rc,
+  bool onRdsUpdate(const envoy::config::route::v3alpha::RouteConfiguration& rc,
                    const std::string& version_info) override;
-  bool onVhdsUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+  bool onVhdsUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                        added_resources,
                     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
                     const std::string& version_info) override;
   const std::string& routeConfigName() const override { return route_config_proto_.name(); }
@@ -43,18 +48,18 @@ class RouteConfigUpdateReceiverImpl : public RouteConfigUpdateReceiver {
   absl::optional<RouteConfigProvider::ConfigInfo> configInfo() const override {
     return config_info_;
   }
-  const envoy::api::v2::RouteConfiguration& routeConfiguration() override {
+  const envoy::config::route::v3alpha::RouteConfiguration& routeConfiguration() override {
     return route_config_proto_;
   }
   SystemTime lastUpdated() const override { return last_updated_; }
 
 private:
   TimeSource& time_source_;
-  envoy::api::v2::RouteConfiguration route_config_proto_;
+  envoy::config::route::v3alpha::RouteConfiguration route_config_proto_;
   uint64_t last_config_hash_;
   std::string last_config_version_;
   SystemTime last_updated_;
-  std::unordered_map<std::string, envoy::api::v2::route::VirtualHost> virtual_hosts_;
+  std::unordered_map<std::string, envoy::config::route::v3alpha::VirtualHost> virtual_hosts_;
   absl::optional<RouteConfigProvider::ConfigInfo> config_info_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
 };
diff --git a/source/common/router/router.h b/source/common/router/router.h
index c21f60bd6949..d1db8c556510 100644
--- a/source/common/router/router.h
+++ b/source/common/router/router.h
@@ -6,7 +6,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/http/router/v2/router.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
 #include "envoy/http/codec.h"
 #include "envoy/http/codes.h"
 #include "envoy/http/filter.h"
@@ -188,7 +188,7 @@ class FilterConfig {
 
   FilterConfig(const std::string& stat_prefix, Server::Configuration::FactoryContext& context,
                ShadowWriterPtr&& shadow_writer,
-               const envoy::config::filter::http::router::v2::Router& config)
+               const envoy::extensions::filters::http::router::v3alpha::Router& config)
       : FilterConfig(stat_prefix, context.localInfo(), context.scope(), context.clusterManager(),
                      context.runtime(), context.random(), std::move(shadow_writer),
                      PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, dynamic_stats, true),
diff --git a/source/common/router/router_ratelimit.cc b/source/common/router/router_ratelimit.cc
index ab3510ae514b..fec0ae17427a 100644
--- a/source/common/router/router_ratelimit.cc
+++ b/source/common/router/router_ratelimit.cc
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/empty_string.h"
@@ -67,7 +67,7 @@ bool GenericKeyAction::populateDescriptor(const Router::RouteEntry&,
 }
 
 HeaderValueMatchAction::HeaderValueMatchAction(
-    const envoy::api::v2::route::RateLimit::Action::HeaderValueMatch& action)
+    const envoy::config::route::v3alpha::RateLimit::Action::HeaderValueMatch& action)
     : descriptor_value_(action.descriptor_value()),
       expect_match_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(action, expect_match, true)),
       action_headers_(Http::HeaderUtility::buildHeaderDataVector(action.headers())) {}
@@ -84,27 +84,28 @@ bool HeaderValueMatchAction::populateDescriptor(const Router::RouteEntry&,
   }
 }
 
-RateLimitPolicyEntryImpl::RateLimitPolicyEntryImpl(const envoy::api::v2::route::RateLimit& config)
+RateLimitPolicyEntryImpl::RateLimitPolicyEntryImpl(
+    const envoy::config::route::v3alpha::RateLimit& config)
     : disable_key_(config.disable_key()),
       stage_(static_cast<uint64_t>(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, stage, 0))) {
   for (const auto& action : config.actions()) {
     switch (action.action_specifier_case()) {
-    case envoy::api::v2::route::RateLimit::Action::kSourceCluster:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kSourceCluster:
       actions_.emplace_back(new SourceClusterAction());
       break;
-    case envoy::api::v2::route::RateLimit::Action::kDestinationCluster:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kDestinationCluster:
       actions_.emplace_back(new DestinationClusterAction());
       break;
-    case envoy::api::v2::route::RateLimit::Action::kRequestHeaders:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kRequestHeaders:
       actions_.emplace_back(new RequestHeadersAction(action.request_headers()));
       break;
-    case envoy::api::v2::route::RateLimit::Action::kRemoteAddress:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kRemoteAddress:
       actions_.emplace_back(new RemoteAddressAction());
       break;
-    case envoy::api::v2::route::RateLimit::Action::kGenericKey:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kGenericKey:
       actions_.emplace_back(new GenericKeyAction(action.generic_key()));
       break;
-    case envoy::api::v2::route::RateLimit::Action::kHeaderValueMatch:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kHeaderValueMatch:
       actions_.emplace_back(new HeaderValueMatchAction(action.header_value_match()));
       break;
     default:
@@ -133,7 +134,7 @@ void RateLimitPolicyEntryImpl::populateDescriptors(
 }
 
 RateLimitPolicyImpl::RateLimitPolicyImpl(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::route::RateLimit>& rate_limits)
+    const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RateLimit>& rate_limits)
     : rate_limit_entries_reference_(RateLimitPolicyImpl::MAX_STAGE_NUMBER + 1) {
   for (const auto& rate_limit : rate_limits) {
     std::unique_ptr<RateLimitPolicyEntry> rate_limit_policy_entry(
diff --git a/source/common/router/router_ratelimit.h b/source/common/router/router_ratelimit.h
index 031954fc33fc..f288f408ee43 100644
--- a/source/common/router/router_ratelimit.h
+++ b/source/common/router/router_ratelimit.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/router/router.h"
 #include "envoy/router/router_ratelimit.h"
 
@@ -41,7 +41,8 @@ class DestinationClusterAction : public RateLimitAction {
  */
 class RequestHeadersAction : public RateLimitAction {
 public:
-  RequestHeadersAction(const envoy::api::v2::route::RateLimit::Action::RequestHeaders& action)
+  RequestHeadersAction(
+      const envoy::config::route::v3alpha::RateLimit::Action::RequestHeaders& action)
       : header_name_(action.header_name()), descriptor_key_(action.descriptor_key()) {}
 
   // Router::RateLimitAction
@@ -70,7 +71,7 @@ class RemoteAddressAction : public RateLimitAction {
  */
 class GenericKeyAction : public RateLimitAction {
 public:
-  GenericKeyAction(const envoy::api::v2::route::RateLimit::Action::GenericKey& action)
+  GenericKeyAction(const envoy::config::route::v3alpha::RateLimit::Action::GenericKey& action)
       : descriptor_value_(action.descriptor_value()) {}
 
   // Router::RateLimitAction
@@ -87,7 +88,8 @@ class GenericKeyAction : public RateLimitAction {
  */
 class HeaderValueMatchAction : public RateLimitAction {
 public:
-  HeaderValueMatchAction(const envoy::api::v2::route::RateLimit::Action::HeaderValueMatch& action);
+  HeaderValueMatchAction(
+      const envoy::config::route::v3alpha::RateLimit::Action::HeaderValueMatch& action);
 
   // Router::RateLimitAction
   bool populateDescriptor(const Router::RouteEntry& route, RateLimit::Descriptor& descriptor,
@@ -105,7 +107,7 @@ class HeaderValueMatchAction : public RateLimitAction {
  */
 class RateLimitPolicyEntryImpl : public RateLimitPolicyEntry {
 public:
-  RateLimitPolicyEntryImpl(const envoy::api::v2::route::RateLimit& config);
+  RateLimitPolicyEntryImpl(const envoy::config::route::v3alpha::RateLimit& config);
 
   // Router::RateLimitPolicyEntry
   uint64_t stage() const override { return stage_; }
@@ -127,7 +129,7 @@ class RateLimitPolicyEntryImpl : public RateLimitPolicyEntry {
 class RateLimitPolicyImpl : public RateLimitPolicy {
 public:
   RateLimitPolicyImpl(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::route::RateLimit>& rate_limits);
+      const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RateLimit>& rate_limits);
 
   // Router::RateLimitPolicy
   const std::vector<std::reference_wrapper<const RateLimitPolicyEntry>>&
diff --git a/source/common/router/scoped_config_impl.cc b/source/common/router/scoped_config_impl.cc
index 268318978a37..baf347405f17 100644
--- a/source/common/router/scoped_config_impl.cc
+++ b/source/common/router/scoped_config_impl.cc
@@ -1,7 +1,7 @@
 #include "common/router/scoped_config_impl.h"
 
-#include "envoy/api/v2/srds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 namespace Envoy {
 namespace Router {
@@ -73,14 +73,16 @@ HeaderValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const
   return nullptr;
 }
 
-ScopedRouteInfo::ScopedRouteInfo(envoy::api::v2::ScopedRouteConfiguration&& config_proto,
-                                 ConfigConstSharedPtr&& route_config)
+ScopedRouteInfo::ScopedRouteInfo(
+    envoy::config::route::v3alpha::ScopedRouteConfiguration&& config_proto,
+    ConfigConstSharedPtr&& route_config)
     : config_proto_(std::move(config_proto)), route_config_(std::move(route_config)) {
   // TODO(stevenzzzz): Maybe worth a KeyBuilder abstraction when there are more than one type of
   // Fragment.
   for (const auto& fragment : config_proto_.key().fragments()) {
     switch (fragment.type_case()) {
-    case envoy::api::v2::ScopedRouteConfiguration::Key::Fragment::kStringKey:
+    case envoy::config::route::v3alpha::ScopedRouteConfiguration::Key::Fragment::TypeCase::
+        kStringKey:
       scope_key_.addFragment(std::make_unique<StringKeyFragment>(fragment.string_key()));
       break;
     default:
diff --git a/source/common/router/scoped_config_impl.h b/source/common/router/scoped_config_impl.h
index 91e67e841b14..ef870dc298d5 100644
--- a/source/common/router/scoped_config_impl.h
+++ b/source/common/router/scoped_config_impl.h
@@ -2,8 +2,8 @@
 
 #include <typeinfo>
 
-#include "envoy/api/v2/srds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/router/rds.h"
 #include "envoy/router/router.h"
 #include "envoy/router/scopes.h"
@@ -19,7 +19,7 @@
 namespace Envoy {
 namespace Router {
 
-using envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes;
+using envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes;
 
 /**
  * Scope key fragment base class.
@@ -149,16 +149,18 @@ class ScopeKeyBuilderImpl : public ScopeKeyBuilderBase {
 // ScopedRouteConfiguration and corresponding RouteConfigProvider.
 class ScopedRouteInfo {
 public:
-  ScopedRouteInfo(envoy::api::v2::ScopedRouteConfiguration&& config_proto,
+  ScopedRouteInfo(envoy::config::route::v3alpha::ScopedRouteConfiguration&& config_proto,
                   ConfigConstSharedPtr&& route_config);
 
   const ConfigConstSharedPtr& routeConfig() const { return route_config_; }
   const ScopeKey& scopeKey() const { return scope_key_; }
-  const envoy::api::v2::ScopedRouteConfiguration& configProto() const { return config_proto_; }
+  const envoy::config::route::v3alpha::ScopedRouteConfiguration& configProto() const {
+    return config_proto_;
+  }
   const std::string& scopeName() const { return config_proto_.name(); }
 
 private:
-  envoy::api::v2::ScopedRouteConfiguration config_proto_;
+  envoy::config::route::v3alpha::ScopedRouteConfiguration config_proto_;
   ScopeKey scope_key_;
   ConfigConstSharedPtr route_config_;
 };
diff --git a/source/common/router/scoped_rds.cc b/source/common/router/scoped_rds.cc
index eaa87814113a..2ac24e4f5df5 100644
--- a/source/common/router/scoped_rds.cc
+++ b/source/common/router/scoped_rds.cc
@@ -2,13 +2,13 @@
 
 #include <memory>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/scoped_route.pb.validate.h"
-#include "envoy/api/v2/srds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/api/v2/scoped_route.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/route/v3alpha/scoped_route.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.validate.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/cleanup.h"
@@ -31,30 +31,32 @@ using Envoy::Config::ConfigProviderPtr;
 namespace Envoy {
 namespace Router {
 namespace ScopedRoutesConfigProviderUtil {
-ConfigProviderPtr
-create(const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-           config,
-       Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
-       ConfigProviderManager& scoped_routes_config_provider_manager) {
-  ASSERT(config.route_specifier_case() == envoy::config::filter::network::http_connection_manager::
-                                              v2::HttpConnectionManager::kScopedRoutes);
+ConfigProviderPtr create(const envoy::extensions::filters::network::http_connection_manager::
+                             v3alpha::HttpConnectionManager& config,
+                         Server::Configuration::FactoryContext& factory_context,
+                         const std::string& stat_prefix,
+                         ConfigProviderManager& scoped_routes_config_provider_manager) {
+  ASSERT(config.route_specifier_case() ==
+         envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager::RouteSpecifierCase::kScopedRoutes);
 
   switch (config.scoped_routes().config_specifier_case()) {
-  case envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::
-      kScopedRouteConfigurationsList: {
-    const envoy::config::filter::network::http_connection_manager::v2::
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+      ConfigSpecifierCase::kScopedRouteConfigurationsList: {
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::
         ScopedRouteConfigurationsList& scoped_route_list =
             config.scoped_routes().scoped_route_configurations_list();
     return scoped_routes_config_provider_manager.createStaticConfigProvider(
-        RepeatedPtrUtil::convertToConstMessagePtrContainer<envoy::api::v2::ScopedRouteConfiguration,
-                                                           ProtobufTypes::ConstMessagePtrVector>(
-            scoped_route_list.scoped_route_configurations()),
+        RepeatedPtrUtil::convertToConstMessagePtrContainer<
+            envoy::config::route::v3alpha::ScopedRouteConfiguration,
+            ProtobufTypes::ConstMessagePtrVector>(scoped_route_list.scoped_route_configurations()),
         factory_context,
         ScopedRoutesConfigProviderManagerOptArg(config.scoped_routes().name(),
                                                 config.scoped_routes().rds_config_source(),
                                                 config.scoped_routes().scope_key_builder()));
   }
-  case envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::kScopedRds:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+      ConfigSpecifierCase::kScopedRds:
     return scoped_routes_config_provider_manager.createXdsConfigProvider(
         config.scoped_routes().scoped_rds(), factory_context, stat_prefix,
         ScopedRoutesConfigProviderManagerOptArg(config.scoped_routes().name(),
@@ -72,9 +74,9 @@ InlineScopedRoutesConfigProvider::InlineScopedRoutesConfigProvider(
     ProtobufTypes::ConstMessagePtrVector&& config_protos, std::string name,
     Server::Configuration::FactoryContext& factory_context,
     ScopedRoutesConfigProviderManager& config_provider_manager,
-    envoy::api::v2::core::ConfigSource rds_config_source,
-    envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::ScopeKeyBuilder
-        scope_key_builder)
+    envoy::config::core::v3alpha::ConfigSource rds_config_source,
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+        ScopeKeyBuilder scope_key_builder)
     : Envoy::Config::ImmutableConfigProviderBase(factory_context, config_provider_manager,
                                                  ConfigProviderInstanceType::Inline,
                                                  ConfigProvider::ApiType::Delta),
@@ -85,12 +87,13 @@ InlineScopedRoutesConfigProvider::InlineScopedRoutesConfigProvider(
       rds_config_source_(std::move(rds_config_source)) {}
 
 ScopedRdsConfigSubscription::ScopedRdsConfigSubscription(
-    const envoy::config::filter::network::http_connection_manager::v2::ScopedRds& scoped_rds,
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRds&
+        scoped_rds,
     const uint64_t manager_identifier, const std::string& name,
-    const envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
         ScopeKeyBuilder& scope_key_builder,
     Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
-    envoy::api::v2::core::ConfigSource rds_config_source,
+    envoy::config::core::v3alpha::ConfigSource rds_config_source,
     RouteConfigProviderManager& route_config_provider_manager,
     ScopedRoutesConfigProviderManager& config_provider_manager)
     : DeltaConfigSubscriptionInstance("SRDS", manager_identifier, config_provider_manager,
@@ -108,14 +111,14 @@ ScopedRdsConfigSubscription::ScopedRdsConfigSubscription(
 
   initialize([scope_key_builder]() -> Envoy::Config::ConfigProvider::ConfigConstSharedPtr {
     return std::make_shared<ScopedConfigImpl>(
-        envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::ScopeKeyBuilder(
-            scope_key_builder));
+        envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+            ScopeKeyBuilder(scope_key_builder));
   });
 }
 
 ScopedRdsConfigSubscription::RdsRouteConfigProviderHelper::RdsRouteConfigProviderHelper(
     ScopedRdsConfigSubscription& parent, std::string scope_name,
-    envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
     Init::Manager& init_manager)
     : parent_(parent), scope_name_(scope_name),
       route_provider_(std::dynamic_pointer_cast<RdsRouteConfigProviderImpl>(
@@ -128,18 +131,19 @@ ScopedRdsConfigSubscription::RdsRouteConfigProviderHelper::RdsRouteConfigProvide
       })) {}
 
 bool ScopedRdsConfigSubscription::addOrUpdateScopes(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& resources,
     Init::Manager& init_manager, const std::string& version_info,
     std::vector<std::string>& exception_msgs) {
   bool any_applied = false;
-  envoy::config::filter::network::http_connection_manager::v2::Rds rds;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds rds;
   rds.mutable_config_source()->MergeFrom(rds_config_source_);
   absl::flat_hash_set<std::string> unique_resource_names;
   for (const auto& resource : resources) {
-    envoy::api::v2::ScopedRouteConfiguration scoped_route_config;
+    envoy::config::route::v3alpha::ScopedRouteConfiguration scoped_route_config;
     try {
       scoped_route_config =
-          MessageUtil::anyConvert<envoy::api::v2::ScopedRouteConfiguration>(resource.resource());
+          MessageUtil::anyConvert<envoy::config::route::v3alpha::ScopedRouteConfiguration>(
+              resource.resource());
       MessageUtil::validate(scoped_route_config, validation_visitor_);
       const std::string scope_name = scoped_route_config.name();
       if (!unique_resource_names.insert(scope_name).second) {
@@ -214,7 +218,7 @@ ScopedRdsConfigSubscription::removeScopes(
 }
 
 void ScopedRdsConfigSubscription::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& version_info) {
   // NOTE: deletes are done before adds/updates.
@@ -285,7 +289,7 @@ void ScopedRdsConfigSubscription::onRdsConfigUpdate(const std::string& scope_nam
   ASSERT(iter != scoped_route_map_.end(),
          fmt::format("trying to update route config for non-existing scope {}", scope_name));
   auto new_scoped_route_info = std::make_shared<ScopedRouteInfo>(
-      envoy::api::v2::ScopedRouteConfiguration(iter->second->configProto()),
+      envoy::config::route::v3alpha::ScopedRouteConfiguration(iter->second->configProto()),
       std::make_shared<ConfigImpl>(rds_subscription.routeConfigUpdate()->routeConfiguration(),
                                    factory_context_.getServerFactoryContext(),
                                    factory_context_.messageValidationVisitor(), false));
@@ -303,12 +307,14 @@ void ScopedRdsConfigSubscription::onRdsConfigUpdate(const std::string& scope_nam
 void ScopedRdsConfigSubscription::onConfigUpdate(
     const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
     const std::string& version_info) {
-  absl::flat_hash_map<std::string, envoy::api::v2::ScopedRouteConfiguration> scoped_routes;
+  absl::flat_hash_map<std::string, envoy::config::route::v3alpha::ScopedRouteConfiguration>
+      scoped_routes;
   absl::flat_hash_map<uint64_t, std::string> scope_name_by_key_hash;
   for (const auto& resource_any : resources) {
     // Throws (thus rejects all) on any error.
     auto scoped_route =
-        MessageUtil::anyConvert<envoy::api::v2::ScopedRouteConfiguration>(resource_any);
+        MessageUtil::anyConvert<envoy::config::route::v3alpha::ScopedRouteConfiguration>(
+            resource_any);
     MessageUtil::validate(scoped_route, validation_visitor_);
     const std::string scope_name = scoped_route.name();
     auto scope_config_inserted = scoped_routes.try_emplace(scope_name, std::move(scoped_route));
@@ -316,7 +322,7 @@ void ScopedRdsConfigSubscription::onConfigUpdate(
       throw EnvoyException(
           fmt::format("duplicate scoped route configuration '{}' found", scope_name));
     }
-    const envoy::api::v2::ScopedRouteConfiguration& scoped_route_config =
+    const envoy::config::route::v3alpha::ScopedRouteConfiguration& scoped_route_config =
         scope_config_inserted.first->second;
     const uint64_t key_fingerprint = MessageUtil::hash(scoped_route_config.key());
     if (!scope_name_by_key_hash.try_emplace(key_fingerprint, scope_name).second) {
@@ -326,7 +332,7 @@ void ScopedRdsConfigSubscription::onConfigUpdate(
     }
   }
   ScopedRouteMap scoped_routes_to_remove = scoped_route_map_;
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> to_add_repeated;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> to_add_repeated;
   Protobuf::RepeatedPtrField<std::string> to_remove_repeated;
   for (auto& iter : scoped_routes) {
     const std::string& scope_name = iter.first;
@@ -346,11 +352,11 @@ void ScopedRdsConfigSubscription::onConfigUpdate(
 std::string ScopedRdsConfigSubscription::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::ScopedRouteConfiguration().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(API_NO_BOOST(
         envoy::config::route::v3alpha::ScopedRouteConfiguration().GetDescriptor()->full_name()));
   default:
@@ -363,7 +369,7 @@ ScopedRdsConfigProvider::ScopedRdsConfigProvider(
     : MutableConfigProviderCommonBase(std::move(subscription), ConfigProvider::ApiType::Delta) {}
 
 ProtobufTypes::MessagePtr ScopedRoutesConfigProviderManager::dumpConfigs() const {
-  auto config_dump = std::make_unique<envoy::admin::v2alpha::ScopedRoutesConfigDump>();
+  auto config_dump = std::make_unique<envoy::admin::v3alpha::ScopedRoutesConfigDump>();
   for (const auto& element : configSubscriptions()) {
     auto subscription = element.second.lock();
     ASSERT(subscription);
@@ -385,7 +391,7 @@ ProtobufTypes::MessagePtr ScopedRoutesConfigProviderManager::dumpConfigs() const
 
   for (const auto& provider : immutableConfigProviders(ConfigProviderInstanceType::Inline)) {
     const auto protos_info =
-        provider->configProtoInfoVector<envoy::api::v2::ScopedRouteConfiguration>();
+        provider->configProtoInfoVector<envoy::config::route::v3alpha::ScopedRouteConfiguration>();
     ASSERT(protos_info != absl::nullopt);
     auto* inline_config = config_dump->mutable_inline_scoped_route_configs()->Add();
     inline_config->set_name(static_cast<InlineScopedRoutesConfigProvider*>(provider)->name());
@@ -411,9 +417,9 @@ ConfigProviderPtr ScopedRoutesConfigProviderManager::createXdsConfigProvider(
            &typed_optarg](const uint64_t manager_identifier,
                           ConfigProviderManagerImplBase& config_provider_manager)
               -> Envoy::Config::ConfigSubscriptionCommonBaseSharedPtr {
-            const auto& scoped_rds_config_source = dynamic_cast<
-                const envoy::config::filter::network::http_connection_manager::v2::ScopedRds&>(
-                config_source_proto);
+            const auto& scoped_rds_config_source =
+                dynamic_cast<const envoy::extensions::filters::network::http_connection_manager::
+                                 v3alpha::ScopedRds&>(config_source_proto);
             return std::make_shared<ScopedRdsConfigSubscription>(
                 scoped_rds_config_source, manager_identifier, typed_optarg.scoped_routes_name_,
                 typed_optarg.scope_key_builder_, factory_context, stat_prefix,
diff --git a/source/common/router/scoped_rds.h b/source/common/router/scoped_rds.h
index d7d70effe79c..9b4481f0b732 100644
--- a/source/common/router/scoped_rds.h
+++ b/source/common/router/scoped_rds.h
@@ -2,13 +2,13 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/srds.pb.h"
 #include "envoy/common/callback.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.h"
 #include "envoy/config/subscription.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/router/route_config_provider_manager.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/config_provider_impl.h"
@@ -25,8 +25,8 @@ namespace ScopedRoutesConfigProviderUtil {
 // If enabled in the HttpConnectionManager config, returns a ConfigProvider for scoped routing
 // configuration.
 Envoy::Config::ConfigProviderPtr
-create(const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-           config,
+create(const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+           HttpConnectionManager& config,
        Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
        Envoy::Config::ConfigProviderManager& scoped_routes_config_provider_manager);
 
@@ -37,13 +37,13 @@ class ScopedRoutesConfigProviderManager;
 // A ConfigProvider for inline scoped routing configuration.
 class InlineScopedRoutesConfigProvider : public Envoy::Config::ImmutableConfigProviderBase {
 public:
-  InlineScopedRoutesConfigProvider(
-      ProtobufTypes::ConstMessagePtrVector&& config_protos, std::string name,
-      Server::Configuration::FactoryContext& factory_context,
-      ScopedRoutesConfigProviderManager& config_provider_manager,
-      envoy::api::v2::core::ConfigSource rds_config_source,
-      envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::ScopeKeyBuilder
-          scope_key_builder);
+  InlineScopedRoutesConfigProvider(ProtobufTypes::ConstMessagePtrVector&& config_protos,
+                                   std::string name,
+                                   Server::Configuration::FactoryContext& factory_context,
+                                   ScopedRoutesConfigProviderManager& config_provider_manager,
+                                   envoy::config::core::v3alpha::ConfigSource rds_config_source,
+                                   envoy::extensions::filters::network::http_connection_manager::
+                                       v3alpha::ScopedRoutes::ScopeKeyBuilder scope_key_builder);
 
   ~InlineScopedRoutesConfigProvider() override = default;
 
@@ -66,7 +66,7 @@ class InlineScopedRoutesConfigProvider : public Envoy::Config::ImmutableConfigPr
   const std::string name_;
   ConfigConstSharedPtr config_;
   const std::vector<std::unique_ptr<const Protobuf::Message>> config_protos_;
-  const envoy::api::v2::core::ConfigSource rds_config_source_;
+  const envoy::config::core::v3alpha::ConfigSource rds_config_source_;
 };
 
 /**
@@ -88,15 +88,16 @@ class ScopedRdsConfigSubscription : public Envoy::Config::DeltaConfigSubscriptio
                                     Envoy::Config::SubscriptionCallbacks {
 public:
   using ScopedRouteConfigurationMap =
-      std::map<std::string, envoy::api::v2::ScopedRouteConfiguration>;
+      std::map<std::string, envoy::config::route::v3alpha::ScopedRouteConfiguration>;
 
   ScopedRdsConfigSubscription(
-      const envoy::config::filter::network::http_connection_manager::v2::ScopedRds& scoped_rds,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRds&
+          scoped_rds,
       const uint64_t manager_identifier, const std::string& name,
-      const envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
           ScopeKeyBuilder& scope_key_builder,
       Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
-      envoy::api::v2::core::ConfigSource rds_config_source,
+      envoy::config::core::v3alpha::ConfigSource rds_config_source,
       RouteConfigProviderManager& route_config_provider_manager,
       ScopedRoutesConfigProviderManager& config_provider_manager);
 
@@ -112,7 +113,7 @@ class ScopedRdsConfigSubscription : public Envoy::Config::DeltaConfigSubscriptio
   struct RdsRouteConfigProviderHelper {
     RdsRouteConfigProviderHelper(
         ScopedRdsConfigSubscription& parent, std::string scope_name,
-        envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
+        envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
         Init::Manager& init_manager);
     ~RdsRouteConfigProviderHelper() { rds_update_callback_handle_->remove(); }
     ConfigConstSharedPtr routeConfig() { return route_provider_->config(); }
@@ -128,9 +129,10 @@ class ScopedRdsConfigSubscription : public Envoy::Config::DeltaConfigSubscriptio
   // Adds or updates scopes, create a new RDS provider for each resource, if an exception is thrown
   // during updating, the exception message is collected via the exception messages vector.
   // Returns true if any scope updated, false otherwise.
-  bool addOrUpdateScopes(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& resources,
-                         Init::Manager& init_manager, const std::string& version_info,
-                         std::vector<std::string>& exception_msgs);
+  bool addOrUpdateScopes(
+      const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& resources,
+      Init::Manager& init_manager, const std::string& version_info,
+      std::vector<std::string>& exception_msgs);
   // Removes given scopes from the managed set of scopes.
   // Returns a list of to be removed helpers which is temporally held in the onConfigUpdate method,
   // to make sure new scopes sharing the same RDS source configs could reuse the subscriptions.
@@ -149,16 +151,20 @@ class ScopedRdsConfigSubscription : public Envoy::Config::DeltaConfigSubscriptio
   // accept correct RouteConfiguration from management server.
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& version_info) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string& version_info) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException*) override {
     ASSERT(Envoy::Config::ConfigUpdateFailureReason::ConnectionFailure != reason);
     DeltaConfigSubscriptionInstance::onConfigUpdateFailed();
   }
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::ScopedRouteConfiguration>(resource).name();
+    return MessageUtil::anyConvert<envoy::config::route::v3alpha::ScopedRouteConfiguration>(
+               resource)
+        .name();
   }
   std::string loadTypeUrl();
   // Propagate RDS updates to ScopeConfigImpl in workers.
@@ -176,15 +182,15 @@ class ScopedRdsConfigSubscription : public Envoy::Config::DeltaConfigSubscriptio
   Server::Configuration::FactoryContext& factory_context_;
   const std::string name_;
   std::unique_ptr<Envoy::Config::Subscription> subscription_;
-  const envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::ScopeKeyBuilder
-      scope_key_builder_;
+  const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+      ScopeKeyBuilder scope_key_builder_;
   Stats::ScopePtr scope_;
   ScopedRdsStats stats_;
-  const envoy::api::v2::core::ConfigSource rds_config_source_;
+  const envoy::config::core::v3alpha::ConfigSource rds_config_source_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
   const std::string stat_prefix_;
   RouteConfigProviderManager& route_config_provider_manager_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 using ScopedRdsConfigSubscriptionSharedPtr = std::shared_ptr<ScopedRdsConfigSubscription>;
@@ -246,16 +252,17 @@ class ScopedRoutesConfigProviderManagerOptArg
     : public Envoy::Config::ConfigProviderManager::OptionalArg {
 public:
   ScopedRoutesConfigProviderManagerOptArg(
-      std::string scoped_routes_name, const envoy::api::v2::core::ConfigSource& rds_config_source,
-      const envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::
+      std::string scoped_routes_name,
+      const envoy::config::core::v3alpha::ConfigSource& rds_config_source,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
           ScopeKeyBuilder& scope_key_builder)
       : scoped_routes_name_(std::move(scoped_routes_name)), rds_config_source_(rds_config_source),
         scope_key_builder_(scope_key_builder) {}
 
   const std::string scoped_routes_name_;
-  const envoy::api::v2::core::ConfigSource& rds_config_source_;
-  const envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::ScopeKeyBuilder&
-      scope_key_builder_;
+  const envoy::config::core::v3alpha::ConfigSource& rds_config_source_;
+  const envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+      ScopeKeyBuilder& scope_key_builder_;
 };
 
 } // namespace Router
diff --git a/source/common/router/tls_context_match_criteria_impl.cc b/source/common/router/tls_context_match_criteria_impl.cc
index 28d586419b35..740fe949d545 100644
--- a/source/common/router/tls_context_match_criteria_impl.cc
+++ b/source/common/router/tls_context_match_criteria_impl.cc
@@ -1,12 +1,12 @@
 #include "common/router/tls_context_match_criteria_impl.h"
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 namespace Envoy {
 namespace Router {
 
 TlsContextMatchCriteriaImpl::TlsContextMatchCriteriaImpl(
-    const ::envoy::api::v2::route::RouteMatch_TlsContextMatchOptions& options) {
+    const envoy::config::route::v3alpha::RouteMatch::TlsContextMatchOptions& options) {
   if (options.has_presented()) {
     presented_ = options.presented().value();
   }
diff --git a/source/common/router/tls_context_match_criteria_impl.h b/source/common/router/tls_context_match_criteria_impl.h
index e8f06af60ea1..4e855fcdd4c4 100644
--- a/source/common/router/tls_context_match_criteria_impl.h
+++ b/source/common/router/tls_context_match_criteria_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/router/router.h"
 
 namespace Envoy {
@@ -9,7 +9,7 @@ namespace Router {
 class TlsContextMatchCriteriaImpl : public TlsContextMatchCriteria {
 public:
   TlsContextMatchCriteriaImpl(
-      const ::envoy::api::v2::route::RouteMatch_TlsContextMatchOptions& options);
+      const envoy::config::route::v3alpha::RouteMatch::TlsContextMatchOptions& options);
 
   const absl::optional<bool>& presented() const override { return presented_; }
 
diff --git a/source/common/router/vhds.cc b/source/common/router/vhds.cc
index 3c5d05e54dcc..31adde7b33cf 100644
--- a/source/common/router/vhds.cc
+++ b/source/common/router/vhds.cc
@@ -5,9 +5,9 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/api/v2/route/route_components.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -24,7 +24,7 @@ VhdsSubscription::VhdsSubscription(
     RouteConfigUpdatePtr& config_update_info,
     Server::Configuration::ServerFactoryContext& factory_context, const std::string& stat_prefix,
     std::unordered_set<RouteConfigProvider*>& route_config_providers,
-    envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version)
+    envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version)
     : config_update_info_(config_update_info),
       scope_(factory_context.scope().createScope(stat_prefix + "vhds." +
                                                  config_update_info_->routeConfigName() + ".")),
@@ -37,7 +37,7 @@ VhdsSubscription::VhdsSubscription(
                                   .config_source()
                                   .api_config_source()
                                   .api_type();
-  if (config_source != envoy::api::v2::core::ApiConfigSource::DELTA_GRPC) {
+  if (config_source != envoy::config::core::v3alpha::ApiConfigSource::DELTA_GRPC) {
     throw EnvoyException("vhds: only 'DELTA_GRPC' is supported as an api_type.");
   }
 
@@ -56,7 +56,7 @@ void VhdsSubscription::onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureRe
 }
 
 void VhdsSubscription::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& version_info) {
   if (config_update_info_->onVhdsUpdate(added_resources, removed_resources, version_info)) {
@@ -74,11 +74,11 @@ void VhdsSubscription::onConfigUpdate(
 std::string VhdsSubscription::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::route::VirtualHost().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::route::VirtualHost().GetDescriptor()->full_name()));
   default:
diff --git a/source/common/router/vhds.h b/source/common/router/vhds.h
index 45d95c806890..1c34a02dca2b 100644
--- a/source/common/router/vhds.h
+++ b/source/common/router/vhds.h
@@ -6,15 +6,15 @@
 #include <unordered_map>
 #include <unordered_set>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/http/codes.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/router/rds.h"
 #include "envoy/router/route_config_update_receiver.h"
 #include "envoy/server/filter_config.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/singleton/instance.h"
 #include "envoy/stats/scope.h"
 #include "envoy/thread_local/thread_local.h"
@@ -41,8 +41,8 @@ class VhdsSubscription : Envoy::Config::SubscriptionCallbacks,
                    Server::Configuration::ServerFactoryContext& factory_context,
                    const std::string& stat_prefix,
                    std::unordered_set<RouteConfigProvider*>& route_config_providers,
-                   const envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version =
-                       envoy::api::v2::core::ConfigSource::AUTO);
+                   const envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version =
+                       envoy::config::core::v3alpha::ConfigSource::AUTO);
   ~VhdsSubscription() override { init_target_.ready(); }
 
   void registerInitTargetWithInitManager(Init::Manager& m) { m.add(init_target_); }
@@ -53,12 +53,13 @@ class VhdsSubscription : Envoy::Config::SubscriptionCallbacks,
                       const std::string&) override {
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
   }
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>&,
-                      const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&,
+                 const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::route::VirtualHost>(resource).name();
+    return MessageUtil::anyConvert<envoy::config::route::v3alpha::VirtualHost>(resource).name();
   }
   std::string loadTypeUrl();
 
@@ -68,7 +69,7 @@ class VhdsSubscription : Envoy::Config::SubscriptionCallbacks,
   std::unique_ptr<Envoy::Config::Subscription> subscription_;
   Init::TargetImpl init_target_;
   std::unordered_set<RouteConfigProvider*>& route_config_providers_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 using VhdsSubscriptionPtr = std::unique_ptr<VhdsSubscription>;
diff --git a/source/common/runtime/BUILD b/source/common/runtime/BUILD
index debfeabae008..0e5c67750cf5 100644
--- a/source/common/runtime/BUILD
+++ b/source/common/runtime/BUILD
@@ -38,12 +38,12 @@ envoy_cc_library(
         "//source/common/init:target_lib",
         "//source/common/protobuf:message_validator_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/service/runtime/v3alpha:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/runtime/runtime_features.h b/source/common/runtime/runtime_features.h
index 505f1860244b..cd3663609755 100644
--- a/source/common/runtime/runtime_features.h
+++ b/source/common/runtime/runtime_features.h
@@ -2,9 +2,9 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/runtime/runtime.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/protobuf/utility.h"
 #include "common/singleton/const_singleton.h"
@@ -47,7 +47,7 @@ using RuntimeFeaturesDefaults = ConstSingleton<RuntimeFeatures>;
 // Helper class for runtime-derived boolean feature flags.
 class FeatureFlag {
 public:
-  FeatureFlag(const envoy::api::v2::core::RuntimeFeatureFlag& feature_flag_proto,
+  FeatureFlag(const envoy::config::core::v3alpha::RuntimeFeatureFlag& feature_flag_proto,
               Runtime::Loader& runtime)
       : runtime_key_(feature_flag_proto.runtime_key()),
         default_value_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(feature_flag_proto, default_value, true)),
@@ -64,8 +64,9 @@ class FeatureFlag {
 // Helper class for runtime-derived fractional percent flags.
 class FractionalPercent {
 public:
-  FractionalPercent(const envoy::api::v2::core::RuntimeFractionalPercent& fractional_percent_proto,
-                    Runtime::Loader& runtime)
+  FractionalPercent(
+      const envoy::config::core::v3alpha::RuntimeFractionalPercent& fractional_percent_proto,
+      Runtime::Loader& runtime)
       : runtime_key_(fractional_percent_proto.runtime_key()),
         default_value_(fractional_percent_proto.default_value()), runtime_(runtime) {}
 
@@ -73,7 +74,7 @@ class FractionalPercent {
 
 private:
   const std::string runtime_key_;
-  const envoy::type::FractionalPercent default_value_;
+  const envoy::type::v3alpha::FractionalPercent default_value_;
   Runtime::Loader& runtime_;
 };
 
diff --git a/source/common/runtime/runtime_impl.cc b/source/common/runtime/runtime_impl.cc
index 9eb0f58b9732..93c59564d88d 100644
--- a/source/common/runtime/runtime_impl.cc
+++ b/source/common/runtime/runtime_impl.cc
@@ -5,15 +5,16 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/service/discovery/v2/rtds.pb.h"
-#include "envoy/service/discovery/v2/rtds.pb.validate.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/service/runtime/v3alpha/rtds.pb.h"
+#include "envoy/service/runtime/v3alpha/rtds.pb.validate.h"
 #include "envoy/thread_local/thread_local.h"
-#include "envoy/type/percent.pb.h"
-#include "envoy/type/percent.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.validate.h"
 
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
@@ -256,16 +257,16 @@ const std::string& SnapshotImpl::get(const std::string& key) const {
   }
 }
 
-bool SnapshotImpl::featureEnabled(const std::string& key,
-                                  const envoy::type::FractionalPercent& default_value) const {
+bool SnapshotImpl::featureEnabled(
+    const std::string& key, const envoy::type::v3alpha::FractionalPercent& default_value) const {
   return featureEnabled(key, default_value, generator_.random());
 }
 
 bool SnapshotImpl::featureEnabled(const std::string& key,
-                                  const envoy::type::FractionalPercent& default_value,
+                                  const envoy::type::v3alpha::FractionalPercent& default_value,
                                   uint64_t random_value) const {
   const auto& entry = values_.find(key);
-  envoy::type::FractionalPercent percent;
+  envoy::type::v3alpha::FractionalPercent percent;
   if (entry != values_.end() && entry->second.fractional_percent_value_.has_value()) {
     percent = entry->second.fractional_percent_value_.value();
   } else if (entry != values_.end() && entry->second.uint_value_.has_value()) {
@@ -280,7 +281,7 @@ bool SnapshotImpl::featureEnabled(const std::string& key,
     // percent proto. To preserve legacy semantics, we treat it as a percentage
     // (i.e. denominator of 100).
     percent.set_numerator(entry->second.uint_value_.value());
-    percent.set_denominator(envoy::type::FractionalPercent::HUNDRED);
+    percent.set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   } else {
     percent = default_value;
   }
@@ -374,7 +375,7 @@ bool SnapshotImpl::parseEntryDoubleValue(Entry& entry) {
 }
 
 void SnapshotImpl::parseEntryFractionalPercentValue(Entry& entry) {
-  envoy::type::FractionalPercent converted_fractional_percent;
+  envoy::type::v3alpha::FractionalPercent converted_fractional_percent;
   try {
     MessageUtil::loadFromYamlAndValidate(entry.raw_string_value_, converted_fractional_percent,
                                          ProtobufMessage::getStrictValidationVisitor());
@@ -501,7 +502,7 @@ void ProtoLayer::walkProtoValue(const ProtobufWkt::Value& v, const std::string&
 }
 
 LoaderImpl::LoaderImpl(Event::Dispatcher& dispatcher, ThreadLocal::SlotAllocator& tls,
-                       const envoy::config::bootstrap::v2::LayeredRuntime& config,
+                       const envoy::config::bootstrap::v3alpha::LayeredRuntime& config,
                        const LocalInfo::LocalInfo& local_info, Init::Manager& init_manager,
                        Stats::Store& store, RandomGenerator& generator,
                        ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api)
@@ -514,24 +515,24 @@ LoaderImpl::LoaderImpl(Event::Dispatcher& dispatcher, ThreadLocal::SlotAllocator
       throw EnvoyException(absl::StrCat("Duplicate layer name: ", layer.name()));
     }
     switch (layer.layer_specifier_case()) {
-    case envoy::config::bootstrap::v2::RuntimeLayer::kStaticLayer:
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kStaticLayer:
       // Nothing needs to be done here.
       break;
-    case envoy::config::bootstrap::v2::RuntimeLayer::kAdminLayer:
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kAdminLayer:
       if (admin_layer_ != nullptr) {
         throw EnvoyException(
             "Too many admin layers specified in LayeredRuntime, at most one may be specified");
       }
       admin_layer_ = std::make_unique<AdminLayer>(layer.name(), stats_);
       break;
-    case envoy::config::bootstrap::v2::RuntimeLayer::kDiskLayer:
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kDiskLayer:
       if (watcher_ == nullptr) {
         watcher_ = dispatcher.createFilesystemWatcher();
       }
       watcher_->addWatch(layer.disk_layer().symlink_root(), Filesystem::Watcher::Events::MovedTo,
                          [this](uint32_t) -> void { loadNewSnapshot(); });
       break;
-    case envoy::config::bootstrap::v2::RuntimeLayer::kRtdsLayer:
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kRtdsLayer:
       subscriptions_.emplace_back(
           std::make_unique<RtdsSubscription>(*this, layer.rtds_layer(), store, validation_visitor));
       init_manager.add(subscriptions_.back()->init_target_);
@@ -547,7 +548,8 @@ LoaderImpl::LoaderImpl(Event::Dispatcher& dispatcher, ThreadLocal::SlotAllocator
 void LoaderImpl::initialize(Upstream::ClusterManager& cm) { cm_ = &cm; }
 
 RtdsSubscription::RtdsSubscription(
-    LoaderImpl& parent, const envoy::config::bootstrap::v2::RuntimeLayer::RtdsLayer& rtds_layer,
+    LoaderImpl& parent,
+    const envoy::config::bootstrap::v3alpha::RuntimeLayer::RtdsLayer& rtds_layer,
     Stats::Store& store, ProtobufMessage::ValidationVisitor& validation_visitor)
     : parent_(parent), config_source_(rtds_layer.rtds_config()), store_(store),
       resource_name_(rtds_layer.name()),
@@ -557,7 +559,7 @@ RtdsSubscription::RtdsSubscription(
 void RtdsSubscription::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                                       const std::string&) {
   validateUpdateSize(resources.size());
-  auto runtime = MessageUtil::anyConvert<envoy::service::discovery::v2::Runtime>(resources[0]);
+  auto runtime = MessageUtil::anyConvert<envoy::service::runtime::v3alpha::Runtime>(resources[0]);
   MessageUtil::validate(runtime, validation_visitor_);
   if (runtime.name() != resource_name_) {
     throw EnvoyException(
@@ -570,7 +572,7 @@ void RtdsSubscription::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufW
 }
 
 void RtdsSubscription::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& resources,
     const Protobuf::RepeatedPtrField<std::string>&, const std::string&) {
   validateUpdateSize(resources.size());
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> unwrapped_resource;
@@ -606,11 +608,11 @@ void RtdsSubscription::validateUpdateSize(uint32_t num_resources) {
 std::string RtdsSubscription::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::service::discovery::v2::Runtime().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::service::runtime::v3alpha::Runtime().GetDescriptor()->full_name()));
   default:
@@ -668,10 +670,10 @@ std::unique_ptr<SnapshotImpl> LoaderImpl::createNewSnapshot() {
   uint32_t rtds_layer = 0;
   for (const auto& layer : config_.layers()) {
     switch (layer.layer_specifier_case()) {
-    case envoy::config::bootstrap::v2::RuntimeLayer::kStaticLayer:
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kStaticLayer:
       layers.emplace_back(std::make_unique<const ProtoLayer>(layer.name(), layer.static_layer()));
       break;
-    case envoy::config::bootstrap::v2::RuntimeLayer::kDiskLayer: {
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kDiskLayer: {
       std::string path =
           layer.disk_layer().symlink_root() + "/" + layer.disk_layer().subdirectory();
       if (layer.disk_layer().append_service_cluster()) {
@@ -691,10 +693,10 @@ std::unique_ptr<SnapshotImpl> LoaderImpl::createNewSnapshot() {
       }
       break;
     }
-    case envoy::config::bootstrap::v2::RuntimeLayer::kAdminLayer:
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kAdminLayer:
       layers.push_back(std::make_unique<AdminLayer>(*admin_layer_));
       break;
-    case envoy::config::bootstrap::v2::RuntimeLayer::kRtdsLayer: {
+    case envoy::config::bootstrap::v3alpha::RuntimeLayer::LayerSpecifierCase::kRtdsLayer: {
       auto* subscription = subscriptions_[rtds_layer++].get();
       layers.emplace_back(std::make_unique<const ProtoLayer>(layer.name(), subscription->proto_));
       break;
diff --git a/source/common/runtime/runtime_impl.h b/source/common/runtime/runtime_impl.h
index 548b5ee6b022..c8a3a71b6170 100644
--- a/source/common/runtime/runtime_impl.h
+++ b/source/common/runtime/runtime_impl.h
@@ -6,18 +6,18 @@
 #include <unordered_map>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/common/exception.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/init/manager.h"
 #include "envoy/runtime/runtime.h"
-#include "envoy/service/discovery/v2/rtds.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
+#include "envoy/service/runtime/v3alpha/rtds.pb.h"
 #include "envoy/stats/stats_macros.h"
 #include "envoy/stats/store.h"
 #include "envoy/thread_local/thread_local.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "common/common/assert.h"
@@ -89,8 +89,9 @@ class SnapshotImpl : public Snapshot,
   bool featureEnabled(const std::string& key, uint64_t default_value,
                       uint64_t random_value) const override;
   bool featureEnabled(const std::string& key,
-                      const envoy::type::FractionalPercent& default_value) const override;
-  bool featureEnabled(const std::string& key, const envoy::type::FractionalPercent& default_value,
+                      const envoy::type::v3alpha::FractionalPercent& default_value) const override;
+  bool featureEnabled(const std::string& key,
+                      const envoy::type::v3alpha::FractionalPercent& default_value,
                       uint64_t random_value) const override;
   const std::string& get(const std::string& key) const override;
   uint64_t getInteger(const std::string& key, uint64_t default_value) const override;
@@ -201,20 +202,22 @@ class LoaderImpl;
 
 struct RtdsSubscription : Config::SubscriptionCallbacks, Logger::Loggable<Logger::Id::runtime> {
   RtdsSubscription(LoaderImpl& parent,
-                   const envoy::config::bootstrap::v2::RuntimeLayer::RtdsLayer& rtds_layer,
+                   const envoy::config::bootstrap::v3alpha::RuntimeLayer::RtdsLayer& rtds_layer,
                    Stats::Store& store, ProtobufMessage::ValidationVisitor& validation_visitor);
 
   // Config::SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string&) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string&) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string&) override;
 
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::service::discovery::v2::Runtime>(resource).name();
+    return MessageUtil::anyConvert<envoy::service::runtime::v3alpha::Runtime>(resource).name();
   }
 
   void start();
@@ -222,14 +225,14 @@ struct RtdsSubscription : Config::SubscriptionCallbacks, Logger::Loggable<Logger
   std::string loadTypeUrl();
 
   LoaderImpl& parent_;
-  const envoy::api::v2::core::ConfigSource config_source_;
+  const envoy::config::core::v3alpha::ConfigSource config_source_;
   Stats::Store& store_;
   Config::SubscriptionPtr subscription_;
   std::string resource_name_;
   Init::TargetImpl init_target_;
   ProtobufWkt::Struct proto_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 using RtdsSubscriptionPtr = std::unique_ptr<RtdsSubscription>;
@@ -243,7 +246,7 @@ using RtdsSubscriptionPtr = std::unique_ptr<RtdsSubscription>;
 class LoaderImpl : public Loader, Logger::Loggable<Logger::Id::runtime> {
 public:
   LoaderImpl(Event::Dispatcher& dispatcher, ThreadLocal::SlotAllocator& tls,
-             const envoy::config::bootstrap::v2::LayeredRuntime& config,
+             const envoy::config::bootstrap::v3alpha::LayeredRuntime& config,
              const LocalInfo::LocalInfo& local_info, Init::Manager& init_manager,
              Stats::Store& store, RandomGenerator& generator,
              ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api);
@@ -267,7 +270,7 @@ class LoaderImpl : public Loader, Logger::Loggable<Logger::Id::runtime> {
   RuntimeStats stats_;
   AdminLayerPtr admin_layer_;
   ThreadLocal::SlotPtr tls_;
-  const envoy::config::bootstrap::v2::LayeredRuntime config_;
+  const envoy::config::bootstrap::v3alpha::LayeredRuntime config_;
   const std::string service_cluster_;
   Filesystem::WatcherPtr watcher_;
   Api::Api& api_;
diff --git a/source/common/secret/BUILD b/source/common/secret/BUILD
index 45b4f11f5d39..3055c18e2a93 100644
--- a/source/common/secret/BUILD
+++ b/source/common/secret/BUILD
@@ -19,9 +19,9 @@ envoy_cc_library(
         "//include/envoy/server:transport_socket_config_interface",
         "//source/common/common:assert_lib",
         "//source/common/common:minimal_logger_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -33,7 +33,7 @@ envoy_cc_library(
         "//include/envoy/secret:secret_provider_interface",
         "//source/common/ssl:certificate_validation_context_config_impl_lib",
         "//source/common/ssl:tls_certificate_config_impl_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -60,8 +60,9 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/ssl:certificate_validation_context_config_impl_lib",
         "//source/common/ssl:tls_certificate_config_impl_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
         "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/secret/sds_api.cc b/source/common/secret/sds_api.cc
index c0b2fa764277..d2031b3f6e36 100644
--- a/source/common/secret/sds_api.cc
+++ b/source/common/secret/sds_api.cc
@@ -3,9 +3,10 @@
 #include <unordered_map>
 
 #include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/auth/cert.pb.validate.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.validate.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/api_version.h"
 #include "common/config/resources.h"
@@ -14,10 +15,11 @@
 namespace Envoy {
 namespace Secret {
 
-SdsApi::SdsApi(envoy::api::v2::core::ConfigSource sds_config, absl::string_view sds_config_name,
-               Config::SubscriptionFactory& subscription_factory, TimeSource& time_source,
-               ProtobufMessage::ValidationVisitor& validation_visitor, Stats::Store& stats,
-               Init::Manager& init_manager, std::function<void()> destructor_cb)
+SdsApi::SdsApi(envoy::config::core::v3alpha::ConfigSource sds_config,
+               absl::string_view sds_config_name, Config::SubscriptionFactory& subscription_factory,
+               TimeSource& time_source, ProtobufMessage::ValidationVisitor& validation_visitor,
+               Stats::Store& stats, Init::Manager& init_manager,
+               std::function<void()> destructor_cb)
     : init_target_(fmt::format("SdsApi {}", sds_config_name), [this] { initialize(); }),
       stats_(stats), sds_config_(std::move(sds_config)), sds_config_name_(sds_config_name),
       secret_hash_(0), clean_up_(std::move(destructor_cb)), validation_visitor_(validation_visitor),
@@ -35,7 +37,8 @@ SdsApi::SdsApi(envoy::api::v2::core::ConfigSource sds_config, absl::string_view
 void SdsApi::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                             const std::string& version_info) {
   validateUpdateSize(resources.size());
-  auto secret = MessageUtil::anyConvert<envoy::api::v2::auth::Secret>(resources[0]);
+  auto secret = MessageUtil::anyConvert<envoy::extensions::transport_sockets::tls::v3alpha::Secret>(
+      resources[0]);
   MessageUtil::validate(secret, validation_visitor_);
 
   if (secret.name() != sds_config_name_) {
@@ -55,8 +58,9 @@ void SdsApi::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>&
   init_target_.ready();
 }
 
-void SdsApi::onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& resources,
-                            const Protobuf::RepeatedPtrField<std::string>&, const std::string&) {
+void SdsApi::onConfigUpdate(
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& resources,
+    const Protobuf::RepeatedPtrField<std::string>&, const std::string&) {
   validateUpdateSize(resources.size());
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> unwrapped_resource;
   *unwrapped_resource.Add() = resources[0].resource();
@@ -89,11 +93,11 @@ void SdsApi::initialize() {
 std::string SdsApi::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::auth::Secret().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::auth::Secret().GetDescriptor()->full_name()));
   default:
diff --git a/source/common/secret/sds_api.h b/source/common/secret/sds_api.h
index 5e4bfadaed0b..6ba44f60ada9 100644
--- a/source/common/secret/sds_api.h
+++ b/source/common/secret/sds_api.h
@@ -3,18 +3,18 @@
 #include <functional>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/config/subscription_factory.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/init/manager.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/secret/secret_callbacks.h"
 #include "envoy/secret/secret_provider.h"
 #include "envoy/server/transport_socket_config.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/stats.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -39,7 +39,7 @@ class SdsApi : public Config::SubscriptionCallbacks {
     SystemTime last_updated_;
   };
 
-  SdsApi(envoy::api::v2::core::ConfigSource sds_config, absl::string_view sds_config_name,
+  SdsApi(envoy::config::core::v3alpha::ConfigSource sds_config, absl::string_view sds_config_name,
          Config::SubscriptionFactory& subscription_factory, TimeSource& time_source,
          ProtobufMessage::ValidationVisitor& validation_visitor, Stats::Store& stats,
          Init::Manager& init_manager, std::function<void()> destructor_cb);
@@ -48,19 +48,23 @@ class SdsApi : public Config::SubscriptionCallbacks {
 
 protected:
   // Creates new secrets.
-  virtual void setSecret(const envoy::api::v2::auth::Secret&) PURE;
-  virtual void validateConfig(const envoy::api::v2::auth::Secret&) PURE;
+  virtual void setSecret(const envoy::extensions::transport_sockets::tls::v3alpha::Secret&) PURE;
+  virtual void
+  validateConfig(const envoy::extensions::transport_sockets::tls::v3alpha::Secret&) PURE;
   Common::CallbackManager<> update_callback_manager_;
 
   // Config::SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>&,
-                      const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&,
+                 const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::auth::Secret>(resource).name();
+    return MessageUtil::anyConvert<envoy::extensions::transport_sockets::tls::v3alpha::Secret>(
+               resource)
+        .name();
   }
   std::string loadTypeUrl();
 
@@ -70,7 +74,7 @@ class SdsApi : public Config::SubscriptionCallbacks {
   Init::TargetImpl init_target_;
   Stats::Store& stats_;
 
-  const envoy::api::v2::core::ConfigSource sds_config_;
+  const envoy::config::core::v3alpha::ConfigSource sds_config_;
   std::unique_ptr<Config::Subscription> subscription_;
   const std::string sds_config_name_;
 
@@ -80,7 +84,7 @@ class SdsApi : public Config::SubscriptionCallbacks {
   Config::SubscriptionFactory& subscription_factory_;
   TimeSource& time_source_;
   SecretData secret_data_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 class TlsCertificateSdsApi;
@@ -98,8 +102,8 @@ class TlsCertificateSdsApi : public SdsApi, public TlsCertificateConfigProvider
 public:
   static TlsCertificateSdsApiSharedPtr
   create(Server::Configuration::TransportSocketFactoryContext& secret_provider_context,
-         const envoy::api::v2::core::ConfigSource& sds_config, const std::string& sds_config_name,
-         std::function<void()> destructor_cb) {
+         const envoy::config::core::v3alpha::ConfigSource& sds_config,
+         const std::string& sds_config_name, std::function<void()> destructor_cb) {
     // We need to do this early as we invoke the subscription factory during initialization, which
     // is too late to throw.
     Config::Utility::checkLocalInfo("TlsCertificateSdsApi", secret_provider_context.localInfo());
@@ -110,7 +114,7 @@ class TlsCertificateSdsApi : public SdsApi, public TlsCertificateConfigProvider
         *secret_provider_context.initManager(), destructor_cb);
   }
 
-  TlsCertificateSdsApi(const envoy::api::v2::core::ConfigSource& sds_config,
+  TlsCertificateSdsApi(const envoy::config::core::v3alpha::ConfigSource& sds_config,
                        const std::string& sds_config_name,
                        Config::SubscriptionFactory& subscription_factory, TimeSource& time_source,
                        ProtobufMessage::ValidationVisitor& validation_visitor, Stats::Store& stats,
@@ -119,11 +123,13 @@ class TlsCertificateSdsApi : public SdsApi, public TlsCertificateConfigProvider
                stats, init_manager, std::move(destructor_cb)) {}
 
   // SecretProvider
-  const envoy::api::v2::auth::TlsCertificate* secret() const override {
+  const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate*
+  secret() const override {
     return tls_certificate_secrets_.get();
   }
-  Common::CallbackHandle*
-  addValidationCallback(std::function<void(const envoy::api::v2::auth::TlsCertificate&)>) override {
+  Common::CallbackHandle* addValidationCallback(
+      std::function<void(
+          const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate&)>) override {
     return nullptr;
   }
   Common::CallbackHandle* addUpdateCallback(std::function<void()> callback) override {
@@ -131,11 +137,13 @@ class TlsCertificateSdsApi : public SdsApi, public TlsCertificateConfigProvider
   }
 
 protected:
-  void setSecret(const envoy::api::v2::auth::Secret& secret) override {
+  void
+  setSecret(const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) override {
     tls_certificate_secrets_ =
-        std::make_unique<envoy::api::v2::auth::TlsCertificate>(secret.tls_certificate());
+        std::make_unique<envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate>(
+            secret.tls_certificate());
   }
-  void validateConfig(const envoy::api::v2::auth::Secret&) override {}
+  void validateConfig(const envoy::extensions::transport_sockets::tls::v3alpha::Secret&) override {}
 
 private:
   TlsCertificatePtr tls_certificate_secrets_;
@@ -150,8 +158,8 @@ class CertificateValidationContextSdsApi : public SdsApi,
 public:
   static CertificateValidationContextSdsApiSharedPtr
   create(Server::Configuration::TransportSocketFactoryContext& secret_provider_context,
-         const envoy::api::v2::core::ConfigSource& sds_config, const std::string& sds_config_name,
-         std::function<void()> destructor_cb) {
+         const envoy::config::core::v3alpha::ConfigSource& sds_config,
+         const std::string& sds_config_name, std::function<void()> destructor_cb) {
     // We need to do this early as we invoke the subscription factory during initialization, which
     // is too late to throw.
     Config::Utility::checkLocalInfo("CertificateValidationContextSdsApi",
@@ -162,7 +170,7 @@ class CertificateValidationContextSdsApi : public SdsApi,
         secret_provider_context.messageValidationVisitor(), secret_provider_context.stats(),
         *secret_provider_context.initManager(), destructor_cb);
   }
-  CertificateValidationContextSdsApi(const envoy::api::v2::core::ConfigSource& sds_config,
+  CertificateValidationContextSdsApi(const envoy::config::core::v3alpha::ConfigSource& sds_config,
                                      const std::string& sds_config_name,
                                      Config::SubscriptionFactory& subscription_factory,
                                      TimeSource& time_source,
@@ -173,7 +181,8 @@ class CertificateValidationContextSdsApi : public SdsApi,
                stats, init_manager, std::move(destructor_cb)) {}
 
   // SecretProvider
-  const envoy::api::v2::auth::CertificateValidationContext* secret() const override {
+  const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+  secret() const override {
     return certificate_validation_context_secrets_.get();
   }
   Common::CallbackHandle* addUpdateCallback(std::function<void()> callback) override {
@@ -181,25 +190,29 @@ class CertificateValidationContextSdsApi : public SdsApi,
   }
 
   Common::CallbackHandle* addValidationCallback(
-      std::function<void(const envoy::api::v2::auth::CertificateValidationContext&)> callback)
-      override {
+      std::function<void(
+          const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&)>
+          callback) override {
     return validation_callback_manager_.add(callback);
   }
 
 protected:
-  void setSecret(const envoy::api::v2::auth::Secret& secret) override {
-    certificate_validation_context_secrets_ =
-        std::make_unique<envoy::api::v2::auth::CertificateValidationContext>(
-            secret.validation_context());
+  void
+  setSecret(const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) override {
+    certificate_validation_context_secrets_ = std::make_unique<
+        envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>(
+        secret.validation_context());
   }
 
-  void validateConfig(const envoy::api::v2::auth::Secret& secret) override {
+  void validateConfig(
+      const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) override {
     validation_callback_manager_.runCallbacks(secret.validation_context());
   }
 
 private:
   CertificateValidationContextPtr certificate_validation_context_secrets_;
-  Common::CallbackManager<const envoy::api::v2::auth::CertificateValidationContext&>
+  Common::CallbackManager<
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&>
       validation_callback_manager_;
 };
 
@@ -211,8 +224,8 @@ class TlsSessionTicketKeysSdsApi : public SdsApi, public TlsSessionTicketKeysCon
 public:
   static TlsSessionTicketKeysSdsApiSharedPtr
   create(Server::Configuration::TransportSocketFactoryContext& secret_provider_context,
-         const envoy::api::v2::core::ConfigSource& sds_config, const std::string& sds_config_name,
-         std::function<void()> destructor_cb) {
+         const envoy::config::core::v3alpha::ConfigSource& sds_config,
+         const std::string& sds_config_name, std::function<void()> destructor_cb) {
     // We need to do this early as we invoke the subscription factory during initialization, which
     // is too late to throw.
     Config::Utility::checkLocalInfo("TlsSessionTicketKeysSdsApi",
@@ -224,7 +237,7 @@ class TlsSessionTicketKeysSdsApi : public SdsApi, public TlsSessionTicketKeysCon
         *secret_provider_context.initManager(), destructor_cb);
   }
 
-  TlsSessionTicketKeysSdsApi(const envoy::api::v2::core::ConfigSource& sds_config,
+  TlsSessionTicketKeysSdsApi(const envoy::config::core::v3alpha::ConfigSource& sds_config,
                              const std::string& sds_config_name,
                              Config::SubscriptionFactory& subscription_factory,
                              TimeSource& time_source,
@@ -235,7 +248,8 @@ class TlsSessionTicketKeysSdsApi : public SdsApi, public TlsSessionTicketKeysCon
                stats, init_manager, std::move(destructor_cb)) {}
 
   // SecretProvider
-  const envoy::api::v2::auth::TlsSessionTicketKeys* secret() const override {
+  const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys*
+  secret() const override {
     return tls_session_ticket_keys_.get();
   }
 
@@ -244,23 +258,29 @@ class TlsSessionTicketKeysSdsApi : public SdsApi, public TlsSessionTicketKeysCon
   }
 
   Common::CallbackHandle* addValidationCallback(
-      std::function<void(const envoy::api::v2::auth::TlsSessionTicketKeys&)> callback) override {
+      std::function<
+          void(const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&)>
+          callback) override {
     return validation_callback_manager_.add(callback);
   }
 
 protected:
-  void setSecret(const envoy::api::v2::auth::Secret& secret) override {
+  void
+  setSecret(const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) override {
     tls_session_ticket_keys_ =
-        std::make_unique<envoy::api::v2::auth::TlsSessionTicketKeys>(secret.session_ticket_keys());
+        std::make_unique<envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys>(
+            secret.session_ticket_keys());
   }
 
-  void validateConfig(const envoy::api::v2::auth::Secret& secret) override {
+  void validateConfig(
+      const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) override {
     validation_callback_manager_.runCallbacks(secret.session_ticket_keys());
   }
 
 private:
   Secret::TlsSessionTicketKeysPtr tls_session_ticket_keys_;
-  Common::CallbackManager<const envoy::api::v2::auth::TlsSessionTicketKeys&>
+  Common::CallbackManager<
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&>
       validation_callback_manager_;
 };
 
diff --git a/source/common/secret/secret_manager_impl.cc b/source/common/secret/secret_manager_impl.cc
index a672f202d216..4e74391f1093 100644
--- a/source/common/secret/secret_manager_impl.cc
+++ b/source/common/secret/secret_manager_impl.cc
@@ -1,10 +1,10 @@
 #include "common/secret/secret_manager_impl.h"
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/logger.h"
@@ -19,9 +19,10 @@ namespace Secret {
 SecretManagerImpl::SecretManagerImpl(Server::ConfigTracker& config_tracker)
     : config_tracker_entry_(config_tracker.add("secrets", [this] { return dumpSecretConfigs(); })) {
 }
-void SecretManagerImpl::addStaticSecret(const envoy::api::v2::auth::Secret& secret) {
+void SecretManagerImpl::addStaticSecret(
+    const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) {
   switch (secret.type_case()) {
-  case envoy::api::v2::auth::Secret::TypeCase::kTlsCertificate: {
+  case envoy::extensions::transport_sockets::tls::v3alpha::Secret::TypeCase::kTlsCertificate: {
     auto secret_provider =
         std::make_shared<TlsCertificateConfigProviderImpl>(secret.tls_certificate());
     if (!static_tls_certificate_providers_.insert(std::make_pair(secret.name(), secret_provider))
@@ -31,7 +32,7 @@ void SecretManagerImpl::addStaticSecret(const envoy::api::v2::auth::Secret& secr
     }
     break;
   }
-  case envoy::api::v2::auth::Secret::TypeCase::kValidationContext: {
+  case envoy::extensions::transport_sockets::tls::v3alpha::Secret::TypeCase::kValidationContext: {
     auto secret_provider = std::make_shared<CertificateValidationContextConfigProviderImpl>(
         secret.validation_context());
     if (!static_certificate_validation_context_providers_
@@ -42,7 +43,7 @@ void SecretManagerImpl::addStaticSecret(const envoy::api::v2::auth::Secret& secr
     }
     break;
   }
-  case envoy::api::v2::auth::Secret::TypeCase::kSessionTicketKeys: {
+  case envoy::extensions::transport_sockets::tls::v3alpha::Secret::TypeCase::kSessionTicketKeys: {
     auto secret_provider =
         std::make_shared<TlsSessionTicketKeysConfigProviderImpl>(secret.session_ticket_keys());
     if (!static_session_ticket_keys_providers_
@@ -78,25 +79,28 @@ SecretManagerImpl::findStaticTlsSessionTicketKeysContextProvider(const std::stri
 }
 
 TlsCertificateConfigProviderSharedPtr SecretManagerImpl::createInlineTlsCertificateProvider(
-    const envoy::api::v2::auth::TlsCertificate& tls_certificate) {
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& tls_certificate) {
   return std::make_shared<TlsCertificateConfigProviderImpl>(tls_certificate);
 }
 
 CertificateValidationContextConfigProviderSharedPtr
 SecretManagerImpl::createInlineCertificateValidationContextProvider(
-    const envoy::api::v2::auth::CertificateValidationContext& certificate_validation_context) {
+    const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+        certificate_validation_context) {
   return std::make_shared<CertificateValidationContextConfigProviderImpl>(
       certificate_validation_context);
 }
 
 TlsSessionTicketKeysConfigProviderSharedPtr
 SecretManagerImpl::createInlineTlsSessionTicketKeysProvider(
-    const envoy::api::v2::auth::TlsSessionTicketKeys& tls_session_ticket_keys) {
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&
+        tls_session_ticket_keys) {
   return std::make_shared<TlsSessionTicketKeysConfigProviderImpl>(tls_session_ticket_keys);
 }
 
 TlsCertificateConfigProviderSharedPtr SecretManagerImpl::findOrCreateTlsCertificateProvider(
-    const envoy::api::v2::core::ConfigSource& sds_config_source, const std::string& config_name,
+    const envoy::config::core::v3alpha::ConfigSource& sds_config_source,
+    const std::string& config_name,
     Server::Configuration::TransportSocketFactoryContext& secret_provider_context) {
   return certificate_providers_.findOrCreate(sds_config_source, config_name,
                                              secret_provider_context);
@@ -104,7 +108,8 @@ TlsCertificateConfigProviderSharedPtr SecretManagerImpl::findOrCreateTlsCertific
 
 CertificateValidationContextConfigProviderSharedPtr
 SecretManagerImpl::findOrCreateCertificateValidationContextProvider(
-    const envoy::api::v2::core::ConfigSource& sds_config_source, const std::string& config_name,
+    const envoy::config::core::v3alpha::ConfigSource& sds_config_source,
+    const std::string& config_name,
     Server::Configuration::TransportSocketFactoryContext& secret_provider_context) {
   return validation_context_providers_.findOrCreate(sds_config_source, config_name,
                                                     secret_provider_context);
@@ -112,7 +117,8 @@ SecretManagerImpl::findOrCreateCertificateValidationContextProvider(
 
 TlsSessionTicketKeysConfigProviderSharedPtr
 SecretManagerImpl::findOrCreateTlsSessionTicketKeysContextProvider(
-    const envoy::api::v2::core::ConfigSource& sds_config_source, const std::string& config_name,
+    const envoy::config::core::v3alpha::ConfigSource& sds_config_source,
+    const std::string& config_name,
     Server::Configuration::TransportSocketFactoryContext& secret_provider_context) {
   return session_ticket_keys_providers_.findOrCreate(sds_config_source, config_name,
                                                      secret_provider_context);
@@ -121,21 +127,27 @@ SecretManagerImpl::findOrCreateTlsSessionTicketKeysContextProvider(
 // We clear private key, password, and session ticket encryption keys to avoid information leaking.
 // TODO(incfly): switch to more generic scrubbing mechanism once
 // https://github.com/envoyproxy/envoy/issues/4757 is resolved.
-void redactSecret(::envoy::api::v2::auth::Secret* secret) {
-  if (secret && secret->type_case() == envoy::api::v2::auth::Secret::TypeCase::kTlsCertificate) {
+void redactSecret(envoy::extensions::transport_sockets::tls::v3alpha::Secret* secret) {
+  if (secret &&
+      secret->type_case() ==
+          envoy::extensions::transport_sockets::tls::v3alpha::Secret::TypeCase::kTlsCertificate) {
     auto tls_certificate = secret->mutable_tls_certificate();
-    if (tls_certificate->has_private_key() && tls_certificate->private_key().specifier_case() !=
-                                                  envoy::api::v2::core::DataSource::kFilename) {
+    if (tls_certificate->has_private_key() &&
+        tls_certificate->private_key().specifier_case() !=
+            envoy::config::core::v3alpha::DataSource::SpecifierCase::kFilename) {
       tls_certificate->mutable_private_key()->set_inline_string("[redacted]");
     }
-    if (tls_certificate->has_password() && tls_certificate->password().specifier_case() !=
-                                               envoy::api::v2::core::DataSource::kFilename) {
+    if (tls_certificate->has_password() &&
+        tls_certificate->password().specifier_case() !=
+            envoy::config::core::v3alpha::DataSource::SpecifierCase::kFilename) {
       tls_certificate->mutable_password()->set_inline_string("[redacted]");
     }
   }
-  if (secret && secret->type_case() == envoy::api::v2::auth::Secret::TypeCase::kSessionTicketKeys) {
+  if (secret && secret->type_case() == envoy::extensions::transport_sockets::tls::v3alpha::Secret::
+                                           TypeCase::kSessionTicketKeys) {
     for (auto& data_source : *secret->mutable_session_ticket_keys()->mutable_keys()) {
-      if (data_source.specifier_case() != envoy::api::v2::core::DataSource::kFilename) {
+      if (data_source.specifier_case() !=
+          envoy::config::core::v3alpha::DataSource::SpecifierCase::kFilename) {
         data_source.set_inline_string("[redacted]");
       }
     }
@@ -143,7 +155,7 @@ void redactSecret(::envoy::api::v2::auth::Secret* secret) {
 }
 
 ProtobufTypes::MessagePtr SecretManagerImpl::dumpSecretConfigs() {
-  auto config_dump = std::make_unique<envoy::admin::v2alpha::SecretsConfigDump>();
+  auto config_dump = std::make_unique<envoy::admin::v3alpha::SecretsConfigDump>();
   // Handle static tls key/cert providers.
   for (const auto& cert_iter : static_tls_certificate_providers_) {
     const auto& tls_cert = cert_iter.second;
@@ -186,7 +198,7 @@ ProtobufTypes::MessagePtr SecretManagerImpl::dumpSecretConfigs() {
   for (const auto& cert_secrets : providers) {
     const auto& secret_data = cert_secrets->secretData();
     const auto& tls_cert = cert_secrets->secret();
-    ::envoy::admin::v2alpha::SecretsConfigDump_DynamicSecret* dump_secret;
+    envoy::admin::v3alpha::SecretsConfigDump::DynamicSecret* dump_secret;
     const bool secret_ready = tls_cert != nullptr;
     if (secret_ready) {
       dump_secret = config_dump->mutable_dynamic_active_secrets()->Add();
@@ -212,7 +224,7 @@ ProtobufTypes::MessagePtr SecretManagerImpl::dumpSecretConfigs() {
   for (const auto& validation_context_secret : context_secret_provider) {
     const auto& secret_data = validation_context_secret->secretData();
     const auto& validation_context = validation_context_secret->secret();
-    ::envoy::admin::v2alpha::SecretsConfigDump_DynamicSecret* dump_secret;
+    envoy::admin::v3alpha::SecretsConfigDump::DynamicSecret* dump_secret;
     const bool secret_ready = validation_context != nullptr;
     if (secret_ready) {
       dump_secret = config_dump->mutable_dynamic_active_secrets()->Add();
@@ -236,7 +248,7 @@ ProtobufTypes::MessagePtr SecretManagerImpl::dumpSecretConfigs() {
   for (const auto& stek_secrets : stek_providers) {
     const auto& secret_data = stek_secrets->secretData();
     const auto& tls_stek = stek_secrets->secret();
-    ::envoy::admin::v2alpha::SecretsConfigDump_DynamicSecret* dump_secret;
+    envoy::admin::v3alpha::SecretsConfigDump::DynamicSecret* dump_secret;
     const bool secret_ready = tls_stek != nullptr;
     if (secret_ready) {
       dump_secret = config_dump->mutable_dynamic_active_secrets()->Add();
diff --git a/source/common/secret/secret_manager_impl.h b/source/common/secret/secret_manager_impl.h
index 1f1018df30c7..270aede13450 100644
--- a/source/common/secret/secret_manager_impl.h
+++ b/source/common/secret/secret_manager_impl.h
@@ -2,8 +2,8 @@
 
 #include <unordered_map>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/secret/secret_manager.h"
 #include "envoy/secret/secret_provider.h"
 #include "envoy/server/transport_socket_config.h"
@@ -19,7 +19,8 @@ namespace Secret {
 class SecretManagerImpl : public SecretManager {
 public:
   SecretManagerImpl(Server::ConfigTracker& config_tracker);
-  void addStaticSecret(const envoy::api::v2::auth::Secret& secret) override;
+  void addStaticSecret(
+      const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) override;
 
   TlsCertificateConfigProviderSharedPtr
   findStaticTlsCertificateProvider(const std::string& name) const override;
@@ -31,27 +32,32 @@ class SecretManagerImpl : public SecretManager {
   findStaticTlsSessionTicketKeysContextProvider(const std::string& name) const override;
 
   TlsCertificateConfigProviderSharedPtr createInlineTlsCertificateProvider(
-      const envoy::api::v2::auth::TlsCertificate& tls_certificate) override;
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& tls_certificate)
+      override;
 
   CertificateValidationContextConfigProviderSharedPtr
   createInlineCertificateValidationContextProvider(
-      const envoy::api::v2::auth::CertificateValidationContext& certificate_validation_context)
-      override;
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+          certificate_validation_context) override;
 
   TlsSessionTicketKeysConfigProviderSharedPtr createInlineTlsSessionTicketKeysProvider(
-      const envoy::api::v2::auth::TlsSessionTicketKeys& tls_session_ticket_keys) override;
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&
+          tls_session_ticket_keys) override;
 
   TlsCertificateConfigProviderSharedPtr findOrCreateTlsCertificateProvider(
-      const envoy::api::v2::core::ConfigSource& config_source, const std::string& config_name,
+      const envoy::config::core::v3alpha::ConfigSource& config_source,
+      const std::string& config_name,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context) override;
 
   CertificateValidationContextConfigProviderSharedPtr
   findOrCreateCertificateValidationContextProvider(
-      const envoy::api::v2::core::ConfigSource& config_source, const std::string& config_name,
+      const envoy::config::core::v3alpha::ConfigSource& config_source,
+      const std::string& config_name,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context) override;
 
   TlsSessionTicketKeysConfigProviderSharedPtr findOrCreateTlsSessionTicketKeysContextProvider(
-      const envoy::api::v2::core::ConfigSource& config_source, const std::string& config_name,
+      const envoy::config::core::v3alpha::ConfigSource& config_source,
+      const std::string& config_name,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context) override;
 
 private:
@@ -62,7 +68,7 @@ class SecretManagerImpl : public SecretManager {
   public:
     // Finds or creates SdsApi object.
     std::shared_ptr<SecretType>
-    findOrCreate(const envoy::api::v2::core::ConfigSource& sds_config_source,
+    findOrCreate(const envoy::config::core::v3alpha::ConfigSource& sds_config_source,
                  const std::string& config_name,
                  Server::Configuration::TransportSocketFactoryContext& secret_provider_context) {
       const std::string map_key =
diff --git a/source/common/secret/secret_provider_impl.cc b/source/common/secret/secret_provider_impl.cc
index 879f22866a1d..679716eb70e7 100644
--- a/source/common/secret/secret_provider_impl.cc
+++ b/source/common/secret/secret_provider_impl.cc
@@ -1,6 +1,6 @@
 #include "common/secret/secret_provider_impl.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/common/assert.h"
 #include "common/ssl/certificate_validation_context_config_impl.h"
@@ -10,19 +10,26 @@ namespace Envoy {
 namespace Secret {
 
 TlsCertificateConfigProviderImpl::TlsCertificateConfigProviderImpl(
-    const envoy::api::v2::auth::TlsCertificate& tls_certificate)
-    : tls_certificate_(std::make_unique<envoy::api::v2::auth::TlsCertificate>(tls_certificate)) {}
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& tls_certificate)
+    : tls_certificate_(
+          std::make_unique<envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate>(
+              tls_certificate)) {}
 
 CertificateValidationContextConfigProviderImpl::CertificateValidationContextConfigProviderImpl(
-    const envoy::api::v2::auth::CertificateValidationContext& certificate_validation_context)
+    const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+        certificate_validation_context)
     : certificate_validation_context_(
-          std::make_unique<envoy::api::v2::auth::CertificateValidationContext>(
+          std::make_unique<
+              envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>(
               certificate_validation_context)) {}
 
 TlsSessionTicketKeysConfigProviderImpl::TlsSessionTicketKeysConfigProviderImpl(
-    const envoy::api::v2::auth::TlsSessionTicketKeys& tls_session_ticket_keys)
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&
+        tls_session_ticket_keys)
     : tls_session_ticket_keys_(
-          std::make_unique<envoy::api::v2::auth::TlsSessionTicketKeys>(tls_session_ticket_keys)) {}
+          std::make_unique<
+              envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys>(
+              tls_session_ticket_keys)) {}
 
 } // namespace Secret
 } // namespace Envoy
diff --git a/source/common/secret/secret_provider_impl.h b/source/common/secret/secret_provider_impl.h
index 224def68cbcb..2bfd8ce1ad7b 100644
--- a/source/common/secret/secret_provider_impl.h
+++ b/source/common/secret/secret_provider_impl.h
@@ -2,7 +2,7 @@
 
 #include <functional>
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/secret/secret_provider.h"
 #include "envoy/ssl/certificate_validation_context_config.h"
 #include "envoy/ssl/tls_certificate_config.h"
@@ -12,14 +12,17 @@ namespace Secret {
 
 class TlsCertificateConfigProviderImpl : public TlsCertificateConfigProvider {
 public:
-  TlsCertificateConfigProviderImpl(const envoy::api::v2::auth::TlsCertificate& tls_certificate);
+  TlsCertificateConfigProviderImpl(
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& tls_certificate);
 
-  const envoy::api::v2::auth::TlsCertificate* secret() const override {
+  const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate*
+  secret() const override {
     return tls_certificate_.get();
   }
 
-  Common::CallbackHandle*
-  addValidationCallback(std::function<void(const envoy::api::v2::auth::TlsCertificate&)>) override {
+  Common::CallbackHandle* addValidationCallback(
+      std::function<void(
+          const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate&)>) override {
     return nullptr;
   }
 
@@ -33,14 +36,18 @@ class CertificateValidationContextConfigProviderImpl
     : public CertificateValidationContextConfigProvider {
 public:
   CertificateValidationContextConfigProviderImpl(
-      const envoy::api::v2::auth::CertificateValidationContext& certificate_validation_context);
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+          certificate_validation_context);
 
-  const envoy::api::v2::auth::CertificateValidationContext* secret() const override {
+  const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+  secret() const override {
     return certificate_validation_context_.get();
   }
 
   Common::CallbackHandle* addValidationCallback(
-      std::function<void(const envoy::api::v2::auth::CertificateValidationContext&)>) override {
+      std::function<void(
+          const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&)>)
+      override {
     return nullptr;
   }
 
@@ -53,14 +60,18 @@ class CertificateValidationContextConfigProviderImpl
 class TlsSessionTicketKeysConfigProviderImpl : public TlsSessionTicketKeysConfigProvider {
 public:
   TlsSessionTicketKeysConfigProviderImpl(
-      const envoy::api::v2::auth::TlsSessionTicketKeys& tls_session_ticket_keys);
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&
+          tls_session_ticket_keys);
 
-  const envoy::api::v2::auth::TlsSessionTicketKeys* secret() const override {
+  const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys*
+  secret() const override {
     return tls_session_ticket_keys_.get();
   }
 
   Common::CallbackHandle* addValidationCallback(
-      std::function<void(const envoy::api::v2::auth::TlsSessionTicketKeys&)>) override {
+      std::function<
+          void(const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&)>)
+      override {
     return nullptr;
   }
 
diff --git a/source/common/ssl/BUILD b/source/common/ssl/BUILD
index 290d53c96640..7266bab468b2 100644
--- a/source/common/ssl/BUILD
+++ b/source/common/ssl/BUILD
@@ -18,7 +18,7 @@ envoy_cc_library(
         "//include/envoy/ssl/private_key:private_key_interface",
         "//source/common/common:empty_string",
         "//source/common/config:datasource_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -31,6 +31,7 @@ envoy_cc_library(
         "//include/envoy/ssl:certificate_validation_context_config_interface",
         "//source/common/common:empty_string",
         "//source/common/config:datasource_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/ssl/certificate_validation_context_config_impl.cc b/source/common/ssl/certificate_validation_context_config_impl.cc
index cf6835d8709b..22e887e35ac0 100644
--- a/source/common/ssl/certificate_validation_context_config_impl.cc
+++ b/source/common/ssl/certificate_validation_context_config_impl.cc
@@ -1,7 +1,7 @@
 #include "common/ssl/certificate_validation_context_config_impl.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/common/fmt.h"
@@ -13,7 +13,8 @@ namespace Ssl {
 static const std::string INLINE_STRING = "<inline>";
 
 CertificateValidationContextConfigImpl::CertificateValidationContextConfigImpl(
-    const envoy::api::v2::auth::CertificateValidationContext& config, Api::Api& api)
+    const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext& config,
+    Api::Api& api)
     : ca_cert_(Config::DataSource::read(config.trusted_ca(), true, api)),
       ca_cert_path_(Config::DataSource::getPath(config.trusted_ca())
                         .value_or(ca_cert_.empty() ? EMPTY_STRING : INLINE_STRING)),
@@ -21,8 +22,9 @@ CertificateValidationContextConfigImpl::CertificateValidationContextConfigImpl(
       certificate_revocation_list_path_(
           Config::DataSource::getPath(config.crl())
               .value_or(certificate_revocation_list_.empty() ? EMPTY_STRING : INLINE_STRING)),
-      verify_subject_alt_name_list_(config.verify_subject_alt_name().begin(),
-                                    config.verify_subject_alt_name().end()),
+      verify_subject_alt_name_list_(
+          config.hidden_envoy_deprecated_verify_subject_alt_name().begin(),
+          config.hidden_envoy_deprecated_verify_subject_alt_name().end()),
       subject_alt_name_matchers_(config.match_subject_alt_names().begin(),
                                  config.match_subject_alt_names().end()),
       verify_certificate_hash_list_(config.verify_certificate_hash().begin(),
diff --git a/source/common/ssl/certificate_validation_context_config_impl.h b/source/common/ssl/certificate_validation_context_config_impl.h
index e9346b63ae46..b6fc04fd5907 100644
--- a/source/common/ssl/certificate_validation_context_config_impl.h
+++ b/source/common/ssl/certificate_validation_context_config_impl.h
@@ -3,8 +3,9 @@
 #include <string>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/ssl/certificate_validation_context_config.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 namespace Envoy {
 namespace Ssl {
@@ -12,7 +13,9 @@ namespace Ssl {
 class CertificateValidationContextConfigImpl : public CertificateValidationContextConfig {
 public:
   CertificateValidationContextConfigImpl(
-      const envoy::api::v2::auth::CertificateValidationContext& config, Api::Api& api);
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+          config,
+      Api::Api& api);
 
   const std::string& caCert() const override { return ca_cert_; }
   const std::string& caCertPath() const override { return ca_cert_path_; }
@@ -25,7 +28,7 @@ class CertificateValidationContextConfigImpl : public CertificateValidationConte
   const std::vector<std::string>& verifySubjectAltNameList() const override {
     return verify_subject_alt_name_list_;
   }
-  const std::vector<::envoy::type::matcher::StringMatcher>&
+  const std::vector<envoy::type::matcher::v3alpha::StringMatcher>&
   subjectAltNameMatchers() const override {
     return subject_alt_name_matchers_;
   }
@@ -43,7 +46,7 @@ class CertificateValidationContextConfigImpl : public CertificateValidationConte
   const std::string certificate_revocation_list_;
   const std::string certificate_revocation_list_path_;
   const std::vector<std::string> verify_subject_alt_name_list_;
-  const std::vector<::envoy::type::matcher::StringMatcher> subject_alt_name_matchers_;
+  const std::vector<envoy::type::matcher::v3alpha::StringMatcher> subject_alt_name_matchers_;
   const std::vector<std::string> verify_certificate_hash_list_;
   const std::vector<std::string> verify_certificate_spki_list_;
   const bool allow_expired_certificate_;
diff --git a/source/common/ssl/tls_certificate_config_impl.cc b/source/common/ssl/tls_certificate_config_impl.cc
index 2a2dea0a0ee8..928c88c39c5f 100644
--- a/source/common/ssl/tls_certificate_config_impl.cc
+++ b/source/common/ssl/tls_certificate_config_impl.cc
@@ -1,7 +1,7 @@
 #include "common/ssl/tls_certificate_config_impl.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/server/transport_socket_config.h"
 
 #include "common/common/empty_string.h"
@@ -14,7 +14,7 @@ namespace Ssl {
 static const std::string INLINE_STRING = "<inline>";
 
 TlsCertificateConfigImpl::TlsCertificateConfigImpl(
-    const envoy::api::v2::auth::TlsCertificate& config,
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& config,
     Server::Configuration::TransportSocketFactoryContext* factory_context, Api::Api& api)
     : certificate_chain_(Config::DataSource::read(config.certificate_chain(), true, api)),
       certificate_chain_path_(
diff --git a/source/common/ssl/tls_certificate_config_impl.h b/source/common/ssl/tls_certificate_config_impl.h
index 1db9046e925a..c2a750744da4 100644
--- a/source/common/ssl/tls_certificate_config_impl.h
+++ b/source/common/ssl/tls_certificate_config_impl.h
@@ -3,7 +3,7 @@
 #include <string>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/ssl/private_key/private_key.h"
 #include "envoy/ssl/tls_certificate_config.h"
 
@@ -12,9 +12,9 @@ namespace Ssl {
 
 class TlsCertificateConfigImpl : public TlsCertificateConfig {
 public:
-  TlsCertificateConfigImpl(const envoy::api::v2::auth::TlsCertificate& config,
-                           Server::Configuration::TransportSocketFactoryContext* factory_context,
-                           Api::Api& api);
+  TlsCertificateConfigImpl(
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate& config,
+      Server::Configuration::TransportSocketFactoryContext* factory_context, Api::Api& api);
 
   const std::string& certificateChain() const override { return certificate_chain_; }
   const std::string& certificateChainPath() const override { return certificate_chain_path_; }
diff --git a/source/common/stats/BUILD b/source/common/stats/BUILD
index fbf7789072a2..f58600cb4ab7 100644
--- a/source/common/stats/BUILD
+++ b/source/common/stats/BUILD
@@ -204,7 +204,7 @@ envoy_cc_library(
         "//source/common/common:perf_annotation_lib",
         "//source/common/config:well_known_names",
         "//source/common/protobuf",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -216,7 +216,7 @@ envoy_cc_library(
         "//include/envoy/stats:stats_interface",
         "//source/common/common:matchers_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/stats/stats_matcher_impl.cc b/source/common/stats/stats_matcher_impl.cc
index e334ffe7d624..6bd4d76fa47d 100644
--- a/source/common/stats/stats_matcher_impl.cc
+++ b/source/common/stats/stats_matcher_impl.cc
@@ -3,7 +3,7 @@
 #include <regex>
 #include <string>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/common/utility.h"
 
@@ -12,20 +12,20 @@ namespace Stats {
 
 // TODO(ambuc): Refactor this into common/matchers.cc, since StatsMatcher is really just a thin
 // wrapper around what might be called a StringMatcherList.
-StatsMatcherImpl::StatsMatcherImpl(const envoy::config::metrics::v2::StatsConfig& config) {
+StatsMatcherImpl::StatsMatcherImpl(const envoy::config::metrics::v3alpha::StatsConfig& config) {
   switch (config.stats_matcher().stats_matcher_case()) {
-  case envoy::config::metrics::v2::StatsMatcher::kRejectAll:
+  case envoy::config::metrics::v3alpha::StatsMatcher::StatsMatcherCase::kRejectAll:
     // In this scenario, there are no matchers to store.
     is_inclusive_ = !config.stats_matcher().reject_all();
     break;
-  case envoy::config::metrics::v2::StatsMatcher::kInclusionList:
+  case envoy::config::metrics::v3alpha::StatsMatcher::StatsMatcherCase::kInclusionList:
     // If we have an inclusion list, we are being default-exclusive.
     for (const auto& stats_matcher : config.stats_matcher().inclusion_list().patterns()) {
       matchers_.push_back(Matchers::StringMatcherImpl(stats_matcher));
     }
     is_inclusive_ = false;
     break;
-  case envoy::config::metrics::v2::StatsMatcher::kExclusionList:
+  case envoy::config::metrics::v3alpha::StatsMatcher::StatsMatcherCase::kExclusionList:
     // If we have an exclusion list, we are being default-inclusive.
     for (const auto& stats_matcher : config.stats_matcher().exclusion_list().patterns()) {
       matchers_.push_back(Matchers::StringMatcherImpl(stats_matcher));
diff --git a/source/common/stats/stats_matcher_impl.h b/source/common/stats/stats_matcher_impl.h
index 7fe65e7fc49e..7c680210436b 100644
--- a/source/common/stats/stats_matcher_impl.h
+++ b/source/common/stats/stats_matcher_impl.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 #include "envoy/stats/stats_matcher.h"
 
 #include "common/common/matchers.h"
@@ -18,7 +18,7 @@ namespace Stats {
  */
 class StatsMatcherImpl : public StatsMatcher {
 public:
-  explicit StatsMatcherImpl(const envoy::config::metrics::v2::StatsConfig& config);
+  explicit StatsMatcherImpl(const envoy::config::metrics::v3alpha::StatsConfig& config);
 
   // Default constructor simply allows everything.
   StatsMatcherImpl() = default;
diff --git a/source/common/stats/tag_producer_impl.cc b/source/common/stats/tag_producer_impl.cc
index 752a22a63104..8914e57b9fcf 100644
--- a/source/common/stats/tag_producer_impl.cc
+++ b/source/common/stats/tag_producer_impl.cc
@@ -3,7 +3,7 @@
 #include <string>
 
 #include "envoy/common/exception.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/common/utility.h"
 #include "common/stats/tag_extractor_impl.h"
@@ -11,7 +11,7 @@
 namespace Envoy {
 namespace Stats {
 
-TagProducerImpl::TagProducerImpl(const envoy::config::metrics::v2::StatsConfig& config) {
+TagProducerImpl::TagProducerImpl(const envoy::config::metrics::v3alpha::StatsConfig& config) {
   // To check name conflict.
   reserveResources(config);
   std::unordered_set<std::string> names = addDefaultExtractors(config);
@@ -24,8 +24,9 @@ TagProducerImpl::TagProducerImpl(const envoy::config::metrics::v2::StatsConfig&
 
     // If no tag value is found, fallback to default regex to keep backward compatibility.
     if (tag_specifier.tag_value_case() ==
-            envoy::config::metrics::v2::TagSpecifier::TAG_VALUE_NOT_SET ||
-        tag_specifier.tag_value_case() == envoy::config::metrics::v2::TagSpecifier::kRegex) {
+            envoy::config::metrics::v3alpha::TagSpecifier::TagValueCase::TAG_VALUE_NOT_SET ||
+        tag_specifier.tag_value_case() ==
+            envoy::config::metrics::v3alpha::TagSpecifier::TagValueCase::kRegex) {
 
       if (tag_specifier.regex().empty()) {
         if (addExtractorsMatching(name) == 0) {
@@ -36,7 +37,7 @@ TagProducerImpl::TagProducerImpl(const envoy::config::metrics::v2::StatsConfig&
         addExtractor(Stats::TagExtractorImpl::createTagExtractor(name, tag_specifier.regex()));
       }
     } else if (tag_specifier.tag_value_case() ==
-               envoy::config::metrics::v2::TagSpecifier::kFixedValue) {
+               envoy::config::metrics::v3alpha::TagSpecifier::TagValueCase::kFixedValue) {
       default_tags_.emplace_back(Stats::Tag{name, tag_specifier.fixed_value()});
     }
   }
@@ -92,12 +93,12 @@ std::string TagProducerImpl::produceTags(absl::string_view metric_name,
   return StringUtil::removeCharacters(metric_name, remove_characters);
 }
 
-void TagProducerImpl::reserveResources(const envoy::config::metrics::v2::StatsConfig& config) {
+void TagProducerImpl::reserveResources(const envoy::config::metrics::v3alpha::StatsConfig& config) {
   default_tags_.reserve(config.stats_tags().size());
 }
 
 std::unordered_set<std::string>
-TagProducerImpl::addDefaultExtractors(const envoy::config::metrics::v2::StatsConfig& config) {
+TagProducerImpl::addDefaultExtractors(const envoy::config::metrics::v3alpha::StatsConfig& config) {
   std::unordered_set<std::string> names;
   if (!config.has_use_all_default_tags() || config.use_all_default_tags().value()) {
     for (const auto& desc : Config::TagNames::get().descriptorVec()) {
diff --git a/source/common/stats/tag_producer_impl.h b/source/common/stats/tag_producer_impl.h
index e18f111e9238..169903288ca5 100644
--- a/source/common/stats/tag_producer_impl.h
+++ b/source/common/stats/tag_producer_impl.h
@@ -8,7 +8,7 @@
 #include <unordered_set>
 #include <vector>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 #include "envoy/stats/tag_extractor.h"
 #include "envoy/stats/tag_producer.h"
 
@@ -29,7 +29,7 @@ namespace Stats {
  */
 class TagProducerImpl : public TagProducer {
 public:
-  TagProducerImpl(const envoy::config::metrics::v2::StatsConfig& config);
+  TagProducerImpl(const envoy::config::metrics::v3alpha::StatsConfig& config);
   TagProducerImpl() = default;
 
   /**
@@ -63,7 +63,7 @@ class TagProducerImpl : public TagProducer {
    * Roughly estimate the size of the vectors.
    * @param config const envoy::config::metrics::v2::StatsConfig& the config.
    */
-  void reserveResources(const envoy::config::metrics::v2::StatsConfig& config);
+  void reserveResources(const envoy::config::metrics::v3alpha::StatsConfig& config);
 
   /**
    * Adds all default extractors from well_known_names.cc into the
@@ -74,7 +74,7 @@ class TagProducerImpl : public TagProducer {
    * @return names std::unordered_set<std::string> the set of names to populate
    */
   std::unordered_set<std::string>
-  addDefaultExtractors(const envoy::config::metrics::v2::StatsConfig& config);
+  addDefaultExtractors(const envoy::config::metrics::v3alpha::StatsConfig& config);
 
   /**
    * Iterates over every tag extractor that might possibly match stat_name, calling
diff --git a/source/common/stream_info/BUILD b/source/common/stream_info/BUILD
index f7f96eb3ad75..85ed82ae7211 100644
--- a/source/common/stream_info/BUILD
+++ b/source/common/stream_info/BUILD
@@ -16,7 +16,7 @@ envoy_cc_library(
         "//include/envoy/stream_info:stream_info_interface",
         "//source/common/common:assert_lib",
         "//source/common/common:dump_state_utils",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/common/stream_info/stream_info_impl.h b/source/common/stream_info/stream_info_impl.h
index 6f23a183f388..9cb127d7fab5 100644
--- a/source/common/stream_info/stream_info_impl.h
+++ b/source/common/stream_info/stream_info_impl.h
@@ -3,8 +3,8 @@
 #include <chrono>
 #include <cstdint>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/time.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/stream_info/stream_info.h"
 
@@ -209,8 +209,10 @@ struct StreamInfoImpl : public StreamInfo {
 
   const Router::RouteEntry* routeEntry() const override { return route_entry_; }
 
-  envoy::api::v2::core::Metadata& dynamicMetadata() override { return metadata_; };
-  const envoy::api::v2::core::Metadata& dynamicMetadata() const override { return metadata_; };
+  envoy::config::core::v3alpha::Metadata& dynamicMetadata() override { return metadata_; };
+  const envoy::config::core::v3alpha::Metadata& dynamicMetadata() const override {
+    return metadata_;
+  };
 
   void setDynamicMetadata(const std::string& name, const ProtobufWkt::Struct& value) override {
     (*metadata_.mutable_filter_metadata())[name].MergeFrom(value);
@@ -260,7 +262,7 @@ struct StreamInfoImpl : public StreamInfo {
   Upstream::HostDescriptionConstSharedPtr upstream_host_{};
   bool health_check_request_{};
   const Router::RouteEntry* route_entry_{};
-  envoy::api::v2::core::Metadata metadata_{};
+  envoy::config::core::v3alpha::Metadata metadata_{};
   std::shared_ptr<FilterStateImpl> filter_state_;
   std::string route_name_;
 
diff --git a/source/common/tcp_proxy/BUILD b/source/common/tcp_proxy/BUILD
index 504ced2b864c..de203953f578 100644
--- a/source/common/tcp_proxy/BUILD
+++ b/source/common/tcp_proxy/BUILD
@@ -43,7 +43,7 @@ envoy_cc_library(
         "//source/common/router:metadatamatchcriteria_lib",
         "//source/common/stream_info:stream_info_lib",
         "//source/common/upstream:load_balancer_lib",
-        "@envoy_api//envoy/config/filter/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/tcp_proxy/tcp_proxy.cc b/source/common/tcp_proxy/tcp_proxy.cc
index 8a71036e1eeb..764ec1c70480 100644
--- a/source/common/tcp_proxy/tcp_proxy.cc
+++ b/source/common/tcp_proxy/tcp_proxy.cc
@@ -4,10 +4,10 @@
 #include <string>
 
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/timer.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/upstream/cluster_manager.h"
 #include "envoy/upstream/upstream.h"
@@ -34,7 +34,8 @@ const std::string& PerConnectionCluster::key() {
 
 Config::RouteImpl::RouteImpl(
     const Config& parent,
-    const envoy::config::filter::network::tcp_proxy::v2::TcpProxy::DeprecatedV1::TCPRoute& config)
+    const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::DeprecatedV1::TCPRoute&
+        config)
     : parent_(parent) {
   cluster_name_ = config.cluster();
 
@@ -74,9 +75,8 @@ bool Config::RouteImpl::matches(Network::Connection& connection) const {
 }
 
 Config::WeightedClusterEntry::WeightedClusterEntry(
-    const Config& parent,
-    const envoy::config::filter::network::tcp_proxy::v2::TcpProxy::WeightedCluster::ClusterWeight&
-        config)
+    const Config& parent, const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::
+                              WeightedCluster::ClusterWeight& config)
     : parent_(parent), cluster_name_(config.name()), cluster_weight_(config.weight()) {
   if (config.has_metadata_match()) {
     const auto filter_it = config.metadata_match().filter_metadata().find(
@@ -94,7 +94,7 @@ Config::WeightedClusterEntry::WeightedClusterEntry(
 }
 
 Config::SharedConfig::SharedConfig(
-    const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& config,
+    const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& config,
     Server::Configuration::FactoryContext& context)
     : stats_scope_(context.scope().createScope(fmt::format("tcp.{}", config.stat_prefix()))),
       stats_(generateStats(*stats_scope_)) {
@@ -108,7 +108,7 @@ Config::SharedConfig::SharedConfig(
   }
 }
 
-Config::Config(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& config,
+Config::Config(const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& config,
                Server::Configuration::FactoryContext& context)
     : max_connect_attempts_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, max_connect_attempts, 1)),
       upstream_drain_manager_slot_(context.threadLocal().allocateSlot()),
@@ -119,15 +119,16 @@ Config::Config(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& co
     return ThreadLocal::ThreadLocalObjectSharedPtr(new UpstreamDrainManager());
   });
 
-  if (config.has_deprecated_v1()) {
-    for (const envoy::config::filter::network::tcp_proxy::v2::TcpProxy::DeprecatedV1::TCPRoute&
-             route_desc : config.deprecated_v1().routes()) {
+  if (config.has_hidden_envoy_deprecated_deprecated_v1()) {
+    for (const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::DeprecatedV1::
+             TCPRoute& route_desc : config.hidden_envoy_deprecated_deprecated_v1().routes()) {
       routes_.emplace_back(std::make_shared<const RouteImpl>(*this, route_desc));
     }
   }
 
   if (!config.cluster().empty()) {
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy::DeprecatedV1::TCPRoute default_route;
+    envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::DeprecatedV1::TCPRoute
+        default_route;
     default_route.set_cluster(config.cluster());
     routes_.emplace_back(std::make_shared<const RouteImpl>(*this, default_route));
   }
@@ -147,7 +148,7 @@ Config::Config(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& co
   // deprecated v1 routes are absent.
   if (routes_.empty() && config.has_weighted_clusters()) {
     total_cluster_weight_ = 0;
-    for (const envoy::config::filter::network::tcp_proxy::v2::TcpProxy::WeightedCluster::
+    for (const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::WeightedCluster::
              ClusterWeight& cluster_desc : config.weighted_clusters().clusters()) {
       WeightedClusterEntryConstSharedPtr cluster_entry(
           std::make_shared<const WeightedClusterEntry>(*this, cluster_desc));
@@ -156,7 +157,8 @@ Config::Config(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& co
     }
   }
 
-  for (const envoy::config::filter::accesslog::v2::AccessLog& log_config : config.access_log()) {
+  for (const envoy::config::filter::accesslog::v3alpha::AccessLog& log_config :
+       config.access_log()) {
     access_logs_.emplace_back(AccessLog::AccessLogFactory::fromProto(log_config, context));
   }
 
@@ -173,7 +175,7 @@ RouteConstSharedPtr Config::getRegularRouteFromEntries(Network::Connection& conn
         connection.streamInfo().filterState().getDataReadOnly<PerConnectionCluster>(
             PerConnectionCluster::key());
 
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy::DeprecatedV1::TCPRoute
+    envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::DeprecatedV1::TCPRoute
         per_connection_route;
     per_connection_route.set_cluster(per_connection_cluster.value());
     return std::make_shared<const RouteImpl>(*this, per_connection_route);
diff --git a/source/common/tcp_proxy/tcp_proxy.h b/source/common/tcp_proxy/tcp_proxy.h
index a9a7e1d50a4b..6c2adb079f6b 100644
--- a/source/common/tcp_proxy/tcp_proxy.h
+++ b/source/common/tcp_proxy/tcp_proxy.h
@@ -7,8 +7,8 @@
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
 #include "envoy/event/timer.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
 #include "envoy/runtime/runtime.h"
@@ -99,7 +99,7 @@ class Config {
    */
   class SharedConfig {
   public:
-    SharedConfig(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& config,
+    SharedConfig(const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& config,
                  Server::Configuration::FactoryContext& context);
     const TcpProxyStats& stats() { return stats_; }
     const absl::optional<std::chrono::milliseconds>& idleTimeout() { return idle_timeout_; }
@@ -117,7 +117,7 @@ class Config {
 
   using SharedConfigSharedPtr = std::shared_ptr<SharedConfig>;
 
-  Config(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& config,
+  Config(const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& config,
          Server::Configuration::FactoryContext& context);
 
   /**
@@ -146,9 +146,8 @@ class Config {
 
 private:
   struct RouteImpl : public Route {
-    RouteImpl(const Config& parent,
-              const envoy::config::filter::network::tcp_proxy::v2::TcpProxy::DeprecatedV1::TCPRoute&
-                  config);
+    RouteImpl(const Config& parent, const envoy::extensions::filters::network::tcp_proxy::v3alpha::
+                                        TcpProxy::DeprecatedV1::TCPRoute& config);
 
     // Route
     bool matches(Network::Connection& connection) const override;
@@ -168,7 +167,7 @@ class Config {
   class WeightedClusterEntry : public Route {
   public:
     WeightedClusterEntry(const Config& parent,
-                         const envoy::config::filter::network::tcp_proxy::v2::TcpProxy::
+                         const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::
                              WeightedCluster::ClusterWeight& config);
 
     uint64_t clusterWeight() const { return cluster_weight_; }
diff --git a/source/common/tracing/BUILD b/source/common/tracing/BUILD
index d69373394f05..4012931375ba 100644
--- a/source/common/tracing/BUILD
+++ b/source/common/tracing/BUILD
@@ -38,7 +38,7 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/runtime:uuid_util_lib",
         "//source/common/stream_info:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/type/metadata/v2:pkg_cc_proto",
         "@envoy_api//envoy/type/tracing/v2:pkg_cc_proto",
     ],
diff --git a/source/common/tracing/http_tracer_impl.cc b/source/common/tracing/http_tracer_impl.cc
index d5e9d63257f8..c4a3f4c7a93e 100644
--- a/source/common/tracing/http_tracer_impl.cc
+++ b/source/common/tracing/http_tracer_impl.cc
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/type/metadata/v2/metadata.pb.h"
 #include "envoy/type/tracing/v2/custom_tag.pb.h"
 
@@ -237,13 +237,13 @@ void HttpTracerUtility::setCommonTags(Span& span, const Http::HeaderMap* respons
 CustomTagConstSharedPtr
 HttpTracerUtility::createCustomTag(const envoy::type::tracing::v2::CustomTag& tag) {
   switch (tag.type_case()) {
-  case envoy::type::tracing::v2::CustomTag::kLiteral:
+  case envoy::type::tracing::v2::CustomTag::TypeCase::kLiteral:
     return std::make_shared<const Tracing::LiteralCustomTag>(tag.tag(), tag.literal());
-  case envoy::type::tracing::v2::CustomTag::kEnvironment:
+  case envoy::type::tracing::v2::CustomTag::TypeCase::kEnvironment:
     return std::make_shared<const Tracing::EnvironmentCustomTag>(tag.tag(), tag.environment());
-  case envoy::type::tracing::v2::CustomTag::kRequestHeader:
+  case envoy::type::tracing::v2::CustomTag::TypeCase::kRequestHeader:
     return std::make_shared<const Tracing::RequestHeaderCustomTag>(tag.tag(), tag.request_header());
-  case envoy::type::tracing::v2::CustomTag::kMetadata:
+  case envoy::type::tracing::v2::CustomTag::TypeCase::kMetadata:
     return std::make_shared<const Tracing::MetadataCustomTag>(tag.tag(), tag.metadata());
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
@@ -308,7 +308,7 @@ MetadataCustomTag::MetadataCustomTag(const std::string& tag,
       metadata_key_(metadata.metadata_key()), default_value_(metadata.default_value()) {}
 
 void MetadataCustomTag::apply(Span& span, const CustomTagContext& ctx) const {
-  const envoy::api::v2::core::Metadata* meta = metadata(ctx);
+  const envoy::config::core::v3alpha::Metadata* meta = metadata(ctx);
   if (!meta) {
     if (!default_value_.empty()) {
       span.setTag(tag(), default_value_);
@@ -340,21 +340,21 @@ void MetadataCustomTag::apply(Span& span, const CustomTagContext& ctx) const {
   }
 }
 
-const envoy::api::v2::core::Metadata*
+const envoy::config::core::v3alpha::Metadata*
 MetadataCustomTag::metadata(const CustomTagContext& ctx) const {
   const StreamInfo::StreamInfo& info = ctx.stream_info;
   switch (kind_) {
-  case envoy::type::metadata::v2::MetadataKind::kRequest:
+  case envoy::type::metadata::v2::MetadataKind::KindCase::kRequest:
     return &info.dynamicMetadata();
-  case envoy::type::metadata::v2::MetadataKind::kRoute: {
+  case envoy::type::metadata::v2::MetadataKind::KindCase::kRoute: {
     const Router::RouteEntry* route_entry = info.routeEntry();
     return route_entry ? &route_entry->metadata() : nullptr;
   }
-  case envoy::type::metadata::v2::MetadataKind::kCluster: {
+  case envoy::type::metadata::v2::MetadataKind::KindCase::kCluster: {
     const auto& hostPtr = info.upstreamHost();
     return hostPtr ? &hostPtr->cluster().metadata() : nullptr;
   }
-  case envoy::type::metadata::v2::MetadataKind::kHost: {
+  case envoy::type::metadata::v2::MetadataKind::KindCase::kHost: {
     const auto& hostPtr = info.upstreamHost();
     return hostPtr ? hostPtr->metadata().get() : nullptr;
   }
diff --git a/source/common/tracing/http_tracer_impl.h b/source/common/tracing/http_tracer_impl.h
index 02f4c0478956..3024826d6000 100644
--- a/source/common/tracing/http_tracer_impl.h
+++ b/source/common/tracing/http_tracer_impl.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/thread_local/thread_local.h"
@@ -245,7 +245,7 @@ class MetadataCustomTag : public CustomTagBase {
                     const envoy::type::tracing::v2::CustomTag::Metadata& metadata);
   void apply(Span& span, const CustomTagContext& ctx) const override;
   absl::string_view value(const CustomTagContext&) const override { return default_value_; }
-  const envoy::api::v2::core::Metadata* metadata(const CustomTagContext& ctx) const;
+  const envoy::config::core::v3alpha::Metadata* metadata(const CustomTagContext& ctx) const;
 
 protected:
   const envoy::type::metadata::v2::MetadataKind::KindCase kind_;
diff --git a/source/common/upstream/BUILD b/source/common/upstream/BUILD
index d6f578fb0ae8..8db7f43fd763 100644
--- a/source/common/upstream/BUILD
+++ b/source/common/upstream/BUILD
@@ -23,8 +23,9 @@ envoy_cc_library(
         "//source/common/config:utility_lib",
         "//source/common/protobuf:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
         "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -64,10 +65,10 @@ envoy_cc_library(
         "//source/common/tcp:conn_pool_lib",
         "//source/common/upstream:priority_conn_pool_map_impl_lib",
         "//source/common/upstream:upstream_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -124,8 +125,8 @@ envoy_cc_library(
     deps = [
         "//include/envoy/upstream:health_checker_interface",
         "//source/common/router:router_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/data/core/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -138,9 +139,9 @@ envoy_cc_library(
     ],
     deps = [
         ":health_checker_base_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/data/core/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
         # TODO(dio): Remove dependency to server.
         "//include/envoy/server:health_checker_config_interface",
         "//source/common/grpc:codec_lib",
@@ -171,7 +172,7 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/common:stack_array",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -185,7 +186,7 @@ envoy_cc_library(
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/common:minimal_logger_lib",
         "//source/common/grpc:async_client_lib",
-        "@envoy_api//envoy/service/load_stats/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/load_stats/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -211,10 +212,10 @@ envoy_cc_library(
         "//source/common/network:resolver_lib",
         "//source/extensions/transport_sockets:well_known_names",
         "//source/server:transport_socket_config_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/health/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -224,8 +225,8 @@ envoy_cc_library(
     hdrs = ["logical_host.h"],
     deps = [
         ":upstream_includes",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -245,9 +246,9 @@ envoy_cc_library(
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
         "//source/extensions/clusters:well_known_names",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -264,9 +265,9 @@ envoy_cc_library(
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
         "//source/extensions/clusters:well_known_names",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -285,8 +286,7 @@ envoy_cc_library(
         "//source/common/common:utility_lib",
         "//source/common/http:codes_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/cluster:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/data/cluster/v2alpha:pkg_cc_proto",
     ],
 )
@@ -309,7 +309,7 @@ envoy_cc_library(
     external_deps = ["abseil_synchronization"],
     deps = [
         ":load_balancer_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -320,7 +320,7 @@ envoy_cc_library(
     deps = [
         ":thread_aware_lb_lib",
         ":upstream_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -331,7 +331,7 @@ envoy_cc_library(
     deps = [
         ":thread_aware_lb_lib",
         "//source/common/common:minimal_logger_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -359,8 +359,10 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/clusters:well_known_names",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -380,8 +382,8 @@ envoy_cc_library(
         "//source/common/config:metadata_lib",
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -398,10 +400,9 @@ envoy_cc_library(
         ":strict_dns_cluster_lib",
         ":upstream_includes",
         ":transport_socket_match_lib",
-        "@envoy_api//envoy/api/v2/cluster:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
         "//include/envoy/event:dispatcher_interface",
         "//include/envoy/event:timer_interface",
         "//include/envoy/network:dns_interface",
@@ -433,8 +434,8 @@ envoy_cc_library(
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
         "//source/extensions/transport_sockets:well_known_names",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -445,7 +446,8 @@ envoy_cc_library(
     deps = [
         ":cluster_factory_includes",
         ":upstream_includes",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -456,8 +458,8 @@ envoy_cc_library(
     deps = [
         ":cluster_factory_includes",
         ":upstream_includes",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -494,9 +496,9 @@ envoy_cc_library(
         "//source/common/stats:isolated_store_lib",
         "//source/common/stats:stats_lib",
         "//source/server:transport_socket_config_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -525,7 +527,7 @@ envoy_cc_library(
         "//source/extensions/clusters:well_known_names",
         "//source/extensions/transport_sockets:well_known_names",
         "//source/server:transport_socket_config_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -561,6 +563,6 @@ envoy_cc_library(
         "//source/common/stats:stats_lib",
         "//source/extensions/clusters:well_known_names",
         "//source/server:transport_socket_config_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/upstream/cds_api_impl.cc b/source/common/upstream/cds_api_impl.cc
index 9180e8633738..e3403eb99060 100644
--- a/source/common/upstream/cds_api_impl.cc
+++ b/source/common/upstream/cds_api_impl.cc
@@ -2,11 +2,11 @@
 
 #include <string>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/cluster.pb.validate.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/api/v2/cluster.pb.h"
 #include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.validate.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/cleanup.h"
@@ -21,14 +21,15 @@
 namespace Envoy {
 namespace Upstream {
 
-CdsApiPtr CdsApiImpl::create(const envoy::api::v2::core::ConfigSource& cds_config,
+CdsApiPtr CdsApiImpl::create(const envoy::config::core::v3alpha::ConfigSource& cds_config,
                              ClusterManager& cm, Stats::Scope& scope,
                              ProtobufMessage::ValidationVisitor& validation_visitor) {
   return CdsApiPtr{new CdsApiImpl(cds_config, cm, scope, validation_visitor)};
 }
 
-CdsApiImpl::CdsApiImpl(const envoy::api::v2::core::ConfigSource& cds_config, ClusterManager& cm,
-                       Stats::Scope& scope, ProtobufMessage::ValidationVisitor& validation_visitor)
+CdsApiImpl::CdsApiImpl(const envoy::config::core::v3alpha::ConfigSource& cds_config,
+                       ClusterManager& cm, Stats::Scope& scope,
+                       ProtobufMessage::ValidationVisitor& validation_visitor)
     : cm_(cm), scope_(scope.createScope("cluster_manager.cds.")),
       validation_visitor_(validation_visitor), xds_api_version_(cds_config.xds_api_version()) {
   subscription_ = cm_.subscriptionFactory().subscriptionFromConfigSource(cds_config, loadTypeUrl(),
@@ -38,18 +39,19 @@ CdsApiImpl::CdsApiImpl(const envoy::api::v2::core::ConfigSource& cds_config, Clu
 void CdsApiImpl::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                                 const std::string& version_info) {
   ClusterManager::ClusterInfoMap clusters_to_remove = cm_.clusters();
-  std::vector<envoy::api::v2::Cluster> clusters;
+  std::vector<envoy::config::cluster::v3alpha::Cluster> clusters;
   for (const auto& cluster_blob : resources) {
-    clusters.push_back(MessageUtil::anyConvert<envoy::api::v2::Cluster>(cluster_blob));
+    clusters.push_back(
+        MessageUtil::anyConvert<envoy::config::cluster::v3alpha::Cluster>(cluster_blob));
     clusters_to_remove.erase(clusters.back().name());
   }
   Protobuf::RepeatedPtrField<std::string> to_remove_repeated;
   for (const auto& cluster : clusters_to_remove) {
     *to_remove_repeated.Add() = cluster.first;
   }
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> to_add_repeated;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> to_add_repeated;
   for (const auto& cluster : clusters) {
-    envoy::api::v2::Resource* to_add = to_add_repeated.Add();
+    envoy::service::discovery::v3alpha::Resource* to_add = to_add_repeated.Add();
     to_add->set_name(cluster.name());
     to_add->set_version(version_info);
     to_add->mutable_resource()->PackFrom(cluster);
@@ -58,7 +60,7 @@ void CdsApiImpl::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::An
 }
 
 void CdsApiImpl::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& system_version_info) {
   std::unique_ptr<Cleanup> maybe_eds_resume;
@@ -75,9 +77,10 @@ void CdsApiImpl::onConfigUpdate(
   std::unordered_set<std::string> cluster_names;
   bool any_applied = false;
   for (const auto& resource : added_resources) {
-    envoy::api::v2::Cluster cluster;
+    envoy::config::cluster::v3alpha::Cluster cluster;
     try {
-      cluster = MessageUtil::anyConvert<envoy::api::v2::Cluster>(resource.resource());
+      cluster =
+          MessageUtil::anyConvert<envoy::config::cluster::v3alpha::Cluster>(resource.resource());
       MessageUtil::validate(cluster, validation_visitor_);
       if (!cluster_names.insert(cluster.name()).second) {
         // NOTE: at this point, the first of these duplicates has already been successfully applied.
@@ -128,11 +131,11 @@ void CdsApiImpl::runInitializeCallbackIfAny() {
 std::string CdsApiImpl::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::Cluster().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::config::cluster::v3alpha::Cluster().GetDescriptor()->full_name()));
   default:
diff --git a/source/common/upstream/cds_api_impl.h b/source/common/upstream/cds_api_impl.h
index e83a03cfbadf..b0ced7adc424 100644
--- a/source/common/upstream/cds_api_impl.h
+++ b/source/common/upstream/cds_api_impl.h
@@ -3,12 +3,12 @@
 #include <functional>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/local_info/local_info.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -24,8 +24,8 @@ class CdsApiImpl : public CdsApi,
                    Config::SubscriptionCallbacks,
                    Logger::Loggable<Logger::Id::upstream> {
 public:
-  static CdsApiPtr create(const envoy::api::v2::core::ConfigSource& cds_config, ClusterManager& cm,
-                          Stats::Scope& scope,
+  static CdsApiPtr create(const envoy::config::core::v3alpha::ConfigSource& cds_config,
+                          ClusterManager& cm, Stats::Scope& scope,
                           ProtobufMessage::ValidationVisitor& validation_visitor);
 
   // Upstream::CdsApi
@@ -39,16 +39,18 @@ class CdsApiImpl : public CdsApi,
   // Config::SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& system_version_info) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string& system_version_info) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::Cluster>(resource).name();
+    return MessageUtil::anyConvert<envoy::config::cluster::v3alpha::Cluster>(resource).name();
   }
   std::string loadTypeUrl();
-  CdsApiImpl(const envoy::api::v2::core::ConfigSource& cds_config, ClusterManager& cm,
+  CdsApiImpl(const envoy::config::core::v3alpha::ConfigSource& cds_config, ClusterManager& cm,
              Stats::Scope& scope, ProtobufMessage::ValidationVisitor& validation_visitor);
   void runInitializeCallbackIfAny();
 
@@ -58,7 +60,7 @@ class CdsApiImpl : public CdsApi,
   std::function<void()> initialize_callback_;
   Stats::ScopePtr scope_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 } // namespace Upstream
diff --git a/source/common/upstream/cluster_factory_impl.cc b/source/common/upstream/cluster_factory_impl.cc
index 9c2f5da1b8f8..d2c715af03d6 100644
--- a/source/common/upstream/cluster_factory_impl.cc
+++ b/source/common/upstream/cluster_factory_impl.cc
@@ -1,6 +1,6 @@
 #include "common/upstream/cluster_factory_impl.h"
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/http/utility.h"
 #include "common/network/address_impl.h"
@@ -15,7 +15,8 @@ namespace Upstream {
 
 namespace {
 
-Stats::ScopePtr generateStatsScope(const envoy::api::v2::Cluster& config, Stats::Store& stats) {
+Stats::ScopePtr generateStatsScope(const envoy::config::cluster::v3alpha::Cluster& config,
+                                   Stats::Store& stats) {
   return stats.createScope(fmt::format(
       "cluster.{}.", config.alt_stat_name().empty() ? config.name() : config.alt_stat_name()));
 }
@@ -23,8 +24,8 @@ Stats::ScopePtr generateStatsScope(const envoy::api::v2::Cluster& config, Stats:
 } // namespace
 
 std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr> ClusterFactoryImplBase::create(
-    const envoy::api::v2::Cluster& cluster, ClusterManager& cluster_manager, Stats::Store& stats,
-    ThreadLocal::Instance& tls, Network::DnsResolverSharedPtr dns_resolver,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cluster_manager,
+    Stats::Store& stats, ThreadLocal::Instance& tls, Network::DnsResolverSharedPtr dns_resolver,
     Ssl::ContextManager& ssl_context_manager, Runtime::Loader& runtime,
     Runtime::RandomGenerator& random, Event::Dispatcher& dispatcher,
     AccessLog::AccessLogManager& log_manager, const LocalInfo::LocalInfo& local_info,
@@ -35,19 +36,19 @@ std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr> ClusterFactoryImplBase::
 
   if (!cluster.has_cluster_type()) {
     switch (cluster.type()) {
-    case envoy::api::v2::Cluster::STATIC:
+    case envoy::config::cluster::v3alpha::Cluster::STATIC:
       cluster_type = Extensions::Clusters::ClusterTypes::get().Static;
       break;
-    case envoy::api::v2::Cluster::STRICT_DNS:
+    case envoy::config::cluster::v3alpha::Cluster::STRICT_DNS:
       cluster_type = Extensions::Clusters::ClusterTypes::get().StrictDns;
       break;
-    case envoy::api::v2::Cluster::LOGICAL_DNS:
+    case envoy::config::cluster::v3alpha::Cluster::LOGICAL_DNS:
       cluster_type = Extensions::Clusters::ClusterTypes::get().LogicalDns;
       break;
-    case envoy::api::v2::Cluster::ORIGINAL_DST:
+    case envoy::config::cluster::v3alpha::Cluster::ORIGINAL_DST:
       cluster_type = Extensions::Clusters::ClusterTypes::get().OriginalDst;
       break;
-    case envoy::api::v2::Cluster::EDS:
+    case envoy::config::cluster::v3alpha::Cluster::EDS:
       cluster_type = Extensions::Clusters::ClusterTypes::get().Eds;
       break;
     default:
@@ -71,7 +72,7 @@ std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr> ClusterFactoryImplBase::
 }
 
 Network::DnsResolverSharedPtr
-ClusterFactoryImplBase::selectDnsResolver(const envoy::api::v2::Cluster& cluster,
+ClusterFactoryImplBase::selectDnsResolver(const envoy::config::cluster::v3alpha::Cluster& cluster,
                                           ClusterFactoryContext& context) {
   // We make this a shared pointer to deal with the distinct ownership
   // scenarios that can exist: in one case, we pass in the "default"
@@ -94,7 +95,7 @@ ClusterFactoryImplBase::selectDnsResolver(const envoy::api::v2::Cluster& cluster
 }
 
 std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-ClusterFactoryImplBase::create(const envoy::api::v2::Cluster& cluster,
+ClusterFactoryImplBase::create(const envoy::config::cluster::v3alpha::Cluster& cluster,
                                ClusterFactoryContext& context) {
   auto stats_scope = generateStatsScope(cluster, context.stats());
   Server::Configuration::TransportSocketFactoryContextImpl factory_context(
diff --git a/source/common/upstream/cluster_factory_impl.h b/source/common/upstream/cluster_factory_impl.h
index a064a8279cfd..1682503f26a0 100644
--- a/source/common/upstream/cluster_factory_impl.h
+++ b/source/common/upstream/cluster_factory_impl.h
@@ -11,7 +11,7 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/event/timer.h"
 #include "envoy/local_info/local_info.h"
@@ -117,7 +117,7 @@ class ClusterFactoryImplBase : public ClusterFactory {
    * Static method to get the registered cluster factory and create an instance of cluster.
    */
   static std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-  create(const envoy::api::v2::Cluster& cluster, ClusterManager& cluster_manager,
+  create(const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cluster_manager,
          Stats::Store& stats, ThreadLocal::Instance& tls,
          Network::DnsResolverSharedPtr dns_resolver, Ssl::ContextManager& ssl_context_manager,
          Runtime::Loader& runtime, Runtime::RandomGenerator& random, Event::Dispatcher& dispatcher,
@@ -129,12 +129,14 @@ class ClusterFactoryImplBase : public ClusterFactory {
   /**
    * Create a dns resolver to be used by the cluster.
    */
-  Network::DnsResolverSharedPtr selectDnsResolver(const envoy::api::v2::Cluster& cluster,
-                                                  ClusterFactoryContext& context);
+  Network::DnsResolverSharedPtr
+  selectDnsResolver(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context);
 
   // Upstream::ClusterFactory
   std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-  create(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context) override;
+  create(const envoy::config::cluster::v3alpha::Cluster& cluster,
+         ClusterFactoryContext& context) override;
   std::string name() override { return name_; }
 
 protected:
@@ -145,7 +147,8 @@ class ClusterFactoryImplBase : public ClusterFactory {
    * Create an instance of ClusterImplBase.
    */
   virtual std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) PURE;
   const std::string name_;
@@ -169,7 +172,8 @@ template <class ConfigProto> class ConfigurableClusterFactoryBase : public Clust
 
 private:
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override {
     ProtobufTypes::MessagePtr config = createEmptyConfigProto();
@@ -183,7 +187,7 @@ template <class ConfigProto> class ConfigurableClusterFactoryBase : public Clust
   }
 
   virtual std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr> createClusterWithConfig(
-      const envoy::api::v2::Cluster& cluster, const ConfigProto& proto_config,
+      const envoy::config::cluster::v3alpha::Cluster& cluster, const ConfigProto& proto_config,
       ClusterFactoryContext& context,
       Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
       Stats::ScopePtr&& stats_scope) PURE;
diff --git a/source/common/upstream/cluster_manager_impl.cc b/source/common/upstream/cluster_manager_impl.cc
index a478ecbb2eda..9b696325c6bd 100644
--- a/source/common/upstream/cluster_manager_impl.cc
+++ b/source/common/upstream/cluster_manager_impl.cc
@@ -8,10 +8,10 @@
 #include <string>
 #include <vector>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/network/dns.h"
 #include "envoy/runtime/runtime.h"
@@ -202,7 +202,7 @@ void ClusterManagerInitHelper::setInitializedCb(std::function<void()> callback)
 }
 
 ClusterManagerImpl::ClusterManagerImpl(
-    const envoy::config::bootstrap::v2::Bootstrap& bootstrap, ClusterManagerFactory& factory,
+    const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap, ClusterManagerFactory& factory,
     Stats::Store& stats, ThreadLocal::Instance& tls, Runtime::Loader& runtime,
     Runtime::RandomGenerator& random, const LocalInfo::LocalInfo& local_info,
     AccessLog::AccessLogManager& log_manager, Event::Dispatcher& main_thread_dispatcher,
@@ -246,10 +246,10 @@ ClusterManagerImpl::ClusterManagerImpl(
   // cluster, so the non-EDS clusters must be loaded first.
   for (const auto& cluster : bootstrap.static_resources().clusters()) {
     // First load all the primary clusters.
-    if (cluster.type() != envoy::api::v2::Cluster::EDS ||
-        (cluster.type() == envoy::api::v2::Cluster::EDS &&
+    if (cluster.type() != envoy::config::cluster::v3alpha::Cluster::EDS ||
+        (cluster.type() == envoy::config::cluster::v3alpha::Cluster::EDS &&
          cluster.eds_cluster_config().eds_config().config_source_specifier_case() ==
-             envoy::api::v2::core::ConfigSource::ConfigSourceSpecifierCase::kPath)) {
+             envoy::config::core::v3alpha::ConfigSource::ConfigSourceSpecifierCase::kPath)) {
       loadCluster(cluster, "", false, active_clusters_);
     }
   }
@@ -260,7 +260,7 @@ ClusterManagerImpl::ClusterManagerImpl(
   // whether the backing implementation is delta or SotW.
   if (dyn_resources.has_ads_config()) {
     if (dyn_resources.ads_config().api_type() ==
-        envoy::api::v2::core::ApiConfigSource::DELTA_GRPC) {
+        envoy::config::core::v3alpha::ApiConfigSource::DELTA_GRPC) {
       auto& api_config_source = dyn_resources.has_ads_config()
                                     ? dyn_resources.ads_config()
                                     : dyn_resources.cds_config().api_config_source();
@@ -293,9 +293,9 @@ ClusterManagerImpl::ClusterManagerImpl(
   // After ADS is initialized, load EDS static clusters as EDS config may potentially need ADS.
   for (const auto& cluster : bootstrap.static_resources().clusters()) {
     // Now load all the secondary clusters.
-    if (cluster.type() == envoy::api::v2::Cluster::EDS &&
+    if (cluster.type() == envoy::config::cluster::v3alpha::Cluster::EDS &&
         cluster.eds_cluster_config().eds_config().config_source_specifier_case() !=
-            envoy::api::v2::core::ConfigSource::ConfigSourceSpecifierCase::kPath) {
+            envoy::config::core::v3alpha::ConfigSource::ConfigSourceSpecifierCase::kPath) {
       loadCluster(cluster, "", false, active_clusters_);
     }
   }
@@ -506,7 +506,7 @@ void ClusterManagerImpl::applyUpdates(const Cluster& cluster, uint32_t priority,
   updates.last_updated_ = time_source_.monotonicTime();
 }
 
-bool ClusterManagerImpl::addOrUpdateCluster(const envoy::api::v2::Cluster& cluster,
+bool ClusterManagerImpl::addOrUpdateCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
                                             const std::string& version_info) {
   // First we need to see if this new config is new or an update to an existing dynamic cluster.
   // We don't allow updates to statically configured clusters in the main configuration. We check
@@ -652,7 +652,7 @@ bool ClusterManagerImpl::removeCluster(const std::string& cluster_name) {
   return removed;
 }
 
-void ClusterManagerImpl::loadCluster(const envoy::api::v2::Cluster& cluster,
+void ClusterManagerImpl::loadCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
                                      const std::string& version_info, bool added_via_api,
                                      ClusterMap& cluster_map) {
   std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr> new_cluster_pair =
@@ -864,7 +864,7 @@ ClusterManagerImpl::addThreadLocalClusterUpdateCallbacks(ClusterUpdateCallbacks&
 }
 
 ProtobufTypes::MessagePtr ClusterManagerImpl::dumpClusterConfigs() {
-  auto config_dump = std::make_unique<envoy::admin::v2alpha::ClustersConfigDump>();
+  auto config_dump = std::make_unique<envoy::admin::v3alpha::ClustersConfigDump>();
   config_dump->set_version_info(cds_api_ != nullptr ? cds_api_->versionInfo() : "");
   for (const auto& active_cluster_pair : active_clusters_) {
     const auto& cluster = *active_cluster_pair.second;
@@ -1315,7 +1315,7 @@ ClusterManagerImpl::ThreadLocalClusterManagerImpl::ClusterEntry::tcpConnPool(
 }
 
 ClusterManagerPtr ProdClusterManagerFactory::clusterManagerFromProto(
-    const envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
   return ClusterManagerPtr{new ClusterManagerImpl(
       bootstrap, *this, stats_, tls_, runtime_, random_, local_info_, log_manager_,
       main_thread_dispatcher_, admin_, validation_context_, api_, http_context_)};
@@ -1348,7 +1348,7 @@ Tcp::ConnectionPool::InstancePtr ProdClusterManagerFactory::allocateTcpConnPool(
 }
 
 std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr> ProdClusterManagerFactory::clusterFromProto(
-    const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
     Outlier::EventLoggerSharedPtr outlier_event_logger, bool added_via_api) {
   return ClusterFactoryImplBase::create(
       cluster, cm, stats_, tls_, dns_resolver_, ssl_context_manager_, runtime_, random_,
@@ -1359,8 +1359,9 @@ std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr> ProdClusterManagerFactor
       api_);
 }
 
-CdsApiPtr ProdClusterManagerFactory::createCds(const envoy::api::v2::core::ConfigSource& cds_config,
-                                               ClusterManager& cm) {
+CdsApiPtr
+ProdClusterManagerFactory::createCds(const envoy::config::core::v3alpha::ConfigSource& cds_config,
+                                     ClusterManager& cm) {
   // TODO(htuch): Differentiate static vs. dynamic validation visitors.
   return CdsApiImpl::create(cds_config, cm, stats_, validation_context_.dynamicValidationVisitor());
 }
diff --git a/source/common/upstream/cluster_manager_impl.h b/source/common/upstream/cluster_manager_impl.h
index 79cc6d83257a..1f11bba7fb45 100644
--- a/source/common/upstream/cluster_manager_impl.h
+++ b/source/common/upstream/cluster_manager_impl.h
@@ -10,10 +10,10 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/http/codes.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/runtime/runtime.h"
@@ -58,7 +58,7 @@ class ProdClusterManagerFactory : public ClusterManagerFactory {
 
   // Upstream::ClusterManagerFactory
   ClusterManagerPtr
-  clusterManagerFromProto(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) override;
+  clusterManagerFromProto(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) override;
   Http::ConnectionPool::InstancePtr allocateConnPool(
       Event::Dispatcher& dispatcher, HostConstSharedPtr host, ResourcePriority priority,
       Http::Protocol protocol, const Network::ConnectionSocket::OptionsSharedPtr& options,
@@ -69,9 +69,9 @@ class ProdClusterManagerFactory : public ClusterManagerFactory {
                       const Network::ConnectionSocket::OptionsSharedPtr& options,
                       Network::TransportSocketOptionsSharedPtr transport_socket_options) override;
   std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-  clusterFromProto(const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+  clusterFromProto(const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
                    Outlier::EventLoggerSharedPtr outlier_event_logger, bool added_via_api) override;
-  CdsApiPtr createCds(const envoy::api::v2::core::ConfigSource& cds_config,
+  CdsApiPtr createCds(const envoy::config::core::v3alpha::ConfigSource& cds_config,
                       ClusterManager& cm) override;
   Secret::SecretManager& secretManager() override { return secret_manager_; }
 
@@ -179,7 +179,7 @@ struct ClusterManagerStats {
  */
 class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::upstream> {
 public:
-  ClusterManagerImpl(const envoy::config::bootstrap::v2::Bootstrap& bootstrap,
+  ClusterManagerImpl(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
                      ClusterManagerFactory& factory, Stats::Store& stats,
                      ThreadLocal::Instance& tls, Runtime::Loader& runtime,
                      Runtime::RandomGenerator& random, const LocalInfo::LocalInfo& local_info,
@@ -191,7 +191,7 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
   std::size_t warmingClusterCount() const { return warming_clusters_.size(); }
 
   // Upstream::ClusterManager
-  bool addOrUpdateCluster(const envoy::api::v2::Cluster& cluster,
+  bool addOrUpdateCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
                           const std::string& version_info) override;
   void setInitializedCb(std::function<void()> callback) override {
     init_helper_.setInitializedCb(callback);
@@ -227,7 +227,9 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
     updateClusterCounts();
   }
 
-  const envoy::api::v2::core::BindConfig& bindConfig() const override { return bind_config_; }
+  const envoy::config::core::v3alpha::BindConfig& bindConfig() const override {
+    return bind_config_;
+  }
 
   Config::GrpcMuxSharedPtr adsMux() override { return ads_mux_; }
   Grpc::AsyncClientManager& grpcAsyncClientManager() override { return *async_client_manager_; }
@@ -370,8 +372,9 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
   };
 
   struct ClusterData {
-    ClusterData(const envoy::api::v2::Cluster& cluster_config, const std::string& version_info,
-                bool added_via_api, ClusterSharedPtr&& cluster, TimeSource& time_source)
+    ClusterData(const envoy::config::cluster::v3alpha::Cluster& cluster_config,
+                const std::string& version_info, bool added_via_api, ClusterSharedPtr&& cluster,
+                TimeSource& time_source)
         : cluster_config_(cluster_config), config_hash_(MessageUtil::hash(cluster_config)),
           version_info_(version_info), added_via_api_(added_via_api), cluster_(std::move(cluster)),
           last_updated_(time_source.systemTime()) {}
@@ -386,7 +389,7 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
       }
     }
 
-    const envoy::api::v2::Cluster cluster_config_;
+    const envoy::config::cluster::v3alpha::Cluster cluster_config_;
     const uint64_t config_hash_;
     const std::string version_info_;
     const bool added_via_api_;
@@ -450,8 +453,8 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
   void createOrUpdateThreadLocalCluster(ClusterData& cluster);
   ProtobufTypes::MessagePtr dumpClusterConfigs();
   static ClusterManagerStats generateStats(Stats::Scope& scope);
-  void loadCluster(const envoy::api::v2::Cluster& cluster, const std::string& version_info,
-                   bool added_via_api, ClusterMap& cluster_map);
+  void loadCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                   const std::string& version_info, bool added_via_api, ClusterMap& cluster_map);
   void onClusterInit(Cluster& cluster);
   void postThreadLocalHealthFailure(const HostSharedPtr& host);
   void updateClusterCounts();
@@ -467,7 +470,7 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
 
 private:
   ClusterMap warming_clusters_;
-  envoy::api::v2::core::BindConfig bind_config_;
+  envoy::config::core::v3alpha::BindConfig bind_config_;
   Outlier::EventLoggerSharedPtr outlier_event_logger_;
   const LocalInfo::LocalInfo& local_info_;
   CdsApiPtr cds_api_;
diff --git a/source/common/upstream/eds.cc b/source/common/upstream/eds.cc
index c1ca6635ea8b..93cf9ee19a2d 100644
--- a/source/common/upstream/eds.cc
+++ b/source/common/upstream/eds.cc
@@ -1,12 +1,12 @@
 #include "common/upstream/eds.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint.pb.validate.h"
+#include "envoy/api/v2/endpoint.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.validate.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/utility.h"
 #include "common/config/api_version.h"
@@ -15,7 +15,7 @@ namespace Envoy {
 namespace Upstream {
 
 EdsClusterImpl::EdsClusterImpl(
-    const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Stats::ScopePtr&& stats_scope, bool added_via_api)
     : BaseDynamicClusterImpl(cluster, runtime, factory_context, std::move(stats_scope),
@@ -30,7 +30,7 @@ EdsClusterImpl::EdsClusterImpl(
   assignment_timeout_ = dispatcher.createTimer([this]() -> void { onAssignmentTimeout(); });
   const auto& eds_config = cluster.eds_cluster_config().eds_config();
   if (eds_config.config_source_specifier_case() ==
-      envoy::api::v2::core::ConfigSource::ConfigSourceSpecifierCase::kPath) {
+      envoy::config::core::v3alpha::ConfigSource::ConfigSourceSpecifierCase::kPath) {
     initialize_phase_ = InitializePhase::Primary;
   } else {
     initialize_phase_ = InitializePhase::Secondary;
@@ -113,7 +113,8 @@ void EdsClusterImpl::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt
     return;
   }
   auto cluster_load_assignment =
-      MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[0]);
+      MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+          resources[0]);
   MessageUtil::validate(cluster_load_assignment, validation_visitor_);
   if (cluster_load_assignment.cluster_name() != cluster_name_) {
     throw EnvoyException(fmt::format("Unexpected EDS cluster (expecting {}): {}", cluster_name_,
@@ -138,7 +139,7 @@ void EdsClusterImpl::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt
 }
 
 void EdsClusterImpl::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& resources,
     const Protobuf::RepeatedPtrField<std::string>&, const std::string&) {
   if (!validateUpdateSize(resources.size())) {
     return;
@@ -168,7 +169,7 @@ void EdsClusterImpl::onAssignmentTimeout() {
   // need to instead change the health status to indicate the assignments are
   // stale.
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
-  envoy::api::v2::ClusterLoadAssignment resource;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment resource;
   resource.set_cluster_name(cluster_name_);
   resources.Add()->PackFrom(resource);
   onConfigUpdate(resources, "");
@@ -225,11 +226,11 @@ void EdsClusterImpl::reloadHealthyHostsHelper(const HostSharedPtr& host) {
 std::string EdsClusterImpl::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::ClusterLoadAssignment().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(API_NO_BOOST(
         envoy::config::endpoint::v3alpha::ClusterLoadAssignment().GetDescriptor()->full_name()));
   default:
@@ -286,7 +287,7 @@ void EdsClusterImpl::onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReas
 
 std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
 EdsClusterFactory::createClusterImpl(
-    const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
   if (!cluster.has_eds_cluster_config()) {
diff --git a/source/common/upstream/eds.h b/source/common/upstream/eds.h
index 909c2cfbd984..8f36b090d761 100644
--- a/source/common/upstream/eds.h
+++ b/source/common/upstream/eds.h
@@ -1,14 +1,14 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/config/subscription_factory.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/secret/secret_manager.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/upstream/locality.h"
 
@@ -25,7 +25,7 @@ namespace Upstream {
  */
 class EdsClusterImpl : public BaseDynamicClusterImpl, Config::SubscriptionCallbacks {
 public:
-  EdsClusterImpl(const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+  EdsClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
                  Server::Configuration::TransportSocketFactoryContext& factory_context,
                  Stats::ScopePtr&& stats_scope, bool added_via_api);
 
@@ -36,16 +36,19 @@ class EdsClusterImpl : public BaseDynamicClusterImpl, Config::SubscriptionCallba
   // Config::SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>&,
-                      const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&,
+                 const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resource).cluster_name();
+    return MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+               resource)
+        .cluster_name();
   }
   std::string loadTypeUrl();
-  using LocalityWeightsMap =
-      std::unordered_map<envoy::api::v2::core::Locality, uint32_t, LocalityHash, LocalityEqualTo>;
+  using LocalityWeightsMap = std::unordered_map<envoy::config::core::v3alpha::Locality, uint32_t,
+                                                LocalityHash, LocalityEqualTo>;
   bool updateHostsPerLocality(const uint32_t priority, const uint32_t overprovisioning_factor,
                               const HostVector& new_hosts, LocalityWeightsMap& locality_weights_map,
                               LocalityWeightsMap& new_locality_weights_map,
@@ -60,8 +63,9 @@ class EdsClusterImpl : public BaseDynamicClusterImpl, Config::SubscriptionCallba
 
   class BatchUpdateHelper : public PrioritySet::BatchUpdateCb {
   public:
-    BatchUpdateHelper(EdsClusterImpl& parent,
-                      const envoy::api::v2::ClusterLoadAssignment& cluster_load_assignment)
+    BatchUpdateHelper(
+        EdsClusterImpl& parent,
+        const envoy::config::endpoint::v3alpha::ClusterLoadAssignment& cluster_load_assignment)
         : parent_(parent), cluster_load_assignment_(cluster_load_assignment) {}
 
     // Upstream::PrioritySet::BatchUpdateCb
@@ -69,7 +73,7 @@ class EdsClusterImpl : public BaseDynamicClusterImpl, Config::SubscriptionCallba
 
   private:
     EdsClusterImpl& parent_;
-    const envoy::api::v2::ClusterLoadAssignment& cluster_load_assignment_;
+    const envoy::config::endpoint::v3alpha::ClusterLoadAssignment& cluster_load_assignment_;
   };
 
   std::unique_ptr<Config::Subscription> subscription_;
@@ -80,7 +84,7 @@ class EdsClusterImpl : public BaseDynamicClusterImpl, Config::SubscriptionCallba
   Event::TimerPtr assignment_timeout_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
   InitializePhase initialize_phase_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 class EdsClusterFactory : public ClusterFactoryImplBase {
@@ -89,7 +93,8 @@ class EdsClusterFactory : public ClusterFactoryImplBase {
 
 private:
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override;
 };
diff --git a/source/common/upstream/health_checker_base_impl.cc b/source/common/upstream/health_checker_base_impl.cc
index 17811a97bd9e..46ac4876ae18 100644
--- a/source/common/upstream/health_checker_base_impl.cc
+++ b/source/common/upstream/health_checker_base_impl.cc
@@ -1,8 +1,8 @@
 #include "common/upstream/health_checker_base_impl.h"
 
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/network/utility.h"
@@ -11,12 +11,10 @@
 namespace Envoy {
 namespace Upstream {
 
-HealthCheckerImplBase::HealthCheckerImplBase(const Cluster& cluster,
-                                             const envoy::api::v2::core::HealthCheck& config,
-                                             Event::Dispatcher& dispatcher,
-                                             Runtime::Loader& runtime,
-                                             Runtime::RandomGenerator& random,
-                                             HealthCheckEventLoggerPtr&& event_logger)
+HealthCheckerImplBase::HealthCheckerImplBase(
+    const Cluster& cluster, const envoy::config::core::v3alpha::HealthCheck& config,
+    Event::Dispatcher& dispatcher, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+    HealthCheckEventLoggerPtr&& event_logger)
     : always_log_health_check_failures_(config.always_log_health_check_failures()),
       cluster_(cluster), dispatcher_(dispatcher),
       timeout_(PROTOBUF_GET_MS_REQUIRED(config, timeout)),
@@ -205,7 +203,7 @@ void HealthCheckerImplBase::setUnhealthyCrossThread(const HostSharedPtr& host) {
       return;
     }
 
-    session->second->setUnhealthy(envoy::data::core::v2alpha::HealthCheckFailureType::PASSIVE);
+    session->second->setUnhealthy(envoy::data::core::v3alpha::PASSIVE);
   });
 }
 
@@ -304,13 +302,13 @@ void HealthCheckerImplBase::ActiveHealthCheckSession::handleSuccess(bool degrade
 }
 
 HealthTransition HealthCheckerImplBase::ActiveHealthCheckSession::setUnhealthy(
-    envoy::data::core::v2alpha::HealthCheckFailureType type) {
+    envoy::data::core::v3alpha::HealthCheckFailureType type) {
   // If we are unhealthy, reset the # of healthy to zero.
   num_healthy_ = 0;
 
   HealthTransition changed_state = HealthTransition::Unchanged;
   if (!host_->healthFlagGet(Host::HealthFlag::FAILED_ACTIVE_HC)) {
-    if (type != envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK ||
+    if (type != envoy::data::core::v3alpha::NETWORK ||
         ++num_unhealthy_ == parent_.unhealthy_threshold_) {
       host_->healthFlagSet(Host::HealthFlag::FAILED_ACTIVE_HC);
       parent_.decHealthy();
@@ -330,9 +328,9 @@ HealthTransition HealthCheckerImplBase::ActiveHealthCheckSession::setUnhealthy(
   }
 
   parent_.stats_.failure_.inc();
-  if (type == envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK) {
+  if (type == envoy::data::core::v3alpha::NETWORK) {
     parent_.stats_.network_failure_.inc();
-  } else if (type == envoy::data::core::v2alpha::HealthCheckFailureType::PASSIVE) {
+  } else if (type == envoy::data::core::v3alpha::PASSIVE) {
     parent_.stats_.passive_failure_.inc();
   }
 
@@ -342,7 +340,7 @@ HealthTransition HealthCheckerImplBase::ActiveHealthCheckSession::setUnhealthy(
 }
 
 void HealthCheckerImplBase::ActiveHealthCheckSession::handleFailure(
-    envoy::data::core::v2alpha::HealthCheckFailureType type) {
+    envoy::data::core::v3alpha::HealthCheckFailureType type) {
   HealthTransition changed_state = setUnhealthy(type);
   // It's possible that the previous call caused this session to be deferred deleted.
   if (timeout_timer_ != nullptr) {
@@ -374,7 +372,7 @@ void HealthCheckerImplBase::ActiveHealthCheckSession::onIntervalBase() {
 
 void HealthCheckerImplBase::ActiveHealthCheckSession::onTimeoutBase() {
   onTimeout();
-  handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK);
+  handleFailure(envoy::data::core::v3alpha::NETWORK);
 }
 
 void HealthCheckerImplBase::ActiveHealthCheckSession::onInitialInterval() {
@@ -387,18 +385,18 @@ void HealthCheckerImplBase::ActiveHealthCheckSession::onInitialInterval() {
 }
 
 void HealthCheckEventLoggerImpl::logEjectUnhealthy(
-    envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+    envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
     const HostDescriptionConstSharedPtr& host,
-    envoy::data::core::v2alpha::HealthCheckFailureType failure_type) {
+    envoy::data::core::v3alpha::HealthCheckFailureType failure_type) {
   createHealthCheckEvent(health_checker_type, *host, [&failure_type](auto& event) {
     event.mutable_eject_unhealthy_event()->set_failure_type(failure_type);
   });
 }
 
 void HealthCheckEventLoggerImpl::logUnhealthy(
-    envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+    envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
     const HostDescriptionConstSharedPtr& host,
-    envoy::data::core::v2alpha::HealthCheckFailureType failure_type, bool first_check) {
+    envoy::data::core::v3alpha::HealthCheckFailureType failure_type, bool first_check) {
   createHealthCheckEvent(health_checker_type, *host, [&first_check, &failure_type](auto& event) {
     event.mutable_health_check_failure_event()->set_failure_type(failure_type);
     event.mutable_health_check_failure_event()->set_first_check(first_check);
@@ -406,7 +404,7 @@ void HealthCheckEventLoggerImpl::logUnhealthy(
 }
 
 void HealthCheckEventLoggerImpl::logAddHealthy(
-    envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+    envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
     const HostDescriptionConstSharedPtr& host, bool first_check) {
   createHealthCheckEvent(health_checker_type, *host, [&first_check](auto& event) {
     event.mutable_add_healthy_event()->set_first_check(first_check);
@@ -414,27 +412,27 @@ void HealthCheckEventLoggerImpl::logAddHealthy(
 }
 
 void HealthCheckEventLoggerImpl::logDegraded(
-    envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+    envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
     const HostDescriptionConstSharedPtr& host) {
   createHealthCheckEvent(health_checker_type, *host,
                          [](auto& event) { event.mutable_degraded_healthy_host(); });
 }
 
 void HealthCheckEventLoggerImpl::logNoLongerDegraded(
-    envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+    envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
     const HostDescriptionConstSharedPtr& host) {
   createHealthCheckEvent(health_checker_type, *host,
                          [](auto& event) { event.mutable_no_longer_degraded_host(); });
 }
 
 void HealthCheckEventLoggerImpl::createHealthCheckEvent(
-    envoy::data::core::v2alpha::HealthCheckerType health_checker_type, const HostDescription& host,
-    std::function<void(envoy::data::core::v2alpha::HealthCheckEvent&)> callback) const {
-  envoy::data::core::v2alpha::HealthCheckEvent event;
+    envoy::data::core::v3alpha::HealthCheckerType health_checker_type, const HostDescription& host,
+    std::function<void(envoy::data::core::v3alpha::HealthCheckEvent&)> callback) const {
+  envoy::data::core::v3alpha::HealthCheckEvent event;
   event.set_cluster_name(host.cluster().name());
   event.set_health_checker_type(health_checker_type);
 
-  envoy::api::v2::core::Address address;
+  envoy::config::core::v3alpha::Address address;
   Network::Utility::addressToProtobufAddress(*host.address(), address);
   *event.mutable_host() = std::move(address);
 
diff --git a/source/common/upstream/health_checker_base_impl.h b/source/common/upstream/health_checker_base_impl.h
index 9616c2db426f..df0225f0c07e 100644
--- a/source/common/upstream/health_checker_base_impl.h
+++ b/source/common/upstream/health_checker_base_impl.h
@@ -1,8 +1,8 @@
 #pragma once
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/scope.h"
@@ -48,7 +48,7 @@ class HealthCheckerImplBase : public HealthChecker,
   class ActiveHealthCheckSession : public Event::DeferredDeletable {
   public:
     ~ActiveHealthCheckSession() override;
-    HealthTransition setUnhealthy(envoy::data::core::v2alpha::HealthCheckFailureType type);
+    HealthTransition setUnhealthy(envoy::data::core::v3alpha::HealthCheckFailureType type);
     void onDeferredDeleteBase();
     void start() { onInitialInterval(); }
 
@@ -57,7 +57,7 @@ class HealthCheckerImplBase : public HealthChecker,
 
     void handleSuccess(bool degraded = false);
     void handleDegraded();
-    void handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType type);
+    void handleFailure(envoy::data::core::v3alpha::HealthCheckFailureType type);
 
     HostSharedPtr host_;
 
@@ -83,13 +83,14 @@ class HealthCheckerImplBase : public HealthChecker,
 
   using ActiveHealthCheckSessionPtr = std::unique_ptr<ActiveHealthCheckSession>;
 
-  HealthCheckerImplBase(const Cluster& cluster, const envoy::api::v2::core::HealthCheck& config,
+  HealthCheckerImplBase(const Cluster& cluster,
+                        const envoy::config::core::v3alpha::HealthCheck& config,
                         Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                         Runtime::RandomGenerator& random, HealthCheckEventLoggerPtr&& event_logger);
   ~HealthCheckerImplBase() override;
 
   virtual ActiveHealthCheckSessionPtr makeSession(HostSharedPtr host) PURE;
-  virtual envoy::data::core::v2alpha::HealthCheckerType healthCheckerType() const PURE;
+  virtual envoy::data::core::v3alpha::HealthCheckerType healthCheckerType() const PURE;
 
   const bool always_log_health_check_failures_;
   const Cluster& cluster_;
@@ -152,25 +153,25 @@ class HealthCheckEventLoggerImpl : public HealthCheckEventLogger {
                              const std::string& file_name)
       : time_source_(time_source), file_(log_manager.createAccessLog(file_name)) {}
 
-  void logEjectUnhealthy(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  void logEjectUnhealthy(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                          const HostDescriptionConstSharedPtr& host,
-                         envoy::data::core::v2alpha::HealthCheckFailureType failure_type) override;
-  void logAddHealthy(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+                         envoy::data::core::v3alpha::HealthCheckFailureType failure_type) override;
+  void logAddHealthy(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                      const HostDescriptionConstSharedPtr& host, bool first_check) override;
-  void logUnhealthy(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  void logUnhealthy(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                     const HostDescriptionConstSharedPtr& host,
-                    envoy::data::core::v2alpha::HealthCheckFailureType failure_type,
+                    envoy::data::core::v3alpha::HealthCheckFailureType failure_type,
                     bool first_check) override;
-  void logDegraded(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  void logDegraded(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                    const HostDescriptionConstSharedPtr& host) override;
-  void logNoLongerDegraded(envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+  void logNoLongerDegraded(envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
                            const HostDescriptionConstSharedPtr& host) override;
 
 private:
   void createHealthCheckEvent(
-      envoy::data::core::v2alpha::HealthCheckerType health_checker_type,
+      envoy::data::core::v3alpha::HealthCheckerType health_checker_type,
       const HostDescription& host,
-      std::function<void(envoy::data::core::v2alpha::HealthCheckEvent&)> callback) const;
+      std::function<void(envoy::data::core::v3alpha::HealthCheckEvent&)> callback) const;
   TimeSource& time_source_;
   AccessLog::AccessLogFileSharedPtr file_;
 };
diff --git a/source/common/upstream/health_checker_impl.cc b/source/common/upstream/health_checker_impl.cc
index 624707d28cda..2d4d94def6d1 100644
--- a/source/common/upstream/health_checker_impl.cc
+++ b/source/common/upstream/health_checker_impl.cc
@@ -1,10 +1,10 @@
 #include "common/upstream/health_checker_impl.h"
 
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 #include "envoy/server/health_checker_config.h"
-#include "envoy/type/http.pb.h"
-#include "envoy/type/range.pb.h"
+#include "envoy/type/v3alpha/http.pb.h"
+#include "envoy/type/v3alpha/range.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/common/empty_string.h"
@@ -59,9 +59,9 @@ class HealthCheckerFactoryContextImpl : public Server::Configuration::HealthChec
 };
 
 HealthCheckerSharedPtr HealthCheckerFactory::create(
-    const envoy::api::v2::core::HealthCheck& health_check_config, Upstream::Cluster& cluster,
-    Runtime::Loader& runtime, Runtime::RandomGenerator& random, Event::Dispatcher& dispatcher,
-    AccessLog::AccessLogManager& log_manager,
+    const envoy::config::core::v3alpha::HealthCheck& health_check_config,
+    Upstream::Cluster& cluster, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+    Event::Dispatcher& dispatcher, AccessLog::AccessLogManager& log_manager,
     ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api) {
   HealthCheckEventLoggerPtr event_logger;
   if (!health_check_config.event_log_path().empty()) {
@@ -69,20 +69,20 @@ HealthCheckerSharedPtr HealthCheckerFactory::create(
         log_manager, dispatcher.timeSource(), health_check_config.event_log_path());
   }
   switch (health_check_config.health_checker_case()) {
-  case envoy::api::v2::core::HealthCheck::HealthCheckerCase::kHttpHealthCheck:
+  case envoy::config::core::v3alpha::HealthCheck::HealthCheckerCase::kHttpHealthCheck:
     return std::make_shared<ProdHttpHealthCheckerImpl>(cluster, health_check_config, dispatcher,
                                                        runtime, random, std::move(event_logger));
-  case envoy::api::v2::core::HealthCheck::HealthCheckerCase::kTcpHealthCheck:
+  case envoy::config::core::v3alpha::HealthCheck::HealthCheckerCase::kTcpHealthCheck:
     return std::make_shared<TcpHealthCheckerImpl>(cluster, health_check_config, dispatcher, runtime,
                                                   random, std::move(event_logger));
-  case envoy::api::v2::core::HealthCheck::HealthCheckerCase::kGrpcHealthCheck:
+  case envoy::config::core::v3alpha::HealthCheck::HealthCheckerCase::kGrpcHealthCheck:
     if (!(cluster.info()->features() & Upstream::ClusterInfo::Features::HTTP2)) {
       throw EnvoyException(fmt::format("{} cluster must support HTTP/2 for gRPC healthchecking",
                                        cluster.info()->name()));
     }
     return std::make_shared<ProdGrpcHealthCheckerImpl>(cluster, health_check_config, dispatcher,
                                                        runtime, random, std::move(event_logger));
-  case envoy::api::v2::core::HealthCheck::HealthCheckerCase::kCustomHealthCheck: {
+  case envoy::config::core::v3alpha::HealthCheck::HealthCheckerCase::kCustomHealthCheck: {
     auto& factory =
         Config::Utility::getAndCheckFactory<Server::Configuration::CustomHealthCheckerFactory>(
             health_check_config.custom_health_check().name());
@@ -97,12 +97,10 @@ HealthCheckerSharedPtr HealthCheckerFactory::create(
   }
 }
 
-HttpHealthCheckerImpl::HttpHealthCheckerImpl(const Cluster& cluster,
-                                             const envoy::api::v2::core::HealthCheck& config,
-                                             Event::Dispatcher& dispatcher,
-                                             Runtime::Loader& runtime,
-                                             Runtime::RandomGenerator& random,
-                                             HealthCheckEventLoggerPtr&& event_logger)
+HttpHealthCheckerImpl::HttpHealthCheckerImpl(
+    const Cluster& cluster, const envoy::config::core::v3alpha::HealthCheck& config,
+    Event::Dispatcher& dispatcher, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+    HealthCheckEventLoggerPtr&& event_logger)
     : HealthCheckerImplBase(cluster, config, dispatcher, runtime, random, std::move(event_logger)),
       path_(config.http_health_check().path()), host_value_(config.http_health_check().host()),
       request_headers_parser_(
@@ -110,16 +108,17 @@ HttpHealthCheckerImpl::HttpHealthCheckerImpl(const Cluster& cluster,
                                           config.http_health_check().request_headers_to_remove())),
       http_status_checker_(config.http_health_check().expected_statuses(),
                            static_cast<uint64_t>(Http::Code::OK)),
-      codec_client_type_(codecClientType(config.http_health_check().use_http2()
-                                             ? envoy::type::HTTP2
-                                             : config.http_health_check().codec_client_type())) {
+      codec_client_type_(
+          codecClientType(config.http_health_check().hidden_envoy_deprecated_use_http2()
+                              ? envoy::type::v3alpha::HTTP2
+                              : config.http_health_check().codec_client_type())) {
   if (!config.http_health_check().service_name().empty()) {
     service_name_ = config.http_health_check().service_name();
   }
 }
 
 HttpHealthCheckerImpl::HttpStatusChecker::HttpStatusChecker(
-    const Protobuf::RepeatedPtrField<envoy::type::Int64Range>& expected_statuses,
+    const Protobuf::RepeatedPtrField<envoy::type::v3alpha::Int64Range>& expected_statuses,
     uint64_t default_expected_status) {
   for (const auto& status_range : expected_statuses) {
     const auto start = status_range.start();
@@ -248,7 +247,7 @@ void HttpHealthCheckerImpl::HttpActiveHealthCheckSession::onResetStream(Http::St
 
   ENVOY_CONN_LOG(debug, "connection/stream error health_flags={}", *client_,
                  HostUtility::healthFlagsToString(*host_));
-  handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK);
+  handleFailure(envoy::data::core::v3alpha::NETWORK);
 }
 
 HttpHealthCheckerImpl::HttpActiveHealthCheckSession::HealthCheckResult
@@ -292,7 +291,7 @@ void HttpHealthCheckerImpl::HttpActiveHealthCheckSession::onResponseComplete() {
     break;
   case HealthCheckResult::Failed:
     host_->setActiveHealthFailureType(Host::ActiveHealthFailureType::UNHEALTHY);
-    handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::ACTIVE);
+    handleFailure(envoy::data::core::v3alpha::ACTIVE);
     break;
   }
 
@@ -349,13 +348,13 @@ void HttpHealthCheckerImpl::HttpActiveHealthCheckSession::onTimeout() {
 }
 
 Http::CodecClient::Type
-HttpHealthCheckerImpl::codecClientType(const envoy::type::CodecClientType& type) {
+HttpHealthCheckerImpl::codecClientType(const envoy::type::v3alpha::CodecClientType& type) {
   switch (type) {
-  case envoy::type::HTTP3:
+  case envoy::type::v3alpha::HTTP3:
     return Http::CodecClient::Type::HTTP3;
-  case envoy::type::HTTP2:
+  case envoy::type::v3alpha::HTTP2:
     return Http::CodecClient::Type::HTTP2;
-  case envoy::type::HTTP1:
+  case envoy::type::v3alpha::HTTP1:
     return Http::CodecClient::Type::HTTP1;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
@@ -369,7 +368,8 @@ ProdHttpHealthCheckerImpl::createCodecClient(Upstream::Host::CreateConnectionDat
 }
 
 TcpHealthCheckMatcher::MatchSegments TcpHealthCheckMatcher::loadProtoBytes(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload>& byte_array) {
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload>&
+        byte_array) {
   MatchSegments result;
 
   for (const auto& entry : byte_array) {
@@ -398,13 +398,14 @@ bool TcpHealthCheckMatcher::match(const MatchSegments& expected, const Buffer::I
 }
 
 TcpHealthCheckerImpl::TcpHealthCheckerImpl(const Cluster& cluster,
-                                           const envoy::api::v2::core::HealthCheck& config,
+                                           const envoy::config::core::v3alpha::HealthCheck& config,
                                            Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                                            Runtime::RandomGenerator& random,
                                            HealthCheckEventLoggerPtr&& event_logger)
     : HealthCheckerImplBase(cluster, config, dispatcher, runtime, random, std::move(event_logger)),
       send_bytes_([&config] {
-        Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload> send_repeated;
+        Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload>
+            send_repeated;
         if (!config.tcp_health_check().send().text().empty()) {
           send_repeated.Add()->CopyFrom(config.tcp_health_check().send());
         }
@@ -442,7 +443,7 @@ void TcpHealthCheckerImpl::TcpActiveHealthCheckSession::onEvent(Network::Connect
   if (event == Network::ConnectionEvent::RemoteClose ||
       event == Network::ConnectionEvent::LocalClose) {
     if (!expect_close_) {
-      handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK);
+      handleFailure(envoy::data::core::v3alpha::NETWORK);
     }
     parent_.dispatcher_.deferredDelete(std::move(client_));
   }
@@ -497,12 +498,10 @@ void TcpHealthCheckerImpl::TcpActiveHealthCheckSession::onTimeout() {
   client_->close(Network::ConnectionCloseType::NoFlush);
 }
 
-GrpcHealthCheckerImpl::GrpcHealthCheckerImpl(const Cluster& cluster,
-                                             const envoy::api::v2::core::HealthCheck& config,
-                                             Event::Dispatcher& dispatcher,
-                                             Runtime::Loader& runtime,
-                                             Runtime::RandomGenerator& random,
-                                             HealthCheckEventLoggerPtr&& event_logger)
+GrpcHealthCheckerImpl::GrpcHealthCheckerImpl(
+    const Cluster& cluster, const envoy::config::core::v3alpha::HealthCheck& config,
+    Event::Dispatcher& dispatcher, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+    HealthCheckEventLoggerPtr&& event_logger)
     : HealthCheckerImplBase(cluster, config, dispatcher, runtime, random, std::move(event_logger)),
       service_method_(*Protobuf::DescriptorPool::generated_pool()->FindMethodByName(
           "grpc.health.v1.Health.Check")) {
@@ -676,7 +675,7 @@ void GrpcHealthCheckerImpl::GrpcActiveHealthCheckSession::onResetStream(Http::St
   // Http::StreamResetReason::RemoteReset or Http::StreamResetReason::ConnectionTermination (both
   // mean connection close), check if connection is not fresh (was used for at least 1 request)
   // and silently retry request on the fresh connection. This is also true for HTTP/1.1 healthcheck.
-  handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK);
+  handleFailure(envoy::data::core::v3alpha::NETWORK);
 }
 
 void GrpcHealthCheckerImpl::GrpcActiveHealthCheckSession::onGoAway() {
@@ -684,7 +683,7 @@ void GrpcHealthCheckerImpl::GrpcActiveHealthCheckSession::onGoAway() {
                  HostUtility::healthFlagsToString(*host_));
   // Even if we have active health check probe, fail it on GOAWAY and schedule new one.
   if (request_encoder_) {
-    handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK);
+    handleFailure(envoy::data::core::v3alpha::NETWORK);
     expect_reset_ = true;
     request_encoder_->getStream().resetStream(Http::StreamResetReason::LocalReset);
   }
@@ -711,7 +710,7 @@ void GrpcHealthCheckerImpl::GrpcActiveHealthCheckSession::onRpcComplete(
   if (isHealthCheckSucceeded(grpc_status)) {
     handleSuccess(false);
   } else {
-    handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::ACTIVE);
+    handleFailure(envoy::data::core::v3alpha::ACTIVE);
   }
 
   // |end_stream| will be false if we decided to stop healthcheck before HTTP stream has ended -
diff --git a/source/common/upstream/health_checker_impl.h b/source/common/upstream/health_checker_impl.h
index 1bc64bdcdf16..eb21030d46e6 100644
--- a/source/common/upstream/health_checker_impl.h
+++ b/source/common/upstream/health_checker_impl.h
@@ -2,11 +2,11 @@
 
 #include "envoy/access_log/access_log.h"
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 #include "envoy/grpc/status.h"
-#include "envoy/type/http.pb.h"
-#include "envoy/type/range.pb.h"
+#include "envoy/type/v3alpha/http.pb.h"
+#include "envoy/type/v3alpha/range.pb.h"
 
 #include "common/common/logger.h"
 #include "common/grpc/codec.h"
@@ -37,9 +37,9 @@ class HealthCheckerFactory : public Logger::Loggable<Logger::Id::health_checker>
    * @return a health checker.
    */
   static HealthCheckerSharedPtr
-  create(const envoy::api::v2::core::HealthCheck& health_check_config, Upstream::Cluster& cluster,
-         Runtime::Loader& runtime, Runtime::RandomGenerator& random, Event::Dispatcher& dispatcher,
-         AccessLog::AccessLogManager& log_manager,
+  create(const envoy::config::core::v3alpha::HealthCheck& health_check_config,
+         Upstream::Cluster& cluster, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+         Event::Dispatcher& dispatcher, AccessLog::AccessLogManager& log_manager,
          ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api);
 };
 
@@ -48,7 +48,8 @@ class HealthCheckerFactory : public Logger::Loggable<Logger::Id::health_checker>
  */
 class HttpHealthCheckerImpl : public HealthCheckerImplBase {
 public:
-  HttpHealthCheckerImpl(const Cluster& cluster, const envoy::api::v2::core::HealthCheck& config,
+  HttpHealthCheckerImpl(const Cluster& cluster,
+                        const envoy::config::core::v3alpha::HealthCheck& config,
                         Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                         Runtime::RandomGenerator& random, HealthCheckEventLoggerPtr&& event_logger);
 
@@ -57,8 +58,9 @@ class HttpHealthCheckerImpl : public HealthCheckerImplBase {
    */
   class HttpStatusChecker {
   public:
-    HttpStatusChecker(const Protobuf::RepeatedPtrField<envoy::type::Int64Range>& expected_statuses,
-                      uint64_t default_expected_status);
+    HttpStatusChecker(
+        const Protobuf::RepeatedPtrField<envoy::type::v3alpha::Int64Range>& expected_statuses,
+        uint64_t default_expected_status);
 
     bool inRange(uint64_t http_status) const;
 
@@ -132,11 +134,11 @@ class HttpHealthCheckerImpl : public HealthCheckerImplBase {
   ActiveHealthCheckSessionPtr makeSession(HostSharedPtr host) override {
     return std::make_unique<HttpActiveHealthCheckSession>(*this, host);
   }
-  envoy::data::core::v2alpha::HealthCheckerType healthCheckerType() const override {
-    return envoy::data::core::v2alpha::HealthCheckerType::HTTP;
+  envoy::data::core::v3alpha::HealthCheckerType healthCheckerType() const override {
+    return envoy::data::core::v3alpha::HTTP;
   }
 
-  Http::CodecClient::Type codecClientType(const envoy::type::CodecClientType& type);
+  Http::CodecClient::Type codecClientType(const envoy::type::v3alpha::CodecClientType& type);
 
   const std::string path_;
   const std::string host_value_;
@@ -207,7 +209,8 @@ class TcpHealthCheckMatcher {
   using MatchSegments = std::list<std::vector<uint8_t>>;
 
   static MatchSegments loadProtoBytes(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload>& byte_array);
+      const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload>&
+          byte_array);
   static bool match(const MatchSegments& expected, const Buffer::Instance& buffer);
 };
 
@@ -216,7 +219,8 @@ class TcpHealthCheckMatcher {
  */
 class TcpHealthCheckerImpl : public HealthCheckerImplBase {
 public:
-  TcpHealthCheckerImpl(const Cluster& cluster, const envoy::api::v2::core::HealthCheck& config,
+  TcpHealthCheckerImpl(const Cluster& cluster,
+                       const envoy::config::core::v3alpha::HealthCheck& config,
                        Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                        Runtime::RandomGenerator& random, HealthCheckEventLoggerPtr&& event_logger);
 
@@ -268,8 +272,8 @@ class TcpHealthCheckerImpl : public HealthCheckerImplBase {
   ActiveHealthCheckSessionPtr makeSession(HostSharedPtr host) override {
     return std::make_unique<TcpActiveHealthCheckSession>(*this, host);
   }
-  envoy::data::core::v2alpha::HealthCheckerType healthCheckerType() const override {
-    return envoy::data::core::v2alpha::HealthCheckerType::TCP;
+  envoy::data::core::v3alpha::HealthCheckerType healthCheckerType() const override {
+    return envoy::data::core::v3alpha::TCP;
   }
 
   const TcpHealthCheckMatcher::MatchSegments send_bytes_;
@@ -281,7 +285,8 @@ class TcpHealthCheckerImpl : public HealthCheckerImplBase {
  */
 class GrpcHealthCheckerImpl : public HealthCheckerImplBase {
 public:
-  GrpcHealthCheckerImpl(const Cluster& cluster, const envoy::api::v2::core::HealthCheck& config,
+  GrpcHealthCheckerImpl(const Cluster& cluster,
+                        const envoy::config::core::v3alpha::HealthCheck& config,
                         Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                         Runtime::RandomGenerator& random, HealthCheckEventLoggerPtr&& event_logger);
 
@@ -361,8 +366,8 @@ class GrpcHealthCheckerImpl : public HealthCheckerImplBase {
   ActiveHealthCheckSessionPtr makeSession(HostSharedPtr host) override {
     return std::make_unique<GrpcActiveHealthCheckSession>(*this, host);
   }
-  envoy::data::core::v2alpha::HealthCheckerType healthCheckerType() const override {
-    return envoy::data::core::v2alpha::HealthCheckerType::GRPC;
+  envoy::data::core::v3alpha::HealthCheckerType healthCheckerType() const override {
+    return envoy::data::core::v3alpha::GRPC;
   }
 
   const Protobuf::MethodDescriptor& service_method_;
diff --git a/source/common/upstream/health_discovery_service.cc b/source/common/upstream/health_discovery_service.cc
index f8ef0e46bb92..35853b459923 100644
--- a/source/common/upstream/health_discovery_service.cc
+++ b/source/common/upstream/health_discovery_service.cc
@@ -1,11 +1,11 @@
 #include "common/upstream/health_discovery_service.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/service/discovery/v2/hds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/service/health/v3alpha/hds.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/protobuf/protobuf.h"
@@ -49,10 +49,10 @@ HdsDelegate::HdsDelegate(Stats::Scope& scope, Grpc::RawAsyncClientPtr async_clie
   // TODO(lilika): Add support for other types of healthchecks
   health_check_request_.mutable_health_check_request()
       ->mutable_capability()
-      ->add_health_check_protocols(envoy::service::discovery::v2::Capability::HTTP);
+      ->add_health_check_protocols(envoy::service::health::v3alpha::Capability::HTTP);
   health_check_request_.mutable_health_check_request()
       ->mutable_capability()
-      ->add_health_check_protocols(envoy::service::discovery::v2::Capability::TCP);
+      ->add_health_check_protocols(envoy::service::health::v3alpha::Capability::TCP);
 
   establishNewStream();
 }
@@ -89,9 +89,9 @@ void HdsDelegate::handleFailure() {
 }
 
 // TODO(lilika): Add support for the same endpoint in different clusters/ports
-envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse
+envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse
 HdsDelegate::sendResponse() {
-  envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse response;
+  envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse response;
   for (const auto& cluster : hds_clusters_) {
     for (const auto& hosts : cluster->prioritySet().hostSetsPerPriority()) {
       for (const auto& host : hosts->hosts()) {
@@ -100,15 +100,15 @@ HdsDelegate::sendResponse() {
             *host->address(), *endpoint->mutable_endpoint()->mutable_address());
         // TODO(lilika): Add support for more granular options of envoy::api::v2::core::HealthStatus
         if (host->health() == Host::Health::Healthy) {
-          endpoint->set_health_status(envoy::api::v2::core::HealthStatus::HEALTHY);
+          endpoint->set_health_status(envoy::config::core::v3alpha::HEALTHY);
         } else {
           if (host->getActiveHealthFailureType() == Host::ActiveHealthFailureType::TIMEOUT) {
-            endpoint->set_health_status(envoy::api::v2::core::HealthStatus::TIMEOUT);
+            endpoint->set_health_status(envoy::config::core::v3alpha::TIMEOUT);
           } else if (host->getActiveHealthFailureType() ==
                      Host::ActiveHealthFailureType::UNHEALTHY) {
-            endpoint->set_health_status(envoy::api::v2::core::HealthStatus::UNHEALTHY);
+            endpoint->set_health_status(envoy::config::core::v3alpha::UNHEALTHY);
           } else if (host->getActiveHealthFailureType() == Host::ActiveHealthFailureType::UNKNOWN) {
-            endpoint->set_health_status(envoy::api::v2::core::HealthStatus::UNHEALTHY);
+            endpoint->set_health_status(envoy::config::core::v3alpha::UNHEALTHY);
           } else {
             NOT_REACHED_GCOVR_EXCL_LINE;
           }
@@ -132,14 +132,14 @@ void HdsDelegate::onReceiveInitialMetadata(Http::HeaderMapPtr&& metadata) {
 }
 
 void HdsDelegate::processMessage(
-    std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier>&& message) {
+    std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier>&& message) {
   ENVOY_LOG(debug, "New health check response message {} ", message->DebugString());
   ASSERT(message);
 
   for (const auto& cluster_health_check : message->cluster_health_checks()) {
     // Create HdsCluster config
-    static const envoy::api::v2::core::BindConfig bind_config;
-    envoy::api::v2::Cluster cluster_config;
+    static const envoy::config::core::v3alpha::BindConfig bind_config;
+    envoy::config::cluster::v3alpha::Cluster cluster_config;
 
     cluster_config.set_name(cluster_health_check.cluster_name());
     cluster_config.mutable_connect_timeout()->set_seconds(ClusterTimeoutSeconds);
@@ -176,7 +176,7 @@ void HdsDelegate::processMessage(
 // TODO(lilika): Add support for subsequent HealthCheckSpecifier messages that
 // might modify the HdsClusters
 void HdsDelegate::onReceiveMessage(
-    std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier>&& message) {
+    std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier>&& message) {
   stats_.requests_.inc();
   ENVOY_LOG(debug, "New health check response message {} ", message->DebugString());
 
@@ -208,10 +208,10 @@ void HdsDelegate::onRemoteClose(Grpc::Status::GrpcStatus status, const std::stri
 }
 
 HdsCluster::HdsCluster(Server::Admin& admin, Runtime::Loader& runtime,
-                       const envoy::api::v2::Cluster& cluster,
-                       const envoy::api::v2::core::BindConfig& bind_config, Stats::Store& stats,
-                       Ssl::ContextManager& ssl_context_manager, bool added_via_api,
-                       ClusterInfoFactory& info_factory, ClusterManager& cm,
+                       const envoy::config::cluster::v3alpha::Cluster& cluster,
+                       const envoy::config::core::v3alpha::BindConfig& bind_config,
+                       Stats::Store& stats, Ssl::ContextManager& ssl_context_manager,
+                       bool added_via_api, ClusterInfoFactory& info_factory, ClusterManager& cm,
                        const LocalInfo::LocalInfo& local_info, Event::Dispatcher& dispatcher,
                        Runtime::RandomGenerator& random, Singleton::Manager& singleton_manager,
                        ThreadLocal::SlotAllocator& tls,
@@ -227,12 +227,12 @@ HdsCluster::HdsCluster(Server::Admin& admin, Runtime::Loader& runtime,
        local_info, dispatcher, random, singleton_manager, tls, validation_visitor, api});
 
   for (const auto& host : cluster.hosts()) {
-    initial_hosts_->emplace_back(
-        new HostImpl(info_, "", Network::Address::resolveProtoAddress(host),
-                     envoy::api::v2::core::Metadata::default_instance(), 1,
-                     envoy::api::v2::core::Locality().default_instance(),
-                     envoy::api::v2::endpoint::Endpoint::HealthCheckConfig().default_instance(), 0,
-                     envoy::api::v2::core::HealthStatus::UNKNOWN));
+    initial_hosts_->emplace_back(new HostImpl(
+        info_, "", Network::Address::resolveProtoAddress(host),
+        envoy::config::core::v3alpha::Metadata::default_instance(), 1,
+        envoy::config::core::v3alpha::Locality().default_instance(),
+        envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig().default_instance(), 0,
+        envoy::config::core::v3alpha::UNKNOWN));
   }
   initialize([] {});
 }
diff --git a/source/common/upstream/health_discovery_service.h b/source/common/upstream/health_discovery_service.h
index 545652092025..4988e3b51d11 100644
--- a/source/common/upstream/health_discovery_service.h
+++ b/source/common/upstream/health_discovery_service.h
@@ -1,11 +1,11 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/server/transport_socket_config.h"
-#include "envoy/service/discovery/v2/hds.pb.h"
+#include "envoy/service/health/v3alpha/hds.pb.h"
 #include "envoy/ssl/context_manager.h"
 #include "envoy/stats/stats_macros.h"
 #include "envoy/upstream/upstream.h"
@@ -39,8 +39,9 @@ class ProdClusterInfoFactory : public ClusterInfoFactory, Logger::Loggable<Logge
 class HdsCluster : public Cluster, Logger::Loggable<Logger::Id::upstream> {
 public:
   static ClusterSharedPtr create();
-  HdsCluster(Server::Admin& admin, Runtime::Loader& runtime, const envoy::api::v2::Cluster& cluster,
-             const envoy::api::v2::core::BindConfig& bind_config, Stats::Store& stats,
+  HdsCluster(Server::Admin& admin, Runtime::Loader& runtime,
+             const envoy::config::cluster::v3alpha::Cluster& cluster,
+             const envoy::config::core::v3alpha::BindConfig& bind_config, Stats::Store& stats,
              Ssl::ContextManager& ssl_context_manager, bool added_via_api,
              ClusterInfoFactory& info_factory, ClusterManager& cm,
              const LocalInfo::LocalInfo& local_info, Event::Dispatcher& dispatcher,
@@ -75,8 +76,8 @@ class HdsCluster : public Cluster, Logger::Loggable<Logger::Id::upstream> {
   std::function<void()> initialization_complete_callback_;
 
   Runtime::Loader& runtime_;
-  const envoy::api::v2::Cluster& cluster_;
-  const envoy::api::v2::core::BindConfig& bind_config_;
+  const envoy::config::cluster::v3alpha::Cluster& cluster_;
+  const envoy::config::core::v3alpha::BindConfig& bind_config_;
   Stats::Store& stats_;
   Ssl::ContextManager& ssl_context_manager_;
   bool added_via_api_;
@@ -111,8 +112,9 @@ struct HdsDelegateStats {
  * server with a set of hosts to healthcheck, healthchecking them, and reporting
  * back the results.
  */
-class HdsDelegate : Grpc::AsyncStreamCallbacks<envoy::service::discovery::v2::HealthCheckSpecifier>,
-                    Logger::Loggable<Logger::Id::upstream> {
+class HdsDelegate
+    : Grpc::AsyncStreamCallbacks<envoy::service::health::v3alpha::HealthCheckSpecifier>,
+      Logger::Loggable<Logger::Id::upstream> {
 public:
   HdsDelegate(Stats::Scope& scope, Grpc::RawAsyncClientPtr async_client,
               Event::Dispatcher& dispatcher, Runtime::Loader& runtime, Envoy::Stats::Store& stats,
@@ -126,10 +128,10 @@ class HdsDelegate : Grpc::AsyncStreamCallbacks<envoy::service::discovery::v2::He
   void onCreateInitialMetadata(Http::HeaderMap& metadata) override;
   void onReceiveInitialMetadata(Http::HeaderMapPtr&& metadata) override;
   void onReceiveMessage(
-      std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier>&& message) override;
+      std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier>&& message) override;
   void onReceiveTrailingMetadata(Http::HeaderMapPtr&& metadata) override;
   void onRemoteClose(Grpc::Status::GrpcStatus status, const std::string& message) override;
-  envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse sendResponse();
+  envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse sendResponse();
 
   std::vector<HdsClusterPtr> hdsClusters() { return hds_clusters_; };
 
@@ -142,15 +144,15 @@ class HdsDelegate : Grpc::AsyncStreamCallbacks<envoy::service::discovery::v2::He
   // Establishes a connection with the management server
   void establishNewStream();
   void
-  processMessage(std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier>&& message);
+  processMessage(std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier>&& message);
 
   HdsDelegateStats stats_;
   const Protobuf::MethodDescriptor& service_method_;
 
-  Grpc::AsyncClient<envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse,
-                    envoy::service::discovery::v2::HealthCheckSpecifier>
+  Grpc::AsyncClient<envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse,
+                    envoy::service::health::v3alpha::HealthCheckSpecifier>
       async_client_;
-  Grpc::AsyncStream<envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse>
+  Grpc::AsyncStream<envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse>
       stream_{};
   Event::Dispatcher& dispatcher_;
   Runtime::Loader& runtime_;
@@ -165,8 +167,8 @@ class HdsDelegate : Grpc::AsyncStreamCallbacks<envoy::service::discovery::v2::He
   Singleton::Manager& singleton_manager_;
   ThreadLocal::SlotAllocator& tls_;
 
-  envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse health_check_request_;
-  std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier> health_check_message_;
+  envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse health_check_request_;
+  std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier> health_check_message_;
 
   std::vector<std::string> clusters_;
   std::vector<HdsClusterPtr> hds_clusters_;
diff --git a/source/common/upstream/load_balancer_impl.cc b/source/common/upstream/load_balancer_impl.cc
index 4f2ae7dbbe70..4db75eca9848 100644
--- a/source/common/upstream/load_balancer_impl.cc
+++ b/source/common/upstream/load_balancer_impl.cc
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/upstream/upstream.h"
 
@@ -97,9 +97,10 @@ LoadBalancerBase::choosePriority(uint64_t hash, const HealthyLoad& healthy_per_p
   NOT_REACHED_GCOVR_EXCL_LINE;
 }
 
-LoadBalancerBase::LoadBalancerBase(const PrioritySet& priority_set, ClusterStats& stats,
-                                   Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                                   const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+LoadBalancerBase::LoadBalancerBase(
+    const PrioritySet& priority_set, ClusterStats& stats, Runtime::Loader& runtime,
+    Runtime::RandomGenerator& random,
+    const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
     : stats_(stats), runtime_(runtime), random_(random),
       default_healthy_panic_percent_(PROTOBUF_PERCENT_TO_ROUNDED_INTEGER_OR_DEFAULT(
           common_config, healthy_panic_threshold, 100, 50)),
@@ -277,7 +278,7 @@ LoadBalancerBase::chooseHostSet(LoadBalancerContext* context) {
 ZoneAwareLoadBalancerBase::ZoneAwareLoadBalancerBase(
     const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterStats& stats,
     Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-    const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+    const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
     : LoadBalancerBase(priority_set, stats, runtime, random, common_config),
       local_priority_set_(local_priority_set),
       routing_enabled_(PROTOBUF_PERCENT_TO_ROUNDED_INTEGER_OR_DEFAULT(
@@ -629,7 +630,7 @@ const HostVector& ZoneAwareLoadBalancerBase::hostSourceToHosts(HostsSource hosts
 EdfLoadBalancerBase::EdfLoadBalancerBase(
     const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterStats& stats,
     Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-    const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+    const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
     : ZoneAwareLoadBalancerBase(priority_set, local_priority_set, stats, runtime, random,
                                 common_config),
       seed_(random_.random()) {
@@ -778,13 +779,14 @@ HostConstSharedPtr RandomLoadBalancer::chooseHostOnce(LoadBalancerContext* conte
 
 SubsetSelectorImpl::SubsetSelectorImpl(
     const Protobuf::RepeatedPtrField<std::string>& selector_keys,
-    envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-        fallback_policy,
+    envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+        LbSubsetSelectorFallbackPolicy fallback_policy,
     const Protobuf::RepeatedPtrField<std::string>& fallback_keys_subset)
     : selector_keys_(selector_keys.begin(), selector_keys.end()), fallback_policy_(fallback_policy),
       fallback_keys_subset_(fallback_keys_subset.begin(), fallback_keys_subset.end()) {
 
-  if (fallback_policy_ != envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET) {
+  if (fallback_policy_ !=
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET) {
     // defining fallback_keys_subset_ for a fallback policy other than KEYS_SUBSET doesn't have
     // any effect and it is probably a user mistake. We should let the user know about it.
     if (!fallback_keys_subset_.empty()) {
diff --git a/source/common/upstream/load_balancer_impl.h b/source/common/upstream/load_balancer_impl.h
index f2d71fb092c9..14ada2ef40be 100644
--- a/source/common/upstream/load_balancer_impl.h
+++ b/source/common/upstream/load_balancer_impl.h
@@ -5,7 +5,7 @@
 #include <set>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/upstream/load_balancer.h"
 #include "envoy/upstream/upstream.h"
@@ -62,7 +62,7 @@ class LoadBalancerBase : public LoadBalancer {
 
   LoadBalancerBase(const PrioritySet& priority_set, ClusterStats& stats, Runtime::Loader& runtime,
                    Runtime::RandomGenerator& random,
-                   const envoy::api::v2::Cluster::CommonLbConfig& common_config);
+                   const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config);
 
   // Choose host set randomly, based on the healthy_per_priority_load_ and
   // degraded_per_priority_load_. per_priority_load_ is consulted first, spilling over to
@@ -162,10 +162,10 @@ class LoadBalancerContextBase : public LoadBalancerContext {
 class ZoneAwareLoadBalancerBase : public LoadBalancerBase {
 protected:
   // Both priority_set and local_priority_set if non-null must have at least one host set.
-  ZoneAwareLoadBalancerBase(const PrioritySet& priority_set, const PrioritySet* local_priority_set,
-                            ClusterStats& stats, Runtime::Loader& runtime,
-                            Runtime::RandomGenerator& random,
-                            const envoy::api::v2::Cluster::CommonLbConfig& common_config);
+  ZoneAwareLoadBalancerBase(
+      const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterStats& stats,
+      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config);
   ~ZoneAwareLoadBalancerBase() override;
 
   // When deciding which hosts to use on an LB decision, we need to know how to index into the
@@ -342,10 +342,10 @@ class ZoneAwareLoadBalancerBase : public LoadBalancerBase {
  */
 class EdfLoadBalancerBase : public ZoneAwareLoadBalancerBase {
 public:
-  EdfLoadBalancerBase(const PrioritySet& priority_set, const PrioritySet* local_priority_set,
-                      ClusterStats& stats, Runtime::Loader& runtime,
-                      Runtime::RandomGenerator& random,
-                      const envoy::api::v2::Cluster::CommonLbConfig& common_config);
+  EdfLoadBalancerBase(
+      const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterStats& stats,
+      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config);
 
   // Upstream::LoadBalancerBase
   HostConstSharedPtr chooseHostOnce(LoadBalancerContext* context) override;
@@ -384,10 +384,10 @@ class EdfLoadBalancerBase : public ZoneAwareLoadBalancerBase {
  */
 class RoundRobinLoadBalancer : public EdfLoadBalancerBase {
 public:
-  RoundRobinLoadBalancer(const PrioritySet& priority_set, const PrioritySet* local_priority_set,
-                         ClusterStats& stats, Runtime::Loader& runtime,
-                         Runtime::RandomGenerator& random,
-                         const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+  RoundRobinLoadBalancer(
+      const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterStats& stats,
+      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
       : EdfLoadBalancerBase(priority_set, local_priority_set, stats, runtime, random,
                             common_config) {
     initialize();
@@ -435,8 +435,9 @@ class LeastRequestLoadBalancer : public EdfLoadBalancerBase {
   LeastRequestLoadBalancer(
       const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterStats& stats,
       Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-      const envoy::api::v2::Cluster::CommonLbConfig& common_config,
-      const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig> least_request_config)
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>
+          least_request_config)
       : EdfLoadBalancerBase(priority_set, local_priority_set, stats, runtime, random,
                             common_config),
         choice_count_(
@@ -472,7 +473,7 @@ class RandomLoadBalancer : public ZoneAwareLoadBalancerBase {
   RandomLoadBalancer(const PrioritySet& priority_set, const PrioritySet* local_priority_set,
                      ClusterStats& stats, Runtime::Loader& runtime,
                      Runtime::RandomGenerator& random,
-                     const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+                     const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
       : ZoneAwareLoadBalancerBase(priority_set, local_priority_set, stats, runtime, random,
                                   common_config) {}
 
@@ -485,24 +486,24 @@ class RandomLoadBalancer : public ZoneAwareLoadBalancerBase {
  */
 class SubsetSelectorImpl : public SubsetSelector {
 public:
-  SubsetSelectorImpl(
-      const Protobuf::RepeatedPtrField<std::string>& selector_keys,
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-          fallback_policy,
-      const Protobuf::RepeatedPtrField<std::string>& fallback_keys_subset);
+  SubsetSelectorImpl(const Protobuf::RepeatedPtrField<std::string>& selector_keys,
+                     envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+                         LbSubsetSelectorFallbackPolicy fallback_policy,
+                     const Protobuf::RepeatedPtrField<std::string>& fallback_keys_subset);
 
   // SubsetSelector
   const std::set<std::string>& selectorKeys() const override { return selector_keys_; }
-  envoy::api::v2::Cluster_LbSubsetConfig_LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-  fallbackPolicy() const override {
+  envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+      LbSubsetSelectorFallbackPolicy
+      fallbackPolicy() const override {
     return fallback_policy_;
   }
   const std::set<std::string>& fallbackKeysSubset() const override { return fallback_keys_subset_; }
 
 private:
   const std::set<std::string> selector_keys_;
-  const envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-      fallback_policy_;
+  const envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+      LbSubsetSelectorFallbackPolicy fallback_policy_;
   const std::set<std::string> fallback_keys_subset_;
 };
 
@@ -511,7 +512,8 @@ class SubsetSelectorImpl : public SubsetSelector {
  */
 class LoadBalancerSubsetInfoImpl : public LoadBalancerSubsetInfo {
 public:
-  LoadBalancerSubsetInfoImpl(const envoy::api::v2::Cluster::LbSubsetConfig& subset_config)
+  LoadBalancerSubsetInfoImpl(
+      const envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig& subset_config)
       : enabled_(!subset_config.subset_selectors().empty()),
         fallback_policy_(subset_config.fallback_policy()),
         default_subset_(subset_config.default_subset()),
@@ -528,7 +530,8 @@ class LoadBalancerSubsetInfoImpl : public LoadBalancerSubsetInfo {
 
   // Upstream::LoadBalancerSubsetInfo
   bool isEnabled() const override { return enabled_; }
-  envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy fallbackPolicy() const override {
+  envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy
+  fallbackPolicy() const override {
     return fallback_policy_;
   }
   const ProtobufWkt::Struct& defaultSubset() const override { return default_subset_; }
@@ -542,7 +545,8 @@ class LoadBalancerSubsetInfoImpl : public LoadBalancerSubsetInfo {
 
 private:
   const bool enabled_;
-  const envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy fallback_policy_;
+  const envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy
+      fallback_policy_;
   const ProtobufWkt::Struct default_subset_;
   std::vector<SubsetSelectorPtr> subset_selectors_;
   const bool locality_weight_aware_;
diff --git a/source/common/upstream/load_stats_reporter.cc b/source/common/upstream/load_stats_reporter.cc
index 1f0b1c21b727..3132dc14c5a3 100644
--- a/source/common/upstream/load_stats_reporter.cc
+++ b/source/common/upstream/load_stats_reporter.cc
@@ -1,6 +1,6 @@
 #include "common/upstream/load_stats_reporter.h"
 
-#include "envoy/service/load_stats/v2/lrs.pb.h"
+#include "envoy/service/load_stats/v3alpha/lrs.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/protobuf/protobuf.h"
@@ -118,7 +118,7 @@ void LoadStatsReporter::onReceiveInitialMetadata(Http::HeaderMapPtr&& metadata)
 }
 
 void LoadStatsReporter::onReceiveMessage(
-    std::unique_ptr<envoy::service::load_stats::v2::LoadStatsResponse>&& message) {
+    std::unique_ptr<envoy::service::load_stats::v3alpha::LoadStatsResponse>&& message) {
   ENVOY_LOG(debug, "New load report epoch: {}", message->DebugString());
   stats_.requests_.inc();
   message_ = std::move(message);
diff --git a/source/common/upstream/load_stats_reporter.h b/source/common/upstream/load_stats_reporter.h
index f938fd366b95..a3761f72f43d 100644
--- a/source/common/upstream/load_stats_reporter.h
+++ b/source/common/upstream/load_stats_reporter.h
@@ -1,5 +1,5 @@
 #include "envoy/event/dispatcher.h"
-#include "envoy/service/load_stats/v2/lrs.pb.h"
+#include "envoy/service/load_stats/v3alpha/lrs.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -26,7 +26,7 @@ struct LoadReporterStats {
 };
 
 class LoadStatsReporter
-    : Grpc::AsyncStreamCallbacks<envoy::service::load_stats::v2::LoadStatsResponse>,
+    : Grpc::AsyncStreamCallbacks<envoy::service::load_stats::v3alpha::LoadStatsResponse>,
       Logger::Loggable<Logger::Id::upstream> {
 public:
   LoadStatsReporter(const LocalInfo::LocalInfo& local_info, ClusterManager& cluster_manager,
@@ -37,7 +37,7 @@ class LoadStatsReporter
   void onCreateInitialMetadata(Http::HeaderMap& metadata) override;
   void onReceiveInitialMetadata(Http::HeaderMapPtr&& metadata) override;
   void onReceiveMessage(
-      std::unique_ptr<envoy::service::load_stats::v2::LoadStatsResponse>&& message) override;
+      std::unique_ptr<envoy::service::load_stats::v3alpha::LoadStatsResponse>&& message) override;
   void onReceiveTrailingMetadata(Http::HeaderMapPtr&& metadata) override;
   void onRemoteClose(Grpc::Status::GrpcStatus status, const std::string& message) override;
 
@@ -53,15 +53,15 @@ class LoadStatsReporter
 
   ClusterManager& cm_;
   LoadReporterStats stats_;
-  Grpc::AsyncClient<envoy::service::load_stats::v2::LoadStatsRequest,
-                    envoy::service::load_stats::v2::LoadStatsResponse>
+  Grpc::AsyncClient<envoy::service::load_stats::v3alpha::LoadStatsRequest,
+                    envoy::service::load_stats::v3alpha::LoadStatsResponse>
       async_client_;
-  Grpc::AsyncStream<envoy::service::load_stats::v2::LoadStatsRequest> stream_{};
+  Grpc::AsyncStream<envoy::service::load_stats::v3alpha::LoadStatsRequest> stream_{};
   const Protobuf::MethodDescriptor& service_method_;
   Event::TimerPtr retry_timer_;
   Event::TimerPtr response_timer_;
-  envoy::service::load_stats::v2::LoadStatsRequest request_;
-  std::unique_ptr<envoy::service::load_stats::v2::LoadStatsResponse> message_;
+  envoy::service::load_stats::v3alpha::LoadStatsRequest request_;
+  std::unique_ptr<envoy::service::load_stats::v3alpha::LoadStatsResponse> message_;
   // Map from cluster name to start of measurement interval.
   std::unordered_map<std::string, std::chrono::steady_clock::duration> clusters_;
   TimeSource& time_source_;
diff --git a/source/common/upstream/logical_dns_cluster.cc b/source/common/upstream/logical_dns_cluster.cc
index 9141b580c5e6..fb4c5a61a1b0 100644
--- a/source/common/upstream/logical_dns_cluster.cc
+++ b/source/common/upstream/logical_dns_cluster.cc
@@ -5,10 +5,10 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/eds.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/fmt.h"
@@ -22,9 +22,9 @@ namespace Envoy {
 namespace Upstream {
 
 namespace {
-envoy::api::v2::ClusterLoadAssignment
-convertPriority(const envoy::api::v2::ClusterLoadAssignment& load_assignment) {
-  envoy::api::v2::ClusterLoadAssignment converted;
+envoy::config::endpoint::v3alpha::ClusterLoadAssignment
+convertPriority(const envoy::config::endpoint::v3alpha::ClusterLoadAssignment& load_assignment) {
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment converted;
   converted.MergeFrom(load_assignment);
 
   // We convert the priority set by the configuration back to zero. This helps
@@ -43,7 +43,7 @@ convertPriority(const envoy::api::v2::ClusterLoadAssignment& load_assignment) {
 } // namespace
 
 LogicalDnsCluster::LogicalDnsCluster(
-    const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
     Network::DnsResolverSharedPtr dns_resolver,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Stats::ScopePtr&& stats_scope, bool added_via_api)
@@ -71,7 +71,7 @@ LogicalDnsCluster::LogicalDnsCluster(
     }
   }
 
-  const envoy::api::v2::core::SocketAddress& socket_address =
+  const envoy::config::core::v3alpha::SocketAddress& socket_address =
       lbEndpoint().endpoint().address().socket_address();
 
   if (!socket_address.resolver_name().empty()) {
@@ -151,7 +151,7 @@ void LogicalDnsCluster::startResolve() {
 
 std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
 LogicalDnsClusterFactory::createClusterImpl(
-    const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
   auto selected_dns_resolver = selectDnsResolver(cluster, context);
diff --git a/source/common/upstream/logical_dns_cluster.h b/source/common/upstream/logical_dns_cluster.h
index a9fe16159d31..dd765d64205d 100644
--- a/source/common/upstream/logical_dns_cluster.h
+++ b/source/common/upstream/logical_dns_cluster.h
@@ -5,9 +5,9 @@
 #include <functional>
 #include <string>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/empty_string.h"
@@ -35,8 +35,8 @@ namespace Upstream {
  */
 class LogicalDnsCluster : public ClusterImplBase {
 public:
-  LogicalDnsCluster(const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
-                    Network::DnsResolverSharedPtr dns_resolver,
+  LogicalDnsCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    Runtime::Loader& runtime, Network::DnsResolverSharedPtr dns_resolver,
                     Server::Configuration::TransportSocketFactoryContext& factory_context,
                     Stats::ScopePtr&& stats_scope, bool added_via_api);
 
@@ -46,13 +46,13 @@ class LogicalDnsCluster : public ClusterImplBase {
   InitializePhase initializePhase() const override { return InitializePhase::Primary; }
 
 private:
-  const envoy::api::v2::endpoint::LocalityLbEndpoints& localityLbEndpoint() const {
+  const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& localityLbEndpoint() const {
     // This is checked in the constructor, i.e. at config load time.
     ASSERT(load_assignment_.endpoints().size() == 1);
     return load_assignment_.endpoints()[0];
   }
 
-  const envoy::api::v2::endpoint::LbEndpoint& lbEndpoint() const {
+  const envoy::config::endpoint::v3alpha::LbEndpoint& lbEndpoint() const {
     // This is checked in the constructor, i.e. at config load time.
     ASSERT(localityLbEndpoint().lb_endpoints().size() == 1);
     return localityLbEndpoint().lb_endpoints()[0];
@@ -75,7 +75,7 @@ class LogicalDnsCluster : public ClusterImplBase {
   LogicalHostSharedPtr logical_host_;
   Network::ActiveDnsQuery* active_dns_query_{};
   const LocalInfo::LocalInfo& local_info_;
-  const envoy::api::v2::ClusterLoadAssignment load_assignment_;
+  const envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment_;
 };
 
 class LogicalDnsClusterFactory : public ClusterFactoryImplBase {
@@ -85,7 +85,8 @@ class LogicalDnsClusterFactory : public ClusterFactoryImplBase {
 
 private:
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override;
 };
diff --git a/source/common/upstream/logical_host.h b/source/common/upstream/logical_host.h
index 07f5bd8e67cd..856a382dc206 100644
--- a/source/common/upstream/logical_host.h
+++ b/source/common/upstream/logical_host.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 
 #include "common/upstream/upstream_impl.h"
 
@@ -16,8 +16,8 @@ class LogicalHost : public HostImpl {
 public:
   LogicalHost(const ClusterInfoConstSharedPtr& cluster, const std::string& hostname,
               const Network::Address::InstanceConstSharedPtr& address,
-              const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint,
-              const envoy::api::v2::endpoint::LbEndpoint& lb_endpoint,
+              const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint,
+              const envoy::config::endpoint::v3alpha::LbEndpoint& lb_endpoint,
               const Network::TransportSocketOptionsSharedPtr& override_transport_socket_options)
       : HostImpl(cluster, hostname, address, lb_endpoint.metadata(),
                  lb_endpoint.load_balancing_weight().value(), locality_lb_endpoint.locality(),
@@ -30,7 +30,7 @@ class LogicalHost : public HostImpl {
   // used on the main thread, but we do so anyway since it shouldn't be perf critical and will
   // future proof the code.
   void setNewAddress(const Network::Address::InstanceConstSharedPtr& address,
-                     const envoy::api::v2::endpoint::LbEndpoint& lb_endpoint) {
+                     const envoy::config::endpoint::v3alpha::LbEndpoint& lb_endpoint) {
     const auto& port_value = lb_endpoint.endpoint().health_check_config().port_value();
     auto health_check_address =
         port_value == 0 ? address : Network::Utility::getAddressWithPort(*address, port_value);
@@ -74,10 +74,12 @@ class RealHostDescription : public HostDescription {
   // Upstream:HostDescription
   bool canary() const override { return logical_host_->canary(); }
   void canary(bool) override { NOT_IMPLEMENTED_GCOVR_EXCL_LINE; }
-  const std::shared_ptr<envoy::api::v2::core::Metadata> metadata() const override {
+  const std::shared_ptr<envoy::config::core::v3alpha::Metadata> metadata() const override {
     return logical_host_->metadata();
   }
-  void metadata(const envoy::api::v2::core::Metadata&) override { NOT_IMPLEMENTED_GCOVR_EXCL_LINE; }
+  void metadata(const envoy::config::core::v3alpha::Metadata&) override {
+    NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
+  }
 
   Network::TransportSocketFactory& transportSocketFactory() const override {
     return logical_host_->transportSocketFactory();
@@ -90,7 +92,7 @@ class RealHostDescription : public HostDescription {
   HostStats& stats() const override { return logical_host_->stats(); }
   const std::string& hostname() const override { return logical_host_->hostname(); }
   Network::Address::InstanceConstSharedPtr address() const override { return address_; }
-  const envoy::api::v2::core::Locality& locality() const override {
+  const envoy::config::core::v3alpha::Locality& locality() const override {
     return logical_host_->locality();
   }
   Stats::StatName localityZoneStatName() const override {
diff --git a/source/common/upstream/maglev_lb.cc b/source/common/upstream/maglev_lb.cc
index e726766da9e2..667588c14bad 100644
--- a/source/common/upstream/maglev_lb.cc
+++ b/source/common/upstream/maglev_lb.cc
@@ -1,6 +1,6 @@
 #include "common/upstream/maglev_lb.h"
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 namespace Envoy {
 namespace Upstream {
@@ -88,11 +88,11 @@ uint64_t MaglevTable::permutation(const TableBuildEntry& entry) {
   return (entry.offset_ + (entry.skip_ * entry.next_)) % table_size_;
 }
 
-MaglevLoadBalancer::MaglevLoadBalancer(const PrioritySet& priority_set, ClusterStats& stats,
-                                       Stats::Scope& scope, Runtime::Loader& runtime,
-                                       Runtime::RandomGenerator& random,
-                                       const envoy::api::v2::Cluster::CommonLbConfig& common_config,
-                                       uint64_t table_size)
+MaglevLoadBalancer::MaglevLoadBalancer(
+    const PrioritySet& priority_set, ClusterStats& stats, Stats::Scope& scope,
+    Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+    const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config,
+    uint64_t table_size)
     : ThreadAwareLoadBalancerBase(priority_set, stats, runtime, random, common_config),
       scope_(scope.createScope("maglev_lb.")), stats_(generateStats(*scope_)),
       table_size_(table_size) {}
diff --git a/source/common/upstream/maglev_lb.h b/source/common/upstream/maglev_lb.h
index e181fd990965..3e4d0a579974 100644
--- a/source/common/upstream/maglev_lb.h
+++ b/source/common/upstream/maglev_lb.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
 
@@ -70,7 +70,7 @@ class MaglevLoadBalancer : public ThreadAwareLoadBalancerBase {
 public:
   MaglevLoadBalancer(const PrioritySet& priority_set, ClusterStats& stats, Stats::Scope& scope,
                      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                     const envoy::api::v2::Cluster::CommonLbConfig& common_config,
+                     const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config,
                      uint64_t table_size = MaglevTable::DefaultTableSize);
 
   const MaglevLoadBalancerStats& stats() const { return stats_; }
diff --git a/source/common/upstream/original_dst_cluster.cc b/source/common/upstream/original_dst_cluster.cc
index bbaeb761b319..9440aa9e9e94 100644
--- a/source/common/upstream/original_dst_cluster.cc
+++ b/source/common/upstream/original_dst_cluster.cc
@@ -5,10 +5,10 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/http/headers.h"
@@ -55,10 +55,10 @@ HostConstSharedPtr OriginalDstCluster::LoadBalancer::chooseHost(LoadBalancerCont
         auto info = parent_->info();
         HostSharedPtr host(std::make_shared<HostImpl>(
             info, info->name() + dst_addr.asString(), std::move(host_ip_port),
-            envoy::api::v2::core::Metadata::default_instance(), 1,
-            envoy::api::v2::core::Locality().default_instance(),
-            envoy::api::v2::endpoint::Endpoint::HealthCheckConfig().default_instance(), 0,
-            envoy::api::v2::core::HealthStatus::UNKNOWN));
+            envoy::config::core::v3alpha::Metadata::default_instance(), 1,
+            envoy::config::core::v3alpha::Locality().default_instance(),
+            envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig().default_instance(), 0,
+            envoy::config::core::v3alpha::UNKNOWN));
         ENVOY_LOG(debug, "Created host {}.", host->address()->asString());
 
         // Tell the cluster about the new host
@@ -103,7 +103,7 @@ OriginalDstCluster::LoadBalancer::requestOverrideHost(LoadBalancerContext* conte
 }
 
 OriginalDstCluster::OriginalDstCluster(
-    const envoy::api::v2::Cluster& config, Runtime::Loader& runtime,
+    const envoy::config::cluster::v3alpha::Cluster& config, Runtime::Loader& runtime,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Stats::ScopePtr&& stats_scope, bool added_via_api)
     : ClusterImplBase(config, runtime, factory_context, std::move(stats_scope), added_via_api),
@@ -177,16 +177,17 @@ void OriginalDstCluster::cleanup() {
 
 std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
 OriginalDstClusterFactory::createClusterImpl(
-    const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
-  if (cluster.lb_policy() != envoy::api::v2::Cluster::ORIGINAL_DST_LB &&
-      cluster.lb_policy() != envoy::api::v2::Cluster::CLUSTER_PROVIDED) {
+  if (cluster.lb_policy() !=
+          envoy::config::cluster::v3alpha::Cluster::hidden_envoy_deprecated_ORIGINAL_DST_LB &&
+      cluster.lb_policy() != envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED) {
     throw EnvoyException(fmt::format(
         "cluster: LB policy {} is not valid for Cluster type {}. Only 'CLUSTER_PROVIDED' or "
         "'ORIGINAL_DST_LB' is allowed with cluster type 'ORIGINAL_DST'",
-        envoy::api::v2::Cluster::LbPolicy_Name(cluster.lb_policy()),
-        envoy::api::v2::Cluster_DiscoveryType_Name(cluster.type())));
+        envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(cluster.lb_policy()),
+        envoy::config::cluster::v3alpha::Cluster::DiscoveryType_Name(cluster.type())));
   }
 
   // TODO(mattklein123): The original DST load balancer type should be deprecated and instead
diff --git a/source/common/upstream/original_dst_cluster.h b/source/common/upstream/original_dst_cluster.h
index e911a3184a45..753d26843a17 100644
--- a/source/common/upstream/original_dst_cluster.h
+++ b/source/common/upstream/original_dst_cluster.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/secret/secret_manager.h"
 #include "envoy/server/transport_socket_config.h"
 #include "envoy/stats/scope.h"
@@ -32,7 +32,8 @@ using HostMapConstSharedPtr = std::shared_ptr<const HostMap>;
  */
 class OriginalDstCluster : public ClusterImplBase {
 public:
-  OriginalDstCluster(const envoy::api::v2::Cluster& config, Runtime::Loader& runtime,
+  OriginalDstCluster(const envoy::config::cluster::v3alpha::Cluster& config,
+                     Runtime::Loader& runtime,
                      Server::Configuration::TransportSocketFactoryContext& factory_context,
                      Stats::ScopePtr&& stats_scope, bool added_via_api);
 
@@ -124,7 +125,8 @@ class OriginalDstClusterFactory : public ClusterFactoryImplBase {
 
 private:
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override;
 };
diff --git a/source/common/upstream/outlier_detection_impl.cc b/source/common/upstream/outlier_detection_impl.cc
index 87ed6593f03f..3f92a1471b06 100644
--- a/source/common/upstream/outlier_detection_impl.cc
+++ b/source/common/upstream/outlier_detection_impl.cc
@@ -6,8 +6,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/cluster/outlier_detection.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/cluster/v3alpha/outlier_detection.pb.h"
 #include "envoy/data/cluster/v2alpha/outlier_detection_event.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/stats/scope.h"
@@ -24,8 +24,8 @@ namespace Upstream {
 namespace Outlier {
 
 DetectorSharedPtr DetectorImplFactory::createForCluster(
-    Cluster& cluster, const envoy::api::v2::Cluster& cluster_config, Event::Dispatcher& dispatcher,
-    Runtime::Loader& runtime, EventLoggerSharedPtr event_logger) {
+    Cluster& cluster, const envoy::config::cluster::v3alpha::Cluster& cluster_config,
+    Event::Dispatcher& dispatcher, Runtime::Loader& runtime, EventLoggerSharedPtr event_logger) {
   if (cluster_config.has_outlier_detection()) {
 
     return DetectorImpl::create(cluster, cluster_config.outlier_detection(), dispatcher, runtime,
@@ -39,9 +39,8 @@ DetectorHostMonitorImpl::DetectorHostMonitorImpl(std::shared_ptr<DetectorImpl> d
                                                  HostSharedPtr host)
     : detector_(detector), host_(host),
       // add Success Rate monitors
-      external_origin_sr_monitor_(envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE),
-      local_origin_sr_monitor_(
-          envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN) {
+      external_origin_sr_monitor_(envoy::data::cluster::v2alpha::SUCCESS_RATE),
+      local_origin_sr_monitor_(envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN) {
   // Setup method to call when putResult is invoked. Depending on the config's
   // split_external_local_origin_errors_ boolean value different method is called.
   put_result_func_ = detector->config().splitExternalLocalOriginErrors()
@@ -208,7 +207,7 @@ void DetectorHostMonitorImpl::localOriginNoFailure() {
   resetConsecutiveLocalOriginFailure();
 }
 
-DetectorConfig::DetectorConfig(const envoy::api::v2::cluster::OutlierDetection& config)
+DetectorConfig::DetectorConfig(const envoy::config::cluster::v3alpha::OutlierDetection& config)
     : interval_ms_(
           static_cast<uint64_t>(PROTOBUF_GET_MS_OR_DEFAULT(config, interval, DEFAULT_INTERVAL_MS))),
       base_ejection_time_ms_(static_cast<uint64_t>(
@@ -254,7 +253,7 @@ DetectorConfig::DetectorConfig(const envoy::api::v2::cluster::OutlierDetection&
                                           DEFAULT_ENFORCING_LOCAL_ORIGIN_SUCCESS_RATE))) {}
 
 DetectorImpl::DetectorImpl(const Cluster& cluster,
-                           const envoy::api::v2::cluster::OutlierDetection& config,
+                           const envoy::config::cluster::v3alpha::OutlierDetection& config,
                            Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                            TimeSource& time_source, EventLoggerSharedPtr event_logger)
     : config_(config), dispatcher_(dispatcher), runtime_(runtime), time_source_(time_source),
@@ -277,7 +276,7 @@ DetectorImpl::~DetectorImpl() {
 
 std::shared_ptr<DetectorImpl>
 DetectorImpl::create(const Cluster& cluster,
-                     const envoy::api::v2::cluster::OutlierDetection& config,
+                     const envoy::config::cluster::v3alpha::OutlierDetection& config,
                      Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
                      TimeSource& time_source, EventLoggerSharedPtr event_logger) {
   std::shared_ptr<DetectorImpl> detector(
@@ -353,28 +352,28 @@ void DetectorImpl::checkHostForUneject(HostSharedPtr host, DetectorHostMonitorIm
 
 bool DetectorImpl::enforceEjection(envoy::data::cluster::v2alpha::OutlierEjectionType type) {
   switch (type) {
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_5XX:
     return runtime_.snapshot().featureEnabled("outlier_detection.enforcing_consecutive_5xx",
                                               config_.enforcingConsecutive5xx());
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE:
     return runtime_.snapshot().featureEnabled(
         "outlier_detection.enforcing_consecutive_gateway_failure",
         config_.enforcingConsecutiveGatewayFailure());
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE:
+  case envoy::data::cluster::v2alpha::SUCCESS_RATE:
     return runtime_.snapshot().featureEnabled("outlier_detection.enforcing_success_rate",
                                               config_.enforcingSuccessRate());
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
     return runtime_.snapshot().featureEnabled(
         "outlier_detection.enforcing_consecutive_local_origin_failure",
         config_.enforcingConsecutiveLocalOriginFailure());
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN:
+  case envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN:
     return runtime_.snapshot().featureEnabled(
         "outlier_detection.enforcing_local_origin_success_rate",
         config_.enforcingLocalOriginSuccessRate());
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE:
+  case envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE:
     return runtime_.snapshot().featureEnabled("outlier_detection.enforcing_failure_percentage",
                                               config_.enforcingFailurePercentage());
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE_LOCAL_ORIGIN:
+  case envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE_LOCAL_ORIGIN:
     return runtime_.snapshot().featureEnabled(
         "outlier_detection.enforcing_failure_percentage_local_origin",
         config_.enforcingFailurePercentageLocalOrigin());
@@ -390,25 +389,25 @@ void DetectorImpl::updateEnforcedEjectionStats(
     envoy::data::cluster::v2alpha::OutlierEjectionType type) {
   stats_.ejections_enforced_total_.inc();
   switch (type) {
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE:
+  case envoy::data::cluster::v2alpha::SUCCESS_RATE:
     stats_.ejections_enforced_success_rate_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_5XX:
     stats_.ejections_enforced_consecutive_5xx_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE:
     stats_.ejections_enforced_consecutive_gateway_failure_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
     stats_.ejections_enforced_consecutive_local_origin_failure_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN:
+  case envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN:
     stats_.ejections_enforced_local_origin_success_rate_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE:
+  case envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE:
     stats_.ejections_enforced_failure_percentage_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE_LOCAL_ORIGIN:
+  case envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE_LOCAL_ORIGIN:
     stats_.ejections_enforced_local_origin_failure_percentage_.inc();
     break;
   default:
@@ -420,25 +419,25 @@ void DetectorImpl::updateEnforcedEjectionStats(
 void DetectorImpl::updateDetectedEjectionStats(
     envoy::data::cluster::v2alpha::OutlierEjectionType type) {
   switch (type) {
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE:
+  case envoy::data::cluster::v2alpha::SUCCESS_RATE:
     stats_.ejections_detected_success_rate_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_5XX:
     stats_.ejections_detected_consecutive_5xx_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE:
     stats_.ejections_detected_consecutive_gateway_failure_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
     stats_.ejections_detected_consecutive_local_origin_failure_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN:
+  case envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN:
     stats_.ejections_detected_local_origin_success_rate_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE:
+  case envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE:
     stats_.ejections_detected_failure_percentage_.inc();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE_LOCAL_ORIGIN:
+  case envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE_LOCAL_ORIGIN:
     stats_.ejections_detected_local_origin_failure_percentage_.inc();
     break;
   default:
@@ -456,8 +455,8 @@ void DetectorImpl::ejectHost(HostSharedPtr host,
   // Note this is not currently checked per-priority level, so it is possible
   // for outlier detection to eject all hosts at any given priority level.
   if (ejected_percent < max_ejection_percent) {
-    if (type == envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX ||
-        type == envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE) {
+    if (type == envoy::data::cluster::v2alpha::CONSECUTIVE_5XX ||
+        type == envoy::data::cluster::v2alpha::SUCCESS_RATE) {
       // Deprecated counter, preserving old behaviour until it's removed.
       stats_.ejections_total_.inc();
     }
@@ -507,18 +506,17 @@ void DetectorImpl::notifyMainThreadConsecutiveError(
 }
 
 void DetectorImpl::onConsecutive5xx(HostSharedPtr host) {
-  notifyMainThreadConsecutiveError(
-      host, envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX);
+  notifyMainThreadConsecutiveError(host, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX);
 }
 
 void DetectorImpl::onConsecutiveGatewayFailure(HostSharedPtr host) {
-  notifyMainThreadConsecutiveError(
-      host, envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE);
+  notifyMainThreadConsecutiveError(host,
+                                   envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE);
 }
 
 void DetectorImpl::onConsecutiveLocalOriginFailure(HostSharedPtr host) {
-  notifyMainThreadConsecutiveError(
-      host, envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE);
+  notifyMainThreadConsecutiveError(host,
+                                   envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE);
 }
 
 void DetectorImpl::onConsecutiveErrorWorker(
@@ -539,14 +537,14 @@ void DetectorImpl::onConsecutiveErrorWorker(
 
   // reset counters
   switch (type) {
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_5XX:
     stats_.ejections_consecutive_5xx_.inc(); // Deprecated
     host_monitors_[host]->resetConsecutive5xx();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE:
     host_monitors_[host]->resetConsecutiveGatewayFailure();
     break;
-  case envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
+  case envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE:
     host_monitors_[host]->resetConsecutiveLocalOriginFailure();
     break;
   default:
@@ -679,9 +677,8 @@ void DetectorImpl::processSuccessRateEjections(
         // SUCCESS_RATE type, so we need to figure it out for ourselves.
         const envoy::data::cluster::v2alpha::OutlierEjectionType type =
             (monitor_type == DetectorHostMonitor::SuccessRateMonitorType::ExternalOrigin)
-                ? envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE
-                : envoy::data::cluster::v2alpha::OutlierEjectionType::
-                      FAILURE_PERCENTAGE_LOCAL_ORIGIN;
+                ? envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE
+                : envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE_LOCAL_ORIGIN;
         updateDetectedEjectionStats(type);
         ejectHost(host_success_rate_pair.host_, type);
       }
@@ -724,14 +721,14 @@ void EventLoggerImpl::logEject(const HostDescriptionConstSharedPtr& host, Detect
   absl::optional<MonotonicTime> time = host->outlierDetector().lastUnejectionTime();
   setCommonEventParams(event, host, time);
 
-  event.set_action(envoy::data::cluster::v2alpha::Action::EJECT);
+  event.set_action(envoy::data::cluster::v2alpha::EJECT);
 
   event.set_enforced(enforced);
 
-  if ((type == envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE) ||
-      (type == envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN)) {
+  if ((type == envoy::data::cluster::v2alpha::SUCCESS_RATE) ||
+      (type == envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN)) {
     const DetectorHostMonitor::SuccessRateMonitorType monitor_type =
-        (type == envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE)
+        (type == envoy::data::cluster::v2alpha::SUCCESS_RATE)
             ? DetectorHostMonitor::SuccessRateMonitorType::ExternalOrigin
             : DetectorHostMonitor::SuccessRateMonitorType::LocalOrigin;
     event.mutable_eject_success_rate_event()->set_cluster_average_success_rate(
@@ -740,11 +737,10 @@ void EventLoggerImpl::logEject(const HostDescriptionConstSharedPtr& host, Detect
         detector.successRateEjectionThreshold(monitor_type));
     event.mutable_eject_success_rate_event()->set_host_success_rate(
         host->outlierDetector().successRate(monitor_type));
-  } else if ((type == envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE) ||
-             (type == envoy::data::cluster::v2alpha::OutlierEjectionType::
-                          FAILURE_PERCENTAGE_LOCAL_ORIGIN)) {
+  } else if ((type == envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE) ||
+             (type == envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE_LOCAL_ORIGIN)) {
     const DetectorHostMonitor::SuccessRateMonitorType monitor_type =
-        (type == envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE)
+        (type == envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE)
             ? DetectorHostMonitor::SuccessRateMonitorType::ExternalOrigin
             : DetectorHostMonitor::SuccessRateMonitorType::LocalOrigin;
     event.mutable_eject_failure_percentage_event()->set_host_success_rate(
@@ -764,7 +760,7 @@ void EventLoggerImpl::logUneject(const HostDescriptionConstSharedPtr& host) {
   absl::optional<MonotonicTime> time = host->outlierDetector().lastEjectionTime();
   setCommonEventParams(event, host, time);
 
-  event.set_action(envoy::data::cluster::v2alpha::Action::UNEJECT);
+  event.set_action(envoy::data::cluster::v2alpha::UNEJECT);
 
   const auto json = MessageUtil::getJsonStringFromMessage(event, /* pretty_print */ false,
                                                           /* always_print_primitive_fields */ true);
diff --git a/source/common/upstream/outlier_detection_impl.h b/source/common/upstream/outlier_detection_impl.h
index 72793d14845f..3f5c3efaa449 100644
--- a/source/common/upstream/outlier_detection_impl.h
+++ b/source/common/upstream/outlier_detection_impl.h
@@ -10,9 +10,9 @@
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/cluster/outlier_detection.pb.h"
 #include "envoy/common/time.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/cluster/v3alpha/outlier_detection.pb.h"
 #include "envoy/data/cluster/v2alpha/outlier_detection_event.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/http/codes.h"
@@ -48,10 +48,10 @@ class DetectorHostMonitorNullImpl : public DetectorHostMonitor {
  */
 class DetectorImplFactory {
 public:
-  static DetectorSharedPtr createForCluster(Cluster& cluster,
-                                            const envoy::api::v2::Cluster& cluster_config,
-                                            Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
-                                            EventLoggerSharedPtr event_logger);
+  static DetectorSharedPtr
+  createForCluster(Cluster& cluster, const envoy::config::cluster::v3alpha::Cluster& cluster_config,
+                   Event::Dispatcher& dispatcher, Runtime::Loader& runtime,
+                   EventLoggerSharedPtr event_logger);
 };
 
 /**
@@ -245,7 +245,7 @@ struct DetectionStats {
  */
 class DetectorConfig {
 public:
-  DetectorConfig(const envoy::api::v2::cluster::OutlierDetection& config);
+  DetectorConfig(const envoy::config::cluster::v3alpha::OutlierDetection& config);
 
   uint64_t intervalMs() const { return interval_ms_; }
   uint64_t baseEjectionTimeMs() const { return base_ejection_time_ms_; }
@@ -325,7 +325,7 @@ class DetectorConfig {
 class DetectorImpl : public Detector, public std::enable_shared_from_this<DetectorImpl> {
 public:
   static std::shared_ptr<DetectorImpl>
-  create(const Cluster& cluster, const envoy::api::v2::cluster::OutlierDetection& config,
+  create(const Cluster& cluster, const envoy::config::cluster::v3alpha::OutlierDetection& config,
          Event::Dispatcher& dispatcher, Runtime::Loader& runtime, TimeSource& time_source,
          EventLoggerSharedPtr event_logger);
   ~DetectorImpl() override;
@@ -366,7 +366,8 @@ class DetectorImpl : public Detector, public std::enable_shared_from_this<Detect
                                double success_rate_stdev_factor);
 
 private:
-  DetectorImpl(const Cluster& cluster, const envoy::api::v2::cluster::OutlierDetection& config,
+  DetectorImpl(const Cluster& cluster,
+               const envoy::config::cluster::v3alpha::OutlierDetection& config,
                Event::Dispatcher& dispatcher, Runtime::Loader& runtime, TimeSource& time_source,
                EventLoggerSharedPtr event_logger);
 
diff --git a/source/common/upstream/ring_hash_lb.cc b/source/common/upstream/ring_hash_lb.cc
index 264b471c182d..ef62f727787c 100644
--- a/source/common/upstream/ring_hash_lb.cc
+++ b/source/common/upstream/ring_hash_lb.cc
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/common/assert.h"
 #include "common/upstream/load_balancer_impl.h"
@@ -18,8 +18,8 @@ namespace Upstream {
 RingHashLoadBalancer::RingHashLoadBalancer(
     const PrioritySet& priority_set, ClusterStats& stats, Stats::Scope& scope,
     Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-    const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>& config,
-    const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+    const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>& config,
+    const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
     : ThreadAwareLoadBalancerBase(priority_set, stats, runtime, random, common_config),
       scope_(scope.createScope("ring_hash_lb.")), stats_(generateStats(*scope_)),
       min_ring_size_(config ? PROTOBUF_GET_WRAPPED_OR_DEFAULT(config.value(), minimum_ring_size,
@@ -79,7 +79,7 @@ HostConstSharedPtr RingHashLoadBalancer::Ring::chooseHost(uint64_t h) const {
   }
 }
 
-using HashFunction = envoy::api::v2::Cluster_RingHashLbConfig_HashFunction;
+using HashFunction = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig::HashFunction;
 RingHashLoadBalancer::Ring::Ring(const NormalizedHostWeightVector& normalized_host_weights,
                                  double min_normalized_weight, uint64_t min_ring_size,
                                  uint64_t max_ring_size, HashFunction hash_function,
diff --git a/source/common/upstream/ring_hash_lb.h b/source/common/upstream/ring_hash_lb.h
index 4a61d39023ae..2e34a6d6e27c 100644
--- a/source/common/upstream/ring_hash_lb.h
+++ b/source/common/upstream/ring_hash_lb.h
@@ -2,7 +2,7 @@
 
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -40,15 +40,16 @@ struct RingHashLoadBalancerStats {
 class RingHashLoadBalancer : public ThreadAwareLoadBalancerBase,
                              Logger::Loggable<Logger::Id::upstream> {
 public:
-  RingHashLoadBalancer(const PrioritySet& priority_set, ClusterStats& stats, Stats::Scope& scope,
-                       Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                       const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>& config,
-                       const envoy::api::v2::Cluster::CommonLbConfig& common_config);
+  RingHashLoadBalancer(
+      const PrioritySet& priority_set, ClusterStats& stats, Stats::Scope& scope,
+      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>& config,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config);
 
   const RingHashLoadBalancerStats& stats() const { return stats_; }
 
 private:
-  using HashFunction = envoy::api::v2::Cluster_RingHashLbConfig_HashFunction;
+  using HashFunction = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig::HashFunction;
 
   struct RingEntry {
     uint64_t hash_;
diff --git a/source/common/upstream/static_cluster.cc b/source/common/upstream/static_cluster.cc
index 2b5997d73d6d..1f235cdc0bb4 100644
--- a/source/common/upstream/static_cluster.cc
+++ b/source/common/upstream/static_cluster.cc
@@ -1,21 +1,21 @@
 #include "common/upstream/static_cluster.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 
 namespace Envoy {
 namespace Upstream {
 
 StaticClusterImpl::StaticClusterImpl(
-    const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Stats::ScopePtr&& stats_scope, bool added_via_api)
     : ClusterImplBase(cluster, runtime, factory_context, std::move(stats_scope), added_via_api),
       priority_state_manager_(
           new PriorityStateManager(*this, factory_context.localInfo(), nullptr)) {
   // TODO(dio): Use by-reference when cluster.hosts() is removed.
-  const envoy::api::v2::ClusterLoadAssignment cluster_load_assignment(
+  const envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment(
       cluster.has_load_assignment() ? cluster.load_assignment()
                                     : Config::Utility::translateClusterHosts(cluster.hosts()));
 
@@ -57,7 +57,7 @@ void StaticClusterImpl::startPreInit() {
 
 std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
 StaticClusterFactory::createClusterImpl(
-    const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
   return std::make_pair(
diff --git a/source/common/upstream/static_cluster.h b/source/common/upstream/static_cluster.h
index b588084dd58e..c7ad5c4f4189 100644
--- a/source/common/upstream/static_cluster.h
+++ b/source/common/upstream/static_cluster.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/upstream/cluster_factory_impl.h"
 #include "common/upstream/upstream_impl.h"
@@ -14,7 +14,8 @@ namespace Upstream {
  */
 class StaticClusterImpl : public ClusterImplBase {
 public:
-  StaticClusterImpl(const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+  StaticClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    Runtime::Loader& runtime,
                     Server::Configuration::TransportSocketFactoryContext& factory_context,
                     Stats::ScopePtr&& stats_scope, bool added_via_api);
 
@@ -39,7 +40,8 @@ class StaticClusterFactory : public ClusterFactoryImplBase {
 
 private:
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override;
 };
diff --git a/source/common/upstream/strict_dns_cluster.cc b/source/common/upstream/strict_dns_cluster.cc
index e6e58f978138..45d6b2ffa15b 100644
--- a/source/common/upstream/strict_dns_cluster.cc
+++ b/source/common/upstream/strict_dns_cluster.cc
@@ -1,15 +1,15 @@
 #include "common/upstream/strict_dns_cluster.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 
 namespace Envoy {
 namespace Upstream {
 
 StrictDnsClusterImpl::StrictDnsClusterImpl(
-    const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
     Network::DnsResolverSharedPtr dns_resolver,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Stats::ScopePtr&& stats_scope, bool added_via_api)
@@ -23,7 +23,7 @@ StrictDnsClusterImpl::StrictDnsClusterImpl(
       cluster, dns_refresh_rate_ms_.count(), factory_context.random());
 
   std::list<ResolveTargetPtr> resolve_targets;
-  const envoy::api::v2::ClusterLoadAssignment load_assignment(
+  const envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment(
       cluster.has_load_assignment() ? cluster.load_assignment()
                                     : Config::Utility::translateClusterHosts(cluster.hosts()));
   const auto& locality_lb_endpoints = load_assignment.endpoints();
@@ -82,8 +82,8 @@ void StrictDnsClusterImpl::updateAllHosts(const HostVector& hosts_added,
 
 StrictDnsClusterImpl::ResolveTarget::ResolveTarget(
     StrictDnsClusterImpl& parent, Event::Dispatcher& dispatcher, const std::string& url,
-    const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint,
-    const envoy::api::v2::endpoint::LbEndpoint& lb_endpoint)
+    const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint,
+    const envoy::config::endpoint::v3alpha::LbEndpoint& lb_endpoint)
     : parent_(parent), dns_address_(Network::Utility::hostFromTcpUrl(url)),
       port_(Network::Utility::portFromTcpUrl(url)),
       resolve_timer_(dispatcher.createTimer([this]() -> void { startResolve(); })),
@@ -170,7 +170,7 @@ void StrictDnsClusterImpl::ResolveTarget::startResolve() {
 
 std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
 StrictDnsClusterFactory::createClusterImpl(
-    const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
   auto selected_dns_resolver = selectDnsResolver(cluster, context);
diff --git a/source/common/upstream/strict_dns_cluster.h b/source/common/upstream/strict_dns_cluster.h
index e8c944203c04..d97c5b9a98f9 100644
--- a/source/common/upstream/strict_dns_cluster.h
+++ b/source/common/upstream/strict_dns_cluster.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 
 #include "common/upstream/cluster_factory_impl.h"
 #include "common/upstream/upstream_impl.h"
@@ -15,8 +15,8 @@ namespace Upstream {
  */
 class StrictDnsClusterImpl : public BaseDynamicClusterImpl {
 public:
-  StrictDnsClusterImpl(const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
-                       Network::DnsResolverSharedPtr dns_resolver,
+  StrictDnsClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                       Runtime::Loader& runtime, Network::DnsResolverSharedPtr dns_resolver,
                        Server::Configuration::TransportSocketFactoryContext& factory_context,
                        Stats::ScopePtr&& stats_scope, bool added_via_api);
 
@@ -27,8 +27,8 @@ class StrictDnsClusterImpl : public BaseDynamicClusterImpl {
   struct ResolveTarget {
     ResolveTarget(StrictDnsClusterImpl& parent, Event::Dispatcher& dispatcher,
                   const std::string& url,
-                  const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint,
-                  const envoy::api::v2::endpoint::LbEndpoint& lb_endpoint);
+                  const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint,
+                  const envoy::config::endpoint::v3alpha::LbEndpoint& lb_endpoint);
     ~ResolveTarget();
     void startResolve();
 
@@ -38,8 +38,8 @@ class StrictDnsClusterImpl : public BaseDynamicClusterImpl {
     uint32_t port_;
     Event::TimerPtr resolve_timer_;
     HostVector hosts_;
-    const envoy::api::v2::endpoint::LocalityLbEndpoints locality_lb_endpoint_;
-    const envoy::api::v2::endpoint::LbEndpoint lb_endpoint_;
+    const envoy::config::endpoint::v3alpha::LocalityLbEndpoints locality_lb_endpoint_;
+    const envoy::config::endpoint::v3alpha::LbEndpoint lb_endpoint_;
     HostMap all_hosts_;
   };
 
@@ -71,7 +71,8 @@ class StrictDnsClusterFactory : public ClusterFactoryImplBase {
 
 private:
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override;
 };
diff --git a/source/common/upstream/subset_lb.cc b/source/common/upstream/subset_lb.cc
index aac75a2dfe01..c29f0ae0a0e2 100644
--- a/source/common/upstream/subset_lb.cc
+++ b/source/common/upstream/subset_lb.cc
@@ -3,8 +3,8 @@
 #include <memory>
 #include <unordered_set>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/runtime/runtime.h"
 
 #include "common/common/assert.h"
@@ -22,9 +22,11 @@ SubsetLoadBalancer::SubsetLoadBalancer(
     LoadBalancerType lb_type, PrioritySet& priority_set, const PrioritySet* local_priority_set,
     ClusterStats& stats, Stats::Scope& scope, Runtime::Loader& runtime,
     Runtime::RandomGenerator& random, const LoadBalancerSubsetInfo& subsets,
-    const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>& lb_ring_hash_config,
-    const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig>& least_request_config,
-    const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+    const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>&
+        lb_ring_hash_config,
+    const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>&
+        least_request_config,
+    const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
     : lb_type_(lb_type), lb_ring_hash_config_(lb_ring_hash_config),
       least_request_config_(least_request_config), common_config_(common_config), stats_(stats),
       scope_(scope), runtime_(runtime), random_(random), fallback_policy_(subsets.fallbackPolicy()),
@@ -36,9 +38,10 @@ SubsetLoadBalancer::SubsetLoadBalancer(
       scale_locality_weight_(subsets.scaleLocalityWeight()), list_as_any_(subsets.listAsAny()) {
   ASSERT(subsets.isEnabled());
 
-  if (fallback_policy_ != envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK) {
+  if (fallback_policy_ != envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK) {
     HostPredicate predicate;
-    if (fallback_policy_ == envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT) {
+    if (fallback_policy_ ==
+        envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT) {
       predicate = [](const Host&) -> bool { return true; };
 
       ENVOY_LOG(debug, "subset lb: creating any-endpoint fallback load balancer");
@@ -121,7 +124,7 @@ void SubsetLoadBalancer::initSubsetSelectorMap() {
     const auto& selector_fallback_policy = subset_selector->fallbackPolicy();
     const auto& selector_fallback_keys_subset = subset_selector->fallbackKeysSubset();
     if (selector_fallback_policy ==
-        envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED) {
+        envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED) {
       continue;
     }
     uint32_t pos = 0;
@@ -149,17 +152,18 @@ void SubsetLoadBalancer::initSubsetSelectorMap() {
 }
 
 void SubsetLoadBalancer::initSelectorFallbackSubset(
-    const envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::LbSubsetSelectorFallbackPolicy&
-        fallback_policy) {
-  if (fallback_policy == envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT &&
+    const envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+        LbSubsetSelectorFallbackPolicy& fallback_policy) {
+  if (fallback_policy == envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                             LbSubsetSelector::ANY_ENDPOINT &&
       selector_fallback_subset_any_ == nullptr) {
     ENVOY_LOG(debug, "subset lb: creating any-endpoint fallback load balancer for selector");
     HostPredicate predicate = [](const Host&) -> bool { return true; };
     selector_fallback_subset_any_ = std::make_shared<LbSubsetEntry>();
     selector_fallback_subset_any_->priority_subset_.reset(
         new PrioritySubsetImpl(*this, predicate, locality_weight_aware_, scale_locality_weight_));
-  } else if (fallback_policy ==
-                 envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET &&
+  } else if (fallback_policy == envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                    LbSubsetSelector::DEFAULT_SUBSET &&
              selector_fallback_subset_default_ == nullptr) {
     ENVOY_LOG(debug, "subset lb: creating default subset fallback load balancer for selector");
     HostPredicate predicate = std::bind(&SubsetLoadBalancer::hostMatches, this,
@@ -181,9 +185,9 @@ HostConstSharedPtr SubsetLoadBalancer::chooseHost(LoadBalancerContext* context)
     // otherwise check if there is fallback policy configured for given route metadata
     absl::optional<SubsetSelectorFallbackParamsRef> selector_fallback_params =
         tryFindSelectorFallbackParams(context);
-    if (selector_fallback_params &&
-        selector_fallback_params->get().fallback_policy_ !=
-            envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED) {
+    if (selector_fallback_params && selector_fallback_params->get().fallback_policy_ !=
+                                        envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                            LbSubsetSelector::NOT_DEFINED) {
       // return result according to configured fallback policy
       return chooseHostForSelectorFallbackPolicy(*selector_fallback_params, context);
     }
@@ -242,15 +246,16 @@ SubsetLoadBalancer::tryFindSelectorFallbackParams(LoadBalancerContext* context)
 HostConstSharedPtr SubsetLoadBalancer::chooseHostForSelectorFallbackPolicy(
     const SubsetSelectorFallbackParams& fallback_params, LoadBalancerContext* context) {
   const auto& fallback_policy = fallback_params.fallback_policy_;
-  if (fallback_policy == envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT &&
+  if (fallback_policy == envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                             LbSubsetSelector::ANY_ENDPOINT &&
       selector_fallback_subset_any_ != nullptr) {
     return selector_fallback_subset_any_->priority_subset_->lb_->chooseHost(context);
-  } else if (fallback_policy ==
-                 envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET &&
+  } else if (fallback_policy == envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                    LbSubsetSelector::DEFAULT_SUBSET &&
              selector_fallback_subset_default_ != nullptr) {
     return selector_fallback_subset_default_->priority_subset_->lb_->chooseHost(context);
-  } else if (fallback_policy ==
-             envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET) {
+  } else if (fallback_policy == envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                    LbSubsetSelector::KEYS_SUBSET) {
     ASSERT(fallback_params.fallback_keys_subset_);
     auto filtered_context = std::make_unique<LoadBalancerContextWrapper>(
         context, *fallback_params.fallback_keys_subset_);
@@ -456,7 +461,7 @@ SubsetLoadBalancer::extractSubsetMetadata(const std::set<std::string>& subset_ke
                                           const Host& host) {
   std::vector<SubsetMetadata> all_kvs;
 
-  const envoy::api::v2::core::Metadata& metadata = *host.metadata();
+  const envoy::config::core::v3alpha::Metadata& metadata = *host.metadata();
   const auto& filter_it = metadata.filter_metadata().find(Config::MetadataFilters::get().ENVOY_LB);
   if (filter_it == metadata.filter_metadata().end()) {
     return all_kvs;
diff --git a/source/common/upstream/subset_lb.h b/source/common/upstream/subset_lb.h
index 7cdcb4139771..a9b3439606ff 100644
--- a/source/common/upstream/subset_lb.h
+++ b/source/common/upstream/subset_lb.h
@@ -6,7 +6,7 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/scope.h"
 #include "envoy/upstream/load_balancer.h"
@@ -27,9 +27,11 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
       LoadBalancerType lb_type, PrioritySet& priority_set, const PrioritySet* local_priority_set,
       ClusterStats& stats, Stats::Scope& scope, Runtime::Loader& runtime,
       Runtime::RandomGenerator& random, const LoadBalancerSubsetInfo& subsets,
-      const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>& lb_ring_hash_config,
-      const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig>& least_request_config,
-      const envoy::api::v2::Cluster::CommonLbConfig& common_config);
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>&
+          lb_ring_hash_config,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>&
+          least_request_config,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config);
   ~SubsetLoadBalancer() override;
 
   // Upstream::LoadBalancer
@@ -40,8 +42,8 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
   struct SubsetSelectorFallbackParams;
 
   void initSubsetSelectorMap();
-  void initSelectorFallbackSubset(const envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::
-                                      LbSubsetSelectorFallbackPolicy&);
+  void initSelectorFallbackSubset(const envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                      LbSubsetSelector::LbSubsetSelectorFallbackPolicy&);
   HostConstSharedPtr
   chooseHostForSelectorFallbackPolicy(const SubsetSelectorFallbackParams& fallback_params,
                                       LoadBalancerContext* context);
@@ -168,8 +170,8 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
   };
 
   struct SubsetSelectorFallbackParams {
-    envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-        fallback_policy_;
+    envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+        LbSubsetSelectorFallbackPolicy fallback_policy_;
     const std::set<std::string>* fallback_keys_subset_ = nullptr;
   };
 
@@ -225,15 +227,18 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
   std::string describeMetadata(const SubsetMetadata& kvs);
 
   const LoadBalancerType lb_type_;
-  const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig> lb_ring_hash_config_;
-  const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig> least_request_config_;
-  const envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>
+      lb_ring_hash_config_;
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>
+      least_request_config_;
+  const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   ClusterStats& stats_;
   Stats::Scope& scope_;
   Runtime::Loader& runtime_;
   Runtime::RandomGenerator& random_;
 
-  const envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy fallback_policy_;
+  const envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy
+      fallback_policy_;
   const SubsetMetadata default_subset_metadata_;
   const std::vector<SubsetSelectorPtr> subset_selectors_;
 
diff --git a/source/common/upstream/thread_aware_lb_impl.h b/source/common/upstream/thread_aware_lb_impl.h
index efe4d117c4e0..0135a7c3b15b 100644
--- a/source/common/upstream/thread_aware_lb_impl.h
+++ b/source/common/upstream/thread_aware_lb_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/upstream/load_balancer_impl.h"
 
@@ -38,9 +38,10 @@ class ThreadAwareLoadBalancerBase : public LoadBalancerBase, public ThreadAwareL
   }
 
 protected:
-  ThreadAwareLoadBalancerBase(const PrioritySet& priority_set, ClusterStats& stats,
-                              Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                              const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+  ThreadAwareLoadBalancerBase(
+      const PrioritySet& priority_set, ClusterStats& stats, Runtime::Loader& runtime,
+      Runtime::RandomGenerator& random,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
       : LoadBalancerBase(priority_set, stats, runtime, random, common_config),
         factory_(new LoadBalancerFactoryImpl(stats, random)) {}
 
diff --git a/source/common/upstream/transport_socket_match_impl.cc b/source/common/upstream/transport_socket_match_impl.cc
index 3077d01834e4..99aaf2936538 100644
--- a/source/common/upstream/transport_socket_match_impl.cc
+++ b/source/common/upstream/transport_socket_match_impl.cc
@@ -1,7 +1,7 @@
 #include "common/upstream/transport_socket_match_impl.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/server/transport_socket_config.h"
 
 #include "common/config/utility.h"
@@ -10,7 +10,8 @@ namespace Envoy {
 namespace Upstream {
 
 TransportSocketMatcherImpl::TransportSocketMatcherImpl(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Cluster_TransportSocketMatch>& socket_matches,
+    const Protobuf::RepeatedPtrField<
+        envoy::config::cluster::v3alpha::Cluster::TransportSocketMatch>& socket_matches,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Network::TransportSocketFactoryPtr& default_factory, Stats::Scope& stats_scope)
     : stats_scope_(stats_scope),
@@ -36,7 +37,7 @@ TransportSocketMatchStats TransportSocketMatcherImpl::generateStats(const std::s
 }
 
 TransportSocketMatcher::MatchData
-TransportSocketMatcherImpl::resolve(const envoy::api::v2::core::Metadata& metadata) const {
+TransportSocketMatcherImpl::resolve(const envoy::config::core::v3alpha::Metadata& metadata) const {
   for (const auto& match : matches_) {
     if (Config::Metadata::metadataLabelMatch(
             match.label_set, metadata,
diff --git a/source/common/upstream/transport_socket_match_impl.h b/source/common/upstream/transport_socket_match_impl.h
index dab8cf531ade..0b4a22fd3bc5 100644
--- a/source/common/upstream/transport_socket_match_impl.h
+++ b/source/common/upstream/transport_socket_match_impl.h
@@ -3,8 +3,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/server/transport_socket_config.h"
 #include "envoy/stats/scope.h"
@@ -33,12 +33,12 @@ class TransportSocketMatcherImpl : public Logger::Loggable<Logger::Id::upstream>
   };
 
   TransportSocketMatcherImpl(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::Cluster_TransportSocketMatch>&
-          socket_matches,
+      const Protobuf::RepeatedPtrField<
+          envoy::config::cluster::v3alpha::Cluster::TransportSocketMatch>& socket_matches,
       Server::Configuration::TransportSocketFactoryContext& factory_context,
       Network::TransportSocketFactoryPtr& default_factory, Stats::Scope& stats_scope);
 
-  MatchData resolve(const envoy::api::v2::core::Metadata& metadata) const override;
+  MatchData resolve(const envoy::config::core::v3alpha::Metadata& metadata) const override;
 
 protected:
   TransportSocketMatchStats generateStats(const std::string& prefix);
diff --git a/source/common/upstream/upstream_impl.cc b/source/common/upstream/upstream_impl.cc
index b7e20aed1647..9329debce38b 100644
--- a/source/common/upstream/upstream_impl.cc
+++ b/source/common/upstream/upstream_impl.cc
@@ -9,12 +9,12 @@
 #include <unordered_set>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/cluster/circuit_breaker.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/circuit_breaker.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/timer.h"
 #include "envoy/network/dns.h"
@@ -50,8 +50,8 @@ namespace Upstream {
 namespace {
 
 const Network::Address::InstanceConstSharedPtr
-getSourceAddress(const envoy::api::v2::Cluster& cluster,
-                 const envoy::api::v2::core::BindConfig& bind_config) {
+getSourceAddress(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                 const envoy::config::core::v3alpha::BindConfig& bind_config) {
   // The source address from cluster config takes precedence.
   if (cluster.upstream_bind_config().has_source_address()) {
     return Network::Address::resolveProtoSocketAddress(
@@ -65,12 +65,13 @@ getSourceAddress(const envoy::api::v2::Cluster& cluster,
   return nullptr;
 }
 
-uint64_t parseFeatures(const envoy::api::v2::Cluster& config) {
+uint64_t parseFeatures(const envoy::config::cluster::v3alpha::Cluster& config) {
   uint64_t features = 0;
   if (config.has_http2_protocol_options()) {
     features |= ClusterInfoImpl::Features::HTTP2;
   }
-  if (config.protocol_selection() == envoy::api::v2::Cluster::USE_DOWNSTREAM_PROTOCOL) {
+  if (config.protocol_selection() ==
+      envoy::config::cluster::v3alpha::Cluster::USE_DOWNSTREAM_PROTOCOL) {
     features |= ClusterInfoImpl::Features::USE_DOWNSTREAM_PROTOCOL;
   }
   if (config.close_connections_on_host_health_failure()) {
@@ -79,8 +80,9 @@ uint64_t parseFeatures(const envoy::api::v2::Cluster& config) {
   return features;
 }
 
-Network::TcpKeepaliveConfig parseTcpKeepaliveConfig(const envoy::api::v2::Cluster& config) {
-  const envoy::api::v2::core::TcpKeepalive& options =
+Network::TcpKeepaliveConfig
+parseTcpKeepaliveConfig(const envoy::config::cluster::v3alpha::Cluster& config) {
+  const envoy::config::core::v3alpha::TcpKeepalive& options =
       config.upstream_connection_options().tcp_keepalive();
   return Network::TcpKeepaliveConfig{
       PROTOBUF_GET_WRAPPED_OR_DEFAULT(options, keepalive_probes, absl::optional<uint32_t>()),
@@ -89,8 +91,8 @@ Network::TcpKeepaliveConfig parseTcpKeepaliveConfig(const envoy::api::v2::Cluste
 }
 
 const Network::ConnectionSocket::OptionsSharedPtr
-parseClusterSocketOptions(const envoy::api::v2::Cluster& config,
-                          const envoy::api::v2::core::BindConfig bind_config) {
+parseClusterSocketOptions(const envoy::config::cluster::v3alpha::Cluster& config,
+                          const envoy::config::core::v3alpha::BindConfig bind_config) {
   Network::ConnectionSocket::OptionsSharedPtr cluster_options =
       std::make_shared<Network::ConnectionSocket::Options>();
   // Cluster IP_FREEBIND settings, when set, will override the cluster manager wide settings.
@@ -150,10 +152,10 @@ createProtocolOptionsConfig(const std::string& name, const ProtobufWkt::Any& typ
 }
 
 std::map<std::string, ProtocolOptionsConfigConstSharedPtr>
-parseExtensionProtocolOptions(const envoy::api::v2::Cluster& config,
+parseExtensionProtocolOptions(const envoy::config::cluster::v3alpha::Cluster& config,
                               ProtobufMessage::ValidationVisitor& validation_visitor) {
   if (!config.typed_extension_protocol_options().empty() &&
-      !config.extension_protocol_options().empty()) {
+      !config.hidden_envoy_deprecated_extension_protocol_options().empty()) {
     throw EnvoyException("Only one of typed_extension_protocol_options or "
                          "extension_protocol_options can be specified");
   }
@@ -168,7 +170,7 @@ parseExtensionProtocolOptions(const envoy::api::v2::Cluster& config,
     }
   }
 
-  for (const auto& it : config.extension_protocol_options()) {
+  for (const auto& it : config.hidden_envoy_deprecated_extension_protocol_options()) {
     auto object = createProtocolOptionsConfig(it.first, ProtobufWkt::Any::default_instance(),
                                               it.second, validation_visitor);
     if (object != nullptr) {
@@ -225,14 +227,16 @@ HostVector filterHosts(const std::unordered_set<HostSharedPtr>& hosts,
 HostDescriptionImpl::HostDescriptionImpl(
     ClusterInfoConstSharedPtr cluster, const std::string& hostname,
     Network::Address::InstanceConstSharedPtr dest_address,
-    const envoy::api::v2::core::Metadata& metadata, const envoy::api::v2::core::Locality& locality,
-    const envoy::api::v2::endpoint::Endpoint::HealthCheckConfig& health_check_config,
+    const envoy::config::core::v3alpha::Metadata& metadata,
+    const envoy::config::core::v3alpha::Locality& locality,
+    const envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig& health_check_config,
     uint32_t priority)
     : cluster_(cluster), hostname_(hostname), address_(dest_address),
       canary_(Config::Metadata::metadataValue(metadata, Config::MetadataFilters::get().ENVOY_LB,
                                               Config::MetadataEnvoyLbKeys::get().CANARY)
                   .bool_value()),
-      metadata_(std::make_shared<envoy::api::v2::core::Metadata>(metadata)), locality_(locality),
+      metadata_(std::make_shared<envoy::config::core::v3alpha::Metadata>(metadata)),
+      locality_(locality),
       locality_zone_stat_name_(locality.zone(), cluster->statsScope().symbolTable()),
       priority_(priority), socket_factory_(resolveTransportSocketFactory(dest_address, metadata)) {
   if (health_check_config.port_value() != 0 && dest_address->type() != Network::Address::Type::Ip) {
@@ -249,7 +253,7 @@ HostDescriptionImpl::HostDescriptionImpl(
 
 Network::TransportSocketFactory& HostDescriptionImpl::resolveTransportSocketFactory(
     const Network::Address::InstanceConstSharedPtr& dest_address,
-    const envoy::api::v2::core::Metadata& metadata) {
+    const envoy::config::core::v3alpha::Metadata& metadata) {
   auto match = cluster_->transportSocketMatcher().resolve(metadata);
   match.stats_.total_match_count_.inc();
   ENVOY_LOG(debug, "transport socket match, socket {} selected for host with address {}",
@@ -265,16 +269,16 @@ Host::CreateConnectionData HostImpl::createConnection(
           shared_from_this()};
 }
 
-void HostImpl::setEdsHealthFlag(envoy::api::v2::core::HealthStatus health_status) {
+void HostImpl::setEdsHealthFlag(envoy::config::core::v3alpha::HealthStatus health_status) {
   switch (health_status) {
-  case envoy::api::v2::core::HealthStatus::UNHEALTHY:
+  case envoy::config::core::v3alpha::UNHEALTHY:
     FALLTHRU;
-  case envoy::api::v2::core::HealthStatus::DRAINING:
+  case envoy::config::core::v3alpha::DRAINING:
     FALLTHRU;
-  case envoy::api::v2::core::HealthStatus::TIMEOUT:
+  case envoy::config::core::v3alpha::TIMEOUT:
     healthFlagSet(Host::HealthFlag::FAILED_EDS_HEALTH);
     break;
-  case envoy::api::v2::core::HealthStatus::DEGRADED:
+  case envoy::config::core::v3alpha::DEGRADED:
     healthFlagSet(Host::HealthFlag::DEGRADED_EDS_HEALTH);
     break;
   default:;
@@ -624,9 +628,9 @@ class FactoryContextImpl : public Server::Configuration::CommonFactoryContext {
 };
 
 ClusterInfoImpl::ClusterInfoImpl(
-    const envoy::api::v2::Cluster& config, const envoy::api::v2::core::BindConfig& bind_config,
-    Runtime::Loader& runtime, TransportSocketMatcherPtr&& socket_matcher,
-    Stats::ScopePtr&& stats_scope, bool added_via_api,
+    const envoy::config::cluster::v3alpha::Cluster& config,
+    const envoy::config::core::v3alpha::BindConfig& bind_config, Runtime::Loader& runtime,
+    TransportSocketMatcherPtr&& socket_matcher, Stats::ScopePtr&& stats_scope, bool added_via_api,
     ProtobufMessage::ValidationVisitor& validation_visitor,
     Server::Configuration::TransportSocketFactoryContext& factory_context)
     : runtime_(runtime), name_(config.name()), type_(config.type()),
@@ -657,52 +661,53 @@ ClusterInfoImpl::ClusterInfoImpl(
       metadata_(config.metadata()), typed_metadata_(config.metadata()),
       common_lb_config_(config.common_lb_config()),
       cluster_socket_options_(parseClusterSocketOptions(config, bind_config)),
-      drain_connections_on_host_removal_(config.drain_connections_on_host_removal()),
+      drain_connections_on_host_removal_(config.ignore_health_on_host_removal()),
       warm_hosts_(!config.health_checks().empty() &&
                   common_lb_config_.ignore_new_hosts_until_first_hc()),
-      cluster_type_(config.has_cluster_type()
-                        ? absl::make_optional<envoy::api::v2::Cluster::CustomClusterType>(
-                              config.cluster_type())
-                        : absl::nullopt),
+      cluster_type_(
+          config.has_cluster_type()
+              ? absl::make_optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType>(
+                    config.cluster_type())
+              : absl::nullopt),
       factory_context_(
           std::make_unique<FactoryContextImpl>(*stats_scope_, runtime, factory_context)) {
   switch (config.lb_policy()) {
-  case envoy::api::v2::Cluster::ROUND_ROBIN:
+  case envoy::config::cluster::v3alpha::Cluster::ROUND_ROBIN:
     lb_type_ = LoadBalancerType::RoundRobin;
     break;
-  case envoy::api::v2::Cluster::LEAST_REQUEST:
+  case envoy::config::cluster::v3alpha::Cluster::LEAST_REQUEST:
     lb_type_ = LoadBalancerType::LeastRequest;
     break;
-  case envoy::api::v2::Cluster::RANDOM:
+  case envoy::config::cluster::v3alpha::Cluster::RANDOM:
     lb_type_ = LoadBalancerType::Random;
     break;
-  case envoy::api::v2::Cluster::RING_HASH:
+  case envoy::config::cluster::v3alpha::Cluster::RING_HASH:
     lb_type_ = LoadBalancerType::RingHash;
     break;
-  case envoy::api::v2::Cluster::ORIGINAL_DST_LB:
-    if (config.type() != envoy::api::v2::Cluster::ORIGINAL_DST) {
+  case envoy::config::cluster::v3alpha::Cluster::hidden_envoy_deprecated_ORIGINAL_DST_LB:
+    if (config.type() != envoy::config::cluster::v3alpha::Cluster::ORIGINAL_DST) {
       throw EnvoyException(
           fmt::format("cluster: LB policy {} is not valid for Cluster type {}. 'ORIGINAL_DST_LB' "
                       "is allowed only with cluster type 'ORIGINAL_DST'",
-                      envoy::api::v2::Cluster::LbPolicy_Name(config.lb_policy()),
-                      envoy::api::v2::Cluster_DiscoveryType_Name(config.type())));
+                      envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(config.lb_policy()),
+                      envoy::config::cluster::v3alpha::Cluster::DiscoveryType_Name(config.type())));
     }
     if (config.has_lb_subset_config()) {
       throw EnvoyException(
           fmt::format("cluster: LB policy {} cannot be combined with lb_subset_config",
-                      envoy::api::v2::Cluster::LbPolicy_Name(config.lb_policy())));
+                      envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(config.lb_policy())));
     }
 
     lb_type_ = LoadBalancerType::ClusterProvided;
     break;
-  case envoy::api::v2::Cluster::MAGLEV:
+  case envoy::config::cluster::v3alpha::Cluster::MAGLEV:
     lb_type_ = LoadBalancerType::Maglev;
     break;
-  case envoy::api::v2::Cluster::CLUSTER_PROVIDED:
+  case envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED:
     if (config.has_lb_subset_config()) {
       throw EnvoyException(
           fmt::format("cluster: LB policy {} cannot be combined with lb_subset_config",
-                      envoy::api::v2::Cluster::LbPolicy_Name(config.lb_policy())));
+                      envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(config.lb_policy())));
     }
 
     lb_type_ = LoadBalancerType::ClusterProvided;
@@ -718,7 +723,8 @@ ClusterInfoImpl::ClusterInfoImpl(
         name_));
   }
 
-  if (config.protocol_selection() == envoy::api::v2::Cluster::USE_CONFIGURED_PROTOCOL) {
+  if (config.protocol_selection() ==
+      envoy::config::cluster::v3alpha::Cluster::USE_CONFIGURED_PROTOCOL) {
     // Make sure multiple protocol configurations are not present
     if (config.has_http_protocol_options() && config.has_http2_protocol_options()) {
       throw EnvoyException(fmt::format("cluster: Both HTTP1 and HTTP2 options may only be "
@@ -737,7 +743,7 @@ ClusterInfoImpl::ClusterInfoImpl(
   }
 
   if (config.has_eds_cluster_config()) {
-    if (config.type() != envoy::api::v2::Cluster::EDS) {
+    if (config.type() != envoy::config::cluster::v3alpha::Cluster::EDS) {
       throw EnvoyException("eds_cluster_config set in a non-EDS cluster");
     }
     eds_service_name_ = config.eds_cluster_config().service_name();
@@ -778,16 +784,17 @@ ClusterInfoImpl::extensionProtocolOptions(const std::string& name) const {
 }
 
 Network::TransportSocketFactoryPtr createTransportSocketFactory(
-    const envoy::api::v2::Cluster& config,
+    const envoy::config::cluster::v3alpha::Cluster& config,
     Server::Configuration::TransportSocketFactoryContext& factory_context) {
   // If the cluster config doesn't have a transport socket configured, override with the default
   // transport socket implementation based on the tls_context. We copy by value first then override
   // if necessary.
   auto transport_socket = config.transport_socket();
   if (!config.has_transport_socket()) {
-    if (config.has_tls_context()) {
+    if (config.has_hidden_envoy_deprecated_tls_context()) {
       transport_socket.set_name(Extensions::TransportSockets::TransportSocketNames::get().Tls);
-      MessageUtil::jsonConvert(config.tls_context(), *transport_socket.mutable_config());
+      MessageUtil::jsonConvert(config.hidden_envoy_deprecated_tls_context(),
+                               *transport_socket.mutable_hidden_envoy_deprecated_config());
     } else {
       transport_socket.set_name(
           Extensions::TransportSockets::TransportSocketNames::get().RawBuffer);
@@ -818,7 +825,7 @@ ClusterInfoImpl::upstreamHttpProtocol(absl::optional<Http::Protocol> downstream_
 }
 
 ClusterImplBase::ClusterImplBase(
-    const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+    const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
     Stats::ScopePtr&& stats_scope, bool added_via_api)
     : init_manager_(fmt::format("Cluster {}", cluster.name())),
@@ -1012,12 +1019,12 @@ void ClusterImplBase::reloadHealthyHostsHelper(const HostSharedPtr&) {
 }
 
 const Network::Address::InstanceConstSharedPtr
-ClusterImplBase::resolveProtoAddress(const envoy::api::v2::core::Address& address) {
+ClusterImplBase::resolveProtoAddress(const envoy::config::core::v3alpha::Address& address) {
   try {
     return Network::Address::resolveProtoAddress(address);
   } catch (EnvoyException& e) {
-    if (info_->type() == envoy::api::v2::Cluster::STATIC ||
-        info_->type() == envoy::api::v2::Cluster::EDS) {
+    if (info_->type() == envoy::config::cluster::v3alpha::Cluster::STATIC ||
+        info_->type() == envoy::config::cluster::v3alpha::Cluster::EDS) {
       throw EnvoyException(fmt::format("{}. Consider setting resolver_name or setting cluster type "
                                        "to 'STRICT_DNS' or 'LOGICAL_DNS'",
                                        e.what()));
@@ -1027,21 +1034,20 @@ ClusterImplBase::resolveProtoAddress(const envoy::api::v2::core::Address& addres
 }
 
 void ClusterImplBase::validateEndpointsForZoneAwareRouting(
-    const envoy::api::v2::endpoint::LocalityLbEndpoints& endpoints) const {
+    const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& endpoints) const {
   if (local_cluster_ && endpoints.priority() > 0) {
     throw EnvoyException(
         fmt::format("Unexpected non-zero priority for local cluster '{}'.", info()->name()));
   }
 }
 
-ClusterInfoImpl::ResourceManagers::ResourceManagers(const envoy::api::v2::Cluster& config,
-                                                    Runtime::Loader& runtime,
-                                                    const std::string& cluster_name,
-                                                    Stats::Scope& stats_scope) {
-  managers_[enumToInt(ResourcePriority::Default)] = load(
-      config, runtime, cluster_name, stats_scope, envoy::api::v2::core::RoutingPriority::DEFAULT);
+ClusterInfoImpl::ResourceManagers::ResourceManagers(
+    const envoy::config::cluster::v3alpha::Cluster& config, Runtime::Loader& runtime,
+    const std::string& cluster_name, Stats::Scope& stats_scope) {
+  managers_[enumToInt(ResourcePriority::Default)] =
+      load(config, runtime, cluster_name, stats_scope, envoy::config::core::v3alpha::DEFAULT);
   managers_[enumToInt(ResourcePriority::High)] =
-      load(config, runtime, cluster_name, stats_scope, envoy::api::v2::core::RoutingPriority::HIGH);
+      load(config, runtime, cluster_name, stats_scope, envoy::config::core::v3alpha::HIGH);
 }
 
 ClusterCircuitBreakersStats
@@ -1057,11 +1063,10 @@ ClusterInfoImpl::generateCircuitBreakersStats(Stats::Scope& scope, const std::st
   }
 }
 
-ResourceManagerImplPtr
-ClusterInfoImpl::ResourceManagers::load(const envoy::api::v2::Cluster& config,
-                                        Runtime::Loader& runtime, const std::string& cluster_name,
-                                        Stats::Scope& stats_scope,
-                                        const envoy::api::v2::core::RoutingPriority& priority) {
+ResourceManagerImplPtr ClusterInfoImpl::ResourceManagers::load(
+    const envoy::config::cluster::v3alpha::Cluster& config, Runtime::Loader& runtime,
+    const std::string& cluster_name, Stats::Scope& stats_scope,
+    const envoy::config::core::v3alpha::RoutingPriority& priority) {
   uint64_t max_connections = 1024;
   uint64_t max_pending_requests = 1024;
   uint64_t max_requests = 1024;
@@ -1072,10 +1077,10 @@ ClusterInfoImpl::ResourceManagers::load(const envoy::api::v2::Cluster& config,
 
   std::string priority_name;
   switch (priority) {
-  case envoy::api::v2::core::RoutingPriority::DEFAULT:
+  case envoy::config::core::v3alpha::DEFAULT:
     priority_name = "default";
     break;
-  case envoy::api::v2::core::RoutingPriority::HIGH:
+  case envoy::config::core::v3alpha::HIGH:
     priority_name = "high";
     break;
   default:
@@ -1088,7 +1093,7 @@ ClusterInfoImpl::ResourceManagers::load(const envoy::api::v2::Cluster& config,
   const auto& thresholds = config.circuit_breakers().thresholds();
   const auto it = std::find_if(
       thresholds.cbegin(), thresholds.cend(),
-      [priority](const envoy::api::v2::cluster::CircuitBreakers::Thresholds& threshold) {
+      [priority](const envoy::config::cluster::v3alpha::CircuitBreakers::Thresholds& threshold) {
         return threshold.priority() == priority;
       });
   if (it != thresholds.cend()) {
@@ -1113,7 +1118,7 @@ PriorityStateManager::PriorityStateManager(ClusterImplBase& cluster,
     : parent_(cluster), local_info_node_(local_info.node()), update_cb_(update_cb) {}
 
 void PriorityStateManager::initializePriorityFor(
-    const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint) {
+    const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint) {
   const uint32_t priority = locality_lb_endpoint.priority();
   if (priority_state_.size() <= priority) {
     priority_state_.resize(priority + 1);
@@ -1129,8 +1134,8 @@ void PriorityStateManager::initializePriorityFor(
 
 void PriorityStateManager::registerHostForPriority(
     const std::string& hostname, Network::Address::InstanceConstSharedPtr address,
-    const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint,
-    const envoy::api::v2::endpoint::LbEndpoint& lb_endpoint) {
+    const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint,
+    const envoy::config::endpoint::v3alpha::LbEndpoint& lb_endpoint) {
   const HostSharedPtr host(
       new HostImpl(parent_.info(), hostname, address, lb_endpoint.metadata(),
                    lb_endpoint.load_balancing_weight().value(), locality_lb_endpoint.locality(),
@@ -1141,7 +1146,7 @@ void PriorityStateManager::registerHostForPriority(
 
 void PriorityStateManager::registerHostForPriority(
     const HostSharedPtr& host,
-    const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint) {
+    const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint) {
   const uint32_t priority = locality_lb_endpoint.priority();
   // Should be called after initializePriorityFor.
   ASSERT(priority_state_[priority].first);
@@ -1173,7 +1178,7 @@ void PriorityStateManager::updateClusterPrioritySet(
   }
 
   // We use std::map to guarantee a stable ordering for zone aware routing.
-  std::map<envoy::api::v2::core::Locality, HostVector, LocalityLess> hosts_per_locality;
+  std::map<envoy::config::core::v3alpha::Locality, HostVector, LocalityLess> hosts_per_locality;
 
   for (const HostSharedPtr& host : *hosts) {
     // Take into consideration when a non-EDS cluster has active health checking, i.e. to mark all
@@ -1415,18 +1420,19 @@ bool BaseDynamicClusterImpl::updateDynamicHostList(const HostVector& new_hosts,
   return hosts_changed;
 }
 
-Network::DnsLookupFamily getDnsLookupFamilyFromCluster(const envoy::api::v2::Cluster& cluster) {
+Network::DnsLookupFamily
+getDnsLookupFamilyFromCluster(const envoy::config::cluster::v3alpha::Cluster& cluster) {
   return getDnsLookupFamilyFromEnum(cluster.dns_lookup_family());
 }
 
 Network::DnsLookupFamily
-getDnsLookupFamilyFromEnum(envoy::api::v2::Cluster::DnsLookupFamily family) {
+getDnsLookupFamilyFromEnum(envoy::config::cluster::v3alpha::Cluster::DnsLookupFamily family) {
   switch (family) {
-  case envoy::api::v2::Cluster::V6_ONLY:
+  case envoy::config::cluster::v3alpha::Cluster::V6_ONLY:
     return Network::DnsLookupFamily::V6Only;
-  case envoy::api::v2::Cluster::V4_ONLY:
+  case envoy::config::cluster::v3alpha::Cluster::V4_ONLY:
     return Network::DnsLookupFamily::V4Only;
-  case envoy::api::v2::Cluster::AUTO:
+  case envoy::config::cluster::v3alpha::Cluster::AUTO:
     return Network::DnsLookupFamily::Auto;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
diff --git a/source/common/upstream/upstream_impl.h b/source/common/upstream/upstream_impl.h
index 4eeed9a7597c..9a292633b09e 100644
--- a/source/common/upstream/upstream_impl.h
+++ b/source/common/upstream/upstream_impl.h
@@ -11,11 +11,11 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/event/timer.h"
 #include "envoy/local_info/local_info.h"
@@ -70,9 +70,9 @@ class HostDescriptionImpl : virtual public HostDescription,
   HostDescriptionImpl(
       ClusterInfoConstSharedPtr cluster, const std::string& hostname,
       Network::Address::InstanceConstSharedPtr dest_address,
-      const envoy::api::v2::core::Metadata& metadata,
-      const envoy::api::v2::core::Locality& locality,
-      const envoy::api::v2::endpoint::Endpoint::HealthCheckConfig& health_check_config,
+      const envoy::config::core::v3alpha::Metadata& metadata,
+      const envoy::config::core::v3alpha::Locality& locality,
+      const envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig& health_check_config,
       uint32_t priority);
 
   Network::TransportSocketFactory& transportSocketFactory() const override {
@@ -88,13 +88,13 @@ class HostDescriptionImpl : virtual public HostDescription,
   // endpoints churning during a deploy of a large cluster). A possible improvement
   // would be to use TLS and post metadata updates from the main thread. This model would
   // possibly benefit other related and expensive computations too (e.g.: updating subsets).
-  const std::shared_ptr<envoy::api::v2::core::Metadata> metadata() const override {
+  const std::shared_ptr<envoy::config::core::v3alpha::Metadata> metadata() const override {
     absl::ReaderMutexLock lock(&metadata_mutex_);
     return metadata_;
   }
-  void metadata(const envoy::api::v2::core::Metadata& new_metadata) override {
+  void metadata(const envoy::config::core::v3alpha::Metadata& new_metadata) override {
     absl::WriterMutexLock lock(&metadata_mutex_);
-    metadata_ = std::make_shared<envoy::api::v2::core::Metadata>(new_metadata);
+    metadata_ = std::make_shared<envoy::config::core::v3alpha::Metadata>(new_metadata);
   }
 
   const ClusterInfo& cluster() const override { return *cluster_; }
@@ -122,7 +122,7 @@ class HostDescriptionImpl : virtual public HostDescription,
   Network::Address::InstanceConstSharedPtr healthCheckAddress() const override {
     return health_check_address_;
   }
-  const envoy::api::v2::core::Locality& locality() const override { return locality_; }
+  const envoy::config::core::v3alpha::Locality& locality() const override { return locality_; }
   Stats::StatName localityZoneStatName() const override {
     return locality_zone_stat_name_.statName();
   }
@@ -132,7 +132,7 @@ class HostDescriptionImpl : virtual public HostDescription,
 private:
   Network::TransportSocketFactory&
   resolveTransportSocketFactory(const Network::Address::InstanceConstSharedPtr& dest_address,
-                                const envoy::api::v2::core::Metadata& metadata);
+                                const envoy::config::core::v3alpha::Metadata& metadata);
 
 protected:
   ClusterInfoConstSharedPtr cluster_;
@@ -141,8 +141,9 @@ class HostDescriptionImpl : virtual public HostDescription,
   Network::Address::InstanceConstSharedPtr health_check_address_;
   std::atomic<bool> canary_;
   mutable absl::Mutex metadata_mutex_;
-  std::shared_ptr<envoy::api::v2::core::Metadata> metadata_ ABSL_GUARDED_BY(metadata_mutex_);
-  const envoy::api::v2::core::Locality locality_;
+  std::shared_ptr<envoy::config::core::v3alpha::Metadata>
+      metadata_ ABSL_GUARDED_BY(metadata_mutex_);
+  const envoy::config::core::v3alpha::Locality locality_;
   Stats::StatNameManagedStorage locality_zone_stat_name_;
   mutable HostStats stats_;
   Outlier::DetectorHostMonitorPtr outlier_detector_;
@@ -160,10 +161,10 @@ class HostImpl : public HostDescriptionImpl,
 public:
   HostImpl(ClusterInfoConstSharedPtr cluster, const std::string& hostname,
            Network::Address::InstanceConstSharedPtr address,
-           const envoy::api::v2::core::Metadata& metadata, uint32_t initial_weight,
-           const envoy::api::v2::core::Locality& locality,
-           const envoy::api::v2::endpoint::Endpoint::HealthCheckConfig& health_check_config,
-           uint32_t priority, const envoy::api::v2::core::HealthStatus health_status)
+           const envoy::config::core::v3alpha::Metadata& metadata, uint32_t initial_weight,
+           const envoy::config::core::v3alpha::Locality& locality,
+           const envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig& health_check_config,
+           uint32_t priority, const envoy::config::core::v3alpha::HealthStatus health_status)
       : HostDescriptionImpl(cluster, hostname, address, metadata, locality, health_check_config,
                             priority),
         used_(true) {
@@ -235,7 +236,7 @@ class HostImpl : public HostDescriptionImpl,
                    Network::TransportSocketOptionsSharedPtr transport_socket_options);
 
 private:
-  void setEdsHealthFlag(envoy::api::v2::core::HealthStatus health_status);
+  void setEdsHealthFlag(envoy::config::core::v3alpha::HealthStatus health_status);
 
   std::atomic<uint32_t> health_flags_{};
   ActiveHealthFailureType active_health_failure_type_{};
@@ -504,10 +505,11 @@ class PrioritySetImpl : public PrioritySet {
  */
 class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::Id::upstream> {
 public:
-  ClusterInfoImpl(const envoy::api::v2::Cluster& config,
-                  const envoy::api::v2::core::BindConfig& bind_config, Runtime::Loader& runtime,
-                  TransportSocketMatcherPtr&& socket_matcher, Stats::ScopePtr&& stats_scope,
-                  bool added_via_api, ProtobufMessage::ValidationVisitor& validation_visitor,
+  ClusterInfoImpl(const envoy::config::cluster::v3alpha::Cluster& config,
+                  const envoy::config::core::v3alpha::BindConfig& bind_config,
+                  Runtime::Loader& runtime, TransportSocketMatcherPtr&& socket_matcher,
+                  Stats::ScopePtr&& stats_scope, bool added_via_api,
+                  ProtobufMessage::ValidationVisitor& validation_visitor,
                   Server::Configuration::TransportSocketFactoryContext&);
 
   static ClusterStats generateStats(Stats::Scope& scope);
@@ -518,7 +520,7 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
 
   // Upstream::ClusterInfo
   bool addedViaApi() const override { return added_via_api_; }
-  const envoy::api::v2::Cluster::CommonLbConfig& lbConfig() const override {
+  const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& lbConfig() const override {
     return common_lb_config_;
   }
   std::chrono::milliseconds connectTimeout() const override { return connect_timeout_; }
@@ -534,19 +536,20 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
   ProtocolOptionsConfigConstSharedPtr
   extensionProtocolOptions(const std::string& name) const override;
   LoadBalancerType lbType() const override { return lb_type_; }
-  envoy::api::v2::Cluster::DiscoveryType type() const override { return type_; }
-  const absl::optional<envoy::api::v2::Cluster::CustomClusterType>& clusterType() const override {
+  envoy::config::cluster::v3alpha::Cluster::DiscoveryType type() const override { return type_; }
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType>&
+  clusterType() const override {
     return cluster_type_;
   }
-  const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig>&
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>&
   lbLeastRequestConfig() const override {
     return lb_least_request_config_;
   }
-  const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>&
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>&
   lbRingHashConfig() const override {
     return lb_ring_hash_config_;
   }
-  const absl::optional<envoy::api::v2::Cluster::OriginalDstLbConfig>&
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::OriginalDstLbConfig>&
   lbOriginalDstConfig() const override {
     return lb_original_dst_config_;
   }
@@ -563,7 +566,7 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
     return source_address_;
   };
   const LoadBalancerSubsetInfo& lbSubsetInfo() const override { return lb_subset_; }
-  const envoy::api::v2::core::Metadata& metadata() const override { return metadata_; }
+  const envoy::config::core::v3alpha::Metadata& metadata() const override { return metadata_; }
   const Envoy::Config::TypedMetadata& typedMetadata() const override { return typed_metadata_; }
 
   const Network::ConnectionSocket::OptionsSharedPtr& clusterSocketOptions() const override {
@@ -581,11 +584,13 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
 
 private:
   struct ResourceManagers {
-    ResourceManagers(const envoy::api::v2::Cluster& config, Runtime::Loader& runtime,
-                     const std::string& cluster_name, Stats::Scope& stats_scope);
-    ResourceManagerImplPtr load(const envoy::api::v2::Cluster& config, Runtime::Loader& runtime,
-                                const std::string& cluster_name, Stats::Scope& stats_scope,
-                                const envoy::api::v2::core::RoutingPriority& priority);
+    ResourceManagers(const envoy::config::cluster::v3alpha::Cluster& config,
+                     Runtime::Loader& runtime, const std::string& cluster_name,
+                     Stats::Scope& stats_scope);
+    ResourceManagerImplPtr load(const envoy::config::cluster::v3alpha::Cluster& config,
+                                Runtime::Loader& runtime, const std::string& cluster_name,
+                                Stats::Scope& stats_scope,
+                                const envoy::config::core::v3alpha::RoutingPriority& priority);
 
     using Managers = std::array<ResourceManagerImplPtr, NumResourcePriorities>;
 
@@ -594,7 +599,7 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
 
   Runtime::Loader& runtime_;
   const std::string name_;
-  const envoy::api::v2::Cluster::DiscoveryType type_;
+  const envoy::config::cluster::v3alpha::Cluster::DiscoveryType type_;
   const uint64_t max_requests_per_connection_;
   const uint32_t max_response_headers_count_;
   const std::chrono::milliseconds connect_timeout_;
@@ -613,19 +618,21 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
   const std::string maintenance_mode_runtime_key_;
   const Network::Address::InstanceConstSharedPtr source_address_;
   LoadBalancerType lb_type_;
-  absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig> lb_least_request_config_;
-  absl::optional<envoy::api::v2::Cluster::RingHashLbConfig> lb_ring_hash_config_;
-  absl::optional<envoy::api::v2::Cluster::OriginalDstLbConfig> lb_original_dst_config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>
+      lb_least_request_config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig> lb_ring_hash_config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::OriginalDstLbConfig>
+      lb_original_dst_config_;
   const bool added_via_api_;
   LoadBalancerSubsetInfoImpl lb_subset_;
-  const envoy::api::v2::core::Metadata metadata_;
+  const envoy::config::core::v3alpha::Metadata metadata_;
   Envoy::Config::TypedMetadataImpl<ClusterTypedMetadataFactory> typed_metadata_;
-  const envoy::api::v2::Cluster::CommonLbConfig common_lb_config_;
+  const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_lb_config_;
   const Network::ConnectionSocket::OptionsSharedPtr cluster_socket_options_;
   const bool drain_connections_on_host_removal_;
   const bool warm_hosts_;
   absl::optional<std::string> eds_service_name_;
-  const absl::optional<envoy::api::v2::Cluster::CustomClusterType> cluster_type_;
+  const absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType> cluster_type_;
   const std::unique_ptr<Server::Configuration::CommonFactoryContext> factory_context_;
   std::vector<Network::FilterFactoryCb> filter_factories_;
 };
@@ -636,7 +643,7 @@ class ClusterInfoImpl : public ClusterInfo, protected Logger::Loggable<Logger::I
  * context.
  */
 Network::TransportSocketFactoryPtr
-createTransportSocketFactory(const envoy::api::v2::Cluster& config,
+createTransportSocketFactory(const envoy::config::cluster::v3alpha::Cluster& config,
                              Server::Configuration::TransportSocketFactoryContext& factory_context);
 
 /**
@@ -669,7 +676,7 @@ class ClusterImplBase : public Cluster, protected Logger::Loggable<Logger::Id::u
    * @return Network::Address::InstanceConstSharedPtr the resolved address.
    */
   const Network::Address::InstanceConstSharedPtr
-  resolveProtoAddress(const envoy::api::v2::core::Address& address);
+  resolveProtoAddress(const envoy::config::core::v3alpha::Address& address);
 
   // Partitions the provided list of hosts into three new lists containing the healthy, degraded
   // and excluded hosts respectively.
@@ -692,7 +699,7 @@ class ClusterImplBase : public Cluster, protected Logger::Loggable<Logger::Id::u
   void initialize(std::function<void()> callback) override;
 
 protected:
-  ClusterImplBase(const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+  ClusterImplBase(const envoy::config::cluster::v3alpha::Cluster& cluster, Runtime::Loader& runtime,
                   Server::Configuration::TransportSocketFactoryContext& factory_context,
                   Stats::ScopePtr&& stats_scope, bool added_via_api);
 
@@ -737,7 +744,7 @@ class ClusterImplBase : public Cluster, protected Logger::Loggable<Logger::Id::u
   PrioritySetImpl priority_set_;
 
   void validateEndpointsForZoneAwareRouting(
-      const envoy::api::v2::endpoint::LocalityLbEndpoints& endpoints) const;
+      const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& endpoints) const;
 
 private:
   void finishInitialization();
@@ -763,23 +770,22 @@ class PriorityStateManager : protected Logger::Loggable<Logger::Id::upstream> {
                        PrioritySet::HostUpdateCb* update_cb);
 
   // Initializes the PriorityState vector based on the priority specified in locality_lb_endpoint.
-  void
-  initializePriorityFor(const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint);
+  void initializePriorityFor(
+      const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint);
 
   // Registers a host based on its address to the PriorityState based on the specified priority (the
   // priority is specified by locality_lb_endpoint.priority()).
   //
   // The specified health_checker_flag is used to set the registered-host's health-flag when the
   // lb_endpoint health status is unhealthy, draining or timeout.
-  void
-  registerHostForPriority(const std::string& hostname,
-                          Network::Address::InstanceConstSharedPtr address,
-                          const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint,
-                          const envoy::api::v2::endpoint::LbEndpoint& lb_endpoint);
+  void registerHostForPriority(
+      const std::string& hostname, Network::Address::InstanceConstSharedPtr address,
+      const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint,
+      const envoy::config::endpoint::v3alpha::LbEndpoint& lb_endpoint);
 
   void registerHostForPriority(
       const HostSharedPtr& host,
-      const envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoint);
+      const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoint);
 
   void
   updateClusterPrioritySet(const uint32_t priority, HostVectorSharedPtr&& current_hosts,
@@ -797,7 +803,7 @@ class PriorityStateManager : protected Logger::Loggable<Logger::Id::upstream> {
 private:
   ClusterImplBase& parent_;
   PriorityState priority_state_;
-  const envoy::api::v2::core::Node& local_info_node_;
+  const envoy::config::core::v3alpha::Node& local_info_node_;
   PrioritySet::HostUpdateCb* update_cb_;
 };
 
@@ -834,9 +840,10 @@ class BaseDynamicClusterImpl : public ClusterImplBase {
 /**
  * Utility function to get Dns from cluster/enum.
  */
-Network::DnsLookupFamily getDnsLookupFamilyFromCluster(const envoy::api::v2::Cluster& cluster);
 Network::DnsLookupFamily
-getDnsLookupFamilyFromEnum(envoy::api::v2::Cluster::DnsLookupFamily family);
+getDnsLookupFamilyFromCluster(const envoy::config::cluster::v3alpha::Cluster& cluster);
+Network::DnsLookupFamily
+getDnsLookupFamilyFromEnum(envoy::config::cluster::v3alpha::Cluster::DnsLookupFamily family);
 
 /**
  * Utility function to report upstream cx destroy metrics
diff --git a/source/exe/main_common.cc b/source/exe/main_common.cc
index 8bdc45025cd0..4b6aa2ab92c3 100644
--- a/source/exe/main_common.cc
+++ b/source/exe/main_common.cc
@@ -4,6 +4,8 @@
 #include <memory>
 #include <new>
 
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+
 #include "common/common/compiler_requirements.h"
 #include "common/common/perf_annotation.h"
 #include "common/network/utility.h"
@@ -29,7 +31,8 @@ Server::DrainManagerPtr ProdComponentFactory::createDrainManager(Server::Instanc
   // The global drain manager only triggers on listener modification, which effectively is
   // hot restart at the global level. The per-listener drain managers decide whether to
   // to include /healthcheck/fail status.
-  return std::make_unique<Server::DrainManagerImpl>(server, envoy::api::v2::Listener::MODIFY_ONLY);
+  return std::make_unique<Server::DrainManagerImpl>(
+      server, envoy::config::listener::v3alpha::Listener::MODIFY_ONLY);
 }
 
 Runtime::LoaderPtr ProdComponentFactory::createRuntime(Server::Instance& server,
diff --git a/source/extensions/access_loggers/file/BUILD b/source/extensions/access_loggers/file/BUILD
index 5901b7a5ce9a..60a305f95e14 100644
--- a/source/extensions/access_loggers/file/BUILD
+++ b/source/extensions/access_loggers/file/BUILD
@@ -33,6 +33,6 @@ envoy_cc_extension(
         "//source/common/access_log:access_log_formatter_lib",
         "//source/common/protobuf",
         "//source/extensions/access_loggers:well_known_names",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/access_loggers/file/config.cc b/source/extensions/access_loggers/file/config.cc
index 556037f5f65a..13bc52ae0b64 100644
--- a/source/extensions/access_loggers/file/config.cc
+++ b/source/extensions/access_loggers/file/config.cc
@@ -3,8 +3,8 @@
 #include <memory>
 #include <unordered_map>
 
-#include "envoy/config/accesslog/v2/file.pb.h"
-#include "envoy/config/accesslog/v2/file.pb.validate.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/file.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/file.pb.validate.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 
@@ -24,25 +24,29 @@ AccessLog::InstanceSharedPtr
 FileAccessLogFactory::createAccessLogInstance(const Protobuf::Message& config,
                                               AccessLog::FilterPtr&& filter,
                                               Server::Configuration::FactoryContext& context) {
-  const auto& fal_config =
-      MessageUtil::downcastAndValidate<const envoy::config::accesslog::v2::FileAccessLog&>(
-          config, context.messageValidationVisitor());
+  const auto& fal_config = MessageUtil::downcastAndValidate<
+      const envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog&>(
+      config, context.messageValidationVisitor());
   AccessLog::FormatterPtr formatter;
 
-  if (fal_config.access_log_format_case() == envoy::config::accesslog::v2::FileAccessLog::kFormat ||
+  if (fal_config.access_log_format_case() == envoy::extensions::access_loggers::grpc::v3alpha::
+                                                 FileAccessLog::AccessLogFormatCase::kFormat ||
       fal_config.access_log_format_case() ==
-          envoy::config::accesslog::v2::FileAccessLog::ACCESS_LOG_FORMAT_NOT_SET) {
+          envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog::AccessLogFormatCase::
+              ACCESS_LOG_FORMAT_NOT_SET) {
     if (fal_config.format().empty()) {
       formatter = AccessLog::AccessLogFormatUtils::defaultAccessLogFormatter();
     } else {
       formatter = std::make_unique<AccessLog::FormatterImpl>(fal_config.format());
     }
   } else if (fal_config.access_log_format_case() ==
-             envoy::config::accesslog::v2::FileAccessLog::kJsonFormat) {
+             envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog::AccessLogFormatCase::
+                 kJsonFormat) {
     auto json_format_map = this->convertJsonFormatToMap(fal_config.json_format());
     formatter = std::make_unique<AccessLog::JsonFormatterImpl>(json_format_map, false);
   } else if (fal_config.access_log_format_case() ==
-             envoy::config::accesslog::v2::FileAccessLog::kTypedJsonFormat) {
+             envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog::AccessLogFormatCase::
+                 kTypedJsonFormat) {
     auto json_format_map = this->convertJsonFormatToMap(fal_config.typed_json_format());
     formatter = std::make_unique<AccessLog::JsonFormatterImpl>(json_format_map, true);
   } else {
@@ -56,7 +60,8 @@ FileAccessLogFactory::createAccessLogInstance(const Protobuf::Message& config,
 }
 
 ProtobufTypes::MessagePtr FileAccessLogFactory::createEmptyConfigProto() {
-  return ProtobufTypes::MessagePtr{new envoy::config::accesslog::v2::FileAccessLog()};
+  return ProtobufTypes::MessagePtr{
+      new envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog()};
 }
 
 std::string FileAccessLogFactory::name() const { return AccessLogNames::get().File; }
diff --git a/source/extensions/access_loggers/grpc/BUILD b/source/extensions/access_loggers/grpc/BUILD
index 3c28905d976d..3a96e7ead41c 100644
--- a/source/extensions/access_loggers/grpc/BUILD
+++ b/source/extensions/access_loggers/grpc/BUILD
@@ -37,9 +37,9 @@ envoy_cc_library(
         "//source/common/grpc:async_client_lib",
         "//source/common/grpc:typed_async_client_lib",
         "//source/extensions/access_loggers/common:access_log_base",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/accesslog/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -52,8 +52,8 @@ envoy_cc_library(
         "//source/common/network:utility_lib",
         "//source/common/stream_info:stream_info_lib",
         "//source/common/stream_info:utility_lib",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -64,9 +64,9 @@ envoy_cc_library(
     deps = [
         ":grpc_access_log_lib",
         ":grpc_access_log_utils",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -77,8 +77,8 @@ envoy_cc_library(
     deps = [
         ":grpc_access_log_lib",
         ":grpc_access_log_utils",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -105,7 +105,7 @@ envoy_cc_extension(
         "//source/extensions/access_loggers:well_known_names",
         "//source/extensions/access_loggers/grpc:grpc_access_log_proto_descriptors_lib",
         "//source/extensions/access_loggers/grpc:http_grpc_access_log_lib",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -122,6 +122,6 @@ envoy_cc_extension(
         "//source/extensions/access_loggers:well_known_names",
         "//source/extensions/access_loggers/grpc:grpc_access_log_proto_descriptors_lib",
         "//source/extensions/access_loggers/grpc:tcp_grpc_access_log_lib",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/access_loggers/grpc/grpc_access_log_impl.cc b/source/extensions/access_loggers/grpc/grpc_access_log_impl.cc
index 6c3cc10e1389..917508d846cb 100644
--- a/source/extensions/access_loggers/grpc/grpc_access_log_impl.cc
+++ b/source/extensions/access_loggers/grpc/grpc_access_log_impl.cc
@@ -1,7 +1,7 @@
 #include "extensions/access_loggers/grpc/grpc_access_log_impl.h"
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/upstream/upstream.h"
 
 #include "common/common/assert.h"
@@ -38,7 +38,7 @@ GrpcAccessLoggerImpl::GrpcAccessLoggerImpl(Grpc::RawAsyncClientPtr&& client, std
   flush_timer_->enableTimer(buffer_flush_interval_msec_);
 }
 
-void GrpcAccessLoggerImpl::log(envoy::data::accesslog::v2::HTTPAccessLogEntry&& entry) {
+void GrpcAccessLoggerImpl::log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry&& entry) {
   approximate_message_size_bytes_ += entry.ByteSizeLong();
   message_.mutable_http_logs()->mutable_log_entry()->Add(std::move(entry));
   if (approximate_message_size_bytes_ >= buffer_size_bytes_) {
@@ -46,7 +46,7 @@ void GrpcAccessLoggerImpl::log(envoy::data::accesslog::v2::HTTPAccessLogEntry&&
   }
 }
 
-void GrpcAccessLoggerImpl::log(envoy::data::accesslog::v2::TCPAccessLogEntry&& entry) {
+void GrpcAccessLoggerImpl::log(envoy::data::accesslog::v3alpha::TCPAccessLogEntry&& entry) {
   approximate_message_size_bytes_ += entry.ByteSizeLong();
   message_.mutable_tcp_logs()->mutable_log_entry()->Add(std::move(entry));
   if (approximate_message_size_bytes_ >= buffer_size_bytes_) {
@@ -98,7 +98,7 @@ GrpcAccessLoggerCacheImpl::GrpcAccessLoggerCacheImpl(Grpc::AsyncClientManager& a
 }
 
 GrpcAccessLoggerSharedPtr GrpcAccessLoggerCacheImpl::getOrCreateLogger(
-    const envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& config,
+    const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig& config,
     GrpcAccessLoggerType logger_type) {
   // TODO(euroelessar): Consider cleaning up loggers.
   auto& cache = tls_slot_->getTyped<ThreadLocalCache>();
diff --git a/source/extensions/access_loggers/grpc/grpc_access_log_impl.h b/source/extensions/access_loggers/grpc/grpc_access_log_impl.h
index ddaadb883c85..e6f06fb83227 100644
--- a/source/extensions/access_loggers/grpc/grpc_access_log_impl.h
+++ b/source/extensions/access_loggers/grpc/grpc_access_log_impl.h
@@ -3,12 +3,12 @@
 #include <unordered_map>
 #include <vector>
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/local_info/local_info.h"
-#include "envoy/service/accesslog/v2/als.pb.h"
+#include "envoy/service/accesslog/v3alpha/als.pb.h"
 #include "envoy/singleton/instance.h"
 #include "envoy/thread_local/thread_local.h"
 
@@ -35,13 +35,13 @@ class GrpcAccessLogger {
    * Log http access entry.
    * @param entry supplies the access log to send.
    */
-  virtual void log(envoy::data::accesslog::v2::HTTPAccessLogEntry&& entry) PURE;
+  virtual void log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry&& entry) PURE;
 
   /**
    * Log tcp access entry.
    * @param entry supplies the access log to send.
    */
-  virtual void log(envoy::data::accesslog::v2::TCPAccessLogEntry&& entry) PURE;
+  virtual void log(envoy::data::accesslog::v3alpha::TCPAccessLogEntry&& entry) PURE;
 };
 
 using GrpcAccessLoggerSharedPtr = std::shared_ptr<GrpcAccessLogger>;
@@ -61,9 +61,9 @@ class GrpcAccessLoggerCache {
    * @param config supplies the configuration for the logger.
    * @return GrpcAccessLoggerSharedPtr ready for logging requests.
    */
-  virtual GrpcAccessLoggerSharedPtr
-  getOrCreateLogger(const ::envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& config,
-                    GrpcAccessLoggerType logger_type) PURE;
+  virtual GrpcAccessLoggerSharedPtr getOrCreateLogger(
+      const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig& config,
+      GrpcAccessLoggerType logger_type) PURE;
 };
 
 using GrpcAccessLoggerCacheSharedPtr = std::shared_ptr<GrpcAccessLoggerCache>;
@@ -76,37 +76,37 @@ class GrpcAccessLoggerImpl : public GrpcAccessLogger {
                        const LocalInfo::LocalInfo& local_info);
 
   // Extensions::AccessLoggers::GrpcCommon::GrpcAccessLogger
-  void log(envoy::data::accesslog::v2::HTTPAccessLogEntry&& entry) override;
-  void log(envoy::data::accesslog::v2::TCPAccessLogEntry&& entry) override;
+  void log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry&& entry) override;
+  void log(envoy::data::accesslog::v3alpha::TCPAccessLogEntry&& entry) override;
 
 private:
-  struct LocalStream
-      : public Grpc::AsyncStreamCallbacks<envoy::service::accesslog::v2::StreamAccessLogsResponse> {
+  struct LocalStream : public Grpc::AsyncStreamCallbacks<
+                           envoy::service::accesslog::v3alpha::StreamAccessLogsResponse> {
     LocalStream(GrpcAccessLoggerImpl& parent) : parent_(parent) {}
 
     // Grpc::AsyncStreamCallbacks
     void onCreateInitialMetadata(Http::HeaderMap&) override {}
     void onReceiveInitialMetadata(Http::HeaderMapPtr&&) override {}
     void onReceiveMessage(
-        std::unique_ptr<envoy::service::accesslog::v2::StreamAccessLogsResponse>&&) override {}
+        std::unique_ptr<envoy::service::accesslog::v3alpha::StreamAccessLogsResponse>&&) override {}
     void onReceiveTrailingMetadata(Http::HeaderMapPtr&&) override {}
     void onRemoteClose(Grpc::Status::GrpcStatus status, const std::string& message) override;
 
     GrpcAccessLoggerImpl& parent_;
-    Grpc::AsyncStream<envoy::service::accesslog::v2::StreamAccessLogsMessage> stream_{};
+    Grpc::AsyncStream<envoy::service::accesslog::v3alpha::StreamAccessLogsMessage> stream_{};
   };
 
   void flush();
 
-  Grpc::AsyncClient<envoy::service::accesslog::v2::StreamAccessLogsMessage,
-                    envoy::service::accesslog::v2::StreamAccessLogsResponse>
+  Grpc::AsyncClient<envoy::service::accesslog::v3alpha::StreamAccessLogsMessage,
+                    envoy::service::accesslog::v3alpha::StreamAccessLogsResponse>
       client_;
   const std::string log_name_;
   const std::chrono::milliseconds buffer_flush_interval_msec_;
   const Event::TimerPtr flush_timer_;
   const uint64_t buffer_size_bytes_;
   uint64_t approximate_message_size_bytes_ = 0;
-  envoy::service::accesslog::v2::StreamAccessLogsMessage message_;
+  envoy::service::accesslog::v3alpha::StreamAccessLogsMessage message_;
   absl::optional<LocalStream> stream_;
   const LocalInfo::LocalInfo& local_info_;
 };
@@ -117,9 +117,9 @@ class GrpcAccessLoggerCacheImpl : public Singleton::Instance, public GrpcAccessL
                             ThreadLocal::SlotAllocator& tls,
                             const LocalInfo::LocalInfo& local_info);
 
-  GrpcAccessLoggerSharedPtr
-  getOrCreateLogger(const ::envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& config,
-                    GrpcAccessLoggerType logger_type) override;
+  GrpcAccessLoggerSharedPtr getOrCreateLogger(
+      const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig& config,
+      GrpcAccessLoggerType logger_type) override;
 
 private:
   /**
diff --git a/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc b/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc
index 58b0c03ae8bc..bdf4b61de232 100644
--- a/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc
+++ b/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc
@@ -1,7 +1,7 @@
 #include "extensions/access_loggers/grpc/grpc_access_log_utils.h"
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/upstream/upstream.h"
 
 #include "common/network/utility.h"
@@ -13,7 +13,7 @@ namespace GrpcCommon {
 
 namespace {
 
-using namespace envoy::data::accesslog::v2;
+using namespace envoy::data::accesslog::v3alpha;
 
 // Helper function to convert from a BoringSSL textual representation of the
 // TLS version to the corresponding enum value used in gRPC access logs.
@@ -34,7 +34,7 @@ TLSProperties_TLSVersion tlsVersionStringToEnum(const std::string& tls_version)
 } // namespace
 
 void Utility::responseFlagsToAccessLogResponseFlags(
-    envoy::data::accesslog::v2::AccessLogCommon& common_access_log,
+    envoy::data::accesslog::v3alpha::AccessLogCommon& common_access_log,
     const StreamInfo::StreamInfo& stream_info) {
 
   static_assert(StreamInfo::ResponseFlag::LastFlag == 0x40000,
@@ -90,7 +90,7 @@ void Utility::responseFlagsToAccessLogResponseFlags(
 
   if (stream_info.hasResponseFlag(StreamInfo::ResponseFlag::UnauthorizedExternalService)) {
     common_access_log.mutable_response_flags()->mutable_unauthorized_details()->set_reason(
-        envoy::data::accesslog::v2::ResponseFlags::Unauthorized::EXTERNAL_SERVICE);
+        envoy::data::accesslog::v3alpha::ResponseFlags::Unauthorized::EXTERNAL_SERVICE);
   }
 
   if (stream_info.hasResponseFlag(StreamInfo::ResponseFlag::RateLimitServiceError)) {
@@ -119,9 +119,9 @@ void Utility::responseFlagsToAccessLogResponseFlags(
 }
 
 void Utility::extractCommonAccessLogProperties(
-    envoy::data::accesslog::v2::AccessLogCommon& common_access_log,
+    envoy::data::accesslog::v3alpha::AccessLogCommon& common_access_log,
     const StreamInfo::StreamInfo& stream_info,
-    const envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& config) {
+    const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig& config) {
   // TODO(mattklein123): Populate sample_rate field.
   if (stream_info.downstreamRemoteAddress() != nullptr) {
     Network::Utility::addressToProtobufAddress(
diff --git a/source/extensions/access_loggers/grpc/grpc_access_log_utils.h b/source/extensions/access_loggers/grpc/grpc_access_log_utils.h
index c6e74bfcbbaa..d0cde876668f 100644
--- a/source/extensions/access_loggers/grpc/grpc_access_log_utils.h
+++ b/source/extensions/access_loggers/grpc/grpc_access_log_utils.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/stream_info/stream_info.h"
 
 namespace Envoy {
@@ -12,12 +12,13 @@ namespace GrpcCommon {
 class Utility {
 public:
   static void extractCommonAccessLogProperties(
-      envoy::data::accesslog::v2::AccessLogCommon& common_access_log,
+      envoy::data::accesslog::v3alpha::AccessLogCommon& common_access_log,
       const StreamInfo::StreamInfo& stream_info,
-      const envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& filter_states_to_log);
+      const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig&
+          filter_states_to_log);
 
   static void responseFlagsToAccessLogResponseFlags(
-      envoy::data::accesslog::v2::AccessLogCommon& common_access_log,
+      envoy::data::accesslog::v3alpha::AccessLogCommon& common_access_log,
       const StreamInfo::StreamInfo& stream_info);
 };
 
diff --git a/source/extensions/access_loggers/grpc/http_config.cc b/source/extensions/access_loggers/grpc/http_config.cc
index 89a050985b79..37eb3037f6e0 100644
--- a/source/extensions/access_loggers/grpc/http_config.cc
+++ b/source/extensions/access_loggers/grpc/http_config.cc
@@ -1,7 +1,7 @@
 #include "extensions/access_loggers/grpc/http_config.h"
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/config/accesslog/v2/als.pb.validate.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.validate.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 
@@ -27,7 +27,7 @@ HttpGrpcAccessLogFactory::createAccessLogInstance(const Protobuf::Message& confi
   GrpcCommon::validateProtoDescriptors();
 
   const auto& proto_config = MessageUtil::downcastAndValidate<
-      const envoy::config::accesslog::v2::HttpGrpcAccessLogConfig&>(
+      const envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig&>(
       config, context.messageValidationVisitor());
 
   return std::make_shared<HttpGrpcAccessLog>(
@@ -36,7 +36,8 @@ HttpGrpcAccessLogFactory::createAccessLogInstance(const Protobuf::Message& confi
 }
 
 ProtobufTypes::MessagePtr HttpGrpcAccessLogFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::accesslog::v2::HttpGrpcAccessLogConfig>();
+  return std::make_unique<
+      envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig>();
 }
 
 std::string HttpGrpcAccessLogFactory::name() const { return AccessLogNames::get().HttpGrpc; }
diff --git a/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.cc b/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.cc
index e6fc6d3bb9b4..e8818c015be7 100644
--- a/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.cc
+++ b/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.cc
@@ -1,8 +1,8 @@
 #include "extensions/access_loggers/grpc/http_grpc_access_log_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 
 #include "common/common/assert.h"
 #include "common/network/utility.h"
@@ -19,10 +19,10 @@ HttpGrpcAccessLog::ThreadLocalLogger::ThreadLocalLogger(
     GrpcCommon::GrpcAccessLoggerSharedPtr logger)
     : logger_(std::move(logger)) {}
 
-HttpGrpcAccessLog::HttpGrpcAccessLog(AccessLog::FilterPtr&& filter,
-                                     envoy::config::accesslog::v2::HttpGrpcAccessLogConfig config,
-                                     ThreadLocal::SlotAllocator& tls,
-                                     GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache)
+HttpGrpcAccessLog::HttpGrpcAccessLog(
+    AccessLog::FilterPtr&& filter,
+    envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig config,
+    ThreadLocal::SlotAllocator& tls, GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache)
     : Common::ImplBase(std::move(filter)), config_(std::move(config)),
       tls_slot_(tls.allocateSlot()), access_logger_cache_(std::move(access_logger_cache)) {
   for (const auto& header : config_.additional_request_headers_to_log()) {
@@ -49,23 +49,23 @@ void HttpGrpcAccessLog::emitLog(const Http::HeaderMap& request_headers,
                                 const StreamInfo::StreamInfo& stream_info) {
   // Common log properties.
   // TODO(mattklein123): Populate sample_rate field.
-  envoy::data::accesslog::v2::HTTPAccessLogEntry log_entry;
+  envoy::data::accesslog::v3alpha::HTTPAccessLogEntry log_entry;
   GrpcCommon::Utility::extractCommonAccessLogProperties(*log_entry.mutable_common_properties(),
                                                         stream_info, config_.common_config());
 
   if (stream_info.protocol()) {
     switch (stream_info.protocol().value()) {
     case Http::Protocol::Http10:
-      log_entry.set_protocol_version(envoy::data::accesslog::v2::HTTPAccessLogEntry::HTTP10);
+      log_entry.set_protocol_version(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry::HTTP10);
       break;
     case Http::Protocol::Http11:
-      log_entry.set_protocol_version(envoy::data::accesslog::v2::HTTPAccessLogEntry::HTTP11);
+      log_entry.set_protocol_version(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry::HTTP11);
       break;
     case Http::Protocol::Http2:
-      log_entry.set_protocol_version(envoy::data::accesslog::v2::HTTPAccessLogEntry::HTTP2);
+      log_entry.set_protocol_version(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry::HTTP2);
       break;
     case Http::Protocol::Http3:
-      log_entry.set_protocol_version(envoy::data::accesslog::v2::HTTPAccessLogEntry::HTTP3);
+      log_entry.set_protocol_version(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry::HTTP3);
       break;
     }
   }
@@ -105,9 +105,9 @@ void HttpGrpcAccessLog::emitLog(const Http::HeaderMap& request_headers,
   request_properties->set_request_headers_bytes(request_headers.byteSize());
   request_properties->set_request_body_bytes(stream_info.bytesReceived());
   if (request_headers.Method() != nullptr) {
-    envoy::api::v2::core::RequestMethod method =
-        envoy::api::v2::core::RequestMethod::METHOD_UNSPECIFIED;
-    envoy::api::v2::core::RequestMethod_Parse(
+    envoy::config::core::v3alpha::RequestMethod method =
+        envoy::config::core::v3alpha::METHOD_UNSPECIFIED;
+    envoy::config::core::v3alpha::RequestMethod_Parse(
         std::string(request_headers.Method()->value().getStringView()), &method);
     request_properties->set_request_method(method);
   }
diff --git a/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h b/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h
index 02b9c6af95aa..6bc0cdda1d88 100644
--- a/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h
+++ b/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h
@@ -3,7 +3,7 @@
 #include <unordered_map>
 #include <vector>
 
-#include "envoy/config/accesslog/v2/als.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/local_info/local_info.h"
@@ -27,10 +27,11 @@ namespace HttpGrpc {
  */
 class HttpGrpcAccessLog : public Common::ImplBase {
 public:
-  HttpGrpcAccessLog(AccessLog::FilterPtr&& filter,
-                    envoy::config::accesslog::v2::HttpGrpcAccessLogConfig config,
-                    ThreadLocal::SlotAllocator& tls,
-                    GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache);
+  HttpGrpcAccessLog(
+      AccessLog::FilterPtr&& filter,
+      envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig config,
+      ThreadLocal::SlotAllocator& tls,
+      GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache);
 
 private:
   /**
@@ -47,7 +48,7 @@ class HttpGrpcAccessLog : public Common::ImplBase {
                const Http::HeaderMap& response_trailers,
                const StreamInfo::StreamInfo& stream_info) override;
 
-  const envoy::config::accesslog::v2::HttpGrpcAccessLogConfig config_;
+  const envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig config_;
   const ThreadLocal::SlotPtr tls_slot_;
   const GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache_;
   std::vector<Http::LowerCaseString> request_headers_to_log_;
diff --git a/source/extensions/access_loggers/grpc/tcp_config.cc b/source/extensions/access_loggers/grpc/tcp_config.cc
index 6af51e20b4bf..f117e018d491 100644
--- a/source/extensions/access_loggers/grpc/tcp_config.cc
+++ b/source/extensions/access_loggers/grpc/tcp_config.cc
@@ -1,7 +1,7 @@
 #include "extensions/access_loggers/grpc/tcp_config.h"
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/config/accesslog/v2/als.pb.validate.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.validate.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 
@@ -26,16 +26,17 @@ TcpGrpcAccessLogFactory::createAccessLogInstance(const Protobuf::Message& config
                                                  Server::Configuration::FactoryContext& context) {
   GrpcCommon::validateProtoDescriptors();
 
-  const auto& proto_config =
-      MessageUtil::downcastAndValidate<const envoy::config::accesslog::v2::TcpGrpcAccessLogConfig&>(
-          config, context.messageValidationVisitor());
+  const auto& proto_config = MessageUtil::downcastAndValidate<
+      const envoy::extensions::access_loggers::grpc::v3alpha::TcpGrpcAccessLogConfig&>(
+      config, context.messageValidationVisitor());
 
   return std::make_shared<TcpGrpcAccessLog>(std::move(filter), proto_config, context.threadLocal(),
                                             GrpcCommon::getGrpcAccessLoggerCacheSingleton(context));
 }
 
 ProtobufTypes::MessagePtr TcpGrpcAccessLogFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::accesslog::v2::TcpGrpcAccessLogConfig>();
+  return std::make_unique<
+      envoy::extensions::access_loggers::grpc::v3alpha::TcpGrpcAccessLogConfig>();
 }
 
 std::string TcpGrpcAccessLogFactory::name() const { return AccessLogNames::get().TcpGrpc; }
diff --git a/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.cc b/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.cc
index 6b41141c36af..04993d0c7477 100644
--- a/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.cc
+++ b/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.cc
@@ -1,7 +1,7 @@
 #include "extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h"
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 
 #include "common/common/assert.h"
 #include "common/network/utility.h"
@@ -17,10 +17,10 @@ namespace TcpGrpc {
 TcpGrpcAccessLog::ThreadLocalLogger::ThreadLocalLogger(GrpcCommon::GrpcAccessLoggerSharedPtr logger)
     : logger_(std::move(logger)) {}
 
-TcpGrpcAccessLog::TcpGrpcAccessLog(AccessLog::FilterPtr&& filter,
-                                   envoy::config::accesslog::v2::TcpGrpcAccessLogConfig config,
-                                   ThreadLocal::SlotAllocator& tls,
-                                   GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache)
+TcpGrpcAccessLog::TcpGrpcAccessLog(
+    AccessLog::FilterPtr&& filter,
+    envoy::extensions::access_loggers::grpc::v3alpha::TcpGrpcAccessLogConfig config,
+    ThreadLocal::SlotAllocator& tls, GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache)
     : Common::ImplBase(std::move(filter)), config_(std::move(config)),
       tls_slot_(tls.allocateSlot()), access_logger_cache_(std::move(access_logger_cache)) {
   tls_slot_->set([this](Event::Dispatcher&) {
@@ -32,11 +32,11 @@ TcpGrpcAccessLog::TcpGrpcAccessLog(AccessLog::FilterPtr&& filter,
 void TcpGrpcAccessLog::emitLog(const Http::HeaderMap&, const Http::HeaderMap&,
                                const Http::HeaderMap&, const StreamInfo::StreamInfo& stream_info) {
   // Common log properties.
-  envoy::data::accesslog::v2::TCPAccessLogEntry log_entry;
+  envoy::data::accesslog::v3alpha::TCPAccessLogEntry log_entry;
   GrpcCommon::Utility::extractCommonAccessLogProperties(*log_entry.mutable_common_properties(),
                                                         stream_info, config_.common_config());
 
-  envoy::data::accesslog::v2::ConnectionProperties& connection_properties =
+  envoy::data::accesslog::v3alpha::ConnectionProperties& connection_properties =
       *log_entry.mutable_connection_properties();
   connection_properties.set_received_bytes(stream_info.bytesReceived());
   connection_properties.set_sent_bytes(stream_info.bytesSent());
diff --git a/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h b/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h
index 3cb96af4b965..b59141486958 100644
--- a/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h
+++ b/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h
@@ -3,7 +3,7 @@
 #include <unordered_map>
 #include <vector>
 
-#include "envoy/config/accesslog/v2/als.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/local_info/local_info.h"
@@ -28,7 +28,7 @@ namespace TcpGrpc {
 class TcpGrpcAccessLog : public Common::ImplBase {
 public:
   TcpGrpcAccessLog(AccessLog::FilterPtr&& filter,
-                   envoy::config::accesslog::v2::TcpGrpcAccessLogConfig config,
+                   envoy::extensions::access_loggers::grpc::v3alpha::TcpGrpcAccessLogConfig config,
                    ThreadLocal::SlotAllocator& tls,
                    GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache);
 
@@ -47,7 +47,7 @@ class TcpGrpcAccessLog : public Common::ImplBase {
                const Http::HeaderMap& response_trailers,
                const StreamInfo::StreamInfo& stream_info) override;
 
-  const envoy::config::accesslog::v2::TcpGrpcAccessLogConfig config_;
+  const envoy::extensions::access_loggers::grpc::v3alpha::TcpGrpcAccessLogConfig config_;
   const ThreadLocal::SlotPtr tls_slot_;
   const GrpcCommon::GrpcAccessLoggerCacheSharedPtr access_logger_cache_;
 };
diff --git a/source/extensions/clusters/aggregate/BUILD b/source/extensions/clusters/aggregate/BUILD
index e7db20184fab..75acdc5cf3d3 100644
--- a/source/extensions/clusters/aggregate/BUILD
+++ b/source/extensions/clusters/aggregate/BUILD
@@ -20,7 +20,7 @@ envoy_cc_extension(
         "//source/common/upstream:cluster_factory_lib",
         "//source/common/upstream:upstream_includes",
         "//source/extensions/clusters:well_known_names",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/cluster/aggregate/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/clusters/aggregate/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/clusters/aggregate/cluster.cc b/source/extensions/clusters/aggregate/cluster.cc
index cdb45536f3db..a8a55467c035 100644
--- a/source/extensions/clusters/aggregate/cluster.cc
+++ b/source/extensions/clusters/aggregate/cluster.cc
@@ -1,16 +1,16 @@
 #include "extensions/clusters/aggregate/cluster.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.validate.h"
 
 namespace Envoy {
 namespace Extensions {
 namespace Clusters {
 namespace Aggregate {
 
-Cluster::Cluster(const envoy::api::v2::Cluster& cluster,
-                 const envoy::config::cluster::aggregate::v2alpha::ClusterConfig& config,
+Cluster::Cluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                 const envoy::extensions::clusters::aggregate::v3alpha::ClusterConfig& config,
                  Upstream::ClusterManager& cluster_manager, Runtime::Loader& runtime,
                  Runtime::RandomGenerator& random,
                  Server::Configuration::TransportSocketFactoryContext& factory_context,
@@ -134,8 +134,8 @@ AggregateClusterLoadBalancer::chooseHost(Upstream::LoadBalancerContext* context)
 
 std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
 ClusterFactory::createClusterWithConfig(
-    const envoy::api::v2::Cluster& cluster,
-    const envoy::config::cluster::aggregate::v2alpha::ClusterConfig& proto_config,
+    const envoy::config::cluster::v3alpha::Cluster& cluster,
+    const envoy::extensions::clusters::aggregate::v3alpha::ClusterConfig& proto_config,
     Upstream::ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
diff --git a/source/extensions/clusters/aggregate/cluster.h b/source/extensions/clusters/aggregate/cluster.h
index 296b35b77b43..18ca8e7d4ab7 100644
--- a/source/extensions/clusters/aggregate/cluster.h
+++ b/source/extensions/clusters/aggregate/cluster.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.validate.h"
 
 #include "common/upstream/cluster_factory_impl.h"
 #include "common/upstream/upstream_impl.h"
@@ -19,8 +19,8 @@ using PriorityContext = std::pair<Upstream::PrioritySetImpl,
 
 class Cluster : public Upstream::ClusterImplBase, Upstream::ClusterUpdateCallbacks {
 public:
-  Cluster(const envoy::api::v2::Cluster& cluster,
-          const envoy::config::cluster::aggregate::v2alpha::ClusterConfig& config,
+  Cluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
+          const envoy::extensions::clusters::aggregate::v3alpha::ClusterConfig& config,
           Upstream::ClusterManager& cluster_manager, Runtime::Loader& runtime,
           Runtime::RandomGenerator& random,
           Server::Configuration::TransportSocketFactoryContext& factory_context,
@@ -59,9 +59,9 @@ class Cluster : public Upstream::ClusterImplBase, Upstream::ClusterUpdateCallbac
 // are updated.
 class AggregateClusterLoadBalancer : public Upstream::LoadBalancer {
 public:
-  AggregateClusterLoadBalancer(Upstream::ClusterStats& stats, Runtime::Loader& runtime,
-                               Runtime::RandomGenerator& random,
-                               const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+  AggregateClusterLoadBalancer(
+      Upstream::ClusterStats& stats, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
+      const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
       : stats_(stats), runtime_(runtime), random_(random), common_config_(common_config) {}
 
   // Upstream::LoadBalancer
@@ -74,7 +74,7 @@ class AggregateClusterLoadBalancer : public Upstream::LoadBalancer {
   public:
     LoadBalancerImpl(const PriorityContext& priority_context, Upstream::ClusterStats& stats,
                      Runtime::Loader& runtime, Runtime::RandomGenerator& random,
-                     const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+                     const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
         : Upstream::LoadBalancerBase(priority_context.first, stats, runtime, random, common_config),
           priority_to_cluster_(priority_context.second) {}
 
@@ -96,7 +96,7 @@ class AggregateClusterLoadBalancer : public Upstream::LoadBalancer {
   Upstream::ClusterStats& stats_;
   Runtime::Loader& runtime_;
   Runtime::RandomGenerator& random_;
-  const envoy::api::v2::Cluster::CommonLbConfig& common_config_;
+  const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config_;
 
 public:
   void refresh(const PriorityContext& priority_context) {
@@ -136,7 +136,7 @@ struct AggregateThreadAwareLoadBalancer : public Upstream::ThreadAwareLoadBalanc
 };
 
 class ClusterFactory : public Upstream::ConfigurableClusterFactoryBase<
-                           envoy::config::cluster::aggregate::v2alpha::ClusterConfig> {
+                           envoy::extensions::clusters::aggregate::v3alpha::ClusterConfig> {
 public:
   ClusterFactory()
       : ConfigurableClusterFactoryBase(Extensions::Clusters::ClusterTypes::get().Aggregate) {}
@@ -144,8 +144,8 @@ class ClusterFactory : public Upstream::ConfigurableClusterFactoryBase<
 private:
   std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
   createClusterWithConfig(
-      const envoy::api::v2::Cluster& cluster,
-      const envoy::config::cluster::aggregate::v2alpha::ClusterConfig& proto_config,
+      const envoy::config::cluster::v3alpha::Cluster& cluster,
+      const envoy::extensions::clusters::aggregate::v3alpha::ClusterConfig& proto_config,
       Upstream::ClusterFactoryContext& context,
       Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
       Stats::ScopePtr&& stats_scope) override;
diff --git a/source/extensions/clusters/dynamic_forward_proxy/BUILD b/source/extensions/clusters/dynamic_forward_proxy/BUILD
index 9580cefea60b..fa56d883c4a9 100644
--- a/source/extensions/clusters/dynamic_forward_proxy/BUILD
+++ b/source/extensions/clusters/dynamic_forward_proxy/BUILD
@@ -20,8 +20,8 @@ envoy_cc_extension(
         "//source/extensions/clusters:well_known_names",
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_interface",
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_manager_impl",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/config/cluster/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/clusters/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/clusters/dynamic_forward_proxy/cluster.cc b/source/extensions/clusters/dynamic_forward_proxy/cluster.cc
index 6272e1694c04..e7518c0542a7 100644
--- a/source/extensions/clusters/dynamic_forward_proxy/cluster.cc
+++ b/source/extensions/clusters/dynamic_forward_proxy/cluster.cc
@@ -1,8 +1,8 @@
 #include "extensions/clusters/dynamic_forward_proxy/cluster.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.pb.h"
-#include "envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/dynamic_forward_proxy/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/dynamic_forward_proxy/v3alpha/cluster.pb.validate.h"
 
 #include "common/network/transport_socket_options_impl.h"
 
@@ -14,8 +14,8 @@ namespace Clusters {
 namespace DynamicForwardProxy {
 
 Cluster::Cluster(
-    const envoy::api::v2::Cluster& cluster,
-    const envoy::config::cluster::dynamic_forward_proxy::v2alpha::ClusterConfig& config,
+    const envoy::config::cluster::v3alpha::Cluster& cluster,
+    const envoy::extensions::clusters::dynamic_forward_proxy::v3alpha::ClusterConfig& config,
     Runtime::Loader& runtime,
     Extensions::Common::DynamicForwardProxy::DnsCacheManagerFactory& cache_manager_factory,
     const LocalInfo::LocalInfo& local_info,
@@ -31,11 +31,12 @@ Cluster::Cluster(
   // support these parameters dynamically in the future. This is not an exhaustive list of
   // parameters that don't make sense but should be the most obvious ones that a user might set
   // in error.
-  if (!cluster.tls_context().sni().empty() || !cluster.tls_context()
-                                                   .common_tls_context()
-                                                   .validation_context()
-                                                   .verify_subject_alt_name()
-                                                   .empty()) {
+  if (!cluster.hidden_envoy_deprecated_tls_context().sni().empty() ||
+      !cluster.hidden_envoy_deprecated_tls_context()
+           .common_tls_context()
+           .validation_context()
+           .hidden_envoy_deprecated_verify_subject_alt_name()
+           .empty()) {
     throw EnvoyException(
         "dynamic_forward_proxy cluster cannot configure 'sni' or 'verify_subject_alt_name'");
   }
@@ -187,8 +188,8 @@ Cluster::LoadBalancer::chooseHost(Upstream::LoadBalancerContext* context) {
 
 std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
 ClusterFactory::createClusterWithConfig(
-    const envoy::api::v2::Cluster& cluster,
-    const envoy::config::cluster::dynamic_forward_proxy::v2alpha::ClusterConfig& proto_config,
+    const envoy::config::cluster::v3alpha::Cluster& cluster,
+    const envoy::extensions::clusters::dynamic_forward_proxy::v3alpha::ClusterConfig& proto_config,
     Upstream::ClusterFactoryContext& context,
     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
     Stats::ScopePtr&& stats_scope) {
diff --git a/source/extensions/clusters/dynamic_forward_proxy/cluster.h b/source/extensions/clusters/dynamic_forward_proxy/cluster.h
index e8f7200185b9..84f91f82d71a 100644
--- a/source/extensions/clusters/dynamic_forward_proxy/cluster.h
+++ b/source/extensions/clusters/dynamic_forward_proxy/cluster.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.pb.h"
-#include "envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/extensions/clusters/dynamic_forward_proxy/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/dynamic_forward_proxy/v3alpha/cluster.pb.validate.h"
 
 #include "common/upstream/cluster_factory_impl.h"
 #include "common/upstream/logical_host.h"
@@ -19,8 +19,8 @@ namespace DynamicForwardProxy {
 class Cluster : public Upstream::BaseDynamicClusterImpl,
                 public Extensions::Common::DynamicForwardProxy::DnsCache::UpdateCallbacks {
 public:
-  Cluster(const envoy::api::v2::Cluster& cluster,
-          const envoy::config::cluster::dynamic_forward_proxy::v2alpha::ClusterConfig& config,
+  Cluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
+          const envoy::extensions::clusters::dynamic_forward_proxy::v3alpha::ClusterConfig& config,
           Runtime::Loader& runtime,
           Extensions::Common::DynamicForwardProxy::DnsCacheManagerFactory& cache_manager_factory,
           const LocalInfo::LocalInfo& local_info,
@@ -104,8 +104,8 @@ class Cluster : public Upstream::BaseDynamicClusterImpl,
   const Extensions::Common::DynamicForwardProxy::DnsCacheSharedPtr dns_cache_;
   const Extensions::Common::DynamicForwardProxy::DnsCache::AddUpdateCallbacksHandlePtr
       update_callbacks_handle_;
-  const envoy::api::v2::endpoint::LocalityLbEndpoints dummy_locality_lb_endpoint_;
-  const envoy::api::v2::endpoint::LbEndpoint dummy_lb_endpoint_;
+  const envoy::config::endpoint::v3alpha::LocalityLbEndpoints dummy_locality_lb_endpoint_;
+  const envoy::config::endpoint::v3alpha::LbEndpoint dummy_lb_endpoint_;
   const LocalInfo::LocalInfo& local_info_;
 
   absl::Mutex host_map_lock_;
@@ -115,8 +115,9 @@ class Cluster : public Upstream::BaseDynamicClusterImpl,
   friend class ClusterTest;
 };
 
-class ClusterFactory : public Upstream::ConfigurableClusterFactoryBase<
-                           envoy::config::cluster::dynamic_forward_proxy::v2alpha::ClusterConfig> {
+class ClusterFactory
+    : public Upstream::ConfigurableClusterFactoryBase<
+          envoy::extensions::clusters::dynamic_forward_proxy::v3alpha::ClusterConfig> {
 public:
   ClusterFactory()
       : ConfigurableClusterFactoryBase(
@@ -125,8 +126,9 @@ class ClusterFactory : public Upstream::ConfigurableClusterFactoryBase<
 private:
   std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
   createClusterWithConfig(
-      const envoy::api::v2::Cluster& cluster,
-      const envoy::config::cluster::dynamic_forward_proxy::v2alpha::ClusterConfig& proto_config,
+      const envoy::config::cluster::v3alpha::Cluster& cluster,
+      const envoy::extensions::clusters::dynamic_forward_proxy::v3alpha::ClusterConfig&
+          proto_config,
       Upstream::ClusterFactoryContext& context,
       Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
       Stats::ScopePtr&& stats_scope) override;
diff --git a/source/extensions/clusters/redis/BUILD b/source/extensions/clusters/redis/BUILD
index f6c5a378c10f..04495a561568 100644
--- a/source/extensions/clusters/redis/BUILD
+++ b/source/extensions/clusters/redis/BUILD
@@ -70,9 +70,9 @@ envoy_cc_extension(
         "//source/extensions/filters/network/redis_proxy:config",
         "//source/extensions/transport_sockets/raw_buffer:config",
         "//source/server:transport_socket_config_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
         "@envoy_api//envoy/config/cluster/redis:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/clusters/redis/redis_cluster.cc b/source/extensions/clusters/redis/redis_cluster.cc
index 1c8013d1bbc8..be8704841f81 100644
--- a/source/extensions/clusters/redis/redis_cluster.cc
+++ b/source/extensions/clusters/redis/redis_cluster.cc
@@ -2,10 +2,11 @@
 
 #include <err.h>
 
-#include "envoy/api/v2/cds.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.validate.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -17,7 +18,7 @@ Extensions::NetworkFilters::Common::Redis::Client::DoNothingPoolCallbacks null_p
 } // namespace
 
 RedisCluster::RedisCluster(
-    const envoy::api::v2::Cluster& cluster,
+    const envoy::config::cluster::v3alpha::Cluster& cluster,
     const envoy::config::cluster::redis::RedisClusterConfig& redis_cluster,
     NetworkFilters::Common::Redis::Client::ClientFactory& redis_client_factory,
     Upstream::ClusterManager& cluster_manager, Runtime::Loader& runtime, Api::Api& api,
@@ -360,7 +361,7 @@ RedisCluster::ClusterSlotsRequest RedisCluster::ClusterSlotsRequest::instance_;
 
 std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
 RedisClusterFactory::createClusterWithConfig(
-    const envoy::api::v2::Cluster& cluster,
+    const envoy::config::cluster::v3alpha::Cluster& cluster,
     const envoy::config::cluster::redis::RedisClusterConfig& proto_config,
     Upstream::ClusterFactoryContext& context,
     Envoy::Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
@@ -371,7 +372,7 @@ RedisClusterFactory::createClusterWithConfig(
   }
   // TODO(hyang): This is needed to migrate existing cluster, disallow using other lb_policy
   // in the future
-  if (cluster.lb_policy() != envoy::api::v2::Cluster::CLUSTER_PROVIDED) {
+  if (cluster.lb_policy() != envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED) {
     return std::make_pair(std::make_shared<RedisCluster>(
                               cluster, proto_config,
                               NetworkFilters::Common::Redis::Client::ClientFactoryImpl::instance_,
diff --git a/source/extensions/clusters/redis/redis_cluster.h b/source/extensions/clusters/redis/redis_cluster.h
index 5ce7c08c8d67..2d2c07084de0 100644
--- a/source/extensions/clusters/redis/redis_cluster.h
+++ b/source/extensions/clusters/redis/redis_cluster.h
@@ -13,15 +13,16 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.validate.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/timer.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 #include "envoy/http/codec.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/network/dns.h"
@@ -92,7 +93,7 @@ namespace Redis {
 
 class RedisCluster : public Upstream::BaseDynamicClusterImpl {
 public:
-  RedisCluster(const envoy::api::v2::Cluster& cluster,
+  RedisCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
                const envoy::config::cluster::redis::RedisClusterConfig& redis_cluster,
                NetworkFilters::Common::Redis::Client::ClientFactory& client_factory,
                Upstream::ClusterManager& cluster_manager, Runtime::Loader& runtime, Api::Api& api,
@@ -129,12 +130,12 @@ class RedisCluster : public Upstream::BaseDynamicClusterImpl {
 
   void reloadHealthyHostsHelper(const Upstream::HostSharedPtr& host) override;
 
-  const envoy::api::v2::endpoint::LocalityLbEndpoints& localityLbEndpoint() const {
+  const envoy::config::endpoint::v3alpha::LocalityLbEndpoints& localityLbEndpoint() const {
     // Always use the first endpoint.
     return load_assignment_.endpoints()[0];
   }
 
-  const envoy::api::v2::endpoint::LbEndpoint& lbEndpoint() const {
+  const envoy::config::endpoint::v3alpha::LbEndpoint& lbEndpoint() const {
     // Always use the first endpoint.
     return localityLbEndpoint().lb_endpoints()[0];
   }
@@ -264,7 +265,7 @@ class RedisCluster : public Upstream::BaseDynamicClusterImpl {
   Event::Dispatcher& dispatcher_;
   Network::DnsResolverSharedPtr dns_resolver_;
   Network::DnsLookupFamily dns_lookup_family_;
-  const envoy::api::v2::ClusterLoadAssignment load_assignment_;
+  const envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment_;
   const LocalInfo::LocalInfo& local_info_;
   Runtime::RandomGenerator& random_;
   RedisDiscoverySession redis_discovery_session_;
@@ -290,7 +291,7 @@ class RedisClusterFactory : public Upstream::ConfigurableClusterFactoryBase<
 
   std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
   createClusterWithConfig(
-      const envoy::api::v2::Cluster& cluster,
+      const envoy::config::cluster::v3alpha::Cluster& cluster,
       const envoy::config::cluster::redis::RedisClusterConfig& proto_config,
       Upstream::ClusterFactoryContext& context,
       Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
diff --git a/source/extensions/common/dynamic_forward_proxy/BUILD b/source/extensions/common/dynamic_forward_proxy/BUILD
index 8218e13a4de9..c2e1fd9c592c 100644
--- a/source/extensions/common/dynamic_forward_proxy/BUILD
+++ b/source/extensions/common/dynamic_forward_proxy/BUILD
@@ -15,7 +15,7 @@ envoy_cc_library(
         "//include/envoy/event:dispatcher_interface",
         "//include/envoy/singleton:manager_interface",
         "//include/envoy/thread_local:thread_local_interface",
-        "@envoy_api//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -26,7 +26,7 @@ envoy_cc_library(
     deps = [
         ":dns_cache_impl",
         "//source/common/protobuf",
-        "@envoy_api//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -41,6 +41,6 @@ envoy_cc_library(
         "//source/common/common:cleanup_lib",
         "//source/common/network:utility_lib",
         "//source/common/upstream:upstream_lib",
-        "@envoy_api//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/common/dynamic_forward_proxy/dns_cache.h b/source/extensions/common/dynamic_forward_proxy/dns_cache.h
index e6466ca12c63..89aff0678495 100644
--- a/source/extensions/common/dynamic_forward_proxy/dns_cache.h
+++ b/source/extensions/common/dynamic_forward_proxy/dns_cache.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 #include "envoy/singleton/manager.h"
 #include "envoy/thread_local/thread_local.h"
 
@@ -165,7 +165,7 @@ class DnsCacheManager {
    *               will be returned, otherwise a new one will be created.
    */
   virtual DnsCacheSharedPtr getCache(
-      const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config) PURE;
+      const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config) PURE;
 };
 
 using DnsCacheManagerSharedPtr = std::shared_ptr<DnsCacheManager>;
diff --git a/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc b/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc
index 2abaa2077b33..c6824a983034 100644
--- a/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc
+++ b/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/common/dynamic_forward_proxy/dns_cache_impl.h"
 
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 
 #include "common/http/utility.h"
 #include "common/network/utility.h"
@@ -16,7 +16,7 @@ namespace DynamicForwardProxy {
 DnsCacheImpl::DnsCacheImpl(
     Event::Dispatcher& main_thread_dispatcher, ThreadLocal::SlotAllocator& tls,
     Stats::Scope& root_scope,
-    const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config)
+    const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config)
     : main_thread_dispatcher_(main_thread_dispatcher),
       dns_lookup_family_(Upstream::getDnsLookupFamilyFromEnum(config.dns_lookup_family())),
       resolver_(main_thread_dispatcher.createDnsResolver({}, false)), tls_slot_(tls.allocateSlot()),
diff --git a/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.h b/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.h
index cf6e4f0ca5ee..60fb52184949 100644
--- a/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.h
+++ b/source/extensions/common/dynamic_forward_proxy/dns_cache_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 #include "envoy/network/dns.h"
 #include "envoy/thread_local/thread_local.h"
 
@@ -37,9 +37,10 @@ struct DnsCacheStats {
 
 class DnsCacheImpl : public DnsCache, Logger::Loggable<Logger::Id::forward_proxy> {
 public:
-  DnsCacheImpl(Event::Dispatcher& main_thread_dispatcher, ThreadLocal::SlotAllocator& tls,
-               Stats::Scope& root_scope,
-               const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config);
+  DnsCacheImpl(
+      Event::Dispatcher& main_thread_dispatcher, ThreadLocal::SlotAllocator& tls,
+      Stats::Scope& root_scope,
+      const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config);
   ~DnsCacheImpl() override;
 
   // DnsCache
diff --git a/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.cc b/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.cc
index 6a4fa1a95ddc..737c9086e464 100644
--- a/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.cc
+++ b/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h"
 
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -16,7 +16,7 @@ namespace DynamicForwardProxy {
 SINGLETON_MANAGER_REGISTRATION(dns_cache_manager);
 
 DnsCacheSharedPtr DnsCacheManagerImpl::getCache(
-    const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config) {
+    const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config) {
   const auto& existing_cache = caches_.find(config.name());
   if (existing_cache != caches_.end()) {
     if (!Protobuf::util::MessageDifferencer::Equivalent(config, existing_cache->second.config_)) {
diff --git a/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h b/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h
index e2a6c4c90f64..cab2a5e5bae4 100644
--- a/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h
+++ b/source/extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 
 #include "extensions/common/dynamic_forward_proxy/dns_cache.h"
 
@@ -18,16 +18,18 @@ class DnsCacheManagerImpl : public DnsCacheManager, public Singleton::Instance {
       : main_thread_dispatcher_(main_thread_dispatcher), tls_(tls), root_scope_(root_scope) {}
 
   // DnsCacheManager
-  DnsCacheSharedPtr getCache(
-      const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config) override;
+  DnsCacheSharedPtr
+  getCache(const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config)
+      override;
 
 private:
   struct ActiveCache {
-    ActiveCache(const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config,
-                DnsCacheSharedPtr cache)
+    ActiveCache(
+        const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config,
+        DnsCacheSharedPtr cache)
         : config_(config), cache_(cache) {}
 
-    const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig config_;
+    const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig config_;
     DnsCacheSharedPtr cache_;
   };
 
diff --git a/source/extensions/common/tap/BUILD b/source/extensions/common/tap/BUILD
index 578f187288a1..495e2dcfeb9f 100644
--- a/source/extensions/common/tap/BUILD
+++ b/source/extensions/common/tap/BUILD
@@ -14,8 +14,8 @@ envoy_cc_library(
     deps = [
         ":tap_matcher",
         "//include/envoy/http:header_map_interface",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -28,8 +28,8 @@ envoy_cc_library(
         ":tap_matcher",
         "//source/common/common:assert_lib",
         "//source/common/common:stack_array",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,7 +39,7 @@ envoy_cc_library(
     hdrs = ["tap_matcher.h"],
     deps = [
         "//source/common/http:header_utility_lib",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -52,9 +52,9 @@ envoy_cc_library(
         "//include/envoy/server:admin_interface",
         "//include/envoy/singleton:manager_interface",
         "//source/common/buffer:buffer_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -65,7 +65,7 @@ envoy_cc_library(
     deps = [
         "//include/envoy/thread_local:thread_local_interface",
         "//source/extensions/common/tap:admin",
-        "@envoy_api//envoy/config/common/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/tap/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/common/tap/admin.cc b/source/extensions/common/tap/admin.cc
index 5d695a51fbff..317bc1bf7f59 100644
--- a/source/extensions/common/tap/admin.cc
+++ b/source/extensions/common/tap/admin.cc
@@ -1,9 +1,9 @@
 #include "extensions/common/tap/admin.h"
 
-#include "envoy/admin/v2alpha/tap.pb.h"
-#include "envoy/admin/v2alpha/tap.pb.validate.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/admin/v3alpha/tap.pb.h"
+#include "envoy/admin/v3alpha/tap.pb.validate.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/protobuf/message_validator_impl.h"
@@ -50,7 +50,7 @@ Http::Code AdminHandler::handler(absl::string_view, Http::HeaderMap&, Buffer::In
     return badRequest(response, "/tap requires a JSON/YAML body");
   }
 
-  envoy::admin::v2alpha::TapRequest tap_request;
+  envoy::admin::v3alpha::TapRequest tap_request;
   try {
     MessageUtil::loadFromYamlAndValidate(admin_stream.getRequestBody()->toString(), tap_request,
                                          ProtobufMessage::getStrictValidationVisitor());
@@ -104,10 +104,10 @@ void AdminHandler::unregisterConfig(ExtensionConfig& config) {
 }
 
 void AdminHandler::AdminPerTapSinkHandle::submitTrace(
-    TraceWrapperPtr&& trace, envoy::service::tap::v2alpha::OutputSink::Format format) {
+    TraceWrapperPtr&& trace, envoy::config::tap::v3alpha::OutputSink::Format format) {
   ENVOY_LOG(debug, "admin submitting buffered trace to main thread");
   // Convert to a shared_ptr, so we can send it to the main thread.
-  std::shared_ptr<envoy::data::tap::v2alpha::TraceWrapper> shared_trace{std::move(trace)};
+  std::shared_ptr<envoy::data::tap::v3alpha::TraceWrapper> shared_trace{std::move(trace)};
   // The handle can be destroyed before the cross thread post is complete. Thus, we capture a
   // reference to our parent.
   parent_.main_thread_dispatcher_.post([& parent = parent_, trace = shared_trace, format]() {
@@ -117,8 +117,8 @@ void AdminHandler::AdminPerTapSinkHandle::submitTrace(
 
     std::string output_string;
     switch (format) {
-    case envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING:
-    case envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_BYTES:
+    case envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING:
+    case envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_BYTES:
       output_string = MessageUtil::getJsonStringFromMessage(*trace, true, true);
       break;
     default:
diff --git a/source/extensions/common/tap/admin.h b/source/extensions/common/tap/admin.h
index 9feb537aa8f8..c0cc621970e5 100644
--- a/source/extensions/common/tap/admin.h
+++ b/source/extensions/common/tap/admin.h
@@ -1,7 +1,7 @@
 #pragma once
 
+#include "envoy/config/tap/v3alpha/common.pb.h"
 #include "envoy/server/admin.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
 #include "envoy/singleton/manager.h"
 
 #include "extensions/common/tap/tap.h"
@@ -61,7 +61,7 @@ class AdminHandler : public Singleton::Instance,
 
     // Extensions::Common::Tap::PerTapSinkHandle
     void submitTrace(TraceWrapperPtr&& trace,
-                     envoy::service::tap::v2alpha::OutputSink::Format format) override;
+                     envoy::config::tap::v3alpha::OutputSink::Format format) override;
 
     AdminHandler& parent_;
   };
diff --git a/source/extensions/common/tap/extension_config_base.cc b/source/extensions/common/tap/extension_config_base.cc
index 305956f8d0a1..7810cde058b1 100644
--- a/source/extensions/common/tap/extension_config_base.cc
+++ b/source/extensions/common/tap/extension_config_base.cc
@@ -1,7 +1,7 @@
 #include "extensions/common/tap/extension_config_base.h"
 
-#include "envoy/config/common/tap/v2alpha/common.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/extensions/common/tap/v3alpha/common.pb.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -9,7 +9,7 @@ namespace Common {
 namespace Tap {
 
 ExtensionConfigBase::ExtensionConfigBase(
-    const envoy::config::common::tap::v2alpha::CommonExtensionConfig proto_config,
+    const envoy::extensions::common::tap::v3alpha::CommonExtensionConfig proto_config,
     TapConfigFactoryPtr&& config_factory, Server::Admin& admin,
     Singleton::Manager& singleton_manager, ThreadLocal::SlotAllocator& tls,
     Event::Dispatcher& main_thread_dispatcher)
@@ -20,15 +20,17 @@ ExtensionConfigBase::ExtensionConfigBase(
   });
 
   switch (proto_config_.config_type_case()) {
-  case envoy::config::common::tap::v2alpha::CommonExtensionConfig::kAdminConfig: {
+  case envoy::extensions::common::tap::v3alpha::CommonExtensionConfig::ConfigTypeCase::
+      kAdminConfig: {
     admin_handler_ = AdminHandler::getSingleton(admin, singleton_manager, main_thread_dispatcher);
     admin_handler_->registerConfig(*this, proto_config_.admin_config().config_id());
     ENVOY_LOG(debug, "initializing tap extension with admin endpoint (config_id={})",
               proto_config_.admin_config().config_id());
     break;
   }
-  case envoy::config::common::tap::v2alpha::CommonExtensionConfig::kStaticConfig: {
-    newTapConfig(envoy::service::tap::v2alpha::TapConfig(proto_config_.static_config()), nullptr);
+  case envoy::extensions::common::tap::v3alpha::CommonExtensionConfig::ConfigTypeCase::
+      kStaticConfig: {
+    newTapConfig(envoy::config::tap::v3alpha::TapConfig(proto_config_.static_config()), nullptr);
     ENVOY_LOG(debug, "initializing tap extension with static config");
     break;
   }
@@ -55,7 +57,7 @@ void ExtensionConfigBase::clearTapConfig() {
   tls_slot_->runOnAllThreads([this] { tls_slot_->getTyped<TlsFilterConfig>().config_ = nullptr; });
 }
 
-void ExtensionConfigBase::newTapConfig(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+void ExtensionConfigBase::newTapConfig(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                                        Sink* admin_streamer) {
   TapConfigSharedPtr new_config =
       config_factory_->createConfigFromProto(std::move(proto_config), admin_streamer);
diff --git a/source/extensions/common/tap/extension_config_base.h b/source/extensions/common/tap/extension_config_base.h
index 07401e9c308f..197e19430dcc 100644
--- a/source/extensions/common/tap/extension_config_base.h
+++ b/source/extensions/common/tap/extension_config_base.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/common/tap/v2alpha/common.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/extensions/common/tap/v3alpha/common.pb.h"
 #include "envoy/thread_local/thread_local.h"
 
 #include "extensions/common/tap/admin.h"
@@ -20,14 +20,15 @@ class ExtensionConfigBase : public ExtensionConfig, Logger::Loggable<Logger::Id:
   // Extensions::Common::Tap::ExtensionConfig
   void clearTapConfig() override;
   const absl::string_view adminId() override;
-  void newTapConfig(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  void newTapConfig(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                     Sink* admin_streamer) override;
 
 protected:
-  ExtensionConfigBase(const envoy::config::common::tap::v2alpha::CommonExtensionConfig proto_config,
-                      TapConfigFactoryPtr&& config_factory, Server::Admin& admin,
-                      Singleton::Manager& singleton_manager, ThreadLocal::SlotAllocator& tls,
-                      Event::Dispatcher& main_thread_dispatcher);
+  ExtensionConfigBase(
+      const envoy::extensions::common::tap::v3alpha::CommonExtensionConfig proto_config,
+      TapConfigFactoryPtr&& config_factory, Server::Admin& admin,
+      Singleton::Manager& singleton_manager, ThreadLocal::SlotAllocator& tls,
+      Event::Dispatcher& main_thread_dispatcher);
   ~ExtensionConfigBase() override;
 
   // All tap configurations derive from TapConfig for type safety. In order to use a common
@@ -42,7 +43,7 @@ class ExtensionConfigBase : public ExtensionConfig, Logger::Loggable<Logger::Id:
     TapConfigSharedPtr config_;
   };
 
-  const envoy::config::common::tap::v2alpha::CommonExtensionConfig proto_config_;
+  const envoy::extensions::common::tap::v3alpha::CommonExtensionConfig proto_config_;
   TapConfigFactoryPtr config_factory_;
   ThreadLocal::SlotPtr tls_slot_;
   AdminHandlerSharedPtr admin_handler_;
diff --git a/source/extensions/common/tap/tap.h b/source/extensions/common/tap/tap.h
index 30505f2d750d..4239974d99cb 100644
--- a/source/extensions/common/tap/tap.h
+++ b/source/extensions/common/tap/tap.h
@@ -1,9 +1,9 @@
 #pragma once
 
 #include "envoy/common/pure.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 #include "envoy/http/header_map.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
 
 #include "extensions/common/tap/tap_matcher.h"
 
@@ -14,9 +14,9 @@ namespace Extensions {
 namespace Common {
 namespace Tap {
 
-using TraceWrapperPtr = std::unique_ptr<envoy::data::tap::v2alpha::TraceWrapper>;
+using TraceWrapperPtr = std::unique_ptr<envoy::data::tap::v3alpha::TraceWrapper>;
 inline TraceWrapperPtr makeTraceWrapper() {
-  return std::make_unique<envoy::data::tap::v2alpha::TraceWrapper>();
+  return std::make_unique<envoy::data::tap::v3alpha::TraceWrapper>();
 }
 
 /**
@@ -34,7 +34,7 @@ class PerTapSinkHandle {
    * @param format supplies the output format to use.
    */
   virtual void submitTrace(TraceWrapperPtr&& trace,
-                           envoy::service::tap::v2alpha::OutputSink::Format format) PURE;
+                           envoy::config::tap::v3alpha::OutputSink::Format format) PURE;
 };
 
 using PerTapSinkHandlePtr = std::unique_ptr<PerTapSinkHandle>;
@@ -98,7 +98,7 @@ class ExtensionConfig {
    *        specifies that output type. May not be used if the configuration does not specify
    *        admin output. May be nullptr if admin is not used to supply the config.
    */
-  virtual void newTapConfig(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  virtual void newTapConfig(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                             Sink* admin_streamer) PURE;
 };
 
@@ -159,7 +159,7 @@ class TapConfigFactory {
    * ExtensionConfig::newTapConfig() for param info.
    */
   virtual TapConfigSharedPtr
-  createConfigFromProto(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  createConfigFromProto(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                         Sink* admin_streamer) PURE;
 };
 
diff --git a/source/extensions/common/tap/tap_config_base.cc b/source/extensions/common/tap/tap_config_base.cc
index 76bd425f085e..091c6dfd19b1 100644
--- a/source/extensions/common/tap/tap_config_base.cc
+++ b/source/extensions/common/tap/tap_config_base.cc
@@ -1,8 +1,8 @@
 #include "extensions/common/tap/tap_config_base.h"
 
-#include "envoy/data/tap/v2alpha/common.pb.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/stack_array.h"
@@ -15,7 +15,7 @@ namespace Extensions {
 namespace Common {
 namespace Tap {
 
-bool Utility::addBufferToProtoBytes(envoy::data::tap::v2alpha::Body& output_body,
+bool Utility::addBufferToProtoBytes(envoy::data::tap::v3alpha::Body& output_body,
                                     uint32_t max_buffered_bytes, const Buffer::Instance& data,
                                     uint32_t buffer_start_offset, uint32_t buffer_length_to_copy) {
   // TODO(mattklein123): Figure out if we can use the buffer API here directly in some way. This is
@@ -43,7 +43,7 @@ bool Utility::addBufferToProtoBytes(envoy::data::tap::v2alpha::Body& output_body
   }
 }
 
-TapConfigBaseImpl::TapConfigBaseImpl(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+TapConfigBaseImpl::TapConfigBaseImpl(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                                      Common::Tap::Sink* admin_streamer)
     : max_buffered_rx_bytes_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
           proto_config.output_config(), max_buffered_rx_bytes, DefaultMaxBufferedBytes)),
@@ -55,17 +55,16 @@ TapConfigBaseImpl::TapConfigBaseImpl(envoy::service::tap::v2alpha::TapConfig&& p
   // streaming, we should require the length delimited version of binary proto, etc.
   sink_format_ = proto_config.output_config().sinks()[0].format();
   switch (proto_config.output_config().sinks()[0].output_sink_type_case()) {
-  case envoy::service::tap::v2alpha::OutputSink::kStreamingAdmin:
+  case envoy::config::tap::v3alpha::OutputSink::OutputSinkTypeCase::kStreamingAdmin:
     // TODO(mattklein123): Graceful failure, error message, and test if someone specifies an
     // admin stream output without configuring via /tap or the wrong format.
     RELEASE_ASSERT(admin_streamer != nullptr, "admin output must be configured via admin");
-    RELEASE_ASSERT(sink_format_ == envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_BYTES ||
-                       sink_format_ ==
-                           envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING,
+    RELEASE_ASSERT(sink_format_ == envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_BYTES ||
+                       sink_format_ == envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING,
                    "admin output only supports JSON formats");
     sink_to_use_ = admin_streamer;
     break;
-  case envoy::service::tap::v2alpha::OutputSink::kFilePerTap:
+  case envoy::config::tap::v3alpha::OutputSink::OutputSinkTypeCase::kFilePerTap:
     sink_ =
         std::make_unique<FilePerTapSink>(proto_config.output_config().sinks()[0].file_per_tap());
     sink_to_use_ = sink_.get();
@@ -83,21 +82,21 @@ const Matcher& TapConfigBaseImpl::rootMatcher() const {
 }
 
 namespace {
-void swapBytesToString(envoy::data::tap::v2alpha::Body& body) {
+void swapBytesToString(envoy::data::tap::v3alpha::Body& body) {
   body.set_allocated_as_string(body.release_as_bytes());
 }
 } // namespace
 
-void Utility::bodyBytesToString(envoy::data::tap::v2alpha::TraceWrapper& trace,
-                                envoy::service::tap::v2alpha::OutputSink::Format sink_format) {
+void Utility::bodyBytesToString(envoy::data::tap::v3alpha::TraceWrapper& trace,
+                                envoy::config::tap::v3alpha::OutputSink::Format sink_format) {
   // Swap the "bytes" string into the "string" string. This is done purely so that JSON
   // serialization will serialize as a string vs. doing base64 encoding.
-  if (sink_format != envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING) {
+  if (sink_format != envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING) {
     return;
   }
 
   switch (trace.trace_case()) {
-  case envoy::data::tap::v2alpha::TraceWrapper::kHttpBufferedTrace: {
+  case envoy::data::tap::v3alpha::TraceWrapper::TraceCase::kHttpBufferedTrace: {
     auto* http_trace = trace.mutable_http_buffered_trace();
     if (http_trace->has_request() && http_trace->request().has_body()) {
       swapBytesToString(*http_trace->mutable_request()->mutable_body());
@@ -107,7 +106,7 @@ void Utility::bodyBytesToString(envoy::data::tap::v2alpha::TraceWrapper& trace,
     }
     break;
   }
-  case envoy::data::tap::v2alpha::TraceWrapper::kHttpStreamedTraceSegment: {
+  case envoy::data::tap::v3alpha::TraceWrapper::TraceCase::kHttpStreamedTraceSegment: {
     auto* http_trace = trace.mutable_http_streamed_trace_segment();
     if (http_trace->has_request_body_chunk()) {
       swapBytesToString(*http_trace->mutable_request_body_chunk());
@@ -117,7 +116,7 @@ void Utility::bodyBytesToString(envoy::data::tap::v2alpha::TraceWrapper& trace,
     }
     break;
   }
-  case envoy::data::tap::v2alpha::TraceWrapper::kSocketBufferedTrace: {
+  case envoy::data::tap::v3alpha::TraceWrapper::TraceCase::kSocketBufferedTrace: {
     auto* socket_trace = trace.mutable_socket_buffered_trace();
     for (auto& event : *socket_trace->mutable_events()) {
       if (event.has_read()) {
@@ -129,7 +128,7 @@ void Utility::bodyBytesToString(envoy::data::tap::v2alpha::TraceWrapper& trace,
     }
     break;
   }
-  case envoy::data::tap::v2alpha::TraceWrapper::kSocketStreamedTraceSegment: {
+  case envoy::data::tap::v3alpha::TraceWrapper::TraceCase::kSocketStreamedTraceSegment: {
     auto& event = *trace.mutable_socket_streamed_trace_segment()->mutable_event();
     if (event.has_read()) {
       swapBytesToString(*event.mutable_read()->mutable_data());
@@ -138,7 +137,7 @@ void Utility::bodyBytesToString(envoy::data::tap::v2alpha::TraceWrapper& trace,
     }
     break;
   }
-  case envoy::data::tap::v2alpha::TraceWrapper::TRACE_NOT_SET:
+  case envoy::data::tap::v3alpha::TraceWrapper::TraceCase::TRACE_NOT_SET:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 }
@@ -149,21 +148,21 @@ void TapConfigBaseImpl::PerTapSinkHandleManagerImpl::submitTrace(TraceWrapperPtr
 }
 
 void FilePerTapSink::FilePerTapSinkHandle::submitTrace(
-    TraceWrapperPtr&& trace, envoy::service::tap::v2alpha::OutputSink::Format format) {
+    TraceWrapperPtr&& trace, envoy::config::tap::v3alpha::OutputSink::Format format) {
   if (!output_file_.is_open()) {
     std::string path = fmt::format("{}_{}", parent_.config_.path_prefix(), trace_id_);
     switch (format) {
-    case envoy::service::tap::v2alpha::OutputSink::PROTO_BINARY:
+    case envoy::config::tap::v3alpha::OutputSink::PROTO_BINARY:
       path += MessageUtil::FileExtensions::get().ProtoBinary;
       break;
-    case envoy::service::tap::v2alpha::OutputSink::PROTO_BINARY_LENGTH_DELIMITED:
+    case envoy::config::tap::v3alpha::OutputSink::PROTO_BINARY_LENGTH_DELIMITED:
       path += MessageUtil::FileExtensions::get().ProtoBinaryLengthDelimited;
       break;
-    case envoy::service::tap::v2alpha::OutputSink::PROTO_TEXT:
+    case envoy::config::tap::v3alpha::OutputSink::PROTO_TEXT:
       path += MessageUtil::FileExtensions::get().ProtoText;
       break;
-    case envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_BYTES:
-    case envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING:
+    case envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_BYTES:
+    case envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING:
       path += MessageUtil::FileExtensions::get().Json;
       break;
     default:
@@ -179,21 +178,21 @@ void FilePerTapSink::FilePerTapSinkHandle::submitTrace(
   ENVOY_LOG_MISC(trace, "Tap for [id={}]: {}", trace_id_, trace->DebugString());
 
   switch (format) {
-  case envoy::service::tap::v2alpha::OutputSink::PROTO_BINARY:
+  case envoy::config::tap::v3alpha::OutputSink::PROTO_BINARY:
     trace->SerializeToOstream(&output_file_);
     break;
-  case envoy::service::tap::v2alpha::OutputSink::PROTO_BINARY_LENGTH_DELIMITED: {
+  case envoy::config::tap::v3alpha::OutputSink::PROTO_BINARY_LENGTH_DELIMITED: {
     Protobuf::io::OstreamOutputStream stream(&output_file_);
     Protobuf::io::CodedOutputStream coded_stream(&stream);
     coded_stream.WriteVarint32(trace->ByteSize());
     trace->SerializeWithCachedSizes(&coded_stream);
     break;
   }
-  case envoy::service::tap::v2alpha::OutputSink::PROTO_TEXT:
+  case envoy::config::tap::v3alpha::OutputSink::PROTO_TEXT:
     output_file_ << trace->DebugString();
     break;
-  case envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_BYTES:
-  case envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING:
+  case envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_BYTES:
+  case envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING:
     output_file_ << MessageUtil::getJsonStringFromMessage(*trace, true, true);
     break;
   default:
diff --git a/source/extensions/common/tap/tap_config_base.h b/source/extensions/common/tap/tap_config_base.h
index 91bed8ae5789..b2f82edd73d4 100644
--- a/source/extensions/common/tap/tap_config_base.h
+++ b/source/extensions/common/tap/tap_config_base.h
@@ -3,9 +3,9 @@
 #include <fstream>
 
 #include "envoy/buffer/buffer.h"
-#include "envoy/data/tap/v2alpha/common.pb.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 #include "extensions/common/tap/tap.h"
 #include "extensions/common/tap/tap_matcher.h"
@@ -30,15 +30,15 @@ class Utility {
    * @param buffer_length_to_copy supplies the length of the data to buffer.
    * @return whether the buffered data was truncated or not.
    */
-  static bool addBufferToProtoBytes(envoy::data::tap::v2alpha::Body& output_body,
+  static bool addBufferToProtoBytes(envoy::data::tap::v3alpha::Body& output_body,
                                     uint32_t max_buffered_bytes, const Buffer::Instance& data,
                                     uint32_t buffer_start_offset, uint32_t buffer_length_to_copy);
 
   /**
    * Swap body as bytes to body as string if necessary in a trace wrapper.
    */
-  static void bodyBytesToString(envoy::data::tap::v2alpha::TraceWrapper& trace,
-                                envoy::service::tap::v2alpha::OutputSink::Format sink_format);
+  static void bodyBytesToString(envoy::data::tap::v3alpha::TraceWrapper& trace,
+                                envoy::config::tap::v3alpha::OutputSink::Format sink_format);
 
   /**
    * Trim a container that contains buffer raw slices so that the slices start at an offset and
@@ -96,7 +96,7 @@ class TapConfigBaseImpl : public virtual TapConfig {
   bool streaming() const override { return streaming_; }
 
 protected:
-  TapConfigBaseImpl(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  TapConfigBaseImpl(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                     Common::Tap::Sink* admin_streamer);
 
 private:
@@ -109,7 +109,7 @@ class TapConfigBaseImpl : public virtual TapConfig {
   const bool streaming_;
   Sink* sink_to_use_;
   SinkPtr sink_;
-  envoy::service::tap::v2alpha::OutputSink::Format sink_format_;
+  envoy::config::tap::v3alpha::OutputSink::Format sink_format_;
   std::vector<MatcherPtr> matchers_;
 };
 
@@ -118,7 +118,7 @@ class TapConfigBaseImpl : public virtual TapConfig {
  */
 class FilePerTapSink : public Sink {
 public:
-  FilePerTapSink(const envoy::service::tap::v2alpha::FilePerTapSink& config) : config_(config) {}
+  FilePerTapSink(const envoy::config::tap::v3alpha::FilePerTapSink& config) : config_(config) {}
 
   // Sink
   PerTapSinkHandlePtr createPerTapSinkHandle(uint64_t trace_id) override {
@@ -132,14 +132,14 @@ class FilePerTapSink : public Sink {
 
     // PerTapSinkHandle
     void submitTrace(TraceWrapperPtr&& trace,
-                     envoy::service::tap::v2alpha::OutputSink::Format format) override;
+                     envoy::config::tap::v3alpha::OutputSink::Format format) override;
 
     FilePerTapSink& parent_;
     const uint64_t trace_id_;
     std::ofstream output_file_;
   };
 
-  const envoy::service::tap::v2alpha::FilePerTapSink config_;
+  const envoy::config::tap::v3alpha::FilePerTapSink config_;
 };
 
 } // namespace Tap
diff --git a/source/extensions/common/tap/tap_matcher.cc b/source/extensions/common/tap/tap_matcher.cc
index 2f0e43d50b1c..abfcaae2d4e1 100644
--- a/source/extensions/common/tap/tap_matcher.cc
+++ b/source/extensions/common/tap/tap_matcher.cc
@@ -1,6 +1,6 @@
 #include "extensions/common/tap/tap_matcher.h"
 
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
 
 #include "common/common/assert.h"
 
@@ -9,7 +9,7 @@ namespace Extensions {
 namespace Common {
 namespace Tap {
 
-void buildMatcher(const envoy::service::tap::v2alpha::MatchPredicate& match_config,
+void buildMatcher(const envoy::config::tap::v3alpha::MatchPredicate& match_config,
                   std::vector<MatcherPtr>& matchers) {
   // In order to store indexes and build our matcher tree inline, we must reserve a slot where
   // the matcher we are about to create will go. This allows us to know its future index and still
@@ -20,33 +20,33 @@ void buildMatcher(const envoy::service::tap::v2alpha::MatchPredicate& match_conf
 
   MatcherPtr new_matcher;
   switch (match_config.rule_case()) {
-  case envoy::service::tap::v2alpha::MatchPredicate::kOrMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kOrMatch:
     new_matcher = std::make_unique<SetLogicMatcher>(match_config.or_match(), matchers,
                                                     SetLogicMatcher::Type::Or);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kAndMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kAndMatch:
     new_matcher = std::make_unique<SetLogicMatcher>(match_config.and_match(), matchers,
                                                     SetLogicMatcher::Type::And);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kNotMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kNotMatch:
     new_matcher = std::make_unique<NotMatcher>(match_config.not_match(), matchers);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kAnyMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kAnyMatch:
     new_matcher = std::make_unique<AnyMatcher>(matchers);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kHttpRequestHeadersMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kHttpRequestHeadersMatch:
     new_matcher = std::make_unique<HttpRequestHeadersMatcher>(
         match_config.http_request_headers_match(), matchers);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kHttpRequestTrailersMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kHttpRequestTrailersMatch:
     new_matcher = std::make_unique<HttpRequestTrailersMatcher>(
         match_config.http_request_trailers_match(), matchers);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kHttpResponseHeadersMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kHttpResponseHeadersMatch:
     new_matcher = std::make_unique<HttpResponseHeadersMatcher>(
         match_config.http_response_headers_match(), matchers);
     break;
-  case envoy::service::tap::v2alpha::MatchPredicate::kHttpResponseTrailersMatch:
+  case envoy::config::tap::v3alpha::MatchPredicate::RuleCase::kHttpResponseTrailersMatch:
     new_matcher = std::make_unique<HttpResponseTrailersMatcher>(
         match_config.http_response_trailers_match(), matchers);
     break;
@@ -59,7 +59,7 @@ void buildMatcher(const envoy::service::tap::v2alpha::MatchPredicate& match_conf
 }
 
 SetLogicMatcher::SetLogicMatcher(
-    const envoy::service::tap::v2alpha::MatchPredicate::MatchSet& configs,
+    const envoy::config::tap::v3alpha::MatchPredicate::MatchSet& configs,
     std::vector<MatcherPtr>& matchers, Type type)
     : LogicMatcherBase(matchers), matchers_(matchers), type_(type) {
   for (const auto& config : configs.rules()) {
@@ -93,7 +93,7 @@ void SetLogicMatcher::updateLocalStatus(MatchStatusVector& statuses,
                   [&statuses](size_t index) { return statuses[index].might_change_status_; });
 }
 
-NotMatcher::NotMatcher(const envoy::service::tap::v2alpha::MatchPredicate& config,
+NotMatcher::NotMatcher(const envoy::config::tap::v3alpha::MatchPredicate& config,
                        std::vector<MatcherPtr>& matchers)
     : LogicMatcherBase(matchers), matchers_(matchers), not_index_(matchers.size()) {
   buildMatcher(config, matchers);
@@ -111,7 +111,7 @@ void NotMatcher::updateLocalStatus(MatchStatusVector& statuses,
 }
 
 HttpHeaderMatcherBase::HttpHeaderMatcherBase(
-    const envoy::service::tap::v2alpha::HttpHeadersMatch& config,
+    const envoy::config::tap::v3alpha::HttpHeadersMatch& config,
     const std::vector<MatcherPtr>& matchers)
     : SimpleMatcher(matchers),
       headers_to_match_(Http::HeaderUtility::buildHeaderDataVector(config.headers())) {}
diff --git a/source/extensions/common/tap/tap_matcher.h b/source/extensions/common/tap/tap_matcher.h
index 5f8e89c38bea..007be3145491 100644
--- a/source/extensions/common/tap/tap_matcher.h
+++ b/source/extensions/common/tap/tap_matcher.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
 
 #include "common/http/header_utility.h"
 
@@ -119,7 +119,7 @@ class Matcher {
  * up recursively building many matchers, which will all be added to the passed in vector
  * of matchers. See the comments in tap.h for the general structure of how tap matchers work.
  */
-void buildMatcher(const envoy::service::tap::v2alpha::MatchPredicate& match_config,
+void buildMatcher(const envoy::config::tap::v3alpha::MatchPredicate& match_config,
                   std::vector<MatcherPtr>& matchers);
 
 /**
@@ -172,7 +172,7 @@ class SetLogicMatcher : public LogicMatcherBase {
 public:
   enum class Type { And, Or };
 
-  SetLogicMatcher(const envoy::service::tap::v2alpha::MatchPredicate::MatchSet& configs,
+  SetLogicMatcher(const envoy::config::tap::v3alpha::MatchPredicate::MatchSet& configs,
                   std::vector<MatcherPtr>& matchers, Type type);
 
 private:
@@ -188,7 +188,7 @@ class SetLogicMatcher : public LogicMatcherBase {
  */
 class NotMatcher : public LogicMatcherBase {
 public:
-  NotMatcher(const envoy::service::tap::v2alpha::MatchPredicate& config,
+  NotMatcher(const envoy::config::tap::v3alpha::MatchPredicate& config,
              std::vector<MatcherPtr>& matchers);
 
 private:
@@ -233,7 +233,7 @@ class AnyMatcher : public SimpleMatcher {
  */
 class HttpHeaderMatcherBase : public SimpleMatcher {
 public:
-  HttpHeaderMatcherBase(const envoy::service::tap::v2alpha::HttpHeadersMatch& config,
+  HttpHeaderMatcherBase(const envoy::config::tap::v3alpha::HttpHeadersMatch& config,
                         const std::vector<MatcherPtr>& matchers);
 
 protected:
diff --git a/source/extensions/filters/common/expr/BUILD b/source/extensions/filters/common/expr/BUILD
index 9ff51cb02cb1..5b046e8a132b 100644
--- a/source/extensions/filters/common/expr/BUILD
+++ b/source/extensions/filters/common/expr/BUILD
@@ -32,6 +32,6 @@ envoy_cc_library(
         "//source/common/stream_info:utility_lib",
         "@com_google_cel_cpp//eval/public:cel_value",
         "@com_google_cel_cpp//eval/public:cel_value_producer",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/common/expr/context.h b/source/extensions/filters/common/expr/context.h
index 731d679ee72a..d27f796025f4 100644
--- a/source/extensions/filters/common/expr/context.h
+++ b/source/extensions/filters/common/expr/context.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/stream_info/stream_info.h"
 
 #include "common/http/headers.h"
@@ -147,13 +147,13 @@ class PeerWrapper : public BaseWrapper {
 
 class MetadataProducer : public google::api::expr::runtime::CelValueProducer {
 public:
-  MetadataProducer(const envoy::api::v2::core::Metadata& metadata) : metadata_(metadata) {}
+  MetadataProducer(const envoy::config::core::v3alpha::Metadata& metadata) : metadata_(metadata) {}
   CelValue Produce(ProtobufWkt::Arena* arena) override {
     return CelValue::CreateMessage(&metadata_, arena);
   }
 
 private:
-  const envoy::api::v2::core::Metadata& metadata_;
+  const envoy::config::core::v3alpha::Metadata& metadata_;
 };
 
 } // namespace Expr
diff --git a/source/extensions/filters/common/ext_authz/BUILD b/source/extensions/filters/common/ext_authz/BUILD
index f02ee5d6a74a..b2f2a6ca26db 100644
--- a/source/extensions/filters/common/ext_authz/BUILD
+++ b/source/extensions/filters/common/ext_authz/BUILD
@@ -14,7 +14,7 @@ envoy_cc_library(
     deps = [
         "//include/envoy/http:codes_interface",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -42,8 +42,8 @@ envoy_cc_library(
         "//source/common/network:utility_lib",
         "//source/common/protobuf",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -60,10 +60,10 @@ envoy_cc_library(
         "//source/common/http:async_client_lib",
         "//source/common/http:codes_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -77,7 +77,7 @@ envoy_cc_library(
         "//include/envoy/http:filter_interface",
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/grpc:async_client_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/common/ext_authz/check_request_utils.cc b/source/extensions/filters/common/ext_authz/check_request_utils.cc
index 51dc8c78aba4..04b31e0df6f8 100644
--- a/source/extensions/filters/common/ext_authz/check_request_utils.cc
+++ b/source/extensions/filters/common/ext_authz/check_request_utils.cc
@@ -5,9 +5,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/service/auth/v2/attribute_context.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/service/auth/v3alpha/attribute_context.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/ssl/connection.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -28,10 +28,10 @@ namespace Filters {
 namespace Common {
 namespace ExtAuthz {
 
-void CheckRequestUtils::setAttrContextPeer(envoy::service::auth::v2::AttributeContext_Peer& peer,
-                                           const Network::Connection& connection,
-                                           const std::string& service, const bool local,
-                                           bool include_certificate) {
+void CheckRequestUtils::setAttrContextPeer(
+    envoy::service::auth::v3alpha::AttributeContext::Peer& peer,
+    const Network::Connection& connection, const std::string& service, const bool local,
+    bool include_certificate) {
 
   // Set the address
   auto addr = peer.mutable_address();
@@ -90,7 +90,7 @@ std::string CheckRequestUtils::getHeaderStr(const Envoy::Http::HeaderEntry* entr
 }
 
 void CheckRequestUtils::setHttpRequest(
-    ::envoy::service::auth::v2::AttributeContext_HttpRequest& httpreq,
+    envoy::service::auth::v3alpha::AttributeContext::HttpRequest& httpreq,
     const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
     const Envoy::Http::HeaderMap& headers, uint64_t max_request_bytes) {
 
@@ -149,7 +149,7 @@ void CheckRequestUtils::setHttpRequest(
 }
 
 void CheckRequestUtils::setAttrContextRequest(
-    ::envoy::service::auth::v2::AttributeContext_Request& req,
+    envoy::service::auth::v3alpha::AttributeContext::Request& req,
     const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
     const Envoy::Http::HeaderMap& headers, uint64_t max_request_bytes) {
   setHttpRequest(*req.mutable_http(), callbacks, headers, max_request_bytes);
@@ -159,8 +159,8 @@ void CheckRequestUtils::createHttpCheck(
     const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
     const Envoy::Http::HeaderMap& headers,
     Protobuf::Map<std::string, std::string>&& context_extensions,
-    envoy::api::v2::core::Metadata&& metadata_context,
-    envoy::service::auth::v2::CheckRequest& request, uint64_t max_request_bytes,
+    envoy::config::core::v3alpha::Metadata&& metadata_context,
+    envoy::service::auth::v3alpha::CheckRequest& request, uint64_t max_request_bytes,
     bool include_peer_certificate) {
 
   auto attrs = request.mutable_attributes();
@@ -182,7 +182,7 @@ void CheckRequestUtils::createHttpCheck(
 }
 
 void CheckRequestUtils::createTcpCheck(const Network::ReadFilterCallbacks* callbacks,
-                                       envoy::service::auth::v2::CheckRequest& request,
+                                       envoy::service::auth::v3alpha::CheckRequest& request,
                                        bool include_peer_certificate) {
 
   auto attrs = request.mutable_attributes();
diff --git a/source/extensions/filters/common/ext_authz/check_request_utils.h b/source/extensions/filters/common/ext_authz/check_request_utils.h
index 5018b0c785c3..8f6e50828c47 100644
--- a/source/extensions/filters/common/ext_authz/check_request_utils.h
+++ b/source/extensions/filters/common/ext_authz/check_request_utils.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/http/filter.h"
@@ -14,8 +14,8 @@
 #include "envoy/network/address.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
-#include "envoy/service/auth/v2/attribute_context.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/service/auth/v3alpha/attribute_context.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/tracing/http_tracer.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -51,8 +51,8 @@ class CheckRequestUtils {
   static void createHttpCheck(const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
                               const Envoy::Http::HeaderMap& headers,
                               Protobuf::Map<std::string, std::string>&& context_extensions,
-                              envoy::api::v2::core::Metadata&& metadata_context,
-                              envoy::service::auth::v2::CheckRequest& request,
+                              envoy::config::core::v3alpha::Metadata&& metadata_context,
+                              envoy::service::auth::v3alpha::CheckRequest& request,
                               uint64_t max_request_bytes, bool include_peer_certificate);
 
   /**
@@ -63,17 +63,17 @@ class CheckRequestUtils {
    * @param include_peer_certificate whether to include the peer certificate in the check request.
    */
   static void createTcpCheck(const Network::ReadFilterCallbacks* callbacks,
-                             envoy::service::auth::v2::CheckRequest& request,
+                             envoy::service::auth::v3alpha::CheckRequest& request,
                              bool include_peer_certificate);
 
 private:
-  static void setAttrContextPeer(envoy::service::auth::v2::AttributeContext_Peer& peer,
+  static void setAttrContextPeer(envoy::service::auth::v3alpha::AttributeContext::Peer& peer,
                                  const Network::Connection& connection, const std::string& service,
                                  const bool local, bool include_certificate);
-  static void setHttpRequest(::envoy::service::auth::v2::AttributeContext_HttpRequest& httpreq,
+  static void setHttpRequest(envoy::service::auth::v3alpha::AttributeContext::HttpRequest& httpreq,
                              const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
                              const Envoy::Http::HeaderMap& headers, uint64_t max_request_bytes);
-  static void setAttrContextRequest(::envoy::service::auth::v2::AttributeContext_Request& req,
+  static void setAttrContextRequest(envoy::service::auth::v3alpha::AttributeContext::Request& req,
                                     const Envoy::Http::StreamDecoderFilterCallbacks* callbacks,
                                     const Envoy::Http::HeaderMap& headers,
                                     uint64_t max_request_bytes);
diff --git a/source/extensions/filters/common/ext_authz/ext_authz.h b/source/extensions/filters/common/ext_authz/ext_authz.h
index 4a76a3f6da7a..1075daac6828 100644
--- a/source/extensions/filters/common/ext_authz/ext_authz.h
+++ b/source/extensions/filters/common/ext_authz/ext_authz.h
@@ -7,7 +7,7 @@
 
 #include "envoy/common/pure.h"
 #include "envoy/http/codes.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/tracing/http_tracer.h"
 
 #include "common/singleton/const_singleton.h"
@@ -93,7 +93,7 @@ class Client {
    *
    */
   virtual void check(RequestCallbacks& callback,
-                     const envoy::service::auth::v2::CheckRequest& request,
+                     const envoy::service::auth::v3alpha::CheckRequest& request,
                      Tracing::Span& parent_span) PURE;
 };
 
diff --git a/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.cc b/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.cc
index 147d6ae80367..1a31e616839c 100644
--- a/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.cc
+++ b/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/common/ext_authz/ext_authz_grpc_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 
 #include "common/common/assert.h"
 #include "common/grpc/async_client_impl.h"
@@ -36,7 +36,7 @@ void GrpcClientImpl::cancel() {
 }
 
 void GrpcClientImpl::check(RequestCallbacks& callbacks,
-                           const envoy::service::auth::v2::CheckRequest& request,
+                           const envoy::service::auth::v3alpha::CheckRequest& request,
                            Tracing::Span& parent_span) {
   ASSERT(callbacks_ == nullptr);
   callbacks_ = &callbacks;
@@ -45,8 +45,8 @@ void GrpcClientImpl::check(RequestCallbacks& callbacks,
                                  Http::AsyncClient::RequestOptions().setTimeout(timeout_));
 }
 
-void GrpcClientImpl::onSuccess(std::unique_ptr<envoy::service::auth::v2::CheckResponse>&& response,
-                               Tracing::Span& span) {
+void GrpcClientImpl::onSuccess(
+    std::unique_ptr<envoy::service::auth::v3alpha::CheckResponse>&& response, Tracing::Span& span) {
   ResponsePtr authz_response = std::make_unique<Response>(Response{});
   if (response->status().code() == Grpc::Status::WellKnownGrpcStatus::Ok) {
     span.setTag(TracingConstants::get().TraceStatus, TracingConstants::get().TraceOk);
@@ -83,7 +83,7 @@ void GrpcClientImpl::onFailure(Grpc::Status::GrpcStatus status, const std::strin
 
 void GrpcClientImpl::toAuthzResponseHeader(
     ResponsePtr& response,
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers) {
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>& headers) {
   for (const auto& header : headers) {
     if (header.append().value()) {
       response->headers_to_append.emplace_back(Http::LowerCaseString(header.header().key()),
diff --git a/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.h b/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.h
index 328113d977bd..7bd5b9c54b9a 100644
--- a/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.h
+++ b/source/extensions/filters/common/ext_authz/ext_authz_grpc_impl.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/http/filter.h"
@@ -14,7 +14,7 @@
 #include "envoy/network/address.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/tracing/http_tracer.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -29,7 +29,8 @@ namespace Filters {
 namespace Common {
 namespace ExtAuthz {
 
-using ExtAuthzAsyncCallbacks = Grpc::AsyncRequestCallbacks<envoy::service::auth::v2::CheckResponse>;
+using ExtAuthzAsyncCallbacks =
+    Grpc::AsyncRequestCallbacks<envoy::service::auth::v3alpha::CheckResponse>;
 
 /*
  * This client implementation is used when the Ext_Authz filter needs to communicate with an gRPC
@@ -47,12 +48,13 @@ class GrpcClientImpl : public Client, public ExtAuthzAsyncCallbacks {
 
   // ExtAuthz::Client
   void cancel() override;
-  void check(RequestCallbacks& callbacks, const envoy::service::auth::v2::CheckRequest& request,
+  void check(RequestCallbacks& callbacks,
+             const envoy::service::auth::v3alpha::CheckRequest& request,
              Tracing::Span& parent_span) override;
 
   // Grpc::AsyncRequestCallbacks
   void onCreateInitialMetadata(Http::HeaderMap&) override {}
-  void onSuccess(std::unique_ptr<envoy::service::auth::v2::CheckResponse>&& response,
+  void onSuccess(std::unique_ptr<envoy::service::auth::v3alpha::CheckResponse>&& response,
                  Tracing::Span& span) override;
   void onFailure(Grpc::Status::GrpcStatus status, const std::string& message,
                  Tracing::Span& span) override;
@@ -61,9 +63,10 @@ class GrpcClientImpl : public Client, public ExtAuthzAsyncCallbacks {
   static const Protobuf::MethodDescriptor& getMethodDescriptor(bool use_alpha);
   void toAuthzResponseHeader(
       ResponsePtr& response,
-      const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers);
+      const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>& headers);
   const Protobuf::MethodDescriptor& service_method_;
-  Grpc::AsyncClient<envoy::service::auth::v2::CheckRequest, envoy::service::auth::v2::CheckResponse>
+  Grpc::AsyncClient<envoy::service::auth::v3alpha::CheckRequest,
+                    envoy::service::auth::v3alpha::CheckResponse>
       async_client_;
   Grpc::AsyncRequest* request_{};
   absl::optional<std::chrono::milliseconds> timeout_;
diff --git a/source/extensions/filters/common/ext_authz/ext_authz_http_impl.cc b/source/extensions/filters/common/ext_authz/ext_authz_http_impl.cc
index fc7538cc43a6..7fbe2e955be4 100644
--- a/source/extensions/filters/common/ext_authz/ext_authz_http_impl.cc
+++ b/source/extensions/filters/common/ext_authz/ext_authz_http_impl.cc
@@ -1,9 +1,9 @@
 #include "extensions/filters/common/ext_authz/ext_authz_http_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/common/enum_to_int.h"
 #include "common/common/fmt.h"
@@ -58,7 +58,7 @@ struct SuccessResponse {
 };
 
 std::vector<Matchers::LowerCaseStringMatcherPtr>
-createLowerCaseMatchers(const envoy::type::matcher::ListStringMatcher& list) {
+createLowerCaseMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& list) {
   std::vector<Matchers::LowerCaseStringMatcherPtr> matchers;
   for (const auto& matcher : list.patterns()) {
     matchers.push_back(std::make_unique<Matchers::LowerCaseStringMatcher>(matcher));
@@ -83,8 +83,9 @@ NotHeaderKeyMatcher::NotHeaderKeyMatcher(std::vector<Matchers::LowerCaseStringMa
 bool NotHeaderKeyMatcher::matches(absl::string_view key) const { return !matcher_.matches(key); }
 
 // Config
-ClientConfig::ClientConfig(const envoy::config::filter::http::ext_authz::v2::ExtAuthz& config,
-                           uint32_t timeout, absl::string_view path_prefix)
+ClientConfig::ClientConfig(
+    const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz& config, uint32_t timeout,
+    absl::string_view path_prefix)
     : request_header_matchers_(
           toRequestMatchers(config.http_service().authorization_request().allowed_headers())),
       client_header_matchers_(toClientMatchers(
@@ -98,14 +99,14 @@ ClientConfig::ClientConfig(const envoy::config::filter::http::ext_authz::v2::Ext
       tracing_name_(fmt::format("async {} egress", config.http_service().server_uri().cluster())) {}
 
 MatcherSharedPtr
-ClientConfig::toRequestMatchers(const envoy::type::matcher::ListStringMatcher& list) {
+ClientConfig::toRequestMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& list) {
   const std::vector<Http::LowerCaseString> keys{
       {Http::Headers::get().Authorization, Http::Headers::get().Method, Http::Headers::get().Path,
        Http::Headers::get().Host}};
 
   std::vector<Matchers::LowerCaseStringMatcherPtr> matchers(createLowerCaseMatchers(list));
   for (const auto& key : keys) {
-    envoy::type::matcher::StringMatcher matcher;
+    envoy::type::matcher::v3alpha::StringMatcher matcher;
     matcher.set_exact(key.get());
     matchers.push_back(std::make_unique<Matchers::LowerCaseStringMatcher>(matcher));
   }
@@ -114,13 +115,13 @@ ClientConfig::toRequestMatchers(const envoy::type::matcher::ListStringMatcher& l
 }
 
 MatcherSharedPtr
-ClientConfig::toClientMatchers(const envoy::type::matcher::ListStringMatcher& list) {
+ClientConfig::toClientMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& list) {
   std::vector<Matchers::LowerCaseStringMatcherPtr> matchers(createLowerCaseMatchers(list));
 
   // If list is empty, all authorization response headers, except Host, should be added to
   // the client response.
   if (matchers.empty()) {
-    envoy::type::matcher::StringMatcher matcher;
+    envoy::type::matcher::v3alpha::StringMatcher matcher;
     matcher.set_exact(Http::Headers::get().Host.get());
     matchers.push_back(std::make_unique<Matchers::LowerCaseStringMatcher>(matcher));
 
@@ -134,7 +135,7 @@ ClientConfig::toClientMatchers(const envoy::type::matcher::ListStringMatcher& li
        Http::Headers::get().WWWAuthenticate, Http::Headers::get().Location}};
 
   for (const auto& key : keys) {
-    envoy::type::matcher::StringMatcher matcher;
+    envoy::type::matcher::v3alpha::StringMatcher matcher;
     matcher.set_exact(key.get());
     matchers.push_back(std::make_unique<Matchers::LowerCaseStringMatcher>(matcher));
   }
@@ -143,12 +144,12 @@ ClientConfig::toClientMatchers(const envoy::type::matcher::ListStringMatcher& li
 }
 
 MatcherSharedPtr
-ClientConfig::toUpstreamMatchers(const envoy::type::matcher::ListStringMatcher& list) {
+ClientConfig::toUpstreamMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& list) {
   return std::make_unique<HeaderKeyMatcher>(createLowerCaseMatchers(list));
 }
 
 Http::LowerCaseStrPairVector ClientConfig::toHeadersAdd(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue>& headers) {
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue>& headers) {
   Http::LowerCaseStrPairVector header_vec;
   header_vec.reserve(headers.size());
   for (const auto& header : headers) {
@@ -178,7 +179,7 @@ void RawHttpClientImpl::cancel() {
 
 // Client
 void RawHttpClientImpl::check(RequestCallbacks& callbacks,
-                              const envoy::service::auth::v2::CheckRequest& request,
+                              const envoy::service::auth::v3alpha::CheckRequest& request,
                               Tracing::Span& parent_span) {
   ASSERT(callbacks_ == nullptr);
   ASSERT(span_ == nullptr);
diff --git a/source/extensions/filters/common/ext_authz/ext_authz_http_impl.h b/source/extensions/filters/common/ext_authz/ext_authz_http_impl.h
index 2d23e1f480cf..9ca583264a1b 100644
--- a/source/extensions/filters/common/ext_authz/ext_authz_http_impl.h
+++ b/source/extensions/filters/common/ext_authz/ext_authz_http_impl.h
@@ -1,10 +1,10 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/tracing/http_tracer.h"
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "common/common/logger.h"
@@ -61,8 +61,8 @@ class NotHeaderKeyMatcher : public Matcher {
  */
 class ClientConfig {
 public:
-  ClientConfig(const envoy::config::filter::http::ext_authz::v2::ExtAuthz& config, uint32_t timeout,
-               absl::string_view path_prefix);
+  ClientConfig(const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz& config,
+               uint32_t timeout, absl::string_view path_prefix);
 
   /**
    * Returns the name of the authorization cluster.
@@ -108,12 +108,14 @@ class ClientConfig {
   const std::string& tracingName() { return tracing_name_; }
 
 private:
-  static MatcherSharedPtr toRequestMatchers(const envoy::type::matcher::ListStringMatcher& matcher);
-  static MatcherSharedPtr toClientMatchers(const envoy::type::matcher::ListStringMatcher& matcher);
   static MatcherSharedPtr
-  toUpstreamMatchers(const envoy::type::matcher::ListStringMatcher& matcher);
+  toRequestMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& matcher);
+  static MatcherSharedPtr
+  toClientMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& matcher);
+  static MatcherSharedPtr
+  toUpstreamMatchers(const envoy::type::matcher::v3alpha::ListStringMatcher& matcher);
   static Http::LowerCaseStrPairVector
-  toHeadersAdd(const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue>&);
+  toHeadersAdd(const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue>&);
 
   const MatcherSharedPtr request_header_matchers_;
   const MatcherSharedPtr client_header_matchers_;
@@ -144,8 +146,8 @@ class RawHttpClientImpl : public Client,
 
   // ExtAuthz::Client
   void cancel() override;
-  void check(RequestCallbacks& callbacks, const envoy::service::auth::v2::CheckRequest& request,
-             Tracing::Span&) override;
+  void check(RequestCallbacks& callbacks,
+             const envoy::service::auth::v3alpha::CheckRequest& request, Tracing::Span&) override;
 
   // Http::AsyncClient::Callbacks
   void onSuccess(Http::MessagePtr&& message) override;
diff --git a/source/extensions/filters/common/fault/BUILD b/source/extensions/filters/common/fault/BUILD
index 77da44c89a7a..26598434c4c9 100644
--- a/source/extensions/filters/common/fault/BUILD
+++ b/source/extensions/filters/common/fault/BUILD
@@ -16,7 +16,7 @@ envoy_cc_library(
         "//include/envoy/http:header_map_interface",
         "//source/common/http:headers_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/config/filter/fault/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/common/fault/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/common/fault/fault_config.cc b/source/extensions/filters/common/fault/fault_config.cc
index af6f2ebc2611..79fb3f81212a 100644
--- a/source/extensions/filters/common/fault/fault_config.cc
+++ b/source/extensions/filters/common/fault/fault_config.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/common/fault/fault_config.h"
 
-#include "envoy/config/filter/fault/v2/fault.pb.h"
+#include "envoy/extensions/filters/common/fault/v3alpha/fault.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -10,17 +10,21 @@ namespace Filters {
 namespace Common {
 namespace Fault {
 
-FaultDelayConfig::FaultDelayConfig(const envoy::config::filter::fault::v2::FaultDelay& delay_config)
+FaultDelayConfig::FaultDelayConfig(
+    const envoy::extensions::filters::common::fault::v3alpha::FaultDelay& delay_config)
     : percentage_(delay_config.percentage()) {
   switch (delay_config.fault_delay_secifier_case()) {
-  case envoy::config::filter::fault::v2::FaultDelay::kFixedDelay:
+  case envoy::extensions::filters::common::fault::v3alpha::FaultDelay::FaultDelaySecifierCase::
+      kFixedDelay:
     provider_ = std::make_unique<FixedDelayProvider>(
         std::chrono::milliseconds(PROTOBUF_GET_MS_REQUIRED(delay_config, fixed_delay)));
     break;
-  case envoy::config::filter::fault::v2::FaultDelay::kHeaderDelay:
+  case envoy::extensions::filters::common::fault::v3alpha::FaultDelay::FaultDelaySecifierCase::
+      kHeaderDelay:
     provider_ = std::make_unique<HeaderDelayProvider>();
     break;
-  case envoy::config::filter::fault::v2::FaultDelay::FAULT_DELAY_SECIFIER_NOT_SET:
+  case envoy::extensions::filters::common::fault::v3alpha::FaultDelay::FaultDelaySecifierCase::
+      FAULT_DELAY_SECIFIER_NOT_SET:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 }
@@ -40,17 +44,20 @@ FaultDelayConfig::HeaderDelayProvider::duration(const Http::HeaderEntry* header)
 }
 
 FaultRateLimitConfig::FaultRateLimitConfig(
-    const envoy::config::filter::fault::v2::FaultRateLimit& rate_limit_config)
+    const envoy::extensions::filters::common::fault::v3alpha::FaultRateLimit& rate_limit_config)
     : percentage_(rate_limit_config.percentage()) {
   switch (rate_limit_config.limit_type_case()) {
-  case envoy::config::filter::fault::v2::FaultRateLimit::kFixedLimit:
+  case envoy::extensions::filters::common::fault::v3alpha::FaultRateLimit::LimitTypeCase::
+      kFixedLimit:
     provider_ =
         std::make_unique<FixedRateLimitProvider>(rate_limit_config.fixed_limit().limit_kbps());
     break;
-  case envoy::config::filter::fault::v2::FaultRateLimit::kHeaderLimit:
+  case envoy::extensions::filters::common::fault::v3alpha::FaultRateLimit::LimitTypeCase::
+      kHeaderLimit:
     provider_ = std::make_unique<HeaderRateLimitProvider>();
     break;
-  case envoy::config::filter::fault::v2::FaultRateLimit::LIMIT_TYPE_NOT_SET:
+  case envoy::extensions::filters::common::fault::v3alpha::FaultRateLimit::LimitTypeCase::
+      LIMIT_TYPE_NOT_SET:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 }
diff --git a/source/extensions/filters/common/fault/fault_config.h b/source/extensions/filters/common/fault/fault_config.h
index 7f17a2ea8825..dc5e64341121 100644
--- a/source/extensions/filters/common/fault/fault_config.h
+++ b/source/extensions/filters/common/fault/fault_config.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/config/filter/fault/v2/fault.pb.h"
+#include "envoy/extensions/filters/common/fault/v3alpha/fault.pb.h"
 #include "envoy/http/header_map.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/http/headers.h"
 #include "common/singleton/const_singleton.h"
@@ -29,9 +29,10 @@ using HeaderNames = ConstSingleton<HeaderNameValues>;
  */
 class FaultDelayConfig {
 public:
-  FaultDelayConfig(const envoy::config::filter::fault::v2::FaultDelay& delay_config);
+  FaultDelayConfig(
+      const envoy::extensions::filters::common::fault::v3alpha::FaultDelay& delay_config);
 
-  const envoy::type::FractionalPercent& percentage() const { return percentage_; }
+  const envoy::type::v3alpha::FractionalPercent& percentage() const { return percentage_; }
   absl::optional<std::chrono::milliseconds> duration(const Http::HeaderEntry* header) const {
     return provider_->duration(header);
   }
@@ -73,7 +74,7 @@ class FaultDelayConfig {
   using DelayProviderPtr = std::unique_ptr<DelayProvider>;
 
   DelayProviderPtr provider_;
-  const envoy::type::FractionalPercent percentage_;
+  const envoy::type::v3alpha::FractionalPercent percentage_;
 };
 
 using FaultDelayConfigPtr = std::unique_ptr<FaultDelayConfig>;
@@ -84,9 +85,10 @@ using FaultDelayConfigSharedPtr = std::shared_ptr<FaultDelayConfig>;
  */
 class FaultRateLimitConfig {
 public:
-  FaultRateLimitConfig(const envoy::config::filter::fault::v2::FaultRateLimit& rate_limit_config);
+  FaultRateLimitConfig(
+      const envoy::extensions::filters::common::fault::v3alpha::FaultRateLimit& rate_limit_config);
 
-  const envoy::type::FractionalPercent& percentage() const { return percentage_; }
+  const envoy::type::v3alpha::FractionalPercent& percentage() const { return percentage_; }
   absl::optional<uint64_t> rateKbps(const Http::HeaderEntry* header) const {
     return provider_->rateKbps(header);
   }
@@ -123,7 +125,7 @@ class FaultRateLimitConfig {
   using RateLimitProviderPtr = std::unique_ptr<RateLimitProvider>;
 
   RateLimitProviderPtr provider_;
-  const envoy::type::FractionalPercent percentage_;
+  const envoy::type::v3alpha::FractionalPercent percentage_;
 };
 
 using FaultRateLimitConfigPtr = std::unique_ptr<FaultRateLimitConfig>;
diff --git a/source/extensions/filters/common/original_src/BUILD b/source/extensions/filters/common/original_src/BUILD
index 4e53b2901223..36847e49586a 100644
--- a/source/extensions/filters/common/original_src/BUILD
+++ b/source/extensions/filters/common/original_src/BUILD
@@ -20,7 +20,7 @@ envoy_cc_library(
         "//source/common/common:minimal_logger_lib",
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/filters/common/original_src/original_src_socket_option.cc b/source/extensions/filters/common/original_src/original_src_socket_option.cc
index 26881b9a5c51..cc79f80f74ab 100644
--- a/source/extensions/filters/common/original_src/original_src_socket_option.cc
+++ b/source/extensions/filters/common/original_src/original_src_socket_option.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/common/original_src/original_src_socket_option.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/assert.h"
 
@@ -18,9 +18,9 @@ OriginalSrcSocketOption::OriginalSrcSocketOption(
 }
 
 bool OriginalSrcSocketOption::setOption(
-    Network::Socket& socket, envoy::api::v2::core::SocketOption::SocketState state) const {
+    Network::Socket& socket, envoy::config::core::v3alpha::SocketOption::SocketState state) const {
 
-  if (state == envoy::api::v2::core::SocketOption::STATE_PREBIND) {
+  if (state == envoy::config::core::v3alpha::SocketOption::STATE_PREBIND) {
     socket.setLocalAddress(src_address_);
   }
 
@@ -52,9 +52,8 @@ void OriginalSrcSocketOption::hashKey(std::vector<uint8_t>& key) const {
   }
 }
 
-absl::optional<Network::Socket::Option::Details>
-OriginalSrcSocketOption::getOptionDetails(const Network::Socket&,
-                                          envoy::api::v2::core::SocketOption::SocketState) const {
+absl::optional<Network::Socket::Option::Details> OriginalSrcSocketOption::getOptionDetails(
+    const Network::Socket&, envoy::config::core::v3alpha::SocketOption::SocketState) const {
   // no details for this option.
   return absl::nullopt;
 }
diff --git a/source/extensions/filters/common/original_src/original_src_socket_option.h b/source/extensions/filters/common/original_src/original_src_socket_option.h
index 096835e4077e..b8ac7c7c4c30 100644
--- a/source/extensions/filters/common/original_src/original_src_socket_option.h
+++ b/source/extensions/filters/common/original_src/original_src_socket_option.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/listen_socket.h"
 
@@ -26,7 +26,7 @@ class OriginalSrcSocketOption : public Network::Socket::Option {
    * Adds socket options to the socket to allow this to work.
    */
   bool setOption(Network::Socket& socket,
-                 envoy::api::v2::core::SocketOption::SocketState state) const override;
+                 envoy::config::core::v3alpha::SocketOption::SocketState state) const override;
 
   /**
    * Appends a key which uniquely identifies the address being tracked.
@@ -35,7 +35,7 @@ class OriginalSrcSocketOption : public Network::Socket::Option {
 
   absl::optional<Details>
   getOptionDetails(const Network::Socket& socket,
-                   envoy::api::v2::core::SocketOption::SocketState state) const override;
+                   envoy::config::core::v3alpha::SocketOption::SocketState state) const override;
 
 private:
   Network::Address::InstanceConstSharedPtr src_address_;
diff --git a/source/extensions/filters/common/ratelimit/BUILD b/source/extensions/filters/common/ratelimit/BUILD
index 2f6ac8c9ccb5..8ad330edd5f5 100644
--- a/source/extensions/filters/common/ratelimit/BUILD
+++ b/source/extensions/filters/common/ratelimit/BUILD
@@ -24,9 +24,9 @@ envoy_cc_library(
         "//source/common/grpc:typed_async_client_lib",
         "//source/common/http:headers_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/ratelimit:pkg_cc_proto",
-        "@envoy_api//envoy/service/ratelimit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/ratelimit/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/filters/common/ratelimit/ratelimit_impl.cc b/source/extensions/filters/common/ratelimit/ratelimit_impl.cc
index e8c952b5eca0..4ae21a91fce8 100644
--- a/source/extensions/filters/common/ratelimit/ratelimit_impl.cc
+++ b/source/extensions/filters/common/ratelimit/ratelimit_impl.cc
@@ -5,9 +5,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/api/v2/ratelimit/ratelimit.pb.h"
-#include "envoy/service/ratelimit/v2/rls.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/common/ratelimit/v3alpha/ratelimit.pb.h"
+#include "envoy/service/ratelimit/v3alpha/rls.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/assert.h"
@@ -34,14 +34,15 @@ void GrpcClientImpl::cancel() {
   callbacks_ = nullptr;
 }
 
-void GrpcClientImpl::createRequest(envoy::service::ratelimit::v2::RateLimitRequest& request,
+void GrpcClientImpl::createRequest(envoy::service::ratelimit::v3alpha::RateLimitRequest& request,
                                    const std::string& domain,
                                    const std::vector<Envoy::RateLimit::Descriptor>& descriptors) {
   request.set_domain(domain);
   for (const Envoy::RateLimit::Descriptor& descriptor : descriptors) {
-    envoy::api::v2::ratelimit::RateLimitDescriptor* new_descriptor = request.add_descriptors();
+    envoy::extensions::common::ratelimit::v3alpha::RateLimitDescriptor* new_descriptor =
+        request.add_descriptors();
     for (const Envoy::RateLimit::DescriptorEntry& entry : descriptor.entries_) {
-      envoy::api::v2::ratelimit::RateLimitDescriptor::Entry* new_entry =
+      envoy::extensions::common::ratelimit::v3alpha::RateLimitDescriptor::Entry* new_entry =
           new_descriptor->add_entries();
       new_entry->set_key(entry.key_);
       new_entry->set_value(entry.value_);
@@ -55,7 +56,7 @@ void GrpcClientImpl::limit(RequestCallbacks& callbacks, const std::string& domai
   ASSERT(callbacks_ == nullptr);
   callbacks_ = &callbacks;
 
-  envoy::service::ratelimit::v2::RateLimitRequest request;
+  envoy::service::ratelimit::v3alpha::RateLimitRequest request;
   createRequest(request, domain, descriptors);
 
   request_ = async_client_->send(service_method_, request, *this, parent_span,
@@ -63,11 +64,13 @@ void GrpcClientImpl::limit(RequestCallbacks& callbacks, const std::string& domai
 }
 
 void GrpcClientImpl::onSuccess(
-    std::unique_ptr<envoy::service::ratelimit::v2::RateLimitResponse>&& response,
+    std::unique_ptr<envoy::service::ratelimit::v3alpha::RateLimitResponse>&& response,
     Tracing::Span& span) {
   LimitStatus status = LimitStatus::OK;
-  ASSERT(response->overall_code() != envoy::service::ratelimit::v2::RateLimitResponse::UNKNOWN);
-  if (response->overall_code() == envoy::service::ratelimit::v2::RateLimitResponse::OVER_LIMIT) {
+  ASSERT(response->overall_code() !=
+         envoy::service::ratelimit::v3alpha::RateLimitResponse::UNKNOWN);
+  if (response->overall_code() ==
+      envoy::service::ratelimit::v3alpha::RateLimitResponse::OVER_LIMIT) {
     status = LimitStatus::OverLimit;
     span.setTag(Constants::get().TraceStatus, Constants::get().TraceOverLimit);
   } else {
@@ -75,9 +78,9 @@ void GrpcClientImpl::onSuccess(
   }
 
   Http::HeaderMapPtr response_headers_to_add, request_headers_to_add;
-  if (!response->headers().empty()) {
+  if (!response->response_headers_to_add().empty()) {
     response_headers_to_add = std::make_unique<Http::HeaderMapImpl>();
-    for (const auto& h : response->headers()) {
+    for (const auto& h : response->response_headers_to_add()) {
       response_headers_to_add->addCopy(Http::LowerCaseString(h.key()), h.value());
     }
   }
@@ -101,7 +104,7 @@ void GrpcClientImpl::onFailure(Grpc::Status::GrpcStatus status, const std::strin
 }
 
 ClientPtr rateLimitClient(Server::Configuration::FactoryContext& context,
-                          const envoy::api::v2::core::GrpcService& grpc_service,
+                          const envoy::config::core::v3alpha::GrpcService& grpc_service,
                           const std::chrono::milliseconds timeout) {
   // TODO(ramaraochavali): register client to singleton when GrpcClientImpl supports concurrent
   // requests.
diff --git a/source/extensions/filters/common/ratelimit/ratelimit_impl.h b/source/extensions/filters/common/ratelimit/ratelimit_impl.h
index 6ae9cb821bd3..386c240f73c5 100644
--- a/source/extensions/filters/common/ratelimit/ratelimit_impl.h
+++ b/source/extensions/filters/common/ratelimit/ratelimit_impl.h
@@ -5,12 +5,12 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/ratelimit/ratelimit.h"
 #include "envoy/server/filter_config.h"
-#include "envoy/service/ratelimit/v2/rls.pb.h"
+#include "envoy/service/ratelimit/v3alpha/rls.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/tracing/http_tracer.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -28,7 +28,7 @@ namespace Common {
 namespace RateLimit {
 
 using RateLimitAsyncCallbacks =
-    Grpc::AsyncRequestCallbacks<envoy::service::ratelimit::v2::RateLimitResponse>;
+    Grpc::AsyncRequestCallbacks<envoy::service::ratelimit::v3alpha::RateLimitResponse>;
 
 struct ConstantValues {
   const std::string TraceStatus = "ratelimit_status";
@@ -49,7 +49,7 @@ class GrpcClientImpl : public Client,
                  const absl::optional<std::chrono::milliseconds>& timeout);
   ~GrpcClientImpl() override;
 
-  static void createRequest(envoy::service::ratelimit::v2::RateLimitRequest& request,
+  static void createRequest(envoy::service::ratelimit::v3alpha::RateLimitRequest& request,
                             const std::string& domain,
                             const std::vector<Envoy::RateLimit::Descriptor>& descriptors);
 
@@ -61,15 +61,15 @@ class GrpcClientImpl : public Client,
 
   // Grpc::AsyncRequestCallbacks
   void onCreateInitialMetadata(Http::HeaderMap&) override {}
-  void onSuccess(std::unique_ptr<envoy::service::ratelimit::v2::RateLimitResponse>&& response,
+  void onSuccess(std::unique_ptr<envoy::service::ratelimit::v3alpha::RateLimitResponse>&& response,
                  Tracing::Span& span) override;
   void onFailure(Grpc::Status::GrpcStatus status, const std::string& message,
                  Tracing::Span& span) override;
 
 private:
   const Protobuf::MethodDescriptor& service_method_;
-  Grpc::AsyncClient<envoy::service::ratelimit::v2::RateLimitRequest,
-                    envoy::service::ratelimit::v2::RateLimitResponse>
+  Grpc::AsyncClient<envoy::service::ratelimit::v3alpha::RateLimitRequest,
+                    envoy::service::ratelimit::v3alpha::RateLimitResponse>
       async_client_;
   Grpc::AsyncRequest* request_{};
   absl::optional<std::chrono::milliseconds> timeout_;
@@ -80,7 +80,7 @@ class GrpcClientImpl : public Client,
  * Builds the rate limit client.
  */
 ClientPtr rateLimitClient(Server::Configuration::FactoryContext& context,
-                          const envoy::api::v2::core::GrpcService& grpc_service,
+                          const envoy::config::core::v3alpha::GrpcService& grpc_service,
                           const std::chrono::milliseconds timeout);
 
 } // namespace RateLimit
diff --git a/source/extensions/filters/common/rbac/BUILD b/source/extensions/filters/common/rbac/BUILD
index 510ddccce10b..bfc4ea665324 100644
--- a/source/extensions/filters/common/rbac/BUILD
+++ b/source/extensions/filters/common/rbac/BUILD
@@ -32,10 +32,10 @@ envoy_cc_library(
         "//source/common/http:header_utility_lib",
         "//source/common/network:cidr_range_lib",
         "//source/extensions/filters/common/expr:evaluator_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -56,6 +56,6 @@ envoy_cc_library(
     deps = [
         "//source/extensions/filters/common/rbac:engine_interface",
         "//source/extensions/filters/common/rbac:matchers_lib",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/common/rbac/engine_impl.cc b/source/extensions/filters/common/rbac/engine_impl.cc
index 792a268b74df..5415df814fd4 100644
--- a/source/extensions/filters/common/rbac/engine_impl.cc
+++ b/source/extensions/filters/common/rbac/engine_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/common/rbac/engine_impl.h"
 
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
 
 #include "common/http/header_map_impl.h"
 
@@ -11,8 +11,8 @@ namespace Common {
 namespace RBAC {
 
 RoleBasedAccessControlEngineImpl::RoleBasedAccessControlEngineImpl(
-    const envoy::config::rbac::v2::RBAC& rules)
-    : allowed_if_matched_(rules.action() == envoy::config::rbac::v2::RBAC::ALLOW) {
+    const envoy::config::rbac::v3alpha::RBAC& rules)
+    : allowed_if_matched_(rules.action() == envoy::config::rbac::v3alpha::RBAC::ALLOW) {
   // guard expression builder by presence of a condition in policies
   for (const auto& policy : rules.policies()) {
     if (policy.second.has_condition()) {
diff --git a/source/extensions/filters/common/rbac/engine_impl.h b/source/extensions/filters/common/rbac/engine_impl.h
index 600651e95865..9f324fe625e4 100644
--- a/source/extensions/filters/common/rbac/engine_impl.h
+++ b/source/extensions/filters/common/rbac/engine_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
 
 #include "extensions/filters/common/rbac/engine.h"
 #include "extensions/filters/common/rbac/matchers.h"
@@ -13,7 +13,7 @@ namespace RBAC {
 
 class RoleBasedAccessControlEngineImpl : public RoleBasedAccessControlEngine, NonCopyable {
 public:
-  RoleBasedAccessControlEngineImpl(const envoy::config::rbac::v2::RBAC& rules);
+  RoleBasedAccessControlEngineImpl(const envoy::config::rbac::v3alpha::RBAC& rules);
 
   bool allowed(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
                const StreamInfo::StreamInfo& info, std::string* effective_policy_id) const override;
diff --git a/source/extensions/filters/common/rbac/matchers.cc b/source/extensions/filters/common/rbac/matchers.cc
index 8fc81347101e..d3712d613f93 100644
--- a/source/extensions/filters/common/rbac/matchers.cc
+++ b/source/extensions/filters/common/rbac/matchers.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/common/rbac/matchers.h"
 
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
 
 #include "common/common/assert.h"
 
@@ -10,61 +10,61 @@ namespace Filters {
 namespace Common {
 namespace RBAC {
 
-MatcherConstSharedPtr Matcher::create(const envoy::config::rbac::v2::Permission& permission) {
+MatcherConstSharedPtr Matcher::create(const envoy::config::rbac::v3alpha::Permission& permission) {
   switch (permission.rule_case()) {
-  case envoy::config::rbac::v2::Permission::RuleCase::kAndRules:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kAndRules:
     return std::make_shared<const AndMatcher>(permission.and_rules());
-  case envoy::config::rbac::v2::Permission::RuleCase::kOrRules:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kOrRules:
     return std::make_shared<const OrMatcher>(permission.or_rules());
-  case envoy::config::rbac::v2::Permission::RuleCase::kHeader:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kHeader:
     return std::make_shared<const HeaderMatcher>(permission.header());
-  case envoy::config::rbac::v2::Permission::RuleCase::kDestinationIp:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kDestinationIp:
     return std::make_shared<const IPMatcher>(permission.destination_ip(), true);
-  case envoy::config::rbac::v2::Permission::RuleCase::kDestinationPort:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kDestinationPort:
     return std::make_shared<const PortMatcher>(permission.destination_port());
-  case envoy::config::rbac::v2::Permission::RuleCase::kAny:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kAny:
     return std::make_shared<const AlwaysMatcher>();
-  case envoy::config::rbac::v2::Permission::RuleCase::kMetadata:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kMetadata:
     return std::make_shared<const MetadataMatcher>(permission.metadata());
-  case envoy::config::rbac::v2::Permission::RuleCase::kNotRule:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kNotRule:
     return std::make_shared<const NotMatcher>(permission.not_rule());
-  case envoy::config::rbac::v2::Permission::RuleCase::kRequestedServerName:
+  case envoy::config::rbac::v3alpha::Permission::RuleCase::kRequestedServerName:
     return std::make_shared<const RequestedServerNameMatcher>(permission.requested_server_name());
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 }
 
-MatcherConstSharedPtr Matcher::create(const envoy::config::rbac::v2::Principal& principal) {
+MatcherConstSharedPtr Matcher::create(const envoy::config::rbac::v3alpha::Principal& principal) {
   switch (principal.identifier_case()) {
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kAndIds:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kAndIds:
     return std::make_shared<const AndMatcher>(principal.and_ids());
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kOrIds:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kOrIds:
     return std::make_shared<const OrMatcher>(principal.or_ids());
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kAuthenticated:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kAuthenticated:
     return std::make_shared<const AuthenticatedMatcher>(principal.authenticated());
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kSourceIp:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kSourceIp:
     return std::make_shared<const IPMatcher>(principal.source_ip(), false);
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kHeader:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kHeader:
     return std::make_shared<const HeaderMatcher>(principal.header());
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kAny:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kAny:
     return std::make_shared<const AlwaysMatcher>();
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kMetadata:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kMetadata:
     return std::make_shared<const MetadataMatcher>(principal.metadata());
-  case envoy::config::rbac::v2::Principal::IdentifierCase::kNotId:
+  case envoy::config::rbac::v3alpha::Principal::IdentifierCase::kNotId:
     return std::make_shared<const NotMatcher>(principal.not_id());
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 }
 
-AndMatcher::AndMatcher(const envoy::config::rbac::v2::Permission_Set& set) {
+AndMatcher::AndMatcher(const envoy::config::rbac::v3alpha::Permission::Set& set) {
   for (const auto& rule : set.rules()) {
     matchers_.push_back(Matcher::create(rule));
   }
 }
 
-AndMatcher::AndMatcher(const envoy::config::rbac::v2::Principal_Set& set) {
+AndMatcher::AndMatcher(const envoy::config::rbac::v3alpha::Principal::Set& set) {
   for (const auto& id : set.ids()) {
     matchers_.push_back(Matcher::create(id));
   }
@@ -83,13 +83,14 @@ bool AndMatcher::matches(const Network::Connection& connection,
 }
 
 OrMatcher::OrMatcher(
-    const Protobuf::RepeatedPtrField<::envoy::config::rbac::v2::Permission>& rules) {
+    const Protobuf::RepeatedPtrField<envoy::config::rbac::v3alpha::Permission>& rules) {
   for (const auto& rule : rules) {
     matchers_.push_back(Matcher::create(rule));
   }
 }
 
-OrMatcher::OrMatcher(const Protobuf::RepeatedPtrField<::envoy::config::rbac::v2::Principal>& ids) {
+OrMatcher::OrMatcher(
+    const Protobuf::RepeatedPtrField<envoy::config::rbac::v3alpha::Principal>& ids) {
   for (const auto& id : ids) {
     matchers_.push_back(Matcher::create(id));
   }
diff --git a/source/extensions/filters/common/rbac/matchers.h b/source/extensions/filters/common/rbac/matchers.h
index 677d8c12e152..f55cf79c0256 100644
--- a/source/extensions/filters/common/rbac/matchers.h
+++ b/source/extensions/filters/common/rbac/matchers.h
@@ -2,12 +2,12 @@
 
 #include <memory>
 
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/network/connection.h"
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/common/matchers.h"
 #include "common/http/header_utility.h"
@@ -46,13 +46,13 @@ class Matcher {
    * Creates a shared instance of a matcher based off the rules defined in the Permission config
    * proto message.
    */
-  static MatcherConstSharedPtr create(const envoy::config::rbac::v2::Permission& permission);
+  static MatcherConstSharedPtr create(const envoy::config::rbac::v3alpha::Permission& permission);
 
   /**
    * Creates a shared instance of a matcher based off the rules defined in the Principal config
    * proto message.
    */
-  static MatcherConstSharedPtr create(const envoy::config::rbac::v2::Principal& principal);
+  static MatcherConstSharedPtr create(const envoy::config::rbac::v3alpha::Principal& principal);
 };
 
 /**
@@ -72,8 +72,8 @@ class AlwaysMatcher : public Matcher {
  */
 class AndMatcher : public Matcher {
 public:
-  AndMatcher(const envoy::config::rbac::v2::Permission_Set& rules);
-  AndMatcher(const envoy::config::rbac::v2::Principal_Set& ids);
+  AndMatcher(const envoy::config::rbac::v3alpha::Permission::Set& rules);
+  AndMatcher(const envoy::config::rbac::v3alpha::Principal::Set& ids);
 
   bool matches(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
                const StreamInfo::StreamInfo&) const override;
@@ -88,10 +88,10 @@ class AndMatcher : public Matcher {
  */
 class OrMatcher : public Matcher {
 public:
-  OrMatcher(const envoy::config::rbac::v2::Permission_Set& set) : OrMatcher(set.rules()) {}
-  OrMatcher(const envoy::config::rbac::v2::Principal_Set& set) : OrMatcher(set.ids()) {}
-  OrMatcher(const Protobuf::RepeatedPtrField<::envoy::config::rbac::v2::Permission>& rules);
-  OrMatcher(const Protobuf::RepeatedPtrField<::envoy::config::rbac::v2::Principal>& ids);
+  OrMatcher(const envoy::config::rbac::v3alpha::Permission::Set& set) : OrMatcher(set.rules()) {}
+  OrMatcher(const envoy::config::rbac::v3alpha::Principal::Set& set) : OrMatcher(set.ids()) {}
+  OrMatcher(const Protobuf::RepeatedPtrField<envoy::config::rbac::v3alpha::Permission>& rules);
+  OrMatcher(const Protobuf::RepeatedPtrField<envoy::config::rbac::v3alpha::Principal>& ids);
 
   bool matches(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
                const StreamInfo::StreamInfo&) const override;
@@ -102,9 +102,9 @@ class OrMatcher : public Matcher {
 
 class NotMatcher : public Matcher {
 public:
-  NotMatcher(const envoy::config::rbac::v2::Permission& permission)
+  NotMatcher(const envoy::config::rbac::v3alpha::Permission& permission)
       : matcher_(Matcher::create(permission)) {}
-  NotMatcher(const envoy::config::rbac::v2::Principal& principal)
+  NotMatcher(const envoy::config::rbac::v3alpha::Principal& principal)
       : matcher_(Matcher::create(principal)) {}
 
   bool matches(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
@@ -120,7 +120,7 @@ class NotMatcher : public Matcher {
  */
 class HeaderMatcher : public Matcher {
 public:
-  HeaderMatcher(const envoy::api::v2::route::HeaderMatcher& matcher) : header_(matcher) {}
+  HeaderMatcher(const envoy::config::route::v3alpha::HeaderMatcher& matcher) : header_(matcher) {}
 
   bool matches(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
                const StreamInfo::StreamInfo&) const override;
@@ -135,7 +135,7 @@ class HeaderMatcher : public Matcher {
  */
 class IPMatcher : public Matcher {
 public:
-  IPMatcher(const envoy::api::v2::core::CidrRange& range, bool destination)
+  IPMatcher(const envoy::config::core::v3alpha::CidrRange& range, bool destination)
       : range_(Network::Address::CidrRange::create(range)), destination_(destination) {}
 
   bool matches(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
@@ -166,7 +166,7 @@ class PortMatcher : public Matcher {
  */
 class AuthenticatedMatcher : public Matcher {
 public:
-  AuthenticatedMatcher(const envoy::config::rbac::v2::Principal_Authenticated& auth)
+  AuthenticatedMatcher(const envoy::config::rbac::v3alpha::Principal::Authenticated& auth)
       : matcher_(auth.has_principal_name()
                      ? absl::make_optional<Matchers::StringMatcherImpl>(auth.principal_name())
                      : absl::nullopt) {}
@@ -185,7 +185,7 @@ class AuthenticatedMatcher : public Matcher {
  */
 class PolicyMatcher : public Matcher, NonCopyable {
 public:
-  PolicyMatcher(const envoy::config::rbac::v2::Policy& policy, Expr::Builder* builder)
+  PolicyMatcher(const envoy::config::rbac::v3alpha::Policy& policy, Expr::Builder* builder)
       : permissions_(policy.permissions()), principals_(policy.principals()),
         condition_(policy.condition()) {
     if (policy.has_condition()) {
@@ -221,7 +221,8 @@ class MetadataMatcher : public Matcher {
  */
 class RequestedServerNameMatcher : public Matcher, Envoy::Matchers::StringMatcherImpl {
 public:
-  RequestedServerNameMatcher(const envoy::type::matcher::StringMatcher& requested_server_name)
+  RequestedServerNameMatcher(
+      const envoy::type::matcher::v3alpha::StringMatcher& requested_server_name)
       : Envoy::Matchers::StringMatcherImpl(requested_server_name) {}
 
   bool matches(const Network::Connection& connection, const Envoy::Http::HeaderMap& headers,
diff --git a/source/extensions/filters/http/adaptive_concurrency/BUILD b/source/extensions/filters/http/adaptive_concurrency/BUILD
index c74ead9fdf5b..846d3eac2d41 100644
--- a/source/extensions/filters/http/adaptive_concurrency/BUILD
+++ b/source/extensions/filters/http/adaptive_concurrency/BUILD
@@ -22,7 +22,7 @@ envoy_cc_library(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/adaptive_concurrency/concurrency_controller:concurrency_controller_lib",
         "//source/extensions/filters/http/common:pass_through_filter_lib",
-        "@envoy_api//envoy/config/filter/http/adaptive_concurrency/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/adaptive_concurrency/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -38,6 +38,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http/adaptive_concurrency:adaptive_concurrency_filter_lib",
         "//source/extensions/filters/http/adaptive_concurrency/concurrency_controller:concurrency_controller_lib",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/adaptive_concurrency/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/adaptive_concurrency/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc
index 6c747a91ad25..12940d3ff7dd 100644
--- a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc
+++ b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
 
 #include "common/common/assert.h"
 #include "common/protobuf/utility.h"
@@ -19,7 +19,7 @@ namespace HttpFilters {
 namespace AdaptiveConcurrency {
 
 AdaptiveConcurrencyFilterConfig::AdaptiveConcurrencyFilterConfig(
-    const envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency&
+    const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency&
         proto_config,
     Runtime::Loader& runtime, std::string stats_prefix, Stats::Scope&, TimeSource& time_source)
     : stats_prefix_(std::move(stats_prefix)), time_source_(time_source),
diff --git a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h
index accbc4eaefee..043fb2844316 100644
--- a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h
+++ b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h
@@ -5,7 +5,7 @@
 #include <string>
 
 #include "envoy/common/time.h"
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/scope.h"
@@ -28,7 +28,7 @@ namespace AdaptiveConcurrency {
 class AdaptiveConcurrencyFilterConfig {
 public:
   AdaptiveConcurrencyFilterConfig(
-      const envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency&
+      const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency&
           proto_config,
       Runtime::Loader& runtime, std::string stats_prefix, Stats::Scope& scope,
       TimeSource& time_source);
diff --git a/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD b/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD
index 139b72f0159c..aef301119432 100644
--- a/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD
+++ b/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD
@@ -28,6 +28,6 @@ envoy_cc_library(
         "//source/common/runtime:runtime_lib",
         "//source/common/stats:isolated_store_lib",
         "//source/common/stats:stats_lib",
-        "@envoy_api//envoy/config/filter/http/adaptive_concurrency/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/adaptive_concurrency/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.cc b/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.cc
index 95f54aa2d5fc..971d3d336be6 100644
--- a/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.cc
+++ b/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.cc
@@ -3,8 +3,8 @@
 #include <atomic>
 #include <chrono>
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/stats.h"
 
@@ -23,7 +23,7 @@ namespace AdaptiveConcurrency {
 namespace ConcurrencyController {
 
 GradientControllerConfig::GradientControllerConfig(
-    const envoy::config::filter::http::adaptive_concurrency::v2alpha::GradientControllerConfig&
+    const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::GradientControllerConfig&
         proto_config,
     Runtime::Loader& runtime)
     : runtime_(runtime),
diff --git a/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.h b/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.h
index 94480e318ebb..247146b076f1 100644
--- a/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.h
+++ b/source/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller.h
@@ -3,8 +3,8 @@
 #include <chrono>
 #include <vector>
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/stats_macros.h"
 
@@ -42,10 +42,9 @@ struct GradientControllerStats {
 
 class GradientControllerConfig : public Logger::Loggable<Logger::Id::filter> {
 public:
-  GradientControllerConfig(
-      const envoy::config::filter::http::adaptive_concurrency::v2alpha::GradientControllerConfig&
-          proto_config,
-      Runtime::Loader& runtime);
+  GradientControllerConfig(const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::
+                               GradientControllerConfig& proto_config,
+                           Runtime::Loader& runtime);
 
   std::chrono::milliseconds minRTTCalcInterval() const {
     const auto ms = runtime_.snapshot().getInteger(RuntimeKeys::get().MinRTTCalcIntervalKey,
diff --git a/source/extensions/filters/http/adaptive_concurrency/config.cc b/source/extensions/filters/http/adaptive_concurrency/config.cc
index b7598e56ff97..66881502ed76 100644
--- a/source/extensions/filters/http/adaptive_concurrency/config.cc
+++ b/source/extensions/filters/http/adaptive_concurrency/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/adaptive_concurrency/config.h"
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.validate.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h"
@@ -13,13 +13,15 @@ namespace HttpFilters {
 namespace AdaptiveConcurrency {
 
 Http::FilterFactoryCb AdaptiveConcurrencyFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency& config,
+    const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency&
+        config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
 
   auto acc_stats_prefix = stats_prefix + "adaptive_concurrency.";
 
   std::shared_ptr<ConcurrencyController::ConcurrencyController> controller;
-  using Proto = envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency;
+  using Proto =
+      envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency;
   ASSERT(config.concurrency_controller_config_case() ==
          Proto::ConcurrencyControllerConfigCase::kGradientControllerConfig);
   auto gradient_controller_config = ConcurrencyController::GradientControllerConfig(
diff --git a/source/extensions/filters/http/adaptive_concurrency/config.h b/source/extensions/filters/http/adaptive_concurrency/config.h
index bce0e0fc6c71..688125853ea6 100644
--- a/source/extensions/filters/http/adaptive_concurrency/config.h
+++ b/source/extensions/filters/http/adaptive_concurrency/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.validate.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -16,12 +16,12 @@ namespace AdaptiveConcurrency {
  */
 class AdaptiveConcurrencyFilterFactory
     : public Common::FactoryBase<
-          envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency> {
+          envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency> {
 public:
   AdaptiveConcurrencyFilterFactory() : FactoryBase(HttpFilterNames::get().AdaptiveConcurrency) {}
 
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency&
+      const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency&
           proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
diff --git a/source/extensions/filters/http/buffer/BUILD b/source/extensions/filters/http/buffer/BUILD
index d4df627dbb86..99066332b6f1 100644
--- a/source/extensions/filters/http/buffer/BUILD
+++ b/source/extensions/filters/http/buffer/BUILD
@@ -29,7 +29,7 @@ envoy_cc_library(
         "//source/common/http:utility_lib",
         "//source/common/runtime:runtime_lib",
         "//source/extensions/filters/http:well_known_names",
-        "@envoy_api//envoy/config/filter/http/buffer/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/buffer/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -43,6 +43,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/buffer:buffer_filter_lib",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/buffer/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/buffer/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/buffer/buffer_filter.cc b/source/extensions/filters/http/buffer/buffer_filter.cc
index 77e56c61effb..0334ed583182 100644
--- a/source/extensions/filters/http/buffer/buffer_filter.cc
+++ b/source/extensions/filters/http/buffer/buffer_filter.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/buffer/buffer_filter.h"
 
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
 #include "envoy/http/codes.h"
 
 #include "common/common/assert.h"
@@ -20,12 +20,12 @@ namespace HttpFilters {
 namespace BufferFilter {
 
 BufferFilterSettings::BufferFilterSettings(
-    const envoy::config::filter::http::buffer::v2::Buffer& proto_config)
+    const envoy::extensions::filters::http::buffer::v3alpha::Buffer& proto_config)
     : disabled_(false),
       max_request_bytes_(static_cast<uint64_t>(proto_config.max_request_bytes().value())) {}
 
 BufferFilterSettings::BufferFilterSettings(
-    const envoy::config::filter::http::buffer::v2::BufferPerRoute& proto_config)
+    const envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute& proto_config)
     : disabled_(proto_config.disabled()),
       max_request_bytes_(
           proto_config.has_buffer()
@@ -33,7 +33,7 @@ BufferFilterSettings::BufferFilterSettings(
               : 0) {}
 
 BufferFilterConfig::BufferFilterConfig(
-    const envoy::config::filter::http::buffer::v2::Buffer& proto_config)
+    const envoy::extensions::filters::http::buffer::v3alpha::Buffer& proto_config)
     : settings_(proto_config) {}
 
 BufferFilter::BufferFilter(BufferFilterConfigSharedPtr config)
diff --git a/source/extensions/filters/http/buffer/buffer_filter.h b/source/extensions/filters/http/buffer/buffer_filter.h
index b02e046b428b..17812f595e72 100644
--- a/source/extensions/filters/http/buffer/buffer_filter.h
+++ b/source/extensions/filters/http/buffer/buffer_filter.h
@@ -5,7 +5,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
 #include "envoy/http/filter.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -17,8 +17,8 @@ namespace BufferFilter {
 
 class BufferFilterSettings : public Router::RouteSpecificFilterConfig {
 public:
-  BufferFilterSettings(const envoy::config::filter::http::buffer::v2::Buffer&);
-  BufferFilterSettings(const envoy::config::filter::http::buffer::v2::BufferPerRoute&);
+  BufferFilterSettings(const envoy::extensions::filters::http::buffer::v3alpha::Buffer&);
+  BufferFilterSettings(const envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute&);
 
   bool disabled() const { return disabled_; }
   uint64_t maxRequestBytes() const { return max_request_bytes_; }
@@ -33,7 +33,7 @@ class BufferFilterSettings : public Router::RouteSpecificFilterConfig {
  */
 class BufferFilterConfig {
 public:
-  BufferFilterConfig(const envoy::config::filter::http::buffer::v2::Buffer& proto_config);
+  BufferFilterConfig(const envoy::extensions::filters::http::buffer::v3alpha::Buffer& proto_config);
 
   const BufferFilterSettings* settings() const { return &settings_; }
 
diff --git a/source/extensions/filters/http/buffer/config.cc b/source/extensions/filters/http/buffer/config.cc
index 77239a1795db..5b0972f4215a 100644
--- a/source/extensions/filters/http/buffer/config.cc
+++ b/source/extensions/filters/http/buffer/config.cc
@@ -4,8 +4,8 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.validate.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/buffer/buffer_filter.h"
@@ -16,8 +16,8 @@ namespace HttpFilters {
 namespace BufferFilter {
 
 Http::FilterFactoryCb BufferFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::buffer::v2::Buffer& proto_config, const std::string&,
-    Server::Configuration::FactoryContext&) {
+    const envoy::extensions::filters::http::buffer::v3alpha::Buffer& proto_config,
+    const std::string&, Server::Configuration::FactoryContext&) {
   ASSERT(proto_config.has_max_request_bytes());
 
   BufferFilterConfigSharedPtr filter_config(new BufferFilterConfig(proto_config));
@@ -28,7 +28,7 @@ Http::FilterFactoryCb BufferFilterFactory::createFilterFactoryFromProtoTyped(
 
 Router::RouteSpecificFilterConfigConstSharedPtr
 BufferFilterFactory::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::buffer::v2::BufferPerRoute& proto_config,
+    const envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute& proto_config,
     Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<const BufferFilterSettings>(proto_config);
 }
diff --git a/source/extensions/filters/http/buffer/config.h b/source/extensions/filters/http/buffer/config.h
index fc25e3137052..04017d552835 100644
--- a/source/extensions/filters/http/buffer/config.h
+++ b/source/extensions/filters/http/buffer/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.validate.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -14,19 +14,19 @@ namespace BufferFilter {
 /**
  * Config registration for the buffer filter.
  */
-class BufferFilterFactory
-    : public Common::FactoryBase<envoy::config::filter::http::buffer::v2::Buffer,
-                                 envoy::config::filter::http::buffer::v2::BufferPerRoute> {
+class BufferFilterFactory : public Common::FactoryBase<
+                                envoy::extensions::filters::http::buffer::v3alpha::Buffer,
+                                envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute> {
 public:
   BufferFilterFactory() : FactoryBase(HttpFilterNames::get().Buffer) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::buffer::v2::Buffer& proto_config,
+      const envoy::extensions::filters::http::buffer::v3alpha::Buffer& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::buffer::v2::BufferPerRoute&,
+      const envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute&,
       Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) override;
 };
 
diff --git a/source/extensions/filters/http/common/BUILD b/source/extensions/filters/http/common/BUILD
index c9721a2a482c..4da361bee344 100644
--- a/source/extensions/filters/http/common/BUILD
+++ b/source/extensions/filters/http/common/BUILD
@@ -42,6 +42,6 @@ envoy_cc_library(
     deps = [
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/http:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/common/jwks_fetcher.cc b/source/extensions/filters/http/common/jwks_fetcher.cc
index bb24aa7ff527..95abf8fdf720 100644
--- a/source/extensions/filters/http/common/jwks_fetcher.cc
+++ b/source/extensions/filters/http/common/jwks_fetcher.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/common/jwks_fetcher.h"
 
-#include "envoy/api/v2/core/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
 
 #include "common/common/enum_to_int.h"
 #include "common/http/headers.h"
@@ -30,7 +30,7 @@ class JwksFetcherImpl : public JwksFetcher,
     reset();
   }
 
-  void fetch(const ::envoy::api::v2::core::HttpUri& uri, Tracing::Span& parent_span,
+  void fetch(const envoy::config::core::v3alpha::HttpUri& uri, Tracing::Span& parent_span,
              JwksFetcher::JwksReceiver& receiver) override {
     ENVOY_LOG(trace, "{}", __func__);
     ASSERT(!receiver_);
@@ -105,7 +105,7 @@ class JwksFetcherImpl : public JwksFetcher,
   Upstream::ClusterManager& cm_;
   bool complete_{};
   JwksFetcher::JwksReceiver* receiver_{};
-  const envoy::api::v2::core::HttpUri* uri_{};
+  const envoy::config::core::v3alpha::HttpUri* uri_{};
   Http::AsyncClient::Request* request_{};
 
   void reset() {
diff --git a/source/extensions/filters/http/common/jwks_fetcher.h b/source/extensions/filters/http/common/jwks_fetcher.h
index 73a5b1609545..bfcb2bce8b0a 100644
--- a/source/extensions/filters/http/common/jwks_fetcher.h
+++ b/source/extensions/filters/http/common/jwks_fetcher.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/http_uri.pb.h"
 #include "envoy/common/pure.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "jwt_verify_lib/jwks.h"
@@ -61,7 +61,7 @@ class JwksFetcher {
    * @param parent_span the active span to create children under
    * @param receiver the receiver of the fetched JWKS or error.
    */
-  virtual void fetch(const ::envoy::api::v2::core::HttpUri& uri, Tracing::Span& parent_span,
+  virtual void fetch(const envoy::config::core::v3alpha::HttpUri& uri, Tracing::Span& parent_span,
                      JwksReceiver& receiver) PURE;
 
   /*
diff --git a/source/extensions/filters/http/csrf/BUILD b/source/extensions/filters/http/csrf/BUILD
index a4f86e7b50c8..7a695ee15dfb 100644
--- a/source/extensions/filters/http/csrf/BUILD
+++ b/source/extensions/filters/http/csrf/BUILD
@@ -24,8 +24,8 @@ envoy_cc_library(
         "//source/common/http:headers_lib",
         "//source/common/http:utility_lib",
         "//source/extensions/filters/http:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/csrf/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/csrf/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,6 +39,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/csrf:csrf_filter_lib",
-        "@envoy_api//envoy/config/filter/http/csrf/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/csrf/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/csrf/config.cc b/source/extensions/filters/http/csrf/config.cc
index c04fce02092d..e2e8522a13fc 100644
--- a/source/extensions/filters/http/csrf/config.cc
+++ b/source/extensions/filters/http/csrf/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/csrf/config.h"
 
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.h"
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.validate.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/csrf/csrf_filter.h"
@@ -12,7 +12,7 @@ namespace HttpFilters {
 namespace Csrf {
 
 Http::FilterFactoryCb CsrfFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
+    const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   CsrfFilterConfigSharedPtr config =
       std::make_shared<CsrfFilterConfig>(policy, stats_prefix, context.scope(), context.runtime());
@@ -23,7 +23,7 @@ Http::FilterFactoryCb CsrfFilterFactory::createFilterFactoryFromProtoTyped(
 
 Router::RouteSpecificFilterConfigConstSharedPtr
 CsrfFilterFactory::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
+    const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
     Server::Configuration::ServerFactoryContext& context, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<const Csrf::CsrfPolicy>(policy, context.runtime());
 }
diff --git a/source/extensions/filters/http/csrf/config.h b/source/extensions/filters/http/csrf/config.h
index 9ff227516567..d917eedadb52 100644
--- a/source/extensions/filters/http/csrf/config.h
+++ b/source/extensions/filters/http/csrf/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.h"
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.validate.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,17 +15,16 @@ namespace Csrf {
  * Config registration for the CSRF filter. @see NamedHttpFilterConfigFactory.
  */
 class CsrfFilterFactory
-    : public Common::FactoryBase<envoy::config::filter::http::csrf::v2::CsrfPolicy> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy> {
 public:
   CsrfFilterFactory() : FactoryBase(HttpFilterNames::get().Csrf) {}
 
 private:
-  Http::FilterFactoryCb
-  createFilterFactoryFromProtoTyped(const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
-                                    const std::string& stats_prefix,
-                                    Server::Configuration::FactoryContext& context) override;
+  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+      const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
+      const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
+      const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
       Server::Configuration::ServerFactoryContext& context,
       ProtobufMessage::ValidationVisitor& validator) override;
 };
diff --git a/source/extensions/filters/http/csrf/csrf_filter.cc b/source/extensions/filters/http/csrf/csrf_filter.cc
index a6bce63831b1..4adc21e50856 100644
--- a/source/extensions/filters/http/csrf/csrf_filter.cc
+++ b/source/extensions/filters/http/csrf/csrf_filter.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/csrf/csrf_filter.h"
 
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/empty_string.h"
@@ -60,15 +60,16 @@ static CsrfStats generateStats(const std::string& prefix, Stats::Scope& scope) {
   return CsrfStats{ALL_CSRF_STATS(POOL_COUNTER_PREFIX(scope, final_prefix))};
 }
 
-static CsrfPolicyPtr generatePolicy(const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
-                                    Runtime::Loader& runtime) {
+static CsrfPolicyPtr
+generatePolicy(const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
+               Runtime::Loader& runtime) {
   return std::make_unique<CsrfPolicy>(policy, runtime);
 }
 } // namespace
 
-CsrfFilterConfig::CsrfFilterConfig(const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
-                                   const std::string& stats_prefix, Stats::Scope& scope,
-                                   Runtime::Loader& runtime)
+CsrfFilterConfig::CsrfFilterConfig(
+    const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
+    const std::string& stats_prefix, Stats::Scope& scope, Runtime::Loader& runtime)
     : stats_(generateStats(stats_prefix, scope)), policy_(generatePolicy(policy, runtime)) {}
 
 CsrfFilter::CsrfFilter(const CsrfFilterConfigSharedPtr config) : config_(config) {}
diff --git a/source/extensions/filters/http/csrf/csrf_filter.h b/source/extensions/filters/http/csrf/csrf_filter.h
index 3e7733616cca..659c00ee3cb6 100644
--- a/source/extensions/filters/http/csrf/csrf_filter.h
+++ b/source/extensions/filters/http/csrf/csrf_filter.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -34,7 +34,7 @@ struct CsrfStats {
  */
 class CsrfPolicy : public Router::RouteSpecificFilterConfig {
 public:
-  CsrfPolicy(const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
+  CsrfPolicy(const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
              Runtime::Loader& runtime)
       : policy_(policy), runtime_(runtime) {
     for (const auto& additional_origin : policy.additional_origins()) {
@@ -44,7 +44,8 @@ class CsrfPolicy : public Router::RouteSpecificFilterConfig {
   }
 
   bool enabled() const {
-    const envoy::api::v2::core::RuntimeFractionalPercent& filter_enabled = policy_.filter_enabled();
+    const envoy::config::core::v3alpha::RuntimeFractionalPercent& filter_enabled =
+        policy_.filter_enabled();
     return runtime_.snapshot().featureEnabled(filter_enabled.runtime_key(),
                                               filter_enabled.default_value());
   }
@@ -53,7 +54,8 @@ class CsrfPolicy : public Router::RouteSpecificFilterConfig {
     if (!policy_.has_shadow_enabled()) {
       return false;
     }
-    const envoy::api::v2::core::RuntimeFractionalPercent& shadow_enabled = policy_.shadow_enabled();
+    const envoy::config::core::v3alpha::RuntimeFractionalPercent& shadow_enabled =
+        policy_.shadow_enabled();
     return runtime_.snapshot().featureEnabled(shadow_enabled.runtime_key(),
                                               shadow_enabled.default_value());
   }
@@ -63,7 +65,7 @@ class CsrfPolicy : public Router::RouteSpecificFilterConfig {
   };
 
 private:
-  const envoy::config::filter::http::csrf::v2::CsrfPolicy policy_;
+  const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy policy_;
   std::vector<Matchers::StringMatcherPtr> additional_origins_;
   Runtime::Loader& runtime_;
 };
@@ -74,7 +76,7 @@ using CsrfPolicyPtr = std::unique_ptr<CsrfPolicy>;
  */
 class CsrfFilterConfig {
 public:
-  CsrfFilterConfig(const envoy::config::filter::http::csrf::v2::CsrfPolicy& policy,
+  CsrfFilterConfig(const envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy& policy,
                    const std::string& stats_prefix, Stats::Scope& scope, Runtime::Loader& runtime);
 
   CsrfStats& stats() { return stats_; }
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/BUILD b/source/extensions/filters/http/dynamic_forward_proxy/BUILD
index 790eda38656f..e12789e2ce53 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/BUILD
+++ b/source/extensions/filters/http/dynamic_forward_proxy/BUILD
@@ -18,8 +18,8 @@ envoy_cc_library(
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_interface",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:pass_through_filter_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -36,6 +36,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/dynamic_forward_proxy:proxy_filter_lib",
-        "@envoy_api//envoy/config/filter/http/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/config.cc b/source/extensions/filters/http/dynamic_forward_proxy/config.cc
index a106278f7ecb..952a3157d7e2 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/config.cc
+++ b/source/extensions/filters/http/dynamic_forward_proxy/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/dynamic_forward_proxy/config.h"
 
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.h"
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.validate.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.validate.h"
 
 #include "extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h"
 #include "extensions/filters/http/dynamic_forward_proxy/proxy_filter.h"
@@ -12,7 +12,8 @@ namespace HttpFilters {
 namespace DynamicForwardProxy {
 
 Http::FilterFactoryCb DynamicForwardProxyFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::FilterConfig& proto_config,
+    const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::FilterConfig&
+        proto_config,
     const std::string&, Server::Configuration::FactoryContext& context) {
   Extensions::Common::DynamicForwardProxy::DnsCacheManagerFactoryImpl cache_manager_factory(
       context.singletonManager(), context.dispatcher(), context.threadLocal(), context.scope());
@@ -25,7 +26,7 @@ Http::FilterFactoryCb DynamicForwardProxyFilterFactory::createFilterFactoryFromP
 
 Router::RouteSpecificFilterConfigConstSharedPtr
 DynamicForwardProxyFilterFactory::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig& config,
+    const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig& config,
     Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<const ProxyPerRouteConfig>(config);
 }
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/config.h b/source/extensions/filters/http/dynamic_forward_proxy/config.h
index 31e34d4fdfcf..f76eddd69d29 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/config.h
+++ b/source/extensions/filters/http/dynamic_forward_proxy/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.h"
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.validate.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -16,17 +16,19 @@ namespace DynamicForwardProxy {
  */
 class DynamicForwardProxyFilterFactory
     : public Common::FactoryBase<
-          envoy::config::filter::http::dynamic_forward_proxy::v2alpha::FilterConfig,
-          envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig> {
+          envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::FilterConfig,
+          envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig> {
 public:
   DynamicForwardProxyFilterFactory() : FactoryBase(HttpFilterNames::get().DynamicForwardProxy) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::FilterConfig& proto_config,
+      const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::FilterConfig&
+          proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig& config,
+      const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig&
+          config,
       Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) override;
 };
 
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc
index 770d77f9cd63..d78a1305d909 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc
+++ b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/dynamic_forward_proxy/proxy_filter.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.h"
 
 #include "extensions/common/dynamic_forward_proxy/dns_cache.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -21,7 +21,8 @@ using ResponseStrings = ConstSingleton<ResponseStringValues>;
 using LoadDnsCacheEntryStatus = Common::DynamicForwardProxy::DnsCache::LoadDnsCacheEntryStatus;
 
 ProxyFilterConfig::ProxyFilterConfig(
-    const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::FilterConfig& proto_config,
+    const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::FilterConfig&
+        proto_config,
     Extensions::Common::DynamicForwardProxy::DnsCacheManagerFactory& cache_manager_factory,
     Upstream::ClusterManager& cluster_manager)
     : dns_cache_manager_(cache_manager_factory.get()),
@@ -29,9 +30,9 @@ ProxyFilterConfig::ProxyFilterConfig(
       cluster_manager_(cluster_manager) {}
 
 ProxyPerRouteConfig::ProxyPerRouteConfig(
-    const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig& config)
-    : host_rewrite_(config.host_rewrite()),
-      host_rewrite_header_(Http::LowerCaseString(config.auto_host_rewrite_header())) {}
+    const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig& config)
+    : host_rewrite_(config.host_rewrite_literal()),
+      host_rewrite_header_(Http::LowerCaseString(config.host_rewrite_header())) {}
 
 void ProxyFilter::onDestroy() {
   // Make sure we destroy any active cache load handle in case we are getting reset and deferred
@@ -66,7 +67,7 @@ Http::FilterHeadersStatus ProxyFilter::decodeHeaders(Http::HeaderMap& headers, b
 
   uint16_t default_port = 80;
   if (cluster_info_->transportSocketMatcher()
-          .resolve(envoy::api::v2::core::Metadata())
+          .resolve(envoy::config::core::v3alpha::Metadata())
           .factory_.implementsSecureTransport()) {
     default_port = 443;
   }
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h
index 25b905c59cc2..ff461c153bde 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h
+++ b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "extensions/common/dynamic_forward_proxy/dns_cache.h"
@@ -14,7 +14,8 @@ namespace DynamicForwardProxy {
 class ProxyFilterConfig {
 public:
   ProxyFilterConfig(
-      const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::FilterConfig& proto_config,
+      const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::FilterConfig&
+          proto_config,
       Extensions::Common::DynamicForwardProxy::DnsCacheManagerFactory& cache_manager_factory,
       Upstream::ClusterManager& cluster_manager);
 
@@ -32,7 +33,8 @@ using ProxyFilterConfigSharedPtr = std::shared_ptr<ProxyFilterConfig>;
 class ProxyPerRouteConfig : public ::Envoy::Router::RouteSpecificFilterConfig {
 public:
   ProxyPerRouteConfig(
-      const envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig& config);
+      const envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig&
+          config);
 
   const std::string& hostRewrite() const { return host_rewrite_; }
   const Http::LowerCaseString& hostRewriteHeader() const { return host_rewrite_header_; }
diff --git a/source/extensions/filters/http/ext_authz/BUILD b/source/extensions/filters/http/ext_authz/BUILD
index 854d196d031e..22c560e336da 100644
--- a/source/extensions/filters/http/ext_authz/BUILD
+++ b/source/extensions/filters/http/ext_authz/BUILD
@@ -30,9 +30,9 @@ envoy_cc_library(
         "//source/common/router:config_lib",
         "//source/extensions/filters/common/ext_authz:ext_authz_grpc_lib",
         "//source/extensions/filters/common/ext_authz:ext_authz_http_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -49,7 +49,7 @@ envoy_cc_extension(
         "//source/extensions/filters/common/ext_authz:ext_authz_http_lib",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/ext_authz/config.cc b/source/extensions/filters/http/ext_authz/config.cc
index ddff58dc65c5..87e80ebcc39c 100644
--- a/source/extensions/filters/http/ext_authz/config.cc
+++ b/source/extensions/filters/http/ext_authz/config.cc
@@ -3,9 +3,9 @@
 #include <chrono>
 #include <string>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -20,7 +20,7 @@ namespace HttpFilters {
 namespace ExtAuthz {
 
 Http::FilterFactoryCb ExtAuthzFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::ext_authz::v2::ExtAuthz& proto_config,
+    const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz& proto_config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   const auto filter_config =
       std::make_shared<FilterConfig>(proto_config, context.localInfo(), context.scope(),
@@ -46,8 +46,8 @@ Http::FilterFactoryCb ExtAuthzFilterConfig::createFilterFactoryFromProtoTyped(
     const uint32_t timeout_ms =
         PROTOBUF_GET_MS_OR_DEFAULT(proto_config.grpc_service(), timeout, DefaultTimeout);
     callback = [grpc_service = proto_config.grpc_service(), &context, filter_config, timeout_ms,
-                use_alpha =
-                    proto_config.use_alpha()](Http::FilterChainFactoryCallbacks& callbacks) {
+                use_alpha = proto_config.hidden_envoy_deprecated_use_alpha()](
+                   Http::FilterChainFactoryCallbacks& callbacks) {
       const auto async_client_factory =
           context.clusterManager().grpcAsyncClientManager().factoryForGrpcService(
               grpc_service, context.scope(), true);
@@ -63,7 +63,7 @@ Http::FilterFactoryCb ExtAuthzFilterConfig::createFilterFactoryFromProtoTyped(
 
 Router::RouteSpecificFilterConfigConstSharedPtr
 ExtAuthzFilterConfig::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute& proto_config,
+    const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute& proto_config,
     Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<FilterConfigPerRoute>(proto_config);
 }
diff --git a/source/extensions/filters/http/ext_authz/config.h b/source/extensions/filters/http/ext_authz/config.h
index fa0dde9b199b..fd53622a26f5 100644
--- a/source/extensions/filters/http/ext_authz/config.h
+++ b/source/extensions/filters/http/ext_authz/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,19 +15,20 @@ namespace ExtAuthz {
  * Config registration for the external authorization filter. @see NamedHttpFilterConfigFactory.
  */
 class ExtAuthzFilterConfig
-    : public Common::FactoryBase<envoy::config::filter::http::ext_authz::v2::ExtAuthz,
-                                 envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz,
+          envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute> {
 public:
   ExtAuthzFilterConfig() : FactoryBase(HttpFilterNames::get().ExtAuthorization) {}
 
 private:
   static constexpr uint64_t DefaultTimeout = 200;
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::ext_authz::v2::ExtAuthz& proto_config,
+      const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute& proto_config,
+      const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute& proto_config,
       Server::Configuration::ServerFactoryContext& context,
       ProtobufMessage::ValidationVisitor& validator) override;
 };
diff --git a/source/extensions/filters/http/ext_authz/ext_authz.cc b/source/extensions/filters/http/ext_authz/ext_authz.cc
index 92a494595d1c..b22d5b350a6f 100644
--- a/source/extensions/filters/http/ext_authz/ext_authz.cc
+++ b/source/extensions/filters/http/ext_authz/ext_authz.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/ext_authz/ext_authz.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/enum_to_int.h"
@@ -66,7 +66,7 @@ void Filter::initiateCall(const Http::HeaderMap& headers) {
   }
 
   // If metadata_context_namespaces is specified, pass matching metadata to the ext_authz service
-  envoy::api::v2::core::Metadata metadata_context;
+  envoy::config::core::v3alpha::Metadata metadata_context;
   const auto& request_metadata = callbacks_->streamInfo().dynamicMetadata().filter_metadata();
   for (const auto& context_key : config_->metadataContextNamespaces()) {
     const auto& metadata_it = request_metadata.find(context_key);
diff --git a/source/extensions/filters/http/ext_authz/ext_authz.h b/source/extensions/filters/http/ext_authz/ext_authz.h
index c01dcf880c01..a51252a800fc 100644
--- a/source/extensions/filters/http/ext_authz/ext_authz.h
+++ b/source/extensions/filters/http/ext_authz/ext_authz.h
@@ -5,11 +5,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/runtime/runtime.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -57,7 +57,7 @@ struct ExtAuthzFilterStats {
  */
 class FilterConfig {
 public:
-  FilterConfig(const envoy::config::filter::http::ext_authz::v2::ExtAuthz& config,
+  FilterConfig(const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz& config,
                const LocalInfo::LocalInfo& local_info, Stats::Scope& scope,
                Runtime::Loader& runtime, Http::Context& http_context,
                const std::string& stats_prefix)
@@ -169,7 +169,8 @@ class FilterConfigPerRoute : public Router::RouteSpecificFilterConfig {
 public:
   using ContextExtensionsMap = Protobuf::Map<std::string, std::string>;
 
-  FilterConfigPerRoute(const envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute& config)
+  FilterConfigPerRoute(
+      const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute& config)
       : context_extensions_(config.has_check_settings()
                                 ? config.check_settings().context_extensions()
                                 : ContextExtensionsMap()),
@@ -246,7 +247,7 @@ class Filter : public Logger::Loggable<Logger::Id::filter>,
   // Used to identify if the callback to onComplete() is synchronous (on the stack) or asynchronous.
   bool initiating_call_{};
   bool buffer_data_{};
-  envoy::service::auth::v2::CheckRequest check_request_{};
+  envoy::service::auth::v3alpha::CheckRequest check_request_{};
 };
 
 } // namespace ExtAuthz
diff --git a/source/extensions/filters/http/fault/BUILD b/source/extensions/filters/http/fault/BUILD
index dca6dedac4a2..668fce253c6c 100644
--- a/source/extensions/filters/http/fault/BUILD
+++ b/source/extensions/filters/http/fault/BUILD
@@ -35,8 +35,8 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/common/fault:fault_config_lib",
         "//source/extensions/filters/http:well_known_names",
-        "@envoy_api//envoy/config/filter/http/fault/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/fault/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -50,6 +50,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/fault:fault_filter_lib",
-        "@envoy_api//envoy/config/filter/http/fault/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/fault/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/fault/config.cc b/source/extensions/filters/http/fault/config.cc
index 902627d8738f..4fee85547ab0 100644
--- a/source/extensions/filters/http/fault/config.cc
+++ b/source/extensions/filters/http/fault/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/fault/config.h"
 
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
-#include "envoy/config/filter/http/fault/v2/fault.pb.validate.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/fault/fault_filter.h"
@@ -12,7 +12,7 @@ namespace HttpFilters {
 namespace Fault {
 
 Http::FilterFactoryCb FaultFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::fault::v2::HTTPFault& config,
+    const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   FaultFilterConfigSharedPtr filter_config(new FaultFilterConfig(
       config, context.runtime(), stats_prefix, context.scope(), context.timeSource()));
@@ -23,7 +23,7 @@ Http::FilterFactoryCb FaultFilterFactory::createFilterFactoryFromProtoTyped(
 
 Router::RouteSpecificFilterConfigConstSharedPtr
 FaultFilterFactory::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::fault::v2::HTTPFault& config,
+    const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& config,
     Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<const Fault::FaultSettings>(config);
 }
diff --git a/source/extensions/filters/http/fault/config.h b/source/extensions/filters/http/fault/config.h
index 4f3b0901dd2d..010ed507b9de 100644
--- a/source/extensions/filters/http/fault/config.h
+++ b/source/extensions/filters/http/fault/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
-#include "envoy/config/filter/http/fault/v2/fault.pb.validate.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,17 +15,17 @@ namespace Fault {
  * Config registration for the fault injection filter. @see NamedHttpFilterConfigFactory.
  */
 class FaultFilterFactory
-    : public Common::FactoryBase<envoy::config::filter::http::fault::v2::HTTPFault> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::fault::v3alpha::HTTPFault> {
 public:
   FaultFilterFactory() : FactoryBase(HttpFilterNames::get().Fault) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::fault::v2::HTTPFault& proto_config,
+      const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::fault::v2::HTTPFault& proto_config,
+      const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& proto_config,
       Server::Configuration::ServerFactoryContext& context,
       ProtobufMessage::ValidationVisitor& validator) override;
 };
diff --git a/source/extensions/filters/http/fault/fault_filter.cc b/source/extensions/filters/http/fault/fault_filter.cc
index eeb24c52a8cd..98209074643f 100644
--- a/source/extensions/filters/http/fault/fault_filter.cc
+++ b/source/extensions/filters/http/fault/fault_filter.cc
@@ -5,8 +5,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
 #include "envoy/event/timer.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
 #include "envoy/http/codes.h"
 #include "envoy/http/header_map.h"
 #include "envoy/stats/scope.h"
@@ -33,7 +33,8 @@ struct RcDetailsValues {
 };
 using RcDetails = ConstSingleton<RcDetailsValues>;
 
-FaultSettings::FaultSettings(const envoy::config::filter::http::fault::v2::HTTPFault& fault)
+FaultSettings::FaultSettings(
+    const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& fault)
     : fault_filter_headers_(Http::HeaderUtility::buildHeaderDataVector(fault.headers())),
       delay_percent_runtime_(PROTOBUF_GET_STRING_OR_DEFAULT(fault, delay_percent_runtime,
                                                             RuntimeKeys::get().DelayPercentKey)),
@@ -75,9 +76,10 @@ FaultSettings::FaultSettings(const envoy::config::filter::http::fault::v2::HTTPF
   }
 }
 
-FaultFilterConfig::FaultFilterConfig(const envoy::config::filter::http::fault::v2::HTTPFault& fault,
-                                     Runtime::Loader& runtime, const std::string& stats_prefix,
-                                     Stats::Scope& scope, TimeSource& time_source)
+FaultFilterConfig::FaultFilterConfig(
+    const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& fault,
+    Runtime::Loader& runtime, const std::string& stats_prefix, Stats::Scope& scope,
+    TimeSource& time_source)
     : settings_(fault), runtime_(runtime), stats_(generateStats(stats_prefix, scope)),
       scope_(scope), time_source_(time_source),
       stat_name_set_(scope.symbolTable().makeSet("Fault")),
diff --git a/source/extensions/filters/http/fault/fault_filter.h b/source/extensions/filters/http/fault/fault_filter.h
index 19039501e857..ab8f2ee12d42 100644
--- a/source/extensions/filters/http/fault/fault_filter.h
+++ b/source/extensions/filters/http/fault/fault_filter.h
@@ -6,12 +6,12 @@
 #include <unordered_set>
 #include <vector>
 
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/watermark_buffer.h"
 #include "common/common/token_bucket_impl.h"
@@ -47,12 +47,12 @@ struct FaultFilterStats {
  */
 class FaultSettings : public Router::RouteSpecificFilterConfig {
 public:
-  FaultSettings(const envoy::config::filter::http::fault::v2::HTTPFault& fault);
+  FaultSettings(const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& fault);
 
   const std::vector<Http::HeaderUtility::HeaderDataPtr>& filterHeaders() const {
     return fault_filter_headers_;
   }
-  envoy::type::FractionalPercent abortPercentage() const { return abort_percentage_; }
+  envoy::type::v3alpha::FractionalPercent abortPercentage() const { return abort_percentage_; }
   uint64_t abortCode() const { return http_status_; }
   const Filters::Common::Fault::FaultDelayConfig* requestDelay() const {
     return request_delay_config_.get();
@@ -85,7 +85,7 @@ class FaultSettings : public Router::RouteSpecificFilterConfig {
 
   using RuntimeKeys = ConstSingleton<RuntimeKeyValues>;
 
-  envoy::type::FractionalPercent abort_percentage_;
+  envoy::type::v3alpha::FractionalPercent abort_percentage_;
   uint64_t http_status_{}; // HTTP or gRPC return codes
   Filters::Common::Fault::FaultDelayConfigPtr request_delay_config_;
   std::string upstream_cluster_; // restrict faults to specific upstream cluster
@@ -106,7 +106,7 @@ class FaultSettings : public Router::RouteSpecificFilterConfig {
  */
 class FaultFilterConfig {
 public:
-  FaultFilterConfig(const envoy::config::filter::http::fault::v2::HTTPFault& fault,
+  FaultFilterConfig(const envoy::extensions::filters::http::fault::v3alpha::HTTPFault& fault,
                     Runtime::Loader& runtime, const std::string& stats_prefix, Stats::Scope& scope,
                     TimeSource& time_source);
 
diff --git a/source/extensions/filters/http/grpc_http1_reverse_bridge/BUILD b/source/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
index 72e6f64e8120..4d812f74fc22 100644
--- a/source/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
+++ b/source/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
@@ -23,7 +23,7 @@ envoy_cc_library(
         "//source/common/http:utility_lib",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:pass_through_filter_lib",
-        "@envoy_api//envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -40,6 +40,6 @@ envoy_cc_extension(
         "//include/envoy/server:filter_config_interface",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/grpc_http1_reverse_bridge/config.cc b/source/extensions/filters/http/grpc_http1_reverse_bridge/config.cc
index c4738020cb6a..34e6d1c44a84 100644
--- a/source/extensions/filters/http/grpc_http1_reverse_bridge/config.cc
+++ b/source/extensions/filters/http/grpc_http1_reverse_bridge/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/grpc_http1_reverse_bridge/config.h"
 
-#include "envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.pb.h"
-#include "envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha/config.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/grpc_http1_reverse_bridge/filter.h"
@@ -12,7 +12,8 @@ namespace HttpFilters {
 namespace GrpcHttp1ReverseBridge {
 
 Http::FilterFactoryCb Config::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfig& config,
+    const envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::FilterConfig&
+        config,
     const std::string&, Server::Configuration::FactoryContext&) {
   return [config](Envoy::Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamFilter(
@@ -21,8 +22,8 @@ Http::FilterFactoryCb Config::createFilterFactoryFromProtoTyped(
 }
 
 Router::RouteSpecificFilterConfigConstSharedPtr Config::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute&
-        proto_config,
+    const envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::
+        FilterConfigPerRoute& proto_config,
     Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<FilterConfigPerRoute>(proto_config);
 }
diff --git a/source/extensions/filters/http/grpc_http1_reverse_bridge/config.h b/source/extensions/filters/http/grpc_http1_reverse_bridge/config.h
index 86574afb1f49..e448d3843a70 100644
--- a/source/extensions/filters/http/grpc_http1_reverse_bridge/config.h
+++ b/source/extensions/filters/http/grpc_http1_reverse_bridge/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.pb.h"
-#include "envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha/config.pb.validate.h"
 #include "envoy/server/filter_config.h"
 
 #include "extensions/filters/http/common/factory_base.h"
@@ -14,20 +14,22 @@ namespace GrpcHttp1ReverseBridge {
 
 class Config
     : public Common::FactoryBase<
-          envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfig,
-          envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute> {
+          envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::FilterConfig,
+          envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::
+              FilterConfigPerRoute> {
 public:
   Config() : FactoryBase(HttpFilterNames::get().GrpcHttp1ReverseBridge) {}
 
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfig& config,
+      const envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::FilterConfig&
+          config,
       const std::string& stat_prefix,
       Envoy::Server::Configuration::FactoryContext& context) override;
 
 private:
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute&
-          proto_config,
+      const envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::
+          FilterConfigPerRoute& proto_config,
       Server::Configuration::ServerFactoryContext& context,
       ProtobufMessage::ValidationVisitor& validator) override;
 };
diff --git a/source/extensions/filters/http/grpc_http1_reverse_bridge/filter.h b/source/extensions/filters/http/grpc_http1_reverse_bridge/filter.h
index 665c0543ded0..1b1bafa5a891 100644
--- a/source/extensions/filters/http/grpc_http1_reverse_bridge/filter.h
+++ b/source/extensions/filters/http/grpc_http1_reverse_bridge/filter.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha/config.pb.h"
 #include "envoy/http/filter.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -48,9 +48,8 @@ class Filter : public Envoy::Http::PassThroughFilter {
 
 class FilterConfigPerRoute : public Router::RouteSpecificFilterConfig {
 public:
-  FilterConfigPerRoute(
-      const envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute&
-          config)
+  FilterConfigPerRoute(const envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::
+                           FilterConfigPerRoute& config)
       : disabled_(config.disabled()) {}
   bool disabled() const { return disabled_; }
 
diff --git a/source/extensions/filters/http/grpc_json_transcoder/BUILD b/source/extensions/filters/http/grpc_json_transcoder/BUILD
index 8a03c9f10de5..8e776a81621b 100644
--- a/source/extensions/filters/http/grpc_json_transcoder/BUILD
+++ b/source/extensions/filters/http/grpc_json_transcoder/BUILD
@@ -29,7 +29,7 @@ envoy_cc_library(
         "//source/common/grpc:common_lib",
         "//source/common/http:headers_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/config/filter/http/transcoder/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_json_transcoder/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -51,6 +51,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/grpc_json_transcoder:json_transcoder_filter_lib",
-        "@envoy_api//envoy/config/filter/http/transcoder/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_json_transcoder/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/grpc_json_transcoder/config.cc b/source/extensions/filters/http/grpc_json_transcoder/config.cc
index 2c799956cb41..822c7ddde495 100644
--- a/source/extensions/filters/http/grpc_json_transcoder/config.cc
+++ b/source/extensions/filters/http/grpc_json_transcoder/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/grpc_json_transcoder/config.h"
 
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.h"
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.h"
@@ -12,7 +12,8 @@ namespace HttpFilters {
 namespace GrpcJsonTranscoder {
 
 Http::FilterFactoryCb GrpcJsonTranscoderFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder& proto_config,
+    const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder&
+        proto_config,
     const std::string&, Server::Configuration::FactoryContext& context) {
   JsonTranscoderConfigSharedPtr filter_config =
       std::make_shared<JsonTranscoderConfig>(proto_config, context.api());
diff --git a/source/extensions/filters/http/grpc_json_transcoder/config.h b/source/extensions/filters/http/grpc_json_transcoder/config.h
index 524cd008bb0a..529bb17d37bc 100644
--- a/source/extensions/filters/http/grpc_json_transcoder/config.h
+++ b/source/extensions/filters/http/grpc_json_transcoder/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.h"
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,13 +15,15 @@ namespace GrpcJsonTranscoder {
  * Config registration for the gRPC JSON transcoder filter. @see NamedHttpFilterConfigFactory.
  */
 class GrpcJsonTranscoderFilterConfig
-    : public Common::FactoryBase<envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder> {
 public:
   GrpcJsonTranscoderFilterConfig() : FactoryBase(HttpFilterNames::get().GrpcJsonTranscoder) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder& proto_config,
+      const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder&
+          proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc b/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
index 1da1b4ea1efa..35b27a20dc13 100644
--- a/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
+++ b/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
@@ -4,7 +4,7 @@
 #include <unordered_set>
 
 #include "envoy/common/exception.h"
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.h"
 #include "envoy/http/filter.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -94,18 +94,21 @@ class TranscoderImpl : public Transcoder {
 } // namespace
 
 JsonTranscoderConfig::JsonTranscoderConfig(
-    const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder& proto_config,
+    const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder&
+        proto_config,
     Api::Api& api) {
   FileDescriptorSet descriptor_set;
 
   switch (proto_config.descriptor_set_case()) {
-  case envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder::kProtoDescriptor:
+  case envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder::
+      DescriptorSetCase::kProtoDescriptor:
     if (!descriptor_set.ParseFromString(
             api.fileSystem().fileReadToEnd(proto_config.proto_descriptor()))) {
       throw EnvoyException("transcoding_filter: Unable to parse proto descriptor");
     }
     break;
-  case envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder::kProtoDescriptorBin:
+  case envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder::
+      DescriptorSetCase::kProtoDescriptorBin:
     if (!descriptor_set.ParseFromString(proto_config.proto_descriptor_bin())) {
       throw EnvoyException("transcoding_filter: Unable to parse proto descriptor");
     }
diff --git a/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.h b/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.h
index a3bae5e4e027..42d43cb77f03 100644
--- a/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.h
+++ b/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.h
@@ -2,7 +2,7 @@
 
 #include "envoy/api/api.h"
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/http/header_map.h"
 #include "envoy/json/json_object.h"
@@ -50,7 +50,8 @@ class JsonTranscoderConfig : public Logger::Loggable<Logger::Id::config> {
    * and construct a path matcher for HTTP path bindings.
    */
   JsonTranscoderConfig(
-      const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder& proto_config,
+      const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder&
+          proto_config,
       Api::Api& api);
 
   /**
diff --git a/source/extensions/filters/http/grpc_stats/BUILD b/source/extensions/filters/http/grpc_stats/BUILD
index fe5e0f8bf17c..8bdb9bba263a 100644
--- a/source/extensions/filters/http/grpc_stats/BUILD
+++ b/source/extensions/filters/http/grpc_stats/BUILD
@@ -26,6 +26,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/common:pass_through_filter_lib",
-        "@envoy_api//envoy/config/filter/http/grpc_stats/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_stats/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc b/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc
index 9308d4f886fe..94feb6161bc1 100644
--- a/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc
+++ b/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/grpc_stats/grpc_stats_filter.h"
 
-#include "envoy/config/filter/http/grpc_stats/v2alpha/config.pb.h"
-#include "envoy/config/filter/http/grpc_stats/v2alpha/config.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_stats/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_stats/v3alpha/config.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/grpc/codec.h"
@@ -105,7 +105,7 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
 } // namespace
 
 Http::FilterFactoryCb GrpcStatsFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::grpc_stats::v2alpha::FilterConfig& config,
+    const envoy::extensions::filters::http::grpc_stats::v3alpha::FilterConfig& config,
     const std::string&, Server::Configuration::FactoryContext& factory_context) {
   return [&factory_context, emit_filter_state = config.emit_filter_state()](
              Http::FilterChainFactoryCallbacks& callbacks) {
diff --git a/source/extensions/filters/http/grpc_stats/grpc_stats_filter.h b/source/extensions/filters/http/grpc_stats/grpc_stats_filter.h
index f2f6c6542986..1c4bf42ad49c 100644
--- a/source/extensions/filters/http/grpc_stats/grpc_stats_filter.h
+++ b/source/extensions/filters/http/grpc_stats/grpc_stats_filter.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/grpc_stats/v2alpha/config.pb.h"
-#include "envoy/config/filter/http/grpc_stats/v2alpha/config.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_stats/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_stats/v3alpha/config.pb.validate.h"
 #include "envoy/server/filter_config.h"
 #include "envoy/stream_info/filter_state.h"
 
@@ -19,7 +19,8 @@ struct GrpcStatsObject : public StreamInfo::FilterState::Object {
   uint64_t response_message_count = 0;
 
   ProtobufTypes::MessagePtr serializeAsProto() const override {
-    auto msg = std::make_unique<envoy::config::filter::http::grpc_stats::v2alpha::FilterObject>();
+    auto msg =
+        std::make_unique<envoy::extensions::filters::http::grpc_stats::v3alpha::FilterObject>();
     msg->set_request_message_count(request_message_count);
     msg->set_response_message_count(response_message_count);
     return msg;
@@ -27,13 +28,14 @@ struct GrpcStatsObject : public StreamInfo::FilterState::Object {
 };
 
 class GrpcStatsFilterConfig
-    : public Common::FactoryBase<envoy::config::filter::http::grpc_stats::v2alpha::FilterConfig> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::http::grpc_stats::v3alpha::FilterConfig> {
 public:
   GrpcStatsFilterConfig() : FactoryBase(HttpFilterNames::get().GrpcStats) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::grpc_stats::v2alpha::FilterConfig& config,
+      const envoy::extensions::filters::http::grpc_stats::v3alpha::FilterConfig& config,
       const std::string&, Server::Configuration::FactoryContext&) override;
 };
 
diff --git a/source/extensions/filters/http/gzip/BUILD b/source/extensions/filters/http/gzip/BUILD
index 0d2eef004c59..c96f0ad96dbd 100644
--- a/source/extensions/filters/http/gzip/BUILD
+++ b/source/extensions/filters/http/gzip/BUILD
@@ -25,7 +25,7 @@ envoy_cc_library(
         "//source/common/http:header_map_lib",
         "//source/common/http:headers_lib",
         "//source/common/protobuf",
-        "@envoy_api//envoy/config/filter/http/gzip/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/gzip/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,6 +39,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/gzip:gzip_filter_lib",
-        "@envoy_api//envoy/config/filter/http/gzip/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/gzip/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/gzip/config.cc b/source/extensions/filters/http/gzip/config.cc
index f623472a4634..4d10d80d922e 100644
--- a/source/extensions/filters/http/gzip/config.cc
+++ b/source/extensions/filters/http/gzip/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/gzip/config.h"
 
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.h"
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.validate.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/gzip/gzip_filter.h"
@@ -12,7 +12,7 @@ namespace HttpFilters {
 namespace Gzip {
 
 Http::FilterFactoryCb GzipFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::gzip::v2::Gzip& proto_config,
+    const envoy::extensions::filters::http::gzip::v3alpha::Gzip& proto_config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   GzipFilterConfigSharedPtr config = std::make_shared<GzipFilterConfig>(
       proto_config, stats_prefix, context.scope(), context.runtime());
diff --git a/source/extensions/filters/http/gzip/config.h b/source/extensions/filters/http/gzip/config.h
index ec5b615a98dc..94de37e9a566 100644
--- a/source/extensions/filters/http/gzip/config.h
+++ b/source/extensions/filters/http/gzip/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.h"
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.validate.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -14,15 +14,15 @@ namespace Gzip {
 /**
  * Config registration for the gzip filter. @see NamedHttpFilterConfigFactory.
  */
-class GzipFilterFactory : public Common::FactoryBase<envoy::config::filter::http::gzip::v2::Gzip> {
+class GzipFilterFactory
+    : public Common::FactoryBase<envoy::extensions::filters::http::gzip::v3alpha::Gzip> {
 public:
   GzipFilterFactory() : FactoryBase(HttpFilterNames::get().EnvoyGzip) {}
 
 private:
-  Http::FilterFactoryCb
-  createFilterFactoryFromProtoTyped(const envoy::config::filter::http::gzip::v2::Gzip& config,
-                                    const std::string& stats_prefix,
-                                    Server::Configuration::FactoryContext& context) override;
+  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+      const envoy::extensions::filters::http::gzip::v3alpha::Gzip& config,
+      const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
 } // namespace Gzip
diff --git a/source/extensions/filters/http/gzip/gzip_filter.cc b/source/extensions/filters/http/gzip/gzip_filter.cc
index 2dd148773711..6eb7e27a5105 100644
--- a/source/extensions/filters/http/gzip/gzip_filter.cc
+++ b/source/extensions/filters/http/gzip/gzip_filter.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/gzip/gzip_filter.h"
 
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/macros.h"
@@ -40,9 +40,9 @@ const std::vector<std::string>& defaultContentEncoding() {
 
 } // namespace
 
-GzipFilterConfig::GzipFilterConfig(const envoy::config::filter::http::gzip::v2::Gzip& gzip,
-                                   const std::string& stats_prefix, Stats::Scope& scope,
-                                   Runtime::Loader& runtime)
+GzipFilterConfig::GzipFilterConfig(
+    const envoy::extensions::filters::http::gzip::v3alpha::Gzip& gzip,
+    const std::string& stats_prefix, Stats::Scope& scope, Runtime::Loader& runtime)
     : compression_level_(compressionLevelEnum(gzip.compression_level())),
       compression_strategy_(compressionStrategyEnum(gzip.compression_strategy())),
       content_length_(contentLengthUint(gzip.content_length().value())),
@@ -54,11 +54,12 @@ GzipFilterConfig::GzipFilterConfig(const envoy::config::filter::http::gzip::v2::
       stats_(generateStats(stats_prefix + "gzip.", scope)), runtime_(runtime) {}
 
 Compressor::ZlibCompressorImpl::CompressionLevel GzipFilterConfig::compressionLevelEnum(
-    envoy::config::filter::http::gzip::v2::Gzip_CompressionLevel_Enum compression_level) {
+    envoy::extensions::filters::http::gzip::v3alpha::Gzip::CompressionLevel::Enum
+        compression_level) {
   switch (compression_level) {
-  case envoy::config::filter::http::gzip::v2::Gzip::CompressionLevel::BEST:
+  case envoy::extensions::filters::http::gzip::v3alpha::Gzip::CompressionLevel::BEST:
     return Compressor::ZlibCompressorImpl::CompressionLevel::Best;
-  case envoy::config::filter::http::gzip::v2::Gzip::CompressionLevel::SPEED:
+  case envoy::extensions::filters::http::gzip::v3alpha::Gzip::CompressionLevel::SPEED:
     return Compressor::ZlibCompressorImpl::CompressionLevel::Speed;
   default:
     return Compressor::ZlibCompressorImpl::CompressionLevel::Standard;
@@ -66,13 +67,14 @@ Compressor::ZlibCompressorImpl::CompressionLevel GzipFilterConfig::compressionLe
 }
 
 Compressor::ZlibCompressorImpl::CompressionStrategy GzipFilterConfig::compressionStrategyEnum(
-    envoy::config::filter::http::gzip::v2::Gzip_CompressionStrategy compression_strategy) {
+    envoy::extensions::filters::http::gzip::v3alpha::Gzip::CompressionStrategy
+        compression_strategy) {
   switch (compression_strategy) {
-  case envoy::config::filter::http::gzip::v2::Gzip::RLE:
+  case envoy::extensions::filters::http::gzip::v3alpha::Gzip::RLE:
     return Compressor::ZlibCompressorImpl::CompressionStrategy::Rle;
-  case envoy::config::filter::http::gzip::v2::Gzip::FILTERED:
+  case envoy::extensions::filters::http::gzip::v3alpha::Gzip::FILTERED:
     return Compressor::ZlibCompressorImpl::CompressionStrategy::Filtered;
-  case envoy::config::filter::http::gzip::v2::Gzip::HUFFMAN:
+  case envoy::extensions::filters::http::gzip::v3alpha::Gzip::HUFFMAN:
     return Compressor::ZlibCompressorImpl::CompressionStrategy::Huffman;
   default:
     return Compressor::ZlibCompressorImpl::CompressionStrategy::Standard;
diff --git a/source/extensions/filters/http/gzip/gzip_filter.h b/source/extensions/filters/http/gzip/gzip_filter.h
index 8f59ac0a6493..cbb6ffb74b76 100644
--- a/source/extensions/filters/http/gzip/gzip_filter.h
+++ b/source/extensions/filters/http/gzip/gzip_filter.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/http/header_map.h"
 #include "envoy/json/json_object.h"
@@ -54,7 +54,7 @@ struct GzipStats {
 class GzipFilterConfig {
 
 public:
-  GzipFilterConfig(const envoy::config::filter::http::gzip::v2::Gzip& gzip,
+  GzipFilterConfig(const envoy::extensions::filters::http::gzip::v3alpha::Gzip& gzip,
                    const std::string& stats_prefix, Stats::Scope& scope, Runtime::Loader& runtime);
 
   Compressor::ZlibCompressorImpl::CompressionLevel compressionLevel() const {
@@ -74,10 +74,12 @@ class GzipFilterConfig {
   uint64_t windowBits() const { return window_bits_; }
 
 private:
-  static Compressor::ZlibCompressorImpl::CompressionLevel compressionLevelEnum(
-      envoy::config::filter::http::gzip::v2::Gzip_CompressionLevel_Enum compression_level);
-  static Compressor::ZlibCompressorImpl::CompressionStrategy compressionStrategyEnum(
-      envoy::config::filter::http::gzip::v2::Gzip_CompressionStrategy compression_strategy);
+  static Compressor::ZlibCompressorImpl::CompressionLevel
+  compressionLevelEnum(envoy::extensions::filters::http::gzip::v3alpha::Gzip::CompressionLevel::Enum
+                           compression_level);
+  static Compressor::ZlibCompressorImpl::CompressionStrategy
+  compressionStrategyEnum(envoy::extensions::filters::http::gzip::v3alpha::Gzip::CompressionStrategy
+                              compression_strategy);
   static StringUtil::CaseUnorderedSet
   contentTypeSet(const Protobuf::RepeatedPtrField<std::string>& types);
 
diff --git a/source/extensions/filters/http/header_to_metadata/BUILD b/source/extensions/filters/http/header_to_metadata/BUILD
index df3b285c0f1c..c4c633c405dd 100644
--- a/source/extensions/filters/http/header_to_metadata/BUILD
+++ b/source/extensions/filters/http/header_to_metadata/BUILD
@@ -20,7 +20,7 @@ envoy_cc_library(
         "//include/envoy/server:filter_config_interface",
         "//source/common/common:base64_lib",
         "//source/extensions/filters/http:well_known_names",
-        "@envoy_api//envoy/config/filter/http/header_to_metadata/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/header_to_metadata/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -35,6 +35,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/header_to_metadata:header_to_metadata_filter_lib",
-        "@envoy_api//envoy/config/filter/http/header_to_metadata/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/header_to_metadata/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/header_to_metadata/config.cc b/source/extensions/filters/http/header_to_metadata/config.cc
index 3c9b10471308..8668041c53f8 100644
--- a/source/extensions/filters/http/header_to_metadata/config.cc
+++ b/source/extensions/filters/http/header_to_metadata/config.cc
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.h"
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.validate.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -16,7 +16,7 @@ namespace HttpFilters {
 namespace HeaderToMetadataFilter {
 
 Http::FilterFactoryCb HeaderToMetadataConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::header_to_metadata::v2::Config& proto_config,
+    const envoy::extensions::filters::http::header_to_metadata::v3alpha::Config& proto_config,
     const std::string&, Server::Configuration::FactoryContext&) {
   ConfigSharedPtr filter_config(std::make_shared<Config>(proto_config));
 
diff --git a/source/extensions/filters/http/header_to_metadata/config.h b/source/extensions/filters/http/header_to_metadata/config.h
index da9b6c35269d..22ffc1a8954c 100644
--- a/source/extensions/filters/http/header_to_metadata/config.h
+++ b/source/extensions/filters/http/header_to_metadata/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.h"
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.validate.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,13 +15,14 @@ namespace HeaderToMetadataFilter {
  * Config registration for the header-to-metadata filter. @see NamedHttpFilterConfigFactory.
  */
 class HeaderToMetadataConfig
-    : public Common::FactoryBase<envoy::config::filter::http::header_to_metadata::v2::Config> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::http::header_to_metadata::v3alpha::Config> {
 public:
   HeaderToMetadataConfig() : FactoryBase(HttpFilterNames::get().HeaderToMetadata) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::header_to_metadata::v2::Config& proto_config,
+      const envoy::extensions::filters::http::header_to_metadata::v3alpha::Config& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc
index 5a00f60ce3b3..396e757ce0c1 100644
--- a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc
+++ b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/header_to_metadata/header_to_metadata_filter.h"
 
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.h"
 
 #include "common/common/base64.h"
 #include "common/config/well_known_names.h"
@@ -16,7 +16,7 @@ namespace Extensions {
 namespace HttpFilters {
 namespace HeaderToMetadataFilter {
 
-Config::Config(const envoy::config::filter::http::header_to_metadata::v2::Config config) {
+Config::Config(const envoy::extensions::filters::http::header_to_metadata::v3alpha::Config config) {
   request_set_ = Config::configToVector(config.request_rules(), request_rules_);
   response_set_ = Config::configToVector(config.response_rules(), response_rules_);
 
@@ -97,7 +97,7 @@ bool HeaderToMetadataFilter::addMetadata(StructMap& map, const std::string& meta
   }
 
   std::string decodedValue = std::string(value);
-  if (encode == envoy::config::filter::http::header_to_metadata::v2::Config::BASE64) {
+  if (encode == envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::BASE64) {
     decodedValue = Base64::decodeWithoutPadding(value);
     if (decodedValue.empty()) {
       ENVOY_LOG(debug, "Base64 decode failed");
@@ -107,10 +107,10 @@ bool HeaderToMetadataFilter::addMetadata(StructMap& map, const std::string& meta
 
   // Sane enough, add the key/value.
   switch (type) {
-  case envoy::config::filter::http::header_to_metadata::v2::Config::STRING:
+  case envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::STRING:
     val.set_string_value(std::move(decodedValue));
     break;
-  case envoy::config::filter::http::header_to_metadata::v2::Config::NUMBER: {
+  case envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::NUMBER: {
     double dval;
     if (absl::SimpleAtod(StringUtil::trim(decodedValue), &dval)) {
       val.set_number_value(dval);
@@ -120,7 +120,7 @@ bool HeaderToMetadataFilter::addMetadata(StructMap& map, const std::string& meta
     }
     break;
   }
-  case envoy::config::filter::http::header_to_metadata::v2::Config::PROTOBUF_VALUE: {
+  case envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::PROTOBUF_VALUE: {
     if (!val.ParseFromString(decodedValue)) {
       ENVOY_LOG(debug, "parse from decoded string failed");
       return false;
diff --git a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h
index 297af97d2bc5..c27b4b84a3e0 100644
--- a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h
+++ b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h
@@ -4,7 +4,7 @@
 #include <tuple>
 #include <vector>
 
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.h"
 #include "envoy/server/filter_config.h"
 
 #include "common/common/logger.h"
@@ -16,9 +16,10 @@ namespace Extensions {
 namespace HttpFilters {
 namespace HeaderToMetadataFilter {
 
-using Rule = envoy::config::filter::http::header_to_metadata::v2::Config::Rule;
-using ValueType = envoy::config::filter::http::header_to_metadata::v2::Config::ValueType;
-using ValueEncode = envoy::config::filter::http::header_to_metadata::v2::Config::ValueEncode;
+using Rule = envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::Rule;
+using ValueType = envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::ValueType;
+using ValueEncode =
+    envoy::extensions::filters::http::header_to_metadata::v3alpha::Config::ValueEncode;
 using HeaderToMetadataRules = std::vector<std::pair<Http::LowerCaseString, Rule>>;
 
 // TODO(yangminzhu): Make MAX_HEADER_VALUE_LEN configurable.
@@ -30,7 +31,7 @@ const uint32_t MAX_HEADER_VALUE_LEN = 8 * 1024;
  */
 class Config : public Logger::Loggable<Logger::Id::config> {
 public:
-  Config(const envoy::config::filter::http::header_to_metadata::v2::Config config);
+  Config(const envoy::extensions::filters::http::header_to_metadata::v3alpha::Config config);
 
   HeaderToMetadataRules requestRules() const { return request_rules_; }
   HeaderToMetadataRules responseRules() const { return response_rules_; }
diff --git a/source/extensions/filters/http/health_check/BUILD b/source/extensions/filters/http/health_check/BUILD
index 2bd6a94e3abe..57404ba535ff 100644
--- a/source/extensions/filters/http/health_check/BUILD
+++ b/source/extensions/filters/http/health_check/BUILD
@@ -44,6 +44,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/health_check:health_check_lib",
-        "@envoy_api//envoy/config/filter/http/health_check/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/health_check/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/health_check/config.cc b/source/extensions/filters/http/health_check/config.cc
index 80a4bfab012d..9ed149e1aea4 100644
--- a/source/extensions/filters/http/health_check/config.cc
+++ b/source/extensions/filters/http/health_check/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/health_check/config.h"
 
-#include "envoy/config/filter/http/health_check/v2/health_check.pb.h"
-#include "envoy/config/filter/http/health_check/v2/health_check.pb.validate.h"
+#include "envoy/extensions/filters/http/health_check/v3alpha/health_check.pb.h"
+#include "envoy/extensions/filters/http/health_check/v3alpha/health_check.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/http/header_utility.h"
@@ -15,7 +15,7 @@ namespace HttpFilters {
 namespace HealthCheck {
 
 Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::health_check::v2::HealthCheck& proto_config,
+    const envoy::extensions::filters::http::health_check::v3alpha::HealthCheck& proto_config,
     const std::string&, Server::Configuration::FactoryContext& context) {
   ASSERT(proto_config.has_pass_through_mode());
 
diff --git a/source/extensions/filters/http/health_check/config.h b/source/extensions/filters/http/health_check/config.h
index 18d6f6142fdd..c42ee35d6814 100644
--- a/source/extensions/filters/http/health_check/config.h
+++ b/source/extensions/filters/http/health_check/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/health_check/v2/health_check.pb.h"
-#include "envoy/config/filter/http/health_check/v2/health_check.pb.validate.h"
+#include "envoy/extensions/filters/http/health_check/v3alpha/health_check.pb.h"
+#include "envoy/extensions/filters/http/health_check/v3alpha/health_check.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -12,13 +12,14 @@ namespace HttpFilters {
 namespace HealthCheck {
 
 class HealthCheckFilterConfig
-    : public Common::FactoryBase<envoy::config::filter::http::health_check::v2::HealthCheck> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::http::health_check::v3alpha::HealthCheck> {
 public:
   HealthCheckFilterConfig() : FactoryBase(HttpFilterNames::get().HealthCheck) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::health_check::v2::HealthCheck& proto_config,
+      const envoy::extensions::filters::http::health_check::v3alpha::HealthCheck& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/jwt_authn/BUILD b/source/extensions/filters/http/jwt_authn/BUILD
index 5af920b2a9b2..97153b8ed3e0 100644
--- a/source/extensions/filters/http/jwt_authn/BUILD
+++ b/source/extensions/filters/http/jwt_authn/BUILD
@@ -15,7 +15,7 @@ envoy_cc_library(
     hdrs = ["extractor.h"],
     deps = [
         "//source/common/http:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -30,7 +30,7 @@ envoy_cc_library(
         "//source/common/common:minimal_logger_lib",
         "//source/common/config:datasource_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -76,7 +76,7 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -88,8 +88,8 @@ envoy_cc_library(
         ":verifier_lib",
         "//source/common/http:header_utility_lib",
         "//source/common/router:config_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -101,7 +101,7 @@ envoy_cc_library(
         ":authenticator_lib",
         ":extractor_lib",
         "//include/envoy/http:header_map_interface",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -115,6 +115,6 @@ envoy_cc_library(
         "//include/envoy/server:filter_config_interface",
         "//include/envoy/stats:stats_macros",
         "//include/envoy/thread_local:thread_local_interface",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/jwt_authn/extractor.cc b/source/extensions/filters/http/jwt_authn/extractor.cc
index b437c79ab433..4dea2c961747 100644
--- a/source/extensions/filters/http/jwt_authn/extractor.cc
+++ b/source/extensions/filters/http/jwt_authn/extractor.cc
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/common/utility.h"
 #include "common/http/headers.h"
@@ -11,8 +11,8 @@
 
 #include "absl/strings/match.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider;
 using Envoy::Http::LowerCaseString;
 
 namespace Envoy {
@@ -89,7 +89,7 @@ class ExtractorImpl : public Logger::Loggable<Logger::Id::jwt>, public Extractor
   ExtractorImpl(const JwtProvider& provider);
 
   ExtractorImpl(
-      const std::vector<const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider*>&
+      const std::vector<const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider*>&
           providers);
 
   std::vector<JwtLocationConstPtr> extract(const Http::HeaderMap& headers) const override;
diff --git a/source/extensions/filters/http/jwt_authn/extractor.h b/source/extensions/filters/http/jwt_authn/extractor.h
index 949a9f30423e..6963cf2bb166 100644
--- a/source/extensions/filters/http/jwt_authn/extractor.h
+++ b/source/extensions/filters/http/jwt_authn/extractor.h
@@ -4,7 +4,7 @@
 #include <string>
 #include <unordered_set>
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 #include "envoy/http/header_map.h"
 
 #include "common/common/logger.h"
@@ -38,7 +38,7 @@ class JwtLocation {
 
 using JwtLocationConstPtr = std::unique_ptr<const JwtLocation>;
 using JwtProviderList =
-    std::vector<const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider*>;
+    std::vector<const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider*>;
 
 class Extractor;
 using ExtractorConstPtr = std::unique_ptr<const Extractor>;
@@ -90,7 +90,7 @@ class Extractor {
    * @return the extractor object.
    */
   static ExtractorConstPtr
-  create(const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider& provider);
+  create(const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider& provider);
 
   /**
    * Create an instance of Extractor for a list of provider config.
diff --git a/source/extensions/filters/http/jwt_authn/filter_config.h b/source/extensions/filters/http/jwt_authn/filter_config.h
index 02c19e251bb4..632c70e4a3a9 100644
--- a/source/extensions/filters/http/jwt_authn/filter_config.h
+++ b/source/extensions/filters/http/jwt_authn/filter_config.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 #include "envoy/router/string_accessor.h"
 #include "envoy/server/filter_config.h"
 #include "envoy/stats/scope.h"
@@ -27,7 +27,7 @@ class ThreadLocalCache : public ThreadLocal::ThreadLocalObject {
 public:
   // Load the config from envoy config.
   ThreadLocalCache(
-      const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication& config,
+      const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication& config,
       TimeSource& time_source, Api::Api& api) {
     jwks_cache_ = JwksCache::create(config, time_source, api);
   }
@@ -62,7 +62,7 @@ class FilterConfig : public Logger::Loggable<Logger::Id::jwt>, public AuthFactor
 public:
   ~FilterConfig() override = default;
 
-  FilterConfig(::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication proto_config,
+  FilterConfig(envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication proto_config,
                const std::string& stats_prefix, Server::Configuration::FactoryContext& context)
       : proto_config_(std::move(proto_config)),
         stats_(generateStats(stats_prefix, context.scope())),
@@ -140,7 +140,7 @@ class FilterConfig : public Logger::Loggable<Logger::Id::jwt>, public AuthFactor
   };
 
   // The proto config.
-  ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication proto_config_;
+  envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication proto_config_;
   // The stats for the filter.
   JwtAuthnFilterStats stats_;
   // Thread local slot to store per-thread auth store
diff --git a/source/extensions/filters/http/jwt_authn/filter_factory.cc b/source/extensions/filters/http/jwt_authn/filter_factory.cc
index f7b84845dc15..1a389a957397 100644
--- a/source/extensions/filters/http/jwt_authn/filter_factory.cc
+++ b/source/extensions/filters/http/jwt_authn/filter_factory.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/jwt_authn/filter_factory.h"
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.validate.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/config/datasource.h"
@@ -10,7 +10,7 @@
 
 #include "jwt_verify_lib/jwks.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using ::google::jwt_verify::Jwks;
 using ::google::jwt_verify::Status;
 
diff --git a/source/extensions/filters/http/jwt_authn/filter_factory.h b/source/extensions/filters/http/jwt_authn/filter_factory.h
index 5dc6c162c2e7..cb93f6faf98b 100644
--- a/source/extensions/filters/http/jwt_authn/filter_factory.h
+++ b/source/extensions/filters/http/jwt_authn/filter_factory.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.validate.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.validate.h"
 #include "envoy/server/filter_config.h"
 
 #include "extensions/filters/http/common/factory_base.h"
@@ -16,13 +16,13 @@ namespace JwtAuthn {
  * Config registration for jwt_authn filter.
  */
 class FilterFactory : public Common::FactoryBase<
-                          ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication> {
+                          envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication> {
 public:
   FilterFactory() : FactoryBase(HttpFilterNames::get().JwtAuthn) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication& proto_config,
+      const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/jwt_authn/jwks_cache.cc b/source/extensions/filters/http/jwt_authn/jwks_cache.cc
index e882d240d6da..c9f99f218869 100644
--- a/source/extensions/filters/http/jwt_authn/jwks_cache.cc
+++ b/source/extensions/filters/http/jwt_authn/jwks_cache.cc
@@ -4,7 +4,7 @@
 #include <unordered_map>
 
 #include "envoy/common/time.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/common/logger.h"
 #include "common/config/datasource.h"
@@ -12,8 +12,8 @@
 
 #include "jwt_verify_lib/check_audience.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider;
 using ::google::jwt_verify::Jwks;
 using ::google::jwt_verify::Status;
 
@@ -133,7 +133,7 @@ class JwksCacheImpl : public JwksCache {
 } // namespace
 
 JwksCachePtr JwksCache::create(
-    const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication& config,
+    const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication& config,
     TimeSource& time_source, Api::Api& api) {
   return JwksCachePtr(new JwksCacheImpl(config, time_source, api));
 }
diff --git a/source/extensions/filters/http/jwt_authn/jwks_cache.h b/source/extensions/filters/http/jwt_authn/jwks_cache.h
index a27cd5ccd380..e27777f9b71c 100644
--- a/source/extensions/filters/http/jwt_authn/jwks_cache.h
+++ b/source/extensions/filters/http/jwt_authn/jwks_cache.h
@@ -3,7 +3,7 @@
 #include "envoy/api/api.h"
 #include "envoy/common/pure.h"
 #include "envoy/common/time.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "jwt_verify_lib/jwks.h"
 
@@ -46,7 +46,7 @@ class JwksCache {
     virtual bool areAudiencesAllowed(const std::vector<std::string>& audiences) const PURE;
 
     // Get the cached config: JWT rule.
-    virtual const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider&
+    virtual const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider&
     getJwtProvider() const PURE;
 
     // Get the Jwks object.
@@ -67,7 +67,7 @@ class JwksCache {
 
   // Factory function to create an instance.
   static JwksCachePtr
-  create(const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication& config,
+  create(const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication& config,
          TimeSource& time_source, Api::Api& api);
 };
 
diff --git a/source/extensions/filters/http/jwt_authn/matcher.cc b/source/extensions/filters/http/jwt_authn/matcher.cc
index 349d822ed71b..f9177f7aba92 100644
--- a/source/extensions/filters/http/jwt_authn/matcher.cc
+++ b/source/extensions/filters/http/jwt_authn/matcher.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/jwt_authn/matcher.h"
 
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/common/logger.h"
 #include "common/common/regex.h"
@@ -9,8 +9,8 @@
 
 #include "absl/strings/match.h"
 
-using ::envoy::api::v2::route::RouteMatch;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::RequirementRule;
+using envoy::config::route::v3alpha::RouteMatch;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::RequirementRule;
 using Envoy::Router::ConfigUtility;
 
 namespace Envoy {
@@ -114,11 +114,14 @@ class PathMatcherImpl : public BaseMatcherImpl {
 class RegexMatcherImpl : public BaseMatcherImpl {
 public:
   RegexMatcherImpl(const RequirementRule& rule) : BaseMatcherImpl(rule) {
-    if (rule.match().path_specifier_case() == envoy::api::v2::route::RouteMatch::kRegex) {
-      regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(rule.match().regex());
-      regex_str_ = rule.match().regex();
+    if (rule.match().path_specifier_case() ==
+        envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kHiddenEnvoyDeprecatedRegex) {
+      regex_ = Regex::Utility::parseStdRegexAsCompiledMatcher(
+          rule.match().hidden_envoy_deprecated_regex());
+      regex_str_ = rule.match().hidden_envoy_deprecated_regex();
     } else {
-      ASSERT(rule.match().path_specifier_case() == envoy::api::v2::route::RouteMatch::kSafeRegex);
+      ASSERT(rule.match().path_specifier_case() ==
+             envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::kSafeRegex);
       regex_ = Regex::Utility::parseRegex(rule.match().safe_regex());
       regex_str_ = rule.match().safe_regex().regex();
     }
@@ -152,7 +155,7 @@ MatcherConstPtr Matcher::create(const RequirementRule& rule) {
     return std::make_unique<PrefixMatcherImpl>(rule);
   case RouteMatch::PathSpecifierCase::kPath:
     return std::make_unique<PathMatcherImpl>(rule);
-  case RouteMatch::PathSpecifierCase::kRegex:
+  case RouteMatch::PathSpecifierCase::kHiddenEnvoyDeprecatedRegex:
   case RouteMatch::PathSpecifierCase::kSafeRegex:
     return std::make_unique<RegexMatcherImpl>(rule);
   // path specifier is required.
diff --git a/source/extensions/filters/http/jwt_authn/matcher.h b/source/extensions/filters/http/jwt_authn/matcher.h
index 77095382202e..29da77e919d8 100644
--- a/source/extensions/filters/http/jwt_authn/matcher.h
+++ b/source/extensions/filters/http/jwt_authn/matcher.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 #include "envoy/http/header_map.h"
 
 namespace Envoy {
@@ -34,7 +34,7 @@ class Matcher {
    * @return the matcher instance.
    */
   static MatcherConstPtr
-  create(const ::envoy::config::filter::http::jwt_authn::v2alpha::RequirementRule& rule);
+  create(const envoy::extensions::filters::http::jwt_authn::v3alpha::RequirementRule& rule);
 };
 
 } // namespace JwtAuthn
diff --git a/source/extensions/filters/http/jwt_authn/verifier.cc b/source/extensions/filters/http/jwt_authn/verifier.cc
index c991e86d32db..f6ba683905a3 100644
--- a/source/extensions/filters/http/jwt_authn/verifier.cc
+++ b/source/extensions/filters/http/jwt_authn/verifier.cc
@@ -1,13 +1,13 @@
 #include "extensions/filters/http/jwt_authn/verifier.h"
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "jwt_verify_lib/check_audience.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtRequirement;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtRequirementAndList;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtRequirementOrList;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtRequirement;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtRequirementAndList;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtRequirementOrList;
 using ::google::jwt_verify::CheckAudience;
 using ::google::jwt_verify::Status;
 
diff --git a/source/extensions/filters/http/jwt_authn/verifier.h b/source/extensions/filters/http/jwt_authn/verifier.h
index b56a45840f27..95758fa33ec2 100644
--- a/source/extensions/filters/http/jwt_authn/verifier.h
+++ b/source/extensions/filters/http/jwt_authn/verifier.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "extensions/filters/http/jwt_authn/authenticator.h"
 
@@ -80,11 +80,12 @@ class Verifier {
   virtual void verify(ContextSharedPtr context) const PURE;
 
   // Factory method for creating verifiers.
-  static VerifierConstPtr create(
-      const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtRequirement& requirement,
-      const Protobuf::Map<
-          std::string, ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider>& providers,
-      const AuthFactory& factory);
+  static VerifierConstPtr
+  create(const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtRequirement& requirement,
+         const Protobuf::Map<std::string,
+                             envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider>&
+             providers,
+         const AuthFactory& factory);
 
   // Factory method for creating verifier contexts.
   static ContextSharedPtr createContext(Http::HeaderMap& headers, Tracing::Span& parent_span,
diff --git a/source/extensions/filters/http/lua/BUILD b/source/extensions/filters/http/lua/BUILD
index 7a6fd15165fa..56a95deeabe1 100644
--- a/source/extensions/filters/http/lua/BUILD
+++ b/source/extensions/filters/http/lua/BUILD
@@ -56,6 +56,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/lua:lua_filter_lib",
-        "@envoy_api//envoy/config/filter/http/lua/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/lua/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/lua/config.cc b/source/extensions/filters/http/lua/config.cc
index 78a68485f7d3..f4138955d589 100644
--- a/source/extensions/filters/http/lua/config.cc
+++ b/source/extensions/filters/http/lua/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/lua/config.h"
 
-#include "envoy/config/filter/http/lua/v2/lua.pb.h"
-#include "envoy/config/filter/http/lua/v2/lua.pb.validate.h"
+#include "envoy/extensions/filters/http/lua/v3alpha/lua.pb.h"
+#include "envoy/extensions/filters/http/lua/v3alpha/lua.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/lua/lua_filter.h"
@@ -12,7 +12,7 @@ namespace HttpFilters {
 namespace Lua {
 
 Http::FilterFactoryCb LuaFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::lua::v2::Lua& proto_config, const std::string&,
+    const envoy::extensions::filters::http::lua::v3alpha::Lua& proto_config, const std::string&,
     Server::Configuration::FactoryContext& context) {
   FilterConfigConstSharedPtr filter_config(new FilterConfig{
       proto_config.inline_code(), context.threadLocal(), context.clusterManager()});
diff --git a/source/extensions/filters/http/lua/config.h b/source/extensions/filters/http/lua/config.h
index 3d007e0c74dc..d916e3acdf97 100644
--- a/source/extensions/filters/http/lua/config.h
+++ b/source/extensions/filters/http/lua/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/lua/v2/lua.pb.h"
-#include "envoy/config/filter/http/lua/v2/lua.pb.validate.h"
+#include "envoy/extensions/filters/http/lua/v3alpha/lua.pb.h"
+#include "envoy/extensions/filters/http/lua/v3alpha/lua.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -14,15 +14,15 @@ namespace Lua {
 /**
  * Config registration for the Lua filter. @see NamedHttpFilterConfigFactory.
  */
-class LuaFilterConfig : public Common::FactoryBase<envoy::config::filter::http::lua::v2::Lua> {
+class LuaFilterConfig
+    : public Common::FactoryBase<envoy::extensions::filters::http::lua::v3alpha::Lua> {
 public:
   LuaFilterConfig() : FactoryBase(HttpFilterNames::get().Lua) {}
 
 private:
-  Http::FilterFactoryCb
-  createFilterFactoryFromProtoTyped(const envoy::config::filter::http::lua::v2::Lua& proto_config,
-                                    const std::string&,
-                                    Server::Configuration::FactoryContext& context) override;
+  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+      const envoy::extensions::filters::http::lua::v3alpha::Lua& proto_config, const std::string&,
+      Server::Configuration::FactoryContext& context) override;
 };
 
 } // namespace Lua
diff --git a/source/extensions/filters/http/original_src/BUILD b/source/extensions/filters/http/original_src/BUILD
index 12fc24b4c565..d2eefce560d5 100644
--- a/source/extensions/filters/http/original_src/BUILD
+++ b/source/extensions/filters/http/original_src/BUILD
@@ -15,7 +15,7 @@ envoy_cc_library(
     name = "config_lib",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    deps = ["@envoy_api//envoy/config/filter/http/original_src/v2alpha1:pkg_cc_proto"],
+    deps = ["@envoy_api//envoy/extensions/filters/http/original_src/v3alpha:pkg_cc_proto"],
 )
 
 envoy_cc_library(
@@ -43,6 +43,6 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/original_src/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/original_src/config.cc b/source/extensions/filters/http/original_src/config.cc
index cfbacff1a275..812f77c9fb01 100644
--- a/source/extensions/filters/http/original_src/config.cc
+++ b/source/extensions/filters/http/original_src/config.cc
@@ -1,13 +1,13 @@
 #include "extensions/filters/http/original_src/config.h"
 
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
 
 namespace Envoy {
 namespace Extensions {
 namespace HttpFilters {
 namespace OriginalSrc {
 
-Config::Config(const envoy::config::filter::http::original_src::v2alpha1::OriginalSrc& config)
+Config::Config(const envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc& config)
     : mark_(config.mark()) {}
 
 } // namespace OriginalSrc
diff --git a/source/extensions/filters/http/original_src/config.h b/source/extensions/filters/http/original_src/config.h
index 3cbe17d8a75a..b73e07c1df28 100644
--- a/source/extensions/filters/http/original_src/config.h
+++ b/source/extensions/filters/http/original_src/config.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -9,7 +9,8 @@ namespace OriginalSrc {
 class Config {
 public:
   Config() = default;
-  explicit Config(const envoy::config::filter::http::original_src::v2alpha1::OriginalSrc& config);
+  explicit Config(
+      const envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc& config);
 
   uint32_t mark() const { return mark_; }
 
diff --git a/source/extensions/filters/http/original_src/original_src_config_factory.cc b/source/extensions/filters/http/original_src/original_src_config_factory.cc
index a3c3ff48c1a7..41f768e874ee 100644
--- a/source/extensions/filters/http/original_src/original_src_config_factory.cc
+++ b/source/extensions/filters/http/original_src/original_src_config_factory.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/original_src/original_src_config_factory.h"
 
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.h"
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.validate.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/original_src/config.h"
@@ -14,7 +14,7 @@ namespace HttpFilters {
 namespace OriginalSrc {
 
 Http::FilterFactoryCb OriginalSrcConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::original_src::v2alpha1::OriginalSrc& proto_config,
+    const envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc& proto_config,
     const std::string&, Server::Configuration::FactoryContext&) {
   Config config(proto_config);
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
diff --git a/source/extensions/filters/http/original_src/original_src_config_factory.h b/source/extensions/filters/http/original_src/original_src_config_factory.h
index 76f8375a41bc..073596c45e1f 100644
--- a/source/extensions/filters/http/original_src/original_src_config_factory.h
+++ b/source/extensions/filters/http/original_src/original_src_config_factory.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.h"
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.validate.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -14,12 +14,13 @@ namespace OriginalSrc {
  * Config registration for the original_src filter.
  */
 class OriginalSrcConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::http::original_src::v2alpha1::OriginalSrc> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc> {
 public:
   OriginalSrcConfigFactory() : FactoryBase(HttpFilterNames::get().OriginalSrc) {}
 
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::original_src::v2alpha1::OriginalSrc& proto_config,
+      const envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc& proto_config,
       const std::string& stat_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/ratelimit/BUILD b/source/extensions/filters/http/ratelimit/BUILD
index 196f7147847d..dd129263f8d3 100644
--- a/source/extensions/filters/http/ratelimit/BUILD
+++ b/source/extensions/filters/http/ratelimit/BUILD
@@ -26,7 +26,7 @@ envoy_cc_library(
         "//source/common/router:config_lib",
         "//source/extensions/filters/common/ratelimit:ratelimit_client_interface",
         "//source/extensions/filters/common/ratelimit:stat_names_lib",
-        "@envoy_api//envoy/config/filter/http/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -43,6 +43,6 @@ envoy_cc_extension(
         "//source/extensions/filters/common/ratelimit:ratelimit_lib",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/ratelimit/config.cc b/source/extensions/filters/http/ratelimit/config.cc
index 772b1ea225ae..cd3f6c820421 100644
--- a/source/extensions/filters/http/ratelimit/config.cc
+++ b/source/extensions/filters/http/ratelimit/config.cc
@@ -3,8 +3,8 @@
 #include <chrono>
 #include <string>
 
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.validate.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -18,8 +18,8 @@ namespace HttpFilters {
 namespace RateLimitFilter {
 
 Http::FilterFactoryCb RateLimitFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::rate_limit::v2::RateLimit& proto_config, const std::string&,
-    Server::Configuration::FactoryContext& context) {
+    const envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit& proto_config,
+    const std::string&, Server::Configuration::FactoryContext& context) {
   ASSERT(!proto_config.domain().empty());
   FilterConfigSharedPtr filter_config(new FilterConfig(proto_config, context.localInfo(),
                                                        context.scope(), context.runtime(),
diff --git a/source/extensions/filters/http/ratelimit/config.h b/source/extensions/filters/http/ratelimit/config.h
index ba0683ab5dcc..35f9c3104b77 100644
--- a/source/extensions/filters/http/ratelimit/config.h
+++ b/source/extensions/filters/http/ratelimit/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.validate.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.validate.h"
 
 #include "extensions/filters/common/ratelimit/ratelimit.h"
 #include "extensions/filters/http/common/factory_base.h"
@@ -16,13 +16,13 @@ namespace RateLimitFilter {
  * Config registration for the rate limit filter. @see NamedHttpFilterConfigFactory.
  */
 class RateLimitFilterConfig
-    : public Common::FactoryBase<envoy::config::filter::http::rate_limit::v2::RateLimit> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit> {
 public:
   RateLimitFilterConfig() : FactoryBase(HttpFilterNames::get().RateLimit) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::rate_limit::v2::RateLimit& proto_config,
+      const envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/ratelimit/ratelimit.h b/source/extensions/filters/http/ratelimit/ratelimit.h
index cc5e05e60612..02de81eab6c7 100644
--- a/source/extensions/filters/http/ratelimit/ratelimit.h
+++ b/source/extensions/filters/http/ratelimit/ratelimit.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.h"
 #include "envoy/http/context.h"
 #include "envoy/http/filter.h"
 #include "envoy/local_info/local_info.h"
@@ -35,7 +35,7 @@ enum class FilterRequestType { Internal, External, Both };
  */
 class FilterConfig {
 public:
-  FilterConfig(const envoy::config::filter::http::rate_limit::v2::RateLimit& config,
+  FilterConfig(const envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit& config,
                const LocalInfo::LocalInfo& local_info, Stats::Scope& scope,
                Runtime::Loader& runtime, Http::Context& http_context)
       : domain_(config.domain()), stage_(static_cast<uint64_t>(config.stage())),
diff --git a/source/extensions/filters/http/rbac/BUILD b/source/extensions/filters/http/rbac/BUILD
index a8dfd2ac9481..29e8aea7e893 100644
--- a/source/extensions/filters/http/rbac/BUILD
+++ b/source/extensions/filters/http/rbac/BUILD
@@ -19,7 +19,7 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/rbac:rbac_filter_lib",
-        "@envoy_api//envoy/config/filter/http/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -34,6 +34,6 @@ envoy_cc_library(
         "//source/extensions/filters/common/rbac:engine_lib",
         "//source/extensions/filters/common/rbac:utility_lib",
         "//source/extensions/filters/http:well_known_names",
-        "@envoy_api//envoy/config/filter/http/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/rbac/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/rbac/config.cc b/source/extensions/filters/http/rbac/config.cc
index 32ac5d93c012..0611e1ea1409 100644
--- a/source/extensions/filters/http/rbac/config.cc
+++ b/source/extensions/filters/http/rbac/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/rbac/config.h"
 
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.validate.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/rbac/rbac_filter.h"
@@ -12,7 +12,7 @@ namespace HttpFilters {
 namespace RBACFilter {
 
 Http::FilterFactoryCb RoleBasedAccessControlFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::rbac::v2::RBAC& proto_config,
+    const envoy::extensions::filters::http::rbac::v3alpha::RBAC& proto_config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
 
   auto config = std::make_shared<RoleBasedAccessControlFilterConfig>(proto_config, stats_prefix,
@@ -25,7 +25,7 @@ Http::FilterFactoryCb RoleBasedAccessControlFilterConfigFactory::createFilterFac
 
 Router::RouteSpecificFilterConfigConstSharedPtr
 RoleBasedAccessControlFilterConfigFactory::createRouteSpecificFilterConfigTyped(
-    const envoy::config::filter::http::rbac::v2::RBACPerRoute& proto_config,
+    const envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute& proto_config,
     Server::Configuration::ServerFactoryContext&, ProtobufMessage::ValidationVisitor&) {
   return std::make_shared<const RoleBasedAccessControlRouteSpecificFilterConfig>(proto_config);
 }
diff --git a/source/extensions/filters/http/rbac/config.h b/source/extensions/filters/http/rbac/config.h
index a58d310e7c5d..774796885863 100644
--- a/source/extensions/filters/http/rbac/config.h
+++ b/source/extensions/filters/http/rbac/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.validate.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,19 +15,18 @@ namespace RBACFilter {
  * Config registration for the RBAC filter. @see NamedHttpFilterConfigFactory.
  */
 class RoleBasedAccessControlFilterConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::http::rbac::v2::RBAC,
-                                 envoy::config::filter::http::rbac::v2::RBACPerRoute> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::rbac::v3alpha::RBAC,
+                                 envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute> {
 public:
   RoleBasedAccessControlFilterConfigFactory() : FactoryBase(HttpFilterNames::get().Rbac) {}
 
 private:
-  Http::FilterFactoryCb
-  createFilterFactoryFromProtoTyped(const envoy::config::filter::http::rbac::v2::RBAC& proto_config,
-                                    const std::string& stats_prefix,
-                                    Server::Configuration::FactoryContext& context) override;
+  Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
+      const envoy::extensions::filters::http::rbac::v3alpha::RBAC& proto_config,
+      const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 
   Router::RouteSpecificFilterConfigConstSharedPtr createRouteSpecificFilterConfigTyped(
-      const envoy::config::filter::http::rbac::v2::RBACPerRoute& proto_config,
+      const envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute& proto_config,
       Server::Configuration::ServerFactoryContext& context,
       ProtobufMessage::ValidationVisitor& validator) override;
 };
diff --git a/source/extensions/filters/http/rbac/rbac_filter.cc b/source/extensions/filters/http/rbac/rbac_filter.cc
index 12f885b17ddc..ac3362ca1a3a 100644
--- a/source/extensions/filters/http/rbac/rbac_filter.cc
+++ b/source/extensions/filters/http/rbac/rbac_filter.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/rbac/rbac_filter.h"
 
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/http/utility.h"
@@ -21,7 +21,7 @@ struct RcDetailsValues {
 using RcDetails = ConstSingleton<RcDetailsValues>;
 
 RoleBasedAccessControlFilterConfig::RoleBasedAccessControlFilterConfig(
-    const envoy::config::filter::http::rbac::v2::RBAC& proto_config,
+    const envoy::extensions::filters::http::rbac::v3alpha::RBAC& proto_config,
     const std::string& stats_prefix, Stats::Scope& scope)
     : stats_(Filters::Common::RBAC::generateStats(stats_prefix, scope)),
       engine_(Filters::Common::RBAC::createEngine(proto_config)),
@@ -48,7 +48,7 @@ RoleBasedAccessControlFilterConfig::engine(const Router::RouteConstSharedPtr rou
 }
 
 RoleBasedAccessControlRouteSpecificFilterConfig::RoleBasedAccessControlRouteSpecificFilterConfig(
-    const envoy::config::filter::http::rbac::v2::RBACPerRoute& per_route_config)
+    const envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute& per_route_config)
     : engine_(Filters::Common::RBAC::createEngine(per_route_config.rbac())),
       shadow_engine_(Filters::Common::RBAC::createShadowEngine(per_route_config.rbac())) {}
 
diff --git a/source/extensions/filters/http/rbac/rbac_filter.h b/source/extensions/filters/http/rbac/rbac_filter.h
index e6b004458052..121bb6090c03 100644
--- a/source/extensions/filters/http/rbac/rbac_filter.h
+++ b/source/extensions/filters/http/rbac/rbac_filter.h
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -20,7 +20,7 @@ namespace RBACFilter {
 class RoleBasedAccessControlRouteSpecificFilterConfig : public Router::RouteSpecificFilterConfig {
 public:
   RoleBasedAccessControlRouteSpecificFilterConfig(
-      const envoy::config::filter::http::rbac::v2::RBACPerRoute& per_route_config);
+      const envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute& per_route_config);
 
   const Filters::Common::RBAC::RoleBasedAccessControlEngineImpl*
   engine(Filters::Common::RBAC::EnforcementMode mode) const {
@@ -39,7 +39,7 @@ class RoleBasedAccessControlRouteSpecificFilterConfig : public Router::RouteSpec
 class RoleBasedAccessControlFilterConfig {
 public:
   RoleBasedAccessControlFilterConfig(
-      const envoy::config::filter::http::rbac::v2::RBAC& proto_config,
+      const envoy::extensions::filters::http::rbac::v3alpha::RBAC& proto_config,
       const std::string& stats_prefix, Stats::Scope& scope);
 
   Filters::Common::RBAC::RoleBasedAccessControlFilterStats& stats() { return stats_; }
diff --git a/source/extensions/filters/http/router/BUILD b/source/extensions/filters/http/router/BUILD
index c60f6e8fcedf..7d43a8bae8ec 100644
--- a/source/extensions/filters/http/router/BUILD
+++ b/source/extensions/filters/http/router/BUILD
@@ -22,6 +22,6 @@ envoy_cc_extension(
         "//source/common/router:shadow_writer_lib",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/router/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/router/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/router/config.cc b/source/extensions/filters/http/router/config.cc
index 73f45b863c37..27e2e19982ad 100644
--- a/source/extensions/filters/http/router/config.cc
+++ b/source/extensions/filters/http/router/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/router/config.h"
 
-#include "envoy/config/filter/http/router/v2/router.pb.h"
-#include "envoy/config/filter/http/router/v2/router.pb.validate.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.validate.h"
 
 #include "common/router/router.h"
 #include "common/router/shadow_writer_impl.h"
@@ -12,7 +12,7 @@ namespace HttpFilters {
 namespace RouterFilter {
 
 Http::FilterFactoryCb RouterFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::router::v2::Router& proto_config,
+    const envoy::extensions::filters::http::router::v3alpha::Router& proto_config,
     const std::string& stat_prefix, Server::Configuration::FactoryContext& context) {
   Router::FilterConfigSharedPtr filter_config(new Router::FilterConfig(
       stat_prefix, context, std::make_unique<Router::ShadowWriterImpl>(context.clusterManager()),
diff --git a/source/extensions/filters/http/router/config.h b/source/extensions/filters/http/router/config.h
index afbab039a827..abd1caff1b92 100644
--- a/source/extensions/filters/http/router/config.h
+++ b/source/extensions/filters/http/router/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/router/v2/router.pb.h"
-#include "envoy/config/filter/http/router/v2/router.pb.validate.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/protobuf.h"
@@ -18,7 +18,7 @@ namespace RouterFilter {
  * Config registration for the router filter. @see NamedHttpFilterConfigFactory.
  */
 class RouterFilterConfig
-    : public Common::FactoryBase<envoy::config::filter::http::router::v2::Router> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::router::v3alpha::Router> {
 public:
   RouterFilterConfig() : FactoryBase(HttpFilterNames::get().Router) {}
 
@@ -26,7 +26,7 @@ class RouterFilterConfig
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::router::v2::Router& proto_config,
+      const envoy::extensions::filters::http::router::v3alpha::Router& proto_config,
       const std::string& stat_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/squash/BUILD b/source/extensions/filters/http/squash/BUILD
index 0cb4ef57c39d..f705e945b428 100644
--- a/source/extensions/filters/http/squash/BUILD
+++ b/source/extensions/filters/http/squash/BUILD
@@ -28,7 +28,7 @@ envoy_cc_library(
         "//source/common/http:message_lib",
         "//source/common/http:utility_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/config/filter/http/squash/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/squash/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -43,6 +43,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/squash:squash_filter_lib",
-        "@envoy_api//envoy/config/filter/http/squash/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/squash/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/squash/config.cc b/source/extensions/filters/http/squash/config.cc
index 6143e964f974..b8c3f5842765 100644
--- a/source/extensions/filters/http/squash/config.cc
+++ b/source/extensions/filters/http/squash/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/http/squash/config.h"
 
-#include "envoy/config/filter/http/squash/v2/squash.pb.h"
-#include "envoy/config/filter/http/squash/v2/squash.pb.validate.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/protobuf.h"
@@ -15,8 +15,8 @@ namespace HttpFilters {
 namespace Squash {
 
 Http::FilterFactoryCb SquashFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::squash::v2::Squash& proto_config, const std::string&,
-    Server::Configuration::FactoryContext& context) {
+    const envoy::extensions::filters::http::squash::v3alpha::Squash& proto_config,
+    const std::string&, Server::Configuration::FactoryContext& context) {
 
   SquashFilterConfigSharedPtr config = std::make_shared<SquashFilterConfig>(
       SquashFilterConfig(proto_config, context.clusterManager()));
diff --git a/source/extensions/filters/http/squash/config.h b/source/extensions/filters/http/squash/config.h
index bdc44ab3ba25..2130ddfe7465 100644
--- a/source/extensions/filters/http/squash/config.h
+++ b/source/extensions/filters/http/squash/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/squash/v2/squash.pb.h"
-#include "envoy/config/filter/http/squash/v2/squash.pb.validate.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,13 +15,13 @@ namespace Squash {
  * Config registration for the squash filter. @see NamedHttpFilterConfigFactory.
  */
 class SquashFilterConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::http::squash::v2::Squash> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::squash::v3alpha::Squash> {
 public:
   SquashFilterConfigFactory() : FactoryBase(HttpFilterNames::get().Squash) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::squash::v2::Squash& proto_config,
+      const envoy::extensions::filters::http::squash::v3alpha::Squash& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/squash/squash_filter.cc b/source/extensions/filters/http/squash/squash_filter.cc
index 52d652b11112..c9d0de573496 100644
--- a/source/extensions/filters/http/squash/squash_filter.cc
+++ b/source/extensions/filters/http/squash/squash_filter.cc
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/config/filter/http/squash/v2/squash.pb.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.h"
 #include "envoy/http/codes.h"
 
 #include "common/common/empty_string.h"
@@ -30,7 +30,7 @@ const std::string SquashFilter::ATTACHED_STATE = "attached";
 const std::string SquashFilter::ERROR_STATE = "error";
 
 SquashFilterConfig::SquashFilterConfig(
-    const envoy::config::filter::http::squash::v2::Squash& proto_config,
+    const envoy::extensions::filters::http::squash::v3alpha::Squash& proto_config,
     Upstream::ClusterManager& cluster_manager)
     : cluster_name_(proto_config.cluster()),
       attachment_json_(getAttachment(proto_config.attachment_template())),
diff --git a/source/extensions/filters/http/squash/squash_filter.h b/source/extensions/filters/http/squash/squash_filter.h
index 7b9e76306dad..6ebed4e8629c 100644
--- a/source/extensions/filters/http/squash/squash_filter.h
+++ b/source/extensions/filters/http/squash/squash_filter.h
@@ -2,7 +2,7 @@
 
 #include <regex>
 
-#include "envoy/config/filter/http/squash/v2/squash.pb.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.h"
 #include "envoy/http/async_client.h"
 #include "envoy/http/filter.h"
 #include "envoy/json/json_object.h"
@@ -20,7 +20,7 @@ namespace Squash {
 
 class SquashFilterConfig : protected Logger::Loggable<Logger::Id::config> {
 public:
-  SquashFilterConfig(const envoy::config::filter::http::squash::v2::Squash& proto_config,
+  SquashFilterConfig(const envoy::extensions::filters::http::squash::v3alpha::Squash& proto_config,
                      Upstream::ClusterManager& cluster_manager);
   const std::string& clusterName() const { return cluster_name_; }
   const std::string& attachmentJson() const { return attachment_json_; }
diff --git a/source/extensions/filters/http/tap/BUILD b/source/extensions/filters/http/tap/BUILD
index 2b1929cbf0ad..e9abc91c8c5e 100644
--- a/source/extensions/filters/http/tap/BUILD
+++ b/source/extensions/filters/http/tap/BUILD
@@ -29,9 +29,9 @@ envoy_cc_library(
     deps = [
         ":tap_config_interface",
         "//source/extensions/common/tap:tap_config_base",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,7 +44,7 @@ envoy_cc_library(
         "//include/envoy/access_log:access_log_interface",
         "//include/envoy/http:filter_interface",
         "//source/extensions/common/tap:extension_config_base",
-        "@envoy_api//envoy/config/filter/http/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -60,7 +60,7 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/http/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/tap/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/tap/config.cc b/source/extensions/filters/http/tap/config.cc
index 35d95e340b99..536e1893dada 100644
--- a/source/extensions/filters/http/tap/config.cc
+++ b/source/extensions/filters/http/tap/config.cc
@@ -1,9 +1,9 @@
 #include "extensions/filters/http/tap/config.h"
 
-#include "envoy/config/filter/http/tap/v2alpha/tap.pb.h"
-#include "envoy/config/filter/http/tap/v2alpha/tap.pb.validate.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/extensions/filters/http/tap/v3alpha/tap.pb.h"
+#include "envoy/extensions/filters/http/tap/v3alpha/tap.pb.validate.h"
 #include "envoy/registry/registry.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
 
 #include "extensions/filters/http/tap/tap_config_impl.h"
 #include "extensions/filters/http/tap/tap_filter.h"
@@ -17,14 +17,14 @@ class HttpTapConfigFactoryImpl : public Extensions::Common::Tap::TapConfigFactor
 public:
   // TapConfigFactory
   Extensions::Common::Tap::TapConfigSharedPtr
-  createConfigFromProto(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  createConfigFromProto(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                         Extensions::Common::Tap::Sink* admin_streamer) override {
     return std::make_shared<HttpTapConfigImpl>(std::move(proto_config), admin_streamer);
   }
 };
 
 Http::FilterFactoryCb TapFilterFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::http::tap::v2alpha::Tap& proto_config,
+    const envoy::extensions::filters::http::tap::v3alpha::Tap& proto_config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
   FilterConfigSharedPtr filter_config(new FilterConfigImpl(
       proto_config, stats_prefix, std::make_unique<HttpTapConfigFactoryImpl>(), context.scope(),
diff --git a/source/extensions/filters/http/tap/config.h b/source/extensions/filters/http/tap/config.h
index 1819217ba3fc..c41011ff1c49 100644
--- a/source/extensions/filters/http/tap/config.h
+++ b/source/extensions/filters/http/tap/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/tap/v2alpha/tap.pb.h"
-#include "envoy/config/filter/http/tap/v2alpha/tap.pb.validate.h"
+#include "envoy/extensions/filters/http/tap/v3alpha/tap.pb.h"
+#include "envoy/extensions/filters/http/tap/v3alpha/tap.pb.validate.h"
 
 #include "extensions/filters/http/common/factory_base.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -15,13 +15,13 @@ namespace TapFilter {
  * Config registration for the tap filter.
  */
 class TapFilterFactory
-    : public Common::FactoryBase<envoy::config::filter::http::tap::v2alpha::Tap> {
+    : public Common::FactoryBase<envoy::extensions::filters::http::tap::v3alpha::Tap> {
 public:
   TapFilterFactory() : FactoryBase(HttpFilterNames::get().Tap) {}
 
 private:
   Http::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::http::tap::v2alpha::Tap& proto_config,
+      const envoy::extensions::filters::http::tap::v3alpha::Tap& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/http/tap/tap_config_impl.cc b/source/extensions/filters/http/tap/tap_config_impl.cc
index 9c7cef9ceaea..9299cbfa538b 100644
--- a/source/extensions/filters/http/tap/tap_config_impl.cc
+++ b/source/extensions/filters/http/tap/tap_config_impl.cc
@@ -1,8 +1,8 @@
 #include "extensions/filters/http/tap/tap_config_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/data/tap/v2alpha/http.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/http.pb.h"
 
 #include "common/common/assert.h"
 #include "common/protobuf/protobuf.h"
@@ -16,8 +16,9 @@ namespace TapCommon = Extensions::Common::Tap;
 
 namespace {
 Http::HeaderMap::Iterate fillHeaderList(const Http::HeaderEntry& header, void* context) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue>& header_list =
-      *reinterpret_cast<Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue>*>(context);
+  Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue>& header_list =
+      *reinterpret_cast<Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue>*>(
+          context);
   auto& new_header = *header_list.Add();
   new_header.set_key(std::string(header.key().getStringView()));
   new_header.set_value(std::string(header.value().getStringView()));
@@ -25,7 +26,7 @@ Http::HeaderMap::Iterate fillHeaderList(const Http::HeaderEntry& header, void* c
 }
 } // namespace
 
-HttpTapConfigImpl::HttpTapConfigImpl(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+HttpTapConfigImpl::HttpTapConfigImpl(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                                      Common::Tap::Sink* admin_streamer)
     : TapCommon::TapConfigBaseImpl(std::move(proto_config), admin_streamer) {}
 
@@ -60,8 +61,8 @@ void HttpPerRequestTapperImpl::streamBufferedRequestBody() {
 
 void HttpPerRequestTapperImpl::onRequestBody(const Buffer::Instance& data) {
   onBody(data, buffered_streamed_request_body_, config_->maxBufferedRxBytes(),
-         &envoy::data::tap::v2alpha::HttpStreamedTraceSegment::mutable_request_body_chunk,
-         &envoy::data::tap::v2alpha::HttpBufferedTrace::mutable_request);
+         &envoy::data::tap::v3alpha::HttpStreamedTraceSegment::mutable_request_body_chunk,
+         &envoy::data::tap::v3alpha::HttpBufferedTrace::mutable_request);
 }
 
 void HttpPerRequestTapperImpl::streamRequestTrailers() {
@@ -122,8 +123,8 @@ void HttpPerRequestTapperImpl::streamBufferedResponseBody() {
 
 void HttpPerRequestTapperImpl::onResponseBody(const Buffer::Instance& data) {
   onBody(data, buffered_streamed_response_body_, config_->maxBufferedTxBytes(),
-         &envoy::data::tap::v2alpha::HttpStreamedTraceSegment::mutable_response_body_chunk,
-         &envoy::data::tap::v2alpha::HttpBufferedTrace::mutable_response);
+         &envoy::data::tap::v3alpha::HttpStreamedTraceSegment::mutable_response_body_chunk,
+         &envoy::data::tap::v3alpha::HttpBufferedTrace::mutable_response);
 }
 
 void HttpPerRequestTapperImpl::onResponseTrailers(const Http::HeaderMap& trailers) {
diff --git a/source/extensions/filters/http/tap/tap_config_impl.h b/source/extensions/filters/http/tap/tap_config_impl.h
index 7bc6bd40db69..5f643785dd05 100644
--- a/source/extensions/filters/http/tap/tap_config_impl.h
+++ b/source/extensions/filters/http/tap/tap_config_impl.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "envoy/data/tap/v2alpha/common.pb.h"
-#include "envoy/data/tap/v2alpha/http.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/http.pb.h"
 #include "envoy/http/header_map.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
 
 #include "common/common/logger.h"
 
@@ -19,7 +19,7 @@ class HttpTapConfigImpl : public Extensions::Common::Tap::TapConfigBaseImpl,
                           public HttpTapConfig,
                           public std::enable_shared_from_this<HttpTapConfigImpl> {
 public:
-  HttpTapConfigImpl(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  HttpTapConfigImpl(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                     Extensions::Common::Tap::Sink* admin_streamer);
 
   // TapFilter::HttpTapConfig
@@ -45,11 +45,11 @@ class HttpPerRequestTapperImpl : public HttpPerRequestTapper, Logger::Loggable<L
   bool onDestroyLog() override;
 
 private:
-  using HttpStreamedTraceSegment = envoy::data::tap::v2alpha::HttpStreamedTraceSegment;
-  using MutableBodyChunk = envoy::data::tap::v2alpha::Body* (HttpStreamedTraceSegment::*)();
-  using HttpBufferedTrace = envoy::data::tap::v2alpha::HttpBufferedTrace;
+  using HttpStreamedTraceSegment = envoy::data::tap::v3alpha::HttpStreamedTraceSegment;
+  using MutableBodyChunk = envoy::data::tap::v3alpha::Body* (HttpStreamedTraceSegment::*)();
+  using HttpBufferedTrace = envoy::data::tap::v3alpha::HttpBufferedTrace;
   using MutableMessage =
-      envoy::data::tap::v2alpha::HttpBufferedTrace::Message* (HttpBufferedTrace::*)();
+      envoy::data::tap::v3alpha::HttpBufferedTrace::Message* (HttpBufferedTrace::*)();
 
   void onBody(const Buffer::Instance& data,
               Extensions::Common::Tap::TraceWrapperPtr& buffered_streamed_body,
diff --git a/source/extensions/filters/http/tap/tap_filter.cc b/source/extensions/filters/http/tap/tap_filter.cc
index fdcc611ab0d5..114401027746 100644
--- a/source/extensions/filters/http/tap/tap_filter.cc
+++ b/source/extensions/filters/http/tap/tap_filter.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/http/tap/tap_filter.h"
 
-#include "envoy/config/filter/http/tap/v2alpha/tap.pb.h"
+#include "envoy/extensions/filters/http/tap/v3alpha/tap.pb.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -8,7 +8,7 @@ namespace HttpFilters {
 namespace TapFilter {
 
 FilterConfigImpl::FilterConfigImpl(
-    const envoy::config::filter::http::tap::v2alpha::Tap& proto_config,
+    const envoy::extensions::filters::http::tap::v3alpha::Tap& proto_config,
     const std::string& stats_prefix, Common::Tap::TapConfigFactoryPtr&& config_factory,
     Stats::Scope& scope, Server::Admin& admin, Singleton::Manager& singleton_manager,
     ThreadLocal::SlotAllocator& tls, Event::Dispatcher& main_thread_dispatcher)
diff --git a/source/extensions/filters/http/tap/tap_filter.h b/source/extensions/filters/http/tap/tap_filter.h
index 79058b0a244a..402689f69962 100644
--- a/source/extensions/filters/http/tap/tap_filter.h
+++ b/source/extensions/filters/http/tap/tap_filter.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/access_log/access_log.h"
-#include "envoy/config/filter/http/tap/v2alpha/tap.pb.h"
+#include "envoy/extensions/filters/http/tap/v3alpha/tap.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -56,7 +56,7 @@ using FilterConfigSharedPtr = std::shared_ptr<FilterConfig>;
  */
 class FilterConfigImpl : public FilterConfig, public Extensions::Common::Tap::ExtensionConfigBase {
 public:
-  FilterConfigImpl(const envoy::config::filter::http::tap::v2alpha::Tap& proto_config,
+  FilterConfigImpl(const envoy::extensions::filters::http::tap::v3alpha::Tap& proto_config,
                    const std::string& stats_prefix,
                    Extensions::Common::Tap::TapConfigFactoryPtr&& config_factory,
                    Stats::Scope& scope, Server::Admin& admin, Singleton::Manager& singleton_manager,
diff --git a/source/extensions/filters/listener/original_src/BUILD b/source/extensions/filters/listener/original_src/BUILD
index 9dc379166aca..41e2d6656717 100644
--- a/source/extensions/filters/listener/original_src/BUILD
+++ b/source/extensions/filters/listener/original_src/BUILD
@@ -15,7 +15,7 @@ envoy_cc_library(
     name = "config_lib",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    deps = ["@envoy_api//envoy/config/filter/listener/original_src/v2alpha1:pkg_cc_proto"],
+    deps = ["@envoy_api//envoy/extensions/filters/listener/original_src/v3alpha:pkg_cc_proto"],
 )
 
 envoy_cc_library(
@@ -46,6 +46,6 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",
         "//source/extensions/filters/listener:well_known_names",
-        "@envoy_api//envoy/config/filter/listener/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/listener/original_src/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/listener/original_src/config.cc b/source/extensions/filters/listener/original_src/config.cc
index 305a68e9f57a..dd223f747629 100644
--- a/source/extensions/filters/listener/original_src/config.cc
+++ b/source/extensions/filters/listener/original_src/config.cc
@@ -1,13 +1,14 @@
 #include "extensions/filters/listener/original_src/config.h"
 
-#include "envoy/config/filter/listener/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/extensions/filters/listener/original_src/v3alpha/original_src.pb.h"
 
 namespace Envoy {
 namespace Extensions {
 namespace ListenerFilters {
 namespace OriginalSrc {
 
-Config::Config(const envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc& config)
+Config::Config(
+    const envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc& config)
     : use_port_(config.bind_port()), mark_(config.mark()) {}
 
 } // namespace OriginalSrc
diff --git a/source/extensions/filters/listener/original_src/config.h b/source/extensions/filters/listener/original_src/config.h
index f708ff87e159..6df3c3c4f99a 100644
--- a/source/extensions/filters/listener/original_src/config.h
+++ b/source/extensions/filters/listener/original_src/config.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/listener/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/extensions/filters/listener/original_src/v3alpha/original_src.pb.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -9,7 +9,7 @@ namespace OriginalSrc {
 class Config {
 public:
   Config() = default;
-  Config(const envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc& config);
+  Config(const envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc& config);
 
   bool usePort() const { return use_port_; }
   uint32_t mark() const { return mark_; }
diff --git a/source/extensions/filters/listener/original_src/original_src_config_factory.cc b/source/extensions/filters/listener/original_src/original_src_config_factory.cc
index 14a1a7384bfe..77fe4610d9f3 100644
--- a/source/extensions/filters/listener/original_src/original_src_config_factory.cc
+++ b/source/extensions/filters/listener/original_src/original_src_config_factory.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/listener/original_src/original_src_config_factory.h"
 
-#include "envoy/config/filter/listener/original_src/v2alpha1/original_src.pb.h"
-#include "envoy/config/filter/listener/original_src/v2alpha1/original_src.pb.validate.h"
+#include "envoy/extensions/filters/listener/original_src/v3alpha/original_src.pb.h"
+#include "envoy/extensions/filters/listener/original_src/v3alpha/original_src.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/listener/original_src/config.h"
@@ -16,7 +16,7 @@ namespace OriginalSrc {
 Network::ListenerFilterFactoryCb OriginalSrcConfigFactory::createFilterFactoryFromProto(
     const Protobuf::Message& message, Server::Configuration::ListenerFactoryContext& context) {
   auto proto_config = MessageUtil::downcastAndValidate<
-      const envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc&>(
+      const envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc&>(
       message, context.messageValidationVisitor());
   Config config(proto_config);
   return [config](Network::ListenerFilterManager& filter_manager) -> void {
@@ -25,7 +25,8 @@ Network::ListenerFilterFactoryCb OriginalSrcConfigFactory::createFilterFactoryFr
 }
 
 ProtobufTypes::MessagePtr OriginalSrcConfigFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc>();
+  return std::make_unique<
+      envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc>();
 }
 /**
  * Static registration for the original_src filter. @see RegisterFactory.
diff --git a/source/extensions/filters/network/client_ssl_auth/BUILD b/source/extensions/filters/network/client_ssl_auth/BUILD
index c469ebba4df7..82cbc9611c04 100644
--- a/source/extensions/filters/network/client_ssl_auth/BUILD
+++ b/source/extensions/filters/network/client_ssl_auth/BUILD
@@ -32,7 +32,7 @@ envoy_cc_library(
         "//source/common/json:json_loader_lib",
         "//source/common/network:cidr_range_lib",
         "//source/common/network:utility_lib",
-        "@envoy_api//envoy/config/filter/network/client_ssl_auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/client_ssl_auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -46,6 +46,6 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/network/client_ssl_auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/client_ssl_auth/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc
index 884a4e5e4edd..560c3de666ef 100644
--- a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc
+++ b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc
@@ -4,7 +4,7 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/stats/scope.h"
 
@@ -22,7 +22,7 @@ namespace NetworkFilters {
 namespace ClientSslAuth {
 
 ClientSslAuthConfig::ClientSslAuthConfig(
-    const envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth& config,
+    const envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth& config,
     ThreadLocal::SlotAllocator& tls, Upstream::ClusterManager& cm, Event::Dispatcher& dispatcher,
     Stats::Scope& scope, Runtime::RandomGenerator& random)
     : RestApiFetcher(
@@ -43,7 +43,7 @@ ClientSslAuthConfig::ClientSslAuthConfig(
 }
 
 ClientSslAuthConfigSharedPtr ClientSslAuthConfig::create(
-    const envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth& config,
+    const envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth& config,
     ThreadLocal::SlotAllocator& tls, Upstream::ClusterManager& cm, Event::Dispatcher& dispatcher,
     Stats::Scope& scope, Runtime::RandomGenerator& random) {
   ClientSslAuthConfigSharedPtr new_config(
diff --git a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
index ca521a9a5a40..18a1160ed23f 100644
--- a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
+++ b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
@@ -5,8 +5,8 @@
 #include <string>
 #include <unordered_set>
 
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.h"
 #include "envoy/config/subscription.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.h"
 #include "envoy/network/filter.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/scope.h"
@@ -75,7 +75,7 @@ using ClientSslAuthConfigSharedPtr = std::shared_ptr<ClientSslAuthConfig>;
 class ClientSslAuthConfig : public Http::RestApiFetcher {
 public:
   static ClientSslAuthConfigSharedPtr
-  create(const envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth& config,
+  create(const envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth& config,
          ThreadLocal::SlotAllocator& tls, Upstream::ClusterManager& cm,
          Event::Dispatcher& dispatcher, Stats::Scope& scope, Runtime::RandomGenerator& random);
 
@@ -85,7 +85,7 @@ class ClientSslAuthConfig : public Http::RestApiFetcher {
 
 private:
   ClientSslAuthConfig(
-      const envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth& config,
+      const envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth& config,
       ThreadLocal::SlotAllocator& tls, Upstream::ClusterManager& cm, Event::Dispatcher& dispatcher,
       Stats::Scope& scope, Runtime::RandomGenerator& random);
 
diff --git a/source/extensions/filters/network/client_ssl_auth/config.cc b/source/extensions/filters/network/client_ssl_auth/config.cc
index a7b83bed5d44..c6bf2f8f2ea4 100644
--- a/source/extensions/filters/network/client_ssl_auth/config.cc
+++ b/source/extensions/filters/network/client_ssl_auth/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/client_ssl_auth/config.h"
 
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.h"
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.validate.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.validate.h"
 #include "envoy/network/connection.h"
 #include "envoy/registry/registry.h"
 
@@ -13,7 +13,8 @@ namespace NetworkFilters {
 namespace ClientSslAuth {
 
 Network::FilterFactoryCb ClientSslAuthConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth& proto_config,
+    const envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth&
+        proto_config,
     Server::Configuration::FactoryContext& context) {
   ASSERT(!proto_config.auth_api_cluster().empty());
   ASSERT(!proto_config.stat_prefix().empty());
diff --git a/source/extensions/filters/network/client_ssl_auth/config.h b/source/extensions/filters/network/client_ssl_auth/config.h
index 7cbb2d711a7f..c303f84d1fab 100644
--- a/source/extensions/filters/network/client_ssl_auth/config.h
+++ b/source/extensions/filters/network/client_ssl_auth/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.h"
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.validate.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -16,13 +16,14 @@ namespace ClientSslAuth {
  */
 class ClientSslAuthConfigFactory
     : public Common::FactoryBase<
-          envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth> {
+          envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth> {
 public:
   ClientSslAuthConfigFactory() : FactoryBase(NetworkFilterNames::get().ClientSslAuth) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth& proto_config,
+      const envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth&
+          proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/common/redis/BUILD b/source/extensions/filters/network/common/redis/BUILD
index 4f19b4b01ea0..8316316a0682 100644
--- a/source/extensions/filters/network/common/redis/BUILD
+++ b/source/extensions/filters/network/common/redis/BUILD
@@ -72,7 +72,7 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/upstream:load_balancer_lib",
         "//source/common/upstream:upstream_lib",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/filters/network/common/redis/client_impl.cc b/source/extensions/filters/network/common/redis/client_impl.cc
index 1da3f45bd1d1..f30d9d5c267e 100644
--- a/source/extensions/filters/network/common/redis/client_impl.cc
+++ b/source/extensions/filters/network/common/redis/client_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/network/common/redis/client_impl.h"
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -15,7 +15,8 @@ Common::Redis::Client::DoNothingPoolCallbacks null_pool_callbacks;
 } // namespace
 
 ConfigImpl::ConfigImpl(
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings& config)
+    const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings&
+        config)
     : op_timeout_(PROTOBUF_GET_MS_REQUIRED(config, op_timeout)),
       enable_hashtagging_(config.enable_hashtagging()),
       enable_redirection_(config.enable_redirection()),
@@ -29,20 +30,23 @@ ConfigImpl::ConfigImpl(
           PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, max_upstream_unknown_connections, 100)),
       enable_command_stats_(config.enable_command_stats()) {
   switch (config.read_policy()) {
-  case envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::MASTER:
+  case envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::
+      MASTER:
     read_policy_ = ReadPolicy::Master;
     break;
-  case envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::PREFER_MASTER:
+  case envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::
+      PREFER_MASTER:
     read_policy_ = ReadPolicy::PreferMaster;
     break;
-  case envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::REPLICA:
+  case envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::
+      REPLICA:
     read_policy_ = ReadPolicy::Replica;
     break;
-  case envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::
+  case envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::
       PREFER_REPLICA:
     read_policy_ = ReadPolicy::PreferReplica;
     break;
-  case envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ANY:
+  case envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::ANY:
     read_policy_ = ReadPolicy::Any;
     break;
   default:
diff --git a/source/extensions/filters/network/common/redis/client_impl.h b/source/extensions/filters/network/common/redis/client_impl.h
index a0609b3e8b04..5c2b191f89c6 100644
--- a/source/extensions/filters/network/common/redis/client_impl.h
+++ b/source/extensions/filters/network/common/redis/client_impl.h
@@ -2,7 +2,7 @@
 
 #include <chrono>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 #include "envoy/stats/timespan.h"
 #include "envoy/thread_local/thread_local.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -38,7 +38,8 @@ using RedirectionResponse = ConstSingleton<RedirectionValues>;
 class ConfigImpl : public Config {
 public:
   ConfigImpl(
-      const envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings& config);
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings&
+          config);
 
   bool disableOutlierEvents() const override { return false; }
   std::chrono::milliseconds opTimeout() const override { return op_timeout_; }
diff --git a/source/extensions/filters/network/dubbo_proxy/BUILD b/source/extensions/filters/network/dubbo_proxy/BUILD
index 9579275aee20..c561ff81ec03 100644
--- a/source/extensions/filters/network/dubbo_proxy/BUILD
+++ b/source/extensions/filters/network/dubbo_proxy/BUILD
@@ -120,7 +120,7 @@ envoy_cc_extension(
         "//source/extensions/filters/network/dubbo_proxy/router:config",
         "//source/extensions/filters/network/dubbo_proxy/router:route_matcher",
         "//source/extensions/filters/network/dubbo_proxy/router:router_lib",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -228,6 +228,6 @@ envoy_cc_library(
         "//source/common/stream_info:stream_info_lib",
         "//source/extensions/filters/network/dubbo_proxy/filters:filter_interface",
         "//source/extensions/filters/network/dubbo_proxy/router:router_interface",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/dubbo_proxy/config.cc b/source/extensions/filters/network/dubbo_proxy/config.cc
index 12214fc7d244..3d4fcce422e7 100644
--- a/source/extensions/filters/network/dubbo_proxy/config.cc
+++ b/source/extensions/filters/network/dubbo_proxy/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/dubbo_proxy/config.h"
 
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/config/utility.h"
@@ -19,7 +19,7 @@ namespace NetworkFilters {
 namespace DubboProxy {
 
 Network::FilterFactoryCb DubboProxyFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy& proto_config,
+    const envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy& proto_config,
     Server::Configuration::FactoryContext& context) {
   std::shared_ptr<Config> filter_config(std::make_shared<ConfigImpl>(proto_config, context));
 
@@ -37,7 +37,8 @@ REGISTER_FACTORY(DubboProxyFilterConfigFactory,
 
 class ProtocolTypeMapper {
 public:
-  using ConfigProtocolType = envoy::config::filter::network::dubbo_proxy::v2alpha1::ProtocolType;
+  using ConfigProtocolType =
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::ProtocolType;
   using ProtocolTypeMap = absl::flat_hash_map<ConfigProtocolType, ProtocolType>;
 
   static ProtocolType lookupProtocolType(ConfigProtocolType config_type) {
@@ -57,7 +58,7 @@ class ProtocolTypeMapper {
 class SerializationTypeMapper {
 public:
   using ConfigSerializationType =
-      envoy::config::filter::network::dubbo_proxy::v2alpha1::SerializationType;
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::SerializationType;
   using SerializationTypeMap = absl::flat_hash_map<ConfigSerializationType, SerializationType>;
 
   static SerializationType lookupSerializationType(ConfigSerializationType type) {
@@ -77,7 +78,8 @@ class SerializationTypeMapper {
 
 class RouteMatcherTypeMapper {
 public:
-  using ConfigProtocolType = envoy::config::filter::network::dubbo_proxy::v2alpha1::ProtocolType;
+  using ConfigProtocolType =
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::ProtocolType;
   using RouteMatcherTypeMap = absl::flat_hash_map<ConfigProtocolType, Router::RouteMatcherType>;
 
   static Router::RouteMatcherType lookupRouteMatcherType(ConfigProtocolType type) {
@@ -109,7 +111,7 @@ ConfigImpl::ConfigImpl(const DubboProxyConfig& config,
   if (config.dubbo_filters().empty()) {
     ENVOY_LOG(debug, "using default router filter");
 
-    envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboFilter router_config;
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboFilter router_config;
     router_config.set_name(DubboFilters::DubboFilterNames::get().ROUTER);
     registerFilter(router_config);
   } else {
diff --git a/source/extensions/filters/network/dubbo_proxy/config.h b/source/extensions/filters/network/dubbo_proxy/config.h
index 0868acb5366e..23e4529a2788 100644
--- a/source/extensions/filters/network/dubbo_proxy/config.h
+++ b/source/extensions/filters/network/dubbo_proxy/config.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/dubbo_proxy/conn_manager.h"
@@ -22,13 +22,13 @@ namespace DubboProxy {
  */
 class DubboProxyFilterConfigFactory
     : public Common::FactoryBase<
-          envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy> {
+          envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy> {
 public:
   DubboProxyFilterConfigFactory() : FactoryBase(NetworkFilterNames::get().DubboProxy, true) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy& proto_config,
+      const envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
@@ -37,8 +37,8 @@ class ConfigImpl : public Config,
                    public DubboFilters::FilterChainFactory,
                    Logger::Loggable<Logger::Id::config> {
 public:
-  using DubboProxyConfig = envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy;
-  using DubboFilterConfig = envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboFilter;
+  using DubboProxyConfig = envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy;
+  using DubboFilterConfig = envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboFilter;
 
   ConfigImpl(const DubboProxyConfig& config, Server::Configuration::FactoryContext& context);
   ~ConfigImpl() override = default;
diff --git a/source/extensions/filters/network/dubbo_proxy/conn_manager.h b/source/extensions/filters/network/dubbo_proxy/conn_manager.h
index 32a9d8f3b88e..1db3cda43d86 100644
--- a/source/extensions/filters/network/dubbo_proxy/conn_manager.h
+++ b/source/extensions/filters/network/dubbo_proxy/conn_manager.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/common/time.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
 #include "envoy/stats/scope.h"
@@ -43,9 +43,10 @@ class ConnectionManager : public Network::ReadFilter,
                           public RequestDecoderCallbacks,
                           Logger::Loggable<Logger::Id::dubbo> {
 public:
-  using ConfigProtocolType = envoy::config::filter::network::dubbo_proxy::v2alpha1::ProtocolType;
+  using ConfigProtocolType =
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::ProtocolType;
   using ConfigSerializationType =
-      envoy::config::filter::network::dubbo_proxy::v2alpha1::SerializationType;
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::SerializationType;
 
   ConnectionManager(Config& config, Runtime::RandomGenerator& random_generator,
                     TimeSource& time_system);
diff --git a/source/extensions/filters/network/dubbo_proxy/router/BUILD b/source/extensions/filters/network/dubbo_proxy/router/BUILD
index 83808c43ffad..70c68995025b 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/BUILD
+++ b/source/extensions/filters/network/dubbo_proxy/router/BUILD
@@ -26,7 +26,7 @@ envoy_cc_library(
         "//source/common/config:utility_lib",
         "//source/common/singleton:const_singleton",
         "//source/extensions/filters/network/dubbo_proxy:metadata_lib",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,9 +44,9 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/network/dubbo_proxy:metadata_lib",
         "//source/extensions/filters/network/dubbo_proxy:serializer_interface",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -60,7 +60,7 @@ envoy_cc_library(
         "//source/extensions/filters/network/dubbo_proxy/filters:factory_base_lib",
         "//source/extensions/filters/network/dubbo_proxy/filters:filter_config_interface",
         "//source/extensions/filters/network/dubbo_proxy/filters:well_known_names",
-        "@envoy_api//envoy/config/filter/dubbo/router/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/router/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/filters/network/dubbo_proxy/router/config.cc b/source/extensions/filters/network/dubbo_proxy/router/config.cc
index 74db64229dfb..efef359136ff 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/config.cc
+++ b/source/extensions/filters/network/dubbo_proxy/router/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/dubbo_proxy/router/config.h"
 
-#include "envoy/config/filter/dubbo/router/v2alpha1/router.pb.h"
-#include "envoy/config/filter/dubbo/router/v2alpha1/router.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/router/v3alpha/router.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/network/dubbo_proxy/router/router_impl.h"
@@ -13,8 +13,8 @@ namespace DubboProxy {
 namespace Router {
 
 DubboFilters::FilterFactoryCb RouterFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::dubbo::router::v2alpha1::Router&, const std::string&,
-    Server::Configuration::FactoryContext& context) {
+    const envoy::extensions::filters::network::dubbo_proxy::router::v3alpha::Router&,
+    const std::string&, Server::Configuration::FactoryContext& context) {
   return [&context](DubboFilters::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addDecoderFilter(std::make_shared<Router>(context.clusterManager()));
   };
diff --git a/source/extensions/filters/network/dubbo_proxy/router/config.h b/source/extensions/filters/network/dubbo_proxy/router/config.h
index 88145b4e2194..6ebe2bee370d 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/config.h
+++ b/source/extensions/filters/network/dubbo_proxy/router/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/dubbo/router/v2alpha1/router.pb.h"
-#include "envoy/config/filter/dubbo/router/v2alpha1/router.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/router/v3alpha/router.pb.validate.h"
 
 #include "extensions/filters/network/dubbo_proxy/filters/factory_base.h"
 #include "extensions/filters/network/dubbo_proxy/filters/well_known_names.h"
@@ -13,13 +13,14 @@ namespace DubboProxy {
 namespace Router {
 
 class RouterFilterConfig
-    : public DubboFilters::FactoryBase<envoy::config::filter::dubbo::router::v2alpha1::Router> {
+    : public DubboFilters::FactoryBase<
+          envoy::extensions::filters::network::dubbo_proxy::router::v3alpha::Router> {
 public:
   RouterFilterConfig() : FactoryBase(DubboFilters::DubboFilterNames::get().ROUTER) {}
 
 private:
   DubboFilters::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::dubbo::router::v2alpha1::Router& proto_config,
+      const envoy::extensions::filters::network::dubbo_proxy::router::v3alpha::Router& proto_config,
       const std::string& stat_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/dubbo_proxy/router/route.h b/source/extensions/filters/network/dubbo_proxy/router/route.h
index 1cb478bd092f..4242540e2d7d 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/route.h
+++ b/source/extensions/filters/network/dubbo_proxy/router/route.h
@@ -3,7 +3,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/route.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/route.pb.h"
 #include "envoy/router/router.h"
 #include "envoy/server/filter_config.h"
 
@@ -20,7 +20,7 @@ namespace DubboProxy {
 namespace Router {
 
 using RouteConfigurations = Protobuf::RepeatedPtrField<
-    ::envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration>;
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration>;
 
 enum class RouteMatcherType : uint8_t {
   Default,
diff --git a/source/extensions/filters/network/dubbo_proxy/router/route_matcher.cc b/source/extensions/filters/network/dubbo_proxy/router/route_matcher.cc
index 90bf6427ecd4..08577ebe7b74 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/route_matcher.cc
+++ b/source/extensions/filters/network/dubbo_proxy/router/route_matcher.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/dubbo_proxy/router/route_matcher.h"
 
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/route.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -14,11 +14,12 @@ namespace DubboProxy {
 namespace Router {
 
 RouteEntryImplBase::RouteEntryImplBase(
-    const envoy::config::filter::network::dubbo_proxy::v2alpha1::Route& route)
+    const envoy::extensions::filters::network::dubbo_proxy::v3alpha::Route& route)
     : cluster_name_(route.route().cluster()),
       config_headers_(Http::HeaderUtility::buildHeaderDataVector(route.match().headers())) {
   if (route.route().cluster_specifier_case() ==
-      envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteAction::kWeightedClusters) {
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteAction::ClusterSpecifierCase::
+          kWeightedClusters) {
     total_cluster_weight_ = 0UL;
     for (const auto& cluster : route.route().weighted_clusters().clusters()) {
       weighted_clusters_.emplace_back(std::make_shared<WeightedClusterEntry>(*this, cluster));
@@ -54,7 +55,7 @@ RouteEntryImplBase::WeightedClusterEntry::WeightedClusterEntry(const RouteEntryI
       cluster_weight_(PROTOBUF_GET_WRAPPED_REQUIRED(cluster, weight)) {}
 
 ParameterRouteEntryImpl::ParameterRouteEntryImpl(
-    const envoy::config::filter::network::dubbo_proxy::v2alpha1::Route& route)
+    const envoy::extensions::filters::network::dubbo_proxy::v3alpha::Route& route)
     : RouteEntryImplBase(route) {
   for (auto& config : route.match().method().params_match()) {
     parameter_data_list_.emplace_back(config.first, config.second);
@@ -128,7 +129,7 @@ ParameterRouteEntryImpl::ParameterData::ParameterData(uint32_t index,
 }
 
 MethodRouteEntryImpl::MethodRouteEntryImpl(
-    const envoy::config::filter::network::dubbo_proxy::v2alpha1::Route& route)
+    const envoy::extensions::filters::network::dubbo_proxy::v3alpha::Route& route)
     : RouteEntryImplBase(route), method_name_(route.match().method().name()) {
   if (route.match().method().params_match_size() != 0) {
     parameter_route_ = std::make_shared<ParameterRouteEntryImpl>(route);
@@ -170,7 +171,7 @@ RouteConstSharedPtr MethodRouteEntryImpl::matches(const MessageMetadata& metadat
 SingleRouteMatcherImpl::SingleRouteMatcherImpl(const RouteConfig& config,
                                                Server::Configuration::FactoryContext&)
     : service_name_(config.interface()), group_(config.group()), version_(config.version()) {
-  using envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteMatch;
+  using envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteMatch;
 
   for (const auto& route : config.routes()) {
     routes_.emplace_back(std::make_shared<MethodRouteEntryImpl>(route));
diff --git a/source/extensions/filters/network/dubbo_proxy/router/route_matcher.h b/source/extensions/filters/network/dubbo_proxy/router/route_matcher.h
index 02ab9c57d024..05de58814c7a 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/route_matcher.h
+++ b/source/extensions/filters/network/dubbo_proxy/router/route_matcher.h
@@ -4,9 +4,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/route.pb.h"
-#include "envoy/type/range.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/route.pb.h"
+#include "envoy/type/v3alpha/range.pb.h"
 
 #include "common/common/logger.h"
 #include "common/common/matchers.h"
@@ -30,7 +30,7 @@ class RouteEntryImplBase : public RouteEntry,
                            public std::enable_shared_from_this<RouteEntryImplBase>,
                            public Logger::Loggable<Logger::Id::dubbo> {
 public:
-  RouteEntryImplBase(const envoy::config::filter::network::dubbo_proxy::v2alpha1::Route& route);
+  RouteEntryImplBase(const envoy::extensions::filters::network::dubbo_proxy::v3alpha::Route& route);
   ~RouteEntryImplBase() override = default;
 
   // Router::RouteEntry
@@ -52,7 +52,7 @@ class RouteEntryImplBase : public RouteEntry,
 private:
   class WeightedClusterEntry : public RouteEntry, public Route {
   public:
-    using WeightedCluster = envoy::api::v2::route::WeightedCluster_ClusterWeight;
+    using WeightedCluster = envoy::config::route::v3alpha::WeightedCluster::ClusterWeight;
     WeightedClusterEntry(const RouteEntryImplBase& parent, const WeightedCluster& cluster);
 
     uint64_t clusterWeight() const { return cluster_weight_; }
@@ -90,17 +90,17 @@ using RouteEntryImplBaseConstSharedPtr = std::shared_ptr<const RouteEntryImplBas
 class ParameterRouteEntryImpl : public RouteEntryImplBase {
 public:
   ParameterRouteEntryImpl(
-      const envoy::config::filter::network::dubbo_proxy::v2alpha1::Route& route);
+      const envoy::extensions::filters::network::dubbo_proxy::v3alpha::Route& route);
   ~ParameterRouteEntryImpl() override;
 
   struct ParameterData {
-    using ParameterMatchSpecifier =
-        envoy::config::filter::network::dubbo_proxy::v2alpha1::MethodMatch_ParameterMatchSpecifier;
+    using ParameterMatchSpecifier = envoy::extensions::filters::network::dubbo_proxy::v3alpha::
+        MethodMatch::ParameterMatchSpecifier;
     ParameterData(uint32_t index, const ParameterMatchSpecifier& config);
 
     Http::HeaderUtility::HeaderMatchType match_type_;
     std::string value_;
-    envoy::type::Int64Range range_;
+    envoy::type::v3alpha::Int64Range range_;
     uint32_t index_;
   };
 
@@ -116,7 +116,8 @@ class ParameterRouteEntryImpl : public RouteEntryImplBase {
 
 class MethodRouteEntryImpl : public RouteEntryImplBase {
 public:
-  MethodRouteEntryImpl(const envoy::config::filter::network::dubbo_proxy::v2alpha1::Route& route);
+  MethodRouteEntryImpl(
+      const envoy::extensions::filters::network::dubbo_proxy::v3alpha::Route& route);
   ~MethodRouteEntryImpl() override;
 
   // RoutEntryImplBase
@@ -130,7 +131,7 @@ class MethodRouteEntryImpl : public RouteEntryImplBase {
 
 class SingleRouteMatcherImpl : public RouteMatcher, public Logger::Loggable<Logger::Id::dubbo> {
 public:
-  using RouteConfig = envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration;
+  using RouteConfig = envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration;
   SingleRouteMatcherImpl(const RouteConfig& config, Server::Configuration::FactoryContext& context);
 
   RouteConstSharedPtr route(const MessageMetadata& metadata, uint64_t random_value) const override;
@@ -145,7 +146,7 @@ class SingleRouteMatcherImpl : public RouteMatcher, public Logger::Loggable<Logg
 class MultiRouteMatcher : public RouteMatcher, public Logger::Loggable<Logger::Id::dubbo> {
 public:
   using RouteConfigList = Envoy::Protobuf::RepeatedPtrField<
-      ::envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration>;
+      envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration>;
   MultiRouteMatcher(const RouteConfigList& route_config_list,
                     Server::Configuration::FactoryContext& context);
 
diff --git a/source/extensions/filters/network/ext_authz/BUILD b/source/extensions/filters/network/ext_authz/BUILD
index 62a27388b5b4..e82415576087 100644
--- a/source/extensions/filters/network/ext_authz/BUILD
+++ b/source/extensions/filters/network/ext_authz/BUILD
@@ -26,8 +26,8 @@ envoy_cc_library(
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/filters/common/ext_authz:ext_authz_grpc_lib",
         "//source/extensions/filters/common/ext_authz:ext_authz_interface",
-        "@envoy_api//envoy/config/filter/network/ext_authz/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ext_authz/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -42,7 +42,7 @@ envoy_cc_extension(
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
         "//source/extensions/filters/network/ext_authz",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/ext_authz/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ext_authz/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/ext_authz/config.cc b/source/extensions/filters/network/ext_authz/config.cc
index 68127be21bf5..60f0494e8cd0 100644
--- a/source/extensions/filters/network/ext_authz/config.cc
+++ b/source/extensions/filters/network/ext_authz/config.cc
@@ -3,9 +3,9 @@
 #include <chrono>
 #include <string>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.validate.h"
 #include "envoy/network/connection.h"
 #include "envoy/registry/registry.h"
 
@@ -21,7 +21,7 @@ namespace NetworkFilters {
 namespace ExtAuthz {
 
 Network::FilterFactoryCb ExtAuthzConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::ext_authz::v2::ExtAuthz& proto_config,
+    const envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz& proto_config,
     Server::Configuration::FactoryContext& context) {
   ConfigSharedPtr ext_authz_config(new Config(proto_config, context.scope()));
   const uint32_t timeout_ms = PROTOBUF_GET_MS_OR_DEFAULT(proto_config.grpc_service(), timeout, 200);
diff --git a/source/extensions/filters/network/ext_authz/config.h b/source/extensions/filters/network/ext_authz/config.h
index 05fccafbb1f5..0ef3287fe543 100644
--- a/source/extensions/filters/network/ext_authz/config.h
+++ b/source/extensions/filters/network/ext_authz/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -15,13 +15,14 @@ namespace ExtAuthz {
  * Config registration for the  external authorization filter. @see NamedNetworkFilterConfigFactory.
  */
 class ExtAuthzConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::network::ext_authz::v2::ExtAuthz> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz> {
 public:
   ExtAuthzConfigFactory() : FactoryBase(NetworkFilterNames::get().ExtAuthorization) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::ext_authz::v2::ExtAuthz& proto_config,
+      const envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/ext_authz/ext_authz.h b/source/extensions/filters/network/ext_authz/ext_authz.h
index 5cc4cf3f6426..66151dcdad70 100644
--- a/source/extensions/filters/network/ext_authz/ext_authz.h
+++ b/source/extensions/filters/network/ext_authz/ext_authz.h
@@ -5,11 +5,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
 #include "envoy/runtime/runtime.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -46,7 +46,8 @@ struct InstanceStats {
  */
 class Config {
 public:
-  Config(const envoy::config::filter::network::ext_authz::v2::ExtAuthz& config, Stats::Scope& scope)
+  Config(const envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz& config,
+         Stats::Scope& scope)
       : stats_(generateStats(config.stat_prefix(), scope)),
         failure_mode_allow_(config.failure_mode_allow()),
         include_peer_certificate_(config.include_peer_certificate()) {}
@@ -113,7 +114,7 @@ class Filter : public Network::ReadFilter,
   FilterReturn filter_return_{FilterReturn::Stop};
   // Used to identify if the callback to onComplete() is synchronous (on the stack) or asynchronous.
   bool calling_check_{};
-  envoy::service::auth::v2::CheckRequest check_request_{};
+  envoy::service::auth::v3alpha::CheckRequest check_request_{};
 };
 } // namespace ExtAuthz
 } // namespace NetworkFilters
diff --git a/source/extensions/filters/network/http_connection_manager/BUILD b/source/extensions/filters/network/http_connection_manager/BUILD
index bcc676feed09..6e0f9b8cb342 100644
--- a/source/extensions/filters/network/http_connection_manager/BUILD
+++ b/source/extensions/filters/network/http_connection_manager/BUILD
@@ -42,9 +42,9 @@ envoy_cc_extension(
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/type/tracing/v2:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/http_connection_manager/config.cc b/source/extensions/filters/network/http_connection_manager/config.cc
index f5662dda813e..5242295ec818 100644
--- a/source/extensions/filters/network/http_connection_manager/config.cc
+++ b/source/extensions/filters/network/http_connection_manager/config.cc
@@ -5,14 +5,14 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.validate.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.validate.h"
 #include "envoy/filesystem/filesystem.h"
 #include "envoy/server/admin.h"
 #include "envoy/tracing/http_tracer.h"
-#include "envoy/type/percent.pb.h"
 #include "envoy/type/tracing/v2/custom_tag.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/access_log/access_log_impl.h"
 #include "common/common/fmt.h"
@@ -61,9 +61,9 @@ FilterFactoryMap::const_iterator findUpgradeCaseInsensitive(const FilterFactoryM
   return upgrade_map.end();
 }
 
-std::unique_ptr<Http::InternalAddressConfig> createInternalAddressConfig(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-        config) {
+std::unique_ptr<Http::InternalAddressConfig>
+createInternalAddressConfig(const envoy::extensions::filters::network::http_connection_manager::
+                                v3alpha::HttpConnectionManager& config) {
   if (config.has_internal_address_config()) {
     return std::make_unique<InternalAddressConfig>(config.internal_address_config());
   }
@@ -80,8 +80,8 @@ SINGLETON_MANAGER_REGISTRATION(scoped_routes_config_provider_manager);
 
 Network::FilterFactoryCb
 HttpConnectionManagerFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-        proto_config,
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager& proto_config,
     Server::Configuration::FactoryContext& context) {
   std::shared_ptr<Http::TlsCachingDateProviderImpl> date_provider =
       context.singletonManager().getTyped<Http::TlsCachingDateProviderImpl>(
@@ -128,13 +128,13 @@ REGISTER_FACTORY(HttpConnectionManagerFilterConfigFactory,
                  Server::Configuration::NamedNetworkFilterConfigFactory);
 
 InternalAddressConfig::InternalAddressConfig(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-        InternalAddressConfig& config)
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager::InternalAddressConfig& config)
     : unix_sockets_(config.unix_sockets()) {}
 
 HttpConnectionManagerConfig::HttpConnectionManagerConfig(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-        config,
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager& config,
     Server::Configuration::FactoryContext& context, Http::DateProvider& date_provider,
     Router::RouteConfigProviderManager& route_config_provider_manager,
     Config::ConfigProviderManager& scoped_routes_config_provider_manager)
@@ -188,7 +188,7 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
   // idle_timeout field.
   // TODO(asraa): Remove when idle_timeout is removed.
   if (!idle_timeout_) {
-    idle_timeout_ = PROTOBUF_GET_OPTIONAL_MS(config, idle_timeout);
+    idle_timeout_ = PROTOBUF_GET_OPTIONAL_MS(config, hidden_envoy_deprecated_idle_timeout);
   }
   if (!idle_timeout_) {
     idle_timeout_ = std::chrono::hours(1);
@@ -199,14 +199,15 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
   // If scoped RDS is enabled, avoid creating a route config provider. Route config providers will
   // be managed by the scoped routing logic instead.
   switch (config.route_specifier_case()) {
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::kRds:
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      kRouteConfig:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::RouteSpecifierCase::kRds:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::RouteSpecifierCase::kRouteConfig:
     route_config_provider_ = Router::RouteConfigProviderUtil::create(
         config, context_, stats_prefix_, route_config_provider_manager_);
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      kScopedRoutes:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::RouteSpecifierCase::kScopedRoutes:
     scoped_routes_config_provider_ = Router::ScopedRoutesConfigProviderUtil::create(
         config, context_, stats_prefix_, scoped_routes_config_provider_manager_);
     break;
@@ -215,23 +216,24 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
   }
 
   switch (config.forward_client_cert_details()) {
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::SANITIZE:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE:
     forward_client_cert_ = Http::ForwardClientCertType::Sanitize;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      FORWARD_ONLY:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::FORWARD_ONLY:
     forward_client_cert_ = Http::ForwardClientCertType::ForwardOnly;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD:
     forward_client_cert_ = Http::ForwardClientCertType::AppendForward;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET:
     forward_client_cert_ = Http::ForwardClientCertType::SanitizeSet;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      ALWAYS_FORWARD_ONLY:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::ALWAYS_FORWARD_ONLY:
     forward_client_cert_ = Http::ForwardClientCertType::AlwaysForwardOnly;
     break;
   default:
@@ -266,14 +268,14 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
 
     // Listener level traffic direction overrides the operation name
     switch (context.direction()) {
-    case envoy::api::v2::core::TrafficDirection::UNSPECIFIED: {
-      switch (tracing_config.operation_name()) {
-      case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-          Tracing::INGRESS:
+    case envoy::config::core::v3alpha::UNSPECIFIED: {
+      switch (tracing_config.hidden_envoy_deprecated_operation_name()) {
+      case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+          HttpConnectionManager::Tracing::INGRESS:
         tracing_operation_name = Tracing::OperationName::Ingress;
         break;
-      case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-          Tracing::EGRESS:
+      case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+          HttpConnectionManager::Tracing::EGRESS:
         tracing_operation_name = Tracing::OperationName::Egress;
         break;
       default:
@@ -281,10 +283,10 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
       }
       break;
     }
-    case envoy::api::v2::core::TrafficDirection::INBOUND:
+    case envoy::config::core::v3alpha::INBOUND:
       tracing_operation_name = Tracing::OperationName::Ingress;
       break;
-    case envoy::api::v2::core::TrafficDirection::OUTBOUND:
+    case envoy::config::core::v3alpha::OUTBOUND:
       tracing_operation_name = Tracing::OperationName::Egress;
       break;
     default:
@@ -292,7 +294,8 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
     }
 
     Tracing::CustomTagMap custom_tags;
-    for (const std::string& header : tracing_config.request_headers_for_tags()) {
+    for (const std::string& header :
+         tracing_config.hidden_envoy_deprecated_request_headers_for_tags()) {
       envoy::type::tracing::v2::CustomTag::Header headerTag;
       headerTag.set_name(header);
       custom_tags.emplace(
@@ -302,17 +305,17 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
       custom_tags.emplace(tag.tag(), Tracing::HttpTracerUtility::createCustomTag(tag));
     }
 
-    envoy::type::FractionalPercent client_sampling;
+    envoy::type::v3alpha::FractionalPercent client_sampling;
     client_sampling.set_numerator(
         tracing_config.has_client_sampling() ? tracing_config.client_sampling().value() : 100);
-    envoy::type::FractionalPercent random_sampling;
+    envoy::type::v3alpha::FractionalPercent random_sampling;
     // TODO: Random sampling historically was an integer and default to out of 10,000. We should
     // deprecate that and move to a straight fractional percent config.
     uint64_t random_sampling_numerator{PROTOBUF_PERCENT_TO_ROUNDED_INTEGER_OR_DEFAULT(
         tracing_config, random_sampling, 10000, 10000)};
     random_sampling.set_numerator(random_sampling_numerator);
-    random_sampling.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
-    envoy::type::FractionalPercent overall_sampling;
+    random_sampling.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
+    envoy::type::v3alpha::FractionalPercent overall_sampling;
     overall_sampling.set_numerator(
         tracing_config.has_overall_sampling() ? tracing_config.overall_sampling().value() : 100);
 
@@ -340,16 +343,20 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
   }
 
   switch (config.codec_type()) {
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::AUTO:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::AUTO:
     codec_type_ = CodecType::AUTO;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::HTTP1:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::HTTP1:
     codec_type_ = CodecType::HTTP1;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::HTTP2:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::HTTP2:
     codec_type_ = CodecType::HTTP2;
     break;
-  case envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::HTTP3:
+  case envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::HTTP3:
     codec_type_ = CodecType::HTTP3;
     break;
   default:
@@ -392,15 +399,17 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
 }
 
 void HttpConnectionManagerConfig::processFilter(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpFilter& proto_config,
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpFilter&
+        proto_config,
     int i, absl::string_view prefix, std::list<Http::FilterFactoryCb>& filter_factories,
     bool& is_terminal) {
   const std::string& string_name = proto_config.name();
 
   ENVOY_LOG(debug, "    {} filter #{}", prefix, i);
   ENVOY_LOG(debug, "      name: {}", string_name);
-  ENVOY_LOG(debug, "    config: {}",
-            MessageUtil::getJsonStringFromMessage(proto_config.config(), true));
+  ENVOY_LOG(
+      debug, "    config: {}",
+      MessageUtil::getJsonStringFromMessage(proto_config.hidden_envoy_deprecated_config(), true));
 
   // Now see if there is a factory that will accept the config.
   auto& factory =
diff --git a/source/extensions/filters/network/http_connection_manager/config.h b/source/extensions/filters/network/http_connection_manager/config.h
index 0eaa73b9e6a8..127e9595c636 100644
--- a/source/extensions/filters/network/http_connection_manager/config.h
+++ b/source/extensions/filters/network/http_connection_manager/config.h
@@ -8,8 +8,8 @@
 #include <string>
 
 #include "envoy/config/config_provider_manager.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.validate.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.validate.h"
 #include "envoy/http/filter.h"
 #include "envoy/router/route_config_provider_manager.h"
 
@@ -30,16 +30,16 @@ namespace HttpConnectionManager {
  */
 class HttpConnectionManagerFilterConfigFactory
     : Logger::Loggable<Logger::Id::config>,
-      public Common::FactoryBase<
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager> {
+      public Common::FactoryBase<envoy::extensions::filters::network::http_connection_manager::
+                                     v3alpha::HttpConnectionManager> {
 public:
   HttpConnectionManagerFilterConfigFactory()
       : FactoryBase(NetworkFilterNames::get().HttpConnectionManager, true) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-          proto_config,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+          HttpConnectionManager& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
@@ -50,8 +50,8 @@ DECLARE_FACTORY(HttpConnectionManagerFilterConfigFactory);
  */
 class InternalAddressConfig : public Http::InternalAddressConfig {
 public:
-  InternalAddressConfig(const envoy::config::filter::network::http_connection_manager::v2::
-                            HttpConnectionManager::InternalAddressConfig& config);
+  InternalAddressConfig(const envoy::extensions::filters::network::http_connection_manager::
+                            v3alpha::HttpConnectionManager::InternalAddressConfig& config);
 
   bool isInternalAddress(const Network::Address::Instance& address) const override {
     if (address.type() == Network::Address::Type::Pipe) {
@@ -73,12 +73,12 @@ class HttpConnectionManagerConfig : Logger::Loggable<Logger::Id::config>,
                                     public Http::FilterChainFactory,
                                     public Http::ConnectionManagerConfig {
 public:
-  HttpConnectionManagerConfig(
-      const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-          config,
-      Server::Configuration::FactoryContext& context, Http::DateProvider& date_provider,
-      Router::RouteConfigProviderManager& route_config_provider_manager,
-      Config::ConfigProviderManager& scoped_routes_config_provider_manager);
+  HttpConnectionManagerConfig(const envoy::extensions::filters::network::http_connection_manager::
+                                  v3alpha::HttpConnectionManager& config,
+                              Server::Configuration::FactoryContext& context,
+                              Http::DateProvider& date_provider,
+                              Router::RouteConfigProviderManager& route_config_provider_manager,
+                              Config::ConfigProviderManager& scoped_routes_config_provider_manager);
 
   // Http::FilterChainFactory
   void createFilterChain(Http::FilterChainFactoryCallbacks& callbacks) override;
@@ -148,7 +148,8 @@ class HttpConnectionManagerConfig : Logger::Loggable<Logger::Id::config>,
 private:
   enum class CodecType { HTTP1, HTTP2, HTTP3, AUTO };
   void processFilter(
-      const envoy::config::filter::network::http_connection_manager::v2::HttpFilter& proto_config,
+      const envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpFilter&
+          proto_config,
       int i, absl::string_view prefix, FilterFactoriesList& filter_factories, bool& is_terminal);
 
   Server::Configuration::FactoryContext& context_;
diff --git a/source/extensions/filters/network/local_ratelimit/BUILD b/source/extensions/filters/network/local_ratelimit/BUILD
index 8cdfc5bd788a..9970cb6a9faf 100644
--- a/source/extensions/filters/network/local_ratelimit/BUILD
+++ b/source/extensions/filters/network/local_ratelimit/BUILD
@@ -25,7 +25,7 @@ envoy_cc_library(
         "//source/common/common:thread_synchronizer_lib",
         "//source/common/protobuf:utility_lib",
         "//source/common/runtime:runtime_lib",
-        "@envoy_api//envoy/config/filter/network/local_rate_limit/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/network/local_rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -38,6 +38,6 @@ envoy_cc_extension(
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
         "//source/extensions/filters/network/local_ratelimit:local_ratelimit_lib",
-        "@envoy_api//envoy/config/filter/network/local_rate_limit/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/network/local_rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/local_ratelimit/config.cc b/source/extensions/filters/network/local_ratelimit/config.cc
index 77100dc1efea..50ecedcb3039 100644
--- a/source/extensions/filters/network/local_ratelimit/config.cc
+++ b/source/extensions/filters/network/local_ratelimit/config.cc
@@ -1,5 +1,8 @@
 #include "extensions/filters/network/local_ratelimit/config.h"
 
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.h"
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.validate.h"
+
 #include "extensions/filters/network/local_ratelimit/local_ratelimit.h"
 
 namespace Envoy {
@@ -8,7 +11,7 @@ namespace NetworkFilters {
 namespace LocalRateLimitFilter {
 
 Network::FilterFactoryCb LocalRateLimitConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::local_rate_limit::v2alpha::LocalRateLimit& proto_config,
+    const envoy::config::filter::network::local_rate_limit::v3alpha::LocalRateLimit& proto_config,
     Server::Configuration::FactoryContext& context) {
   ConfigSharedPtr filter_config(
       new Config(proto_config, context.dispatcher(), context.scope(), context.runtime()));
diff --git a/source/extensions/filters/network/local_ratelimit/config.h b/source/extensions/filters/network/local_ratelimit/config.h
index a865b7cd8629..d81143a02240 100644
--- a/source/extensions/filters/network/local_ratelimit/config.h
+++ b/source/extensions/filters/network/local_ratelimit/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/local_rate_limit/v2alpha/local_rate_limit.pb.h"
-#include "envoy/config/filter/network/local_rate_limit/v2alpha/local_rate_limit.pb.validate.h"
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.h"
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -16,13 +16,13 @@ namespace LocalRateLimitFilter {
  */
 class LocalRateLimitConfigFactory
     : public Common::FactoryBase<
-          envoy::config::filter::network::local_rate_limit::v2alpha::LocalRateLimit> {
+          envoy::config::filter::network::local_rate_limit::v3alpha::LocalRateLimit> {
 public:
   LocalRateLimitConfigFactory() : FactoryBase(NetworkFilterNames::get().LocalRateLimit) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::local_rate_limit::v2alpha::LocalRateLimit& proto_config,
+      const envoy::config::filter::network::local_rate_limit::v3alpha::LocalRateLimit& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc b/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc
index ba127e117842..dc0159a724aa 100644
--- a/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc
+++ b/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc
@@ -1,5 +1,6 @@
 #include "extensions/filters/network/local_ratelimit/local_ratelimit.h"
 
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.h"
 #include "envoy/event/dispatcher.h"
 
 #include "common/protobuf/utility.h"
@@ -10,7 +11,7 @@ namespace NetworkFilters {
 namespace LocalRateLimitFilter {
 
 Config::Config(
-    const envoy::config::filter::network::local_rate_limit::v2alpha::LocalRateLimit& proto_config,
+    const envoy::config::filter::network::local_rate_limit::v3alpha::LocalRateLimit& proto_config,
     Event::Dispatcher& dispatcher, Stats::Scope& scope, Runtime::Loader& runtime)
     : fill_timer_(dispatcher.createTimer([this] { onFillTimer(); })),
       max_tokens_(proto_config.token_bucket().max_tokens()),
diff --git a/source/extensions/filters/network/local_ratelimit/local_ratelimit.h b/source/extensions/filters/network/local_ratelimit/local_ratelimit.h
index 1b1208940b82..8cc66a64ae85 100644
--- a/source/extensions/filters/network/local_ratelimit/local_ratelimit.h
+++ b/source/extensions/filters/network/local_ratelimit/local_ratelimit.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/network/local_rate_limit/v2alpha/local_rate_limit.pb.h"
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/network/filter.h"
 #include "envoy/runtime/runtime.h"
@@ -32,7 +32,7 @@ struct LocalRateLimitStats {
 class Config : Logger::Loggable<Logger::Id::filter> {
 public:
   Config(
-      const envoy::config::filter::network::local_rate_limit::v2alpha::LocalRateLimit& proto_config,
+      const envoy::config::filter::network::local_rate_limit::v3alpha::LocalRateLimit& proto_config,
       Event::Dispatcher& dispatcher, Stats::Scope& scope, Runtime::Loader& runtime);
 
   bool canCreateConnection();
diff --git a/source/extensions/filters/network/mongo_proxy/BUILD b/source/extensions/filters/network/mongo_proxy/BUILD
index 7e5c55fb1c20..ab59c8f5e360 100644
--- a/source/extensions/filters/network/mongo_proxy/BUILD
+++ b/source/extensions/filters/network/mongo_proxy/BUILD
@@ -112,6 +112,6 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/network/mongo_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/mongo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/mongo_proxy/config.cc b/source/extensions/filters/network/mongo_proxy/config.cc
index db8f0593f8bf..13fc83748a65 100644
--- a/source/extensions/filters/network/mongo_proxy/config.cc
+++ b/source/extensions/filters/network/mongo_proxy/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/mongo_proxy/config.h"
 
-#include "envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.pb.h"
-#include "envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/mongo_proxy/v3alpha/mongo_proxy.pb.h"
+#include "envoy/extensions/filters/network/mongo_proxy/v3alpha/mongo_proxy.pb.validate.h"
 #include "envoy/network/connection.h"
 #include "envoy/registry/registry.h"
 
@@ -15,7 +15,7 @@ namespace NetworkFilters {
 namespace MongoProxy {
 
 Network::FilterFactoryCb MongoProxyFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::mongo_proxy::v2::MongoProxy& proto_config,
+    const envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy& proto_config,
     Server::Configuration::FactoryContext& context) {
 
   ASSERT(!proto_config.stat_prefix().empty());
diff --git a/source/extensions/filters/network/mongo_proxy/config.h b/source/extensions/filters/network/mongo_proxy/config.h
index f2aada65792a..c46b35899b6a 100644
--- a/source/extensions/filters/network/mongo_proxy/config.h
+++ b/source/extensions/filters/network/mongo_proxy/config.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.pb.h"
-#include "envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/mongo_proxy/v3alpha/mongo_proxy.pb.h"
+#include "envoy/extensions/filters/network/mongo_proxy/v3alpha/mongo_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -17,13 +17,14 @@ namespace MongoProxy {
  * Config registration for the mongo proxy filter. @see NamedNetworkFilterConfigFactory.
  */
 class MongoProxyFilterConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::network::mongo_proxy::v2::MongoProxy> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy> {
 public:
   MongoProxyFilterConfigFactory() : FactoryBase(NetworkFilterNames::get().MongoProxy) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::mongo_proxy::v2::MongoProxy& proto_config,
+      const envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/mysql_proxy/BUILD b/source/extensions/filters/network/mysql_proxy/BUILD
index 4637fb51542a..71915fa9d584 100644
--- a/source/extensions/filters/network/mysql_proxy/BUILD
+++ b/source/extensions/filters/network/mysql_proxy/BUILD
@@ -45,7 +45,7 @@ envoy_cc_library(
         "//source/common/buffer:buffer_lib",
         "//source/common/network:filter_lib",
         "//source/extensions/filters/network:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -59,6 +59,6 @@ envoy_cc_extension(
         ":proxy_lib",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/network/mysql_proxy/v1alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/mysql_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/mysql_proxy/mysql_config.cc b/source/extensions/filters/network/mysql_proxy/mysql_config.cc
index 3f47e243ecce..a41f458282f3 100644
--- a/source/extensions/filters/network/mysql_proxy/mysql_config.cc
+++ b/source/extensions/filters/network/mysql_proxy/mysql_config.cc
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.pb.h"
-#include "envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/mysql_proxy/v3alpha/mysql_proxy.pb.h"
+#include "envoy/extensions/filters/network/mysql_proxy/v3alpha/mysql_proxy.pb.validate.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 
@@ -21,7 +21,7 @@ namespace MySQLProxy {
  */
 Network::FilterFactoryCb
 NetworkFilters::MySQLProxy::MySQLConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::mysql_proxy::v1alpha1::MySQLProxy& proto_config,
+    const envoy::extensions::filters::network::mysql_proxy::v3alpha::MySQLProxy& proto_config,
     Server::Configuration::FactoryContext& context) {
 
   ASSERT(!proto_config.stat_prefix().empty());
diff --git a/source/extensions/filters/network/mysql_proxy/mysql_config.h b/source/extensions/filters/network/mysql_proxy/mysql_config.h
index 2b73a1dbe02c..335eebc740cf 100644
--- a/source/extensions/filters/network/mysql_proxy/mysql_config.h
+++ b/source/extensions/filters/network/mysql_proxy/mysql_config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.pb.h"
-#include "envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/mysql_proxy/v3alpha/mysql_proxy.pb.h"
+#include "envoy/extensions/filters/network/mysql_proxy/v3alpha/mysql_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/mysql_proxy/mysql_filter.h"
@@ -15,14 +15,15 @@ namespace MySQLProxy {
 /**
  * Config registration for the MySQL proxy filter.
  */
-class MySQLConfigFactory : public Common::FactoryBase<
-                               envoy::config::filter::network::mysql_proxy::v1alpha1::MySQLProxy> {
+class MySQLConfigFactory
+    : public Common::FactoryBase<
+          envoy::extensions::filters::network::mysql_proxy::v3alpha::MySQLProxy> {
 public:
   MySQLConfigFactory() : FactoryBase(NetworkFilterNames::get().MySQLProxy) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::mysql_proxy::v1alpha1::MySQLProxy& proto_config,
+      const envoy::extensions::filters::network::mysql_proxy::v3alpha::MySQLProxy& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/mysql_proxy/mysql_filter.cc b/source/extensions/filters/network/mysql_proxy/mysql_filter.cc
index 13b4d174d949..93483a8058ea 100644
--- a/source/extensions/filters/network/mysql_proxy/mysql_filter.cc
+++ b/source/extensions/filters/network/mysql_proxy/mysql_filter.cc
@@ -1,6 +1,6 @@
 #include "extensions/filters/network/mysql_proxy/mysql_filter.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/assert.h"
@@ -46,7 +46,7 @@ Network::FilterStatus MySQLFilter::onWrite(Buffer::Instance& data, bool) {
 
 void MySQLFilter::doDecode(Buffer::Instance& buffer) {
   // Clear dynamic metadata.
-  envoy::api::v2::core::Metadata& dynamic_metadata =
+  envoy::config::core::v3alpha::Metadata& dynamic_metadata =
       read_callbacks_->connection().streamInfo().dynamicMetadata();
   auto& metadata =
       (*dynamic_metadata.mutable_filter_metadata())[NetworkFilterNames::get().MySQLProxy];
@@ -118,7 +118,7 @@ void MySQLFilter::onCommand(Command& command) {
   config_->stats_.queries_parsed_.inc();
 
   // Set dynamic metadata
-  envoy::api::v2::core::Metadata& dynamic_metadata =
+  envoy::config::core::v3alpha::Metadata& dynamic_metadata =
       read_callbacks_->connection().streamInfo().dynamicMetadata();
   ProtobufWkt::Struct metadata(
       (*dynamic_metadata.mutable_filter_metadata())[NetworkFilterNames::get().MySQLProxy]);
diff --git a/source/extensions/filters/network/ratelimit/BUILD b/source/extensions/filters/network/ratelimit/BUILD
index 8e45eaa9b9b2..399b95ed857b 100644
--- a/source/extensions/filters/network/ratelimit/BUILD
+++ b/source/extensions/filters/network/ratelimit/BUILD
@@ -24,7 +24,7 @@ envoy_cc_library(
         "//include/envoy/stats:stats_macros",
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/filters/common/ratelimit:ratelimit_client_interface",
-        "@envoy_api//envoy/config/filter/network/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -41,6 +41,6 @@ envoy_cc_extension(
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
         "//source/extensions/filters/network/ratelimit:ratelimit_lib",
-        "@envoy_api//envoy/config/filter/network/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/ratelimit/config.cc b/source/extensions/filters/network/ratelimit/config.cc
index f2df934a2a71..c664bf7cfe23 100644
--- a/source/extensions/filters/network/ratelimit/config.cc
+++ b/source/extensions/filters/network/ratelimit/config.cc
@@ -3,8 +3,8 @@
 #include <chrono>
 #include <string>
 
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.validate.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -18,7 +18,7 @@ namespace NetworkFilters {
 namespace RateLimitFilter {
 
 Network::FilterFactoryCb RateLimitConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::rate_limit::v2::RateLimit& proto_config,
+    const envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit& proto_config,
     Server::Configuration::FactoryContext& context) {
 
   ASSERT(!proto_config.stat_prefix().empty());
diff --git a/source/extensions/filters/network/ratelimit/config.h b/source/extensions/filters/network/ratelimit/config.h
index b7bd967b6b19..b78a04f19bfa 100644
--- a/source/extensions/filters/network/ratelimit/config.h
+++ b/source/extensions/filters/network/ratelimit/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.validate.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.validate.h"
 
 #include "extensions/filters/common/ratelimit/ratelimit.h"
 #include "extensions/filters/network/common/factory_base.h"
@@ -16,13 +16,14 @@ namespace RateLimitFilter {
  * Config registration for the rate limit filter. @see NamedNetworkFilterConfigFactory.
  */
 class RateLimitConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::network::rate_limit::v2::RateLimit> {
+    : public Common::FactoryBase<
+          envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit> {
 public:
   RateLimitConfigFactory() : FactoryBase(NetworkFilterNames::get().RateLimit) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::rate_limit::v2::RateLimit& proto_config,
+      const envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/ratelimit/ratelimit.cc b/source/extensions/filters/network/ratelimit/ratelimit.cc
index 502f63199bf5..3d8e30fdd732 100644
--- a/source/extensions/filters/network/ratelimit/ratelimit.cc
+++ b/source/extensions/filters/network/ratelimit/ratelimit.cc
@@ -3,7 +3,7 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/fmt.h"
@@ -14,7 +14,7 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace RateLimitFilter {
 
-Config::Config(const envoy::config::filter::network::rate_limit::v2::RateLimit& config,
+Config::Config(const envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit& config,
                Stats::Scope& scope, Runtime::Loader& runtime)
     : domain_(config.domain()), stats_(generateStats(config.stat_prefix(), scope)),
       runtime_(runtime), failure_mode_deny_(config.failure_mode_deny()) {
diff --git a/source/extensions/filters/network/ratelimit/ratelimit.h b/source/extensions/filters/network/ratelimit/ratelimit.h
index 82cbd386d7fa..a988590ea805 100644
--- a/source/extensions/filters/network/ratelimit/ratelimit.h
+++ b/source/extensions/filters/network/ratelimit/ratelimit.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
 #include "envoy/ratelimit/ratelimit.h"
@@ -44,7 +44,7 @@ struct InstanceStats {
  */
 class Config {
 public:
-  Config(const envoy::config::filter::network::rate_limit::v2::RateLimit& config,
+  Config(const envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit& config,
          Stats::Scope& scope, Runtime::Loader& runtime);
   const std::string& domain() { return domain_; }
   const std::vector<RateLimit::Descriptor>& descriptors() { return descriptors_; }
diff --git a/source/extensions/filters/network/rbac/BUILD b/source/extensions/filters/network/rbac/BUILD
index f3149e8486ff..840c5ba07511 100644
--- a/source/extensions/filters/network/rbac/BUILD
+++ b/source/extensions/filters/network/rbac/BUILD
@@ -20,8 +20,8 @@ envoy_cc_extension(
         "//include/envoy/server:filter_config_interface",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/network/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -37,6 +37,6 @@ envoy_cc_library(
         "//source/extensions/filters/common/rbac:engine_lib",
         "//source/extensions/filters/common/rbac:utility_lib",
         "//source/extensions/filters/network:well_known_names",
-        "@envoy_api//envoy/config/filter/network/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/rbac/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/rbac/config.cc b/source/extensions/filters/network/rbac/config.cc
index d377a05159b4..37835fc17e83 100644
--- a/source/extensions/filters/network/rbac/config.cc
+++ b/source/extensions/filters/network/rbac/config.cc
@@ -1,8 +1,8 @@
 #include "extensions/filters/network/rbac/config.h"
 
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.validate.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.validate.h"
 #include "envoy/network/connection.h"
 #include "envoy/registry/registry.h"
 
@@ -20,7 +20,7 @@ static void validateFail(const std::string& header) {
                                    header));
 }
 
-static void validatePermission(const envoy::config::rbac::v2::Permission& permission) {
+static void validatePermission(const envoy::config::rbac::v3alpha::Permission& permission) {
   if (permission.has_header()) {
     validateFail(permission.header().DebugString());
   }
@@ -39,7 +39,7 @@ static void validatePermission(const envoy::config::rbac::v2::Permission& permis
   }
 }
 
-static void validatePrincipal(const envoy::config::rbac::v2::Principal& principal) {
+static void validatePrincipal(const envoy::config::rbac::v3alpha::Principal& principal) {
   if (principal.has_header()) {
     validateFail(principal.header().DebugString());
   }
@@ -61,7 +61,7 @@ static void validatePrincipal(const envoy::config::rbac::v2::Principal& principa
 /**
  * Validate the RBAC rules doesn't include any header or metadata rule.
  */
-static void validateRbacRules(const envoy::config::rbac::v2::RBAC& rules) {
+static void validateRbacRules(const envoy::config::rbac::v3alpha::RBAC& rules) {
   for (const auto& policy : rules.policies()) {
     for (const auto& permission : policy.second.permissions()) {
       validatePermission(permission);
@@ -74,7 +74,7 @@ static void validateRbacRules(const envoy::config::rbac::v2::RBAC& rules) {
 
 Network::FilterFactoryCb
 RoleBasedAccessControlNetworkFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::rbac::v2::RBAC& proto_config,
+    const envoy::extensions::filters::network::rbac::v3alpha::RBAC& proto_config,
     Server::Configuration::FactoryContext& context) {
   validateRbacRules(proto_config.rules());
   validateRbacRules(proto_config.shadow_rules());
diff --git a/source/extensions/filters/network/rbac/config.h b/source/extensions/filters/network/rbac/config.h
index 9b7cc34ac25d..788ce1321aed 100644
--- a/source/extensions/filters/network/rbac/config.h
+++ b/source/extensions/filters/network/rbac/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.validate.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -15,7 +15,7 @@ namespace RBACFilter {
  * Config registration for the RBAC network filter. @see NamedNetworkFilterConfigFactory.
  */
 class RoleBasedAccessControlNetworkFilterConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::network::rbac::v2::RBAC> {
+    : public Common::FactoryBase<envoy::extensions::filters::network::rbac::v3alpha::RBAC> {
 
 public:
   RoleBasedAccessControlNetworkFilterConfigFactory()
@@ -23,7 +23,7 @@ class RoleBasedAccessControlNetworkFilterConfigFactory
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::rbac::v2::RBAC& proto_config,
+      const envoy::extensions::filters::network::rbac::v3alpha::RBAC& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/rbac/rbac_filter.cc b/source/extensions/filters/network/rbac/rbac_filter.cc
index b0337677d39c..2524e2d4dca1 100644
--- a/source/extensions/filters/network/rbac/rbac_filter.cc
+++ b/source/extensions/filters/network/rbac/rbac_filter.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/rbac/rbac_filter.h"
 
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
 #include "envoy/network/connection.h"
 
 #include "extensions/filters/network/well_known_names.h"
@@ -14,7 +14,8 @@ namespace NetworkFilters {
 namespace RBACFilter {
 
 RoleBasedAccessControlFilterConfig::RoleBasedAccessControlFilterConfig(
-    const envoy::config::filter::network::rbac::v2::RBAC& proto_config, Stats::Scope& scope)
+    const envoy::extensions::filters::network::rbac::v3alpha::RBAC& proto_config,
+    Stats::Scope& scope)
     : stats_(Filters::Common::RBAC::generateStats(proto_config.stat_prefix(), scope)),
       engine_(Filters::Common::RBAC::createEngine(proto_config)),
       shadow_engine_(Filters::Common::RBAC::createShadowEngine(proto_config)),
@@ -38,7 +39,8 @@ Network::FilterStatus RoleBasedAccessControlFilter::onData(Buffer::Instance&, bo
 
   // When the enforcement type is continuous always do the RBAC checks. If it is a one time check,
   // run the check once and skip it for subsequent onData calls.
-  if (config_->enforcementType() == envoy::config::filter::network::rbac::v2::RBAC::CONTINUOUS) {
+  if (config_->enforcementType() ==
+      envoy::extensions::filters::network::rbac::v3alpha::RBAC::CONTINUOUS) {
     shadow_engine_result_ = checkEngine(Filters::Common::RBAC::EnforcementMode::Shadow);
     engine_result_ = checkEngine(Filters::Common::RBAC::EnforcementMode::Enforced);
   } else {
diff --git a/source/extensions/filters/network/rbac/rbac_filter.h b/source/extensions/filters/network/rbac/rbac_filter.h
index d0e2ed6122f9..30188c4b6771 100644
--- a/source/extensions/filters/network/rbac/rbac_filter.h
+++ b/source/extensions/filters/network/rbac/rbac_filter.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/filter.h"
 #include "envoy/stats/stats_macros.h"
@@ -23,7 +23,8 @@ enum EngineResult { Unknown, None, Allow, Deny };
 class RoleBasedAccessControlFilterConfig {
 public:
   RoleBasedAccessControlFilterConfig(
-      const envoy::config::filter::network::rbac::v2::RBAC& proto_config, Stats::Scope& scope);
+      const envoy::extensions::filters::network::rbac::v3alpha::RBAC& proto_config,
+      Stats::Scope& scope);
 
   Filters::Common::RBAC::RoleBasedAccessControlFilterStats& stats() { return stats_; }
 
@@ -33,7 +34,8 @@ class RoleBasedAccessControlFilterConfig {
                                                                     : shadow_engine_.get();
   }
 
-  envoy::config::filter::network::rbac::v2::RBAC::EnforcementType enforcementType() const {
+  envoy::extensions::filters::network::rbac::v3alpha::RBAC::EnforcementType
+  enforcementType() const {
     return enforcement_type_;
   }
 
@@ -42,7 +44,7 @@ class RoleBasedAccessControlFilterConfig {
 
   std::unique_ptr<Filters::Common::RBAC::RoleBasedAccessControlEngineImpl> engine_;
   std::unique_ptr<Filters::Common::RBAC::RoleBasedAccessControlEngineImpl> shadow_engine_;
-  const envoy::config::filter::network::rbac::v2::RBAC::EnforcementType enforcement_type_;
+  const envoy::extensions::filters::network::rbac::v3alpha::RBAC::EnforcementType enforcement_type_;
 };
 
 using RoleBasedAccessControlFilterConfigSharedPtr =
diff --git a/source/extensions/filters/network/redis_proxy/BUILD b/source/extensions/filters/network/redis_proxy/BUILD
index f2ca8b862e5f..319d5f297f21 100644
--- a/source/extensions/filters/network/redis_proxy/BUILD
+++ b/source/extensions/filters/network/redis_proxy/BUILD
@@ -28,8 +28,8 @@ envoy_cc_library(
         "//source/common/config:datasource_lib",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -91,9 +91,9 @@ envoy_cc_library(
         "//source/extensions/common/redis:cluster_refresh_manager_interface",
         "//source/extensions/filters/network/common/redis:client_lib",
         "//source/extensions/filters/network/common/redis:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -111,7 +111,7 @@ envoy_cc_library(
         "//source/common/config:datasource_lib",
         "//source/common/config:utility_lib",
         "//source/extensions/filters/network/common/redis:codec_interface",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -131,8 +131,8 @@ envoy_cc_extension(
         "//source/extensions/filters/network/redis_proxy:conn_pool_lib",
         "//source/extensions/filters/network/redis_proxy:proxy_filter_lib",
         "//source/extensions/filters/network/redis_proxy:router_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -149,7 +149,7 @@ envoy_cc_library(
         "//source/extensions/filters/network/common/redis:supported_commands_lib",
         "//source/extensions/filters/network/common/redis:utility_lib",
         "//source/extensions/filters/network/redis_proxy:conn_pool_lib",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/redis_proxy/config.cc b/source/extensions/filters/network/redis_proxy/config.cc
index 48890e528285..c5f31494c511 100644
--- a/source/extensions/filters/network/redis_proxy/config.cc
+++ b/source/extensions/filters/network/redis_proxy/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/redis_proxy/config.h"
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "extensions/common/redis/cluster_refresh_manager_impl.h"
 #include "extensions/filters/network/common/redis/client_impl.h"
@@ -17,9 +17,9 @@ namespace NetworkFilters {
 namespace RedisProxy {
 
 namespace {
-inline void addUniqueClusters(
-    absl::flat_hash_set<std::string>& clusters,
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy_PrefixRoutes_Route& route) {
+inline void addUniqueClusters(absl::flat_hash_set<std::string>& clusters,
+                              const envoy::extensions::filters::network::redis_proxy::v3alpha::
+                                  RedisProxy::PrefixRoutes::Route& route) {
   clusters.emplace(route.cluster());
   for (auto& mirror : route.request_mirror_policy()) {
     clusters.emplace(mirror.cluster());
@@ -28,7 +28,7 @@ inline void addUniqueClusters(
 } // namespace
 
 Network::FilterFactoryCb RedisProxyFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy& proto_config,
+    const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy& proto_config,
     Server::Configuration::FactoryContext& context) {
 
   ASSERT(!proto_config.stat_prefix().empty());
@@ -42,20 +42,23 @@ Network::FilterFactoryCb RedisProxyFilterConfigFactory::createFilterFactoryFromP
   ProxyFilterConfigSharedPtr filter_config(std::make_shared<ProxyFilterConfig>(
       proto_config, context.scope(), context.drainDecision(), context.runtime(), context.api()));
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes prefix_routes(
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes prefix_routes(
       proto_config.prefix_routes());
 
   // Set the catch-all route from the deprecated cluster and settings parameters.
-  if (prefix_routes.catch_all_cluster().empty() && prefix_routes.routes_size() == 0 &&
-      !prefix_routes.has_catch_all_route()) {
-    if (proto_config.cluster().empty()) {
+  if (prefix_routes.hidden_envoy_deprecated_catch_all_cluster().empty() &&
+      prefix_routes.routes_size() == 0 && !prefix_routes.has_catch_all_route()) {
+    if (proto_config.hidden_envoy_deprecated_cluster().empty()) {
       throw EnvoyException("cannot configure a redis-proxy without any upstream");
     }
 
-    prefix_routes.mutable_catch_all_route()->set_cluster(proto_config.cluster());
-  } else if (!prefix_routes.catch_all_cluster().empty() && !prefix_routes.has_catch_all_route()) {
+    prefix_routes.mutable_catch_all_route()->set_cluster(
+        proto_config.hidden_envoy_deprecated_cluster());
+  } else if (!prefix_routes.hidden_envoy_deprecated_catch_all_cluster().empty() &&
+             !prefix_routes.has_catch_all_route()) {
     // Set the catch-all route from the deprecated catch-all cluster.
-    prefix_routes.mutable_catch_all_route()->set_cluster(prefix_routes.catch_all_cluster());
+    prefix_routes.mutable_catch_all_route()->set_cluster(
+        prefix_routes.hidden_envoy_deprecated_catch_all_cluster());
   }
 
   absl::flat_hash_set<std::string> unique_clusters;
diff --git a/source/extensions/filters/network/redis_proxy/config.h b/source/extensions/filters/network/redis_proxy/config.h
index d8af1cbbfb55..a1e2d5ea0f1e 100644
--- a/source/extensions/filters/network/redis_proxy/config.h
+++ b/source/extensions/filters/network/redis_proxy/config.h
@@ -3,9 +3,9 @@
 #include <string>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 #include "envoy/upstream/upstream.h"
 
 #include "common/common/empty_string.h"
@@ -22,14 +22,15 @@ namespace RedisProxy {
 class ProtocolOptionsConfigImpl : public Upstream::ProtocolOptionsConfig {
 public:
   ProtocolOptionsConfigImpl(
-      const envoy::config::filter::network::redis_proxy::v2::RedisProtocolOptions& proto_config)
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProtocolOptions&
+          proto_config)
       : auth_password_(proto_config.auth_password()) {}
 
   std::string auth_password(Api::Api& api) const {
     return Config::DataSource::read(auth_password_, true, api);
   }
 
-  const envoy::api::v2::core::DataSource& auth_password_datasource() const {
+  const envoy::config::core::v3alpha::DataSource& auth_password_datasource() const {
     return auth_password_;
   }
 
@@ -44,7 +45,7 @@ class ProtocolOptionsConfigImpl : public Upstream::ProtocolOptionsConfig {
   }
 
 private:
-  envoy::api::v2::core::DataSource auth_password_;
+  envoy::config::core::v3alpha::DataSource auth_password_;
 };
 
 /**
@@ -52,19 +53,19 @@ class ProtocolOptionsConfigImpl : public Upstream::ProtocolOptionsConfig {
  */
 class RedisProxyFilterConfigFactory
     : public Common::FactoryBase<
-          envoy::config::filter::network::redis_proxy::v2::RedisProxy,
-          envoy::config::filter::network::redis_proxy::v2::RedisProtocolOptions> {
+          envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy,
+          envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProtocolOptions> {
 public:
   RedisProxyFilterConfigFactory() : FactoryBase(NetworkFilterNames::get().RedisProxy, true) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::redis_proxy::v2::RedisProxy& proto_config,
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy& proto_config,
       Server::Configuration::FactoryContext& context) override;
 
   Upstream::ProtocolOptionsConfigConstSharedPtr createProtocolOptionsTyped(
-      const envoy::config::filter::network::redis_proxy::v2::RedisProtocolOptions& proto_config)
-      override {
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProtocolOptions&
+          proto_config) override {
     return std::make_shared<ProtocolOptionsConfigImpl>(proto_config);
   }
 };
diff --git a/source/extensions/filters/network/redis_proxy/conn_pool_impl.cc b/source/extensions/filters/network/redis_proxy/conn_pool_impl.cc
index 3ed0ef53bb26..6e2abd0a72c8 100644
--- a/source/extensions/filters/network/redis_proxy/conn_pool_impl.cc
+++ b/source/extensions/filters/network/redis_proxy/conn_pool_impl.cc
@@ -5,11 +5,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "common/common/assert.h"
 #include "common/stats/utility.h"
@@ -38,7 +38,8 @@ const Common::Redis::RespValue& getRequest(const RespVariant& request) {
 InstanceImpl::InstanceImpl(
     const std::string& cluster_name, Upstream::ClusterManager& cm,
     Common::Redis::Client::ClientFactory& client_factory, ThreadLocal::SlotAllocator& tls,
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings& config,
+    const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings&
+        config,
     Api::Api& api, Stats::ScopePtr&& stats_scope,
     const Common::Redis::RedisCommandStatsSharedPtr& redis_command_stats,
     Extensions::Common::Redis::ClusterRefreshManagerSharedPtr refresh_manager)
@@ -307,10 +308,11 @@ Common::Redis::Client::PoolRequest* InstanceImpl::ThreadLocalPool::makeRequestTo
       }
     }
     Upstream::HostSharedPtr new_host{new Upstream::HostImpl(
-        cluster_->info(), "", address_ptr, envoy::api::v2::core::Metadata::default_instance(), 1,
-        envoy::api::v2::core::Locality(),
-        envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), 0,
-        envoy::api::v2::core::HealthStatus::UNKNOWN)};
+        cluster_->info(), "", address_ptr,
+        envoy::config::core::v3alpha::Metadata::default_instance(), 1,
+        envoy::config::core::v3alpha::Locality(),
+        envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(), 0,
+        envoy::config::core::v3alpha::UNKNOWN)};
     host_address_map_[host_address_map_key] = new_host;
     created_via_redirect_hosts_.push_back(new_host);
     it = host_address_map_.find(host_address_map_key);
diff --git a/source/extensions/filters/network/redis_proxy/conn_pool_impl.h b/source/extensions/filters/network/redis_proxy/conn_pool_impl.h
index c74dc2809cda..d318ad9f690f 100644
--- a/source/extensions/filters/network/redis_proxy/conn_pool_impl.h
+++ b/source/extensions/filters/network/redis_proxy/conn_pool_impl.h
@@ -8,7 +8,7 @@
 #include <unordered_map>
 #include <vector>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 #include "envoy/stats/stats_macros.h"
 #include "envoy/thread_local/thread_local.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -57,7 +57,8 @@ class InstanceImpl : public Instance {
   InstanceImpl(
       const std::string& cluster_name, Upstream::ClusterManager& cm,
       Common::Redis::Client::ClientFactory& client_factory, ThreadLocal::SlotAllocator& tls,
-      const envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings& config,
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings&
+          config,
       Api::Api& api, Stats::ScopePtr&& stats_scope,
       const Common::Redis::RedisCommandStatsSharedPtr& redis_command_stats,
       Extensions::Common::Redis::ClusterRefreshManagerSharedPtr refresh_manager);
diff --git a/source/extensions/filters/network/redis_proxy/proxy_filter.cc b/source/extensions/filters/network/redis_proxy/proxy_filter.cc
index 221fc806a6c7..14d26ba28923 100644
--- a/source/extensions/filters/network/redis_proxy/proxy_filter.cc
+++ b/source/extensions/filters/network/redis_proxy/proxy_filter.cc
@@ -3,7 +3,7 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/assert.h"
@@ -17,8 +17,9 @@ namespace NetworkFilters {
 namespace RedisProxy {
 
 ProxyFilterConfig::ProxyFilterConfig(
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy& config, Stats::Scope& scope,
-    const Network::DrainDecision& drain_decision, Runtime::Loader& runtime, Api::Api& api)
+    const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy& config,
+    Stats::Scope& scope, const Network::DrainDecision& drain_decision, Runtime::Loader& runtime,
+    Api::Api& api)
     : drain_decision_(drain_decision), runtime_(runtime),
       stat_prefix_(fmt::format("redis.{}.", config.stat_prefix())),
       stats_(generateStats(stat_prefix_, scope)),
diff --git a/source/extensions/filters/network/redis_proxy/proxy_filter.h b/source/extensions/filters/network/redis_proxy/proxy_filter.h
index aefa3b9a7efa..77c7a07acc78 100644
--- a/source/extensions/filters/network/redis_proxy/proxy_filter.h
+++ b/source/extensions/filters/network/redis_proxy/proxy_filter.h
@@ -5,7 +5,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 #include "envoy/network/drain_decision.h"
 #include "envoy/network/filter.h"
 #include "envoy/stats/scope.h"
@@ -48,9 +48,10 @@ struct ProxyStats {
  */
 class ProxyFilterConfig {
 public:
-  ProxyFilterConfig(const envoy::config::filter::network::redis_proxy::v2::RedisProxy& config,
-                    Stats::Scope& scope, const Network::DrainDecision& drain_decision,
-                    Runtime::Loader& runtime, Api::Api& api);
+  ProxyFilterConfig(
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy& config,
+      Stats::Scope& scope, const Network::DrainDecision& drain_decision, Runtime::Loader& runtime,
+      Api::Api& api);
 
   const Network::DrainDecision& drain_decision_;
   Runtime::Loader& runtime_;
diff --git a/source/extensions/filters/network/redis_proxy/router_impl.cc b/source/extensions/filters/network/redis_proxy/router_impl.cc
index a5265a5e85df..3cc646c3d5d4 100644
--- a/source/extensions/filters/network/redis_proxy/router_impl.cc
+++ b/source/extensions/filters/network/redis_proxy/router_impl.cc
@@ -1,21 +1,22 @@
 #include "extensions/filters/network/redis_proxy/router_impl.h"
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
 namespace RedisProxy {
 
-MirrorPolicyImpl::MirrorPolicyImpl(const envoy::config::filter::network::redis_proxy::v2::
+MirrorPolicyImpl::MirrorPolicyImpl(const envoy::extensions::filters::network::redis_proxy::v3alpha::
                                        RedisProxy::PrefixRoutes::Route::RequestMirrorPolicy& config,
                                    const ConnPool::InstanceSharedPtr upstream,
                                    Runtime::Loader& runtime)
     : runtime_key_(config.runtime_fraction().runtime_key()),
-      default_value_(config.has_runtime_fraction() ? absl::optional<envoy::type::FractionalPercent>(
-                                                         config.runtime_fraction().default_value())
-                                                   : absl::nullopt),
+      default_value_(config.has_runtime_fraction()
+                         ? absl::optional<envoy::type::v3alpha::FractionalPercent>(
+                               config.runtime_fraction().default_value())
+                         : absl::nullopt),
       exclude_read_commands_(config.exclude_read_commands()), upstream_(upstream),
       runtime_(runtime) {}
 
@@ -39,7 +40,8 @@ bool MirrorPolicyImpl::shouldMirror(const std::string& command) const {
 }
 
 Prefix::Prefix(
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route route,
+    const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::Route
+        route,
     Upstreams& upstreams, Runtime::Loader& runtime)
     : prefix_(route.prefix()), remove_prefix_(route.remove_prefix()),
       upstream_(upstreams.at(route.cluster())) {
@@ -50,7 +52,8 @@ Prefix::Prefix(
 }
 
 PrefixRoutes::PrefixRoutes(
-    const envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes& config,
+    const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes&
+        config,
     Upstreams&& upstreams, Runtime::Loader& runtime)
     : case_insensitive_(config.case_insensitive()), upstreams_(std::move(upstreams)),
       catch_all_route_(config.has_catch_all_route()
diff --git a/source/extensions/filters/network/redis_proxy/router_impl.h b/source/extensions/filters/network/redis_proxy/router_impl.h
index b46cb22c435d..fd7862fbb996 100644
--- a/source/extensions/filters/network/redis_proxy/router_impl.h
+++ b/source/extensions/filters/network/redis_proxy/router_impl.h
@@ -7,10 +7,10 @@
 #include <set>
 #include <string>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/thread_local/thread_local.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "common/common/to_lower_table.h"
@@ -28,8 +28,8 @@ using Upstreams = std::map<std::string, ConnPool::InstanceSharedPtr>;
 
 class MirrorPolicyImpl : public MirrorPolicy {
 public:
-  MirrorPolicyImpl(const envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::
-                       Route::RequestMirrorPolicy&,
+  MirrorPolicyImpl(const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                       PrefixRoutes::Route::RequestMirrorPolicy&,
                    const ConnPool::InstanceSharedPtr, Runtime::Loader& runtime);
 
   ConnPool::InstanceSharedPtr upstream() const override { return upstream_; };
@@ -38,7 +38,7 @@ class MirrorPolicyImpl : public MirrorPolicy {
 
 private:
   const std::string runtime_key_;
-  const absl::optional<envoy::type::FractionalPercent> default_value_;
+  const absl::optional<envoy::type::v3alpha::FractionalPercent> default_value_;
   const bool exclude_read_commands_;
   ConnPool::InstanceSharedPtr upstream_;
   Runtime::Loader& runtime_;
@@ -47,9 +47,9 @@ class MirrorPolicyImpl : public MirrorPolicy {
 
 class Prefix : public Route {
 public:
-  Prefix(
-      const envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route route,
-      Upstreams& upstreams, Runtime::Loader& runtime);
+  Prefix(const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::
+             Route route,
+         Upstreams& upstreams, Runtime::Loader& runtime);
 
   ConnPool::InstanceSharedPtr upstream() const override { return upstream_; }
   const MirrorPolicies& mirrorPolicies() const override { return mirror_policies_; };
@@ -67,9 +67,10 @@ using PrefixSharedPtr = std::shared_ptr<Prefix>;
 
 class PrefixRoutes : public Router {
 public:
-  PrefixRoutes(const envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes&
-                   prefix_routes,
-               Upstreams&& upstreams, Runtime::Loader& runtime);
+  PrefixRoutes(
+      const envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes&
+          prefix_routes,
+      Upstreams&& upstreams, Runtime::Loader& runtime);
 
   RouteSharedPtr upstreamPool(std::string& key) override;
 
diff --git a/source/extensions/filters/network/tcp_proxy/BUILD b/source/extensions/filters/network/tcp_proxy/BUILD
index 4ff4d71b0c4a..01a685889355 100644
--- a/source/extensions/filters/network/tcp_proxy/BUILD
+++ b/source/extensions/filters/network/tcp_proxy/BUILD
@@ -21,6 +21,6 @@ envoy_cc_extension(
         "//source/common/tcp_proxy",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/tcp_proxy/config.cc b/source/extensions/filters/network/tcp_proxy/config.cc
index f8a1ad91a14c..a82496c760bd 100644
--- a/source/extensions/filters/network/tcp_proxy/config.cc
+++ b/source/extensions/filters/network/tcp_proxy/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/tcp_proxy/config.h"
 
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/tcp_proxy/tcp_proxy.h"
@@ -12,11 +12,11 @@ namespace NetworkFilters {
 namespace TcpProxy {
 
 Network::FilterFactoryCb ConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& proto_config,
+    const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& proto_config,
     Server::Configuration::FactoryContext& context) {
   ASSERT(!proto_config.stat_prefix().empty());
-  if (proto_config.has_deprecated_v1()) {
-    ASSERT(proto_config.deprecated_v1().routes_size() > 0);
+  if (proto_config.has_hidden_envoy_deprecated_deprecated_v1()) {
+    ASSERT(proto_config.hidden_envoy_deprecated_deprecated_v1().routes_size() > 0);
   }
 
   Envoy::TcpProxy::ConfigSharedPtr filter_config(
diff --git a/source/extensions/filters/network/tcp_proxy/config.h b/source/extensions/filters/network/tcp_proxy/config.h
index 13c6571e359e..76ea3cfe3e9a 100644
--- a/source/extensions/filters/network/tcp_proxy/config.h
+++ b/source/extensions/filters/network/tcp_proxy/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -14,14 +14,14 @@ namespace TcpProxy {
 /**
  * Config registration for the tcp proxy filter. @see NamedNetworkFilterConfigFactory.
  */
-class ConfigFactory
-    : public Common::FactoryBase<envoy::config::filter::network::tcp_proxy::v2::TcpProxy> {
+class ConfigFactory : public Common::FactoryBase<
+                          envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy> {
 public:
   ConfigFactory() : FactoryBase(NetworkFilterNames::get().TcpProxy, true) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& proto_config,
+      const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/thrift_proxy/BUILD b/source/extensions/filters/network/thrift_proxy/BUILD
index 67b3bb4b93fc..bf27c42c07fa 100644
--- a/source/extensions/filters/network/thrift_proxy/BUILD
+++ b/source/extensions/filters/network/thrift_proxy/BUILD
@@ -57,7 +57,7 @@ envoy_cc_extension(
         "//source/extensions/filters/network/thrift_proxy/filters:filter_config_interface",
         "//source/extensions/filters/network/thrift_proxy/filters:well_known_names",
         "//source/extensions/filters/network/thrift_proxy/router:router_lib",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/filters/network/thrift_proxy/config.cc b/source/extensions/filters/network/thrift_proxy/config.cc
index 25ecd6e78e40..526f22819a3f 100644
--- a/source/extensions/filters/network/thrift_proxy/config.cc
+++ b/source/extensions/filters/network/thrift_proxy/config.cc
@@ -3,8 +3,8 @@
 #include <map>
 #include <string>
 
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.validate.h"
 #include "envoy/network/connection.h"
 #include "envoy/registry/registry.h"
 
@@ -28,62 +28,64 @@ namespace ThriftProxy {
 namespace {
 
 using TransportTypeMap =
-    std::map<envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType, TransportType>;
+    std::map<envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType,
+             TransportType>;
 
 static const TransportTypeMap& transportTypeMap() {
   CONSTRUCT_ON_FIRST_USE(
       TransportTypeMap,
       {
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::AUTO_TRANSPORT,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::AUTO_TRANSPORT,
            TransportType::Auto},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::FRAMED,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::FRAMED,
            TransportType::Framed},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::UNFRAMED,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::UNFRAMED,
            TransportType::Unframed},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::HEADER,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::HEADER,
            TransportType::Header},
       });
 }
 
 using ProtocolTypeMap =
-    std::map<envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType, ProtocolType>;
+    std::map<envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType,
+             ProtocolType>;
 
 static const ProtocolTypeMap& protocolTypeMap() {
   CONSTRUCT_ON_FIRST_USE(
       ProtocolTypeMap,
       {
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::AUTO_PROTOCOL,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::AUTO_PROTOCOL,
            ProtocolType::Auto},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::BINARY,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::BINARY,
            ProtocolType::Binary},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::LAX_BINARY,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::LAX_BINARY,
            ProtocolType::LaxBinary},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::COMPACT,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::COMPACT,
            ProtocolType::Compact},
-          {envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::TWITTER,
+          {envoy::extensions::filters::network::thrift_proxy::v3alpha::TWITTER,
            ProtocolType::Twitter},
       });
 }
 
-TransportType
-lookupTransport(envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType transport) {
+TransportType lookupTransport(
+    envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType transport) {
   const auto& transport_iter = transportTypeMap().find(transport);
   if (transport_iter == transportTypeMap().end()) {
     throw EnvoyException(fmt::format(
         "unknown transport {}",
-        envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType_Name(transport)));
+        envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType_Name(transport)));
   }
 
   return transport_iter->second;
 }
 
 ProtocolType
-lookupProtocol(envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType protocol) {
+lookupProtocol(envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType protocol) {
   const auto& protocol_iter = protocolTypeMap().find(protocol);
   if (protocol_iter == protocolTypeMap().end()) {
     throw EnvoyException(fmt::format(
         "unknown protocol {}",
-        envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType_Name(protocol)));
+        envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType_Name(protocol)));
   }
   return protocol_iter->second;
 }
@@ -91,7 +93,7 @@ lookupProtocol(envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolT
 } // namespace
 
 ProtocolOptionsConfigImpl::ProtocolOptionsConfigImpl(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProtocolOptions& config)
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProtocolOptions& config)
     : transport_(lookupTransport(config.transport())),
       protocol_(lookupProtocol(config.protocol())) {}
 
@@ -104,7 +106,7 @@ ProtocolType ProtocolOptionsConfigImpl::protocol(ProtocolType downstream_protoco
 }
 
 Network::FilterFactoryCb ThriftProxyFilterConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy& proto_config,
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy& proto_config,
     Server::Configuration::FactoryContext& context) {
   std::shared_ptr<Config> filter_config(new ConfigImpl(proto_config, context));
 
@@ -121,7 +123,7 @@ REGISTER_FACTORY(ThriftProxyFilterConfigFactory,
                  Server::Configuration::NamedNetworkFilterConfigFactory);
 
 ConfigImpl::ConfigImpl(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy& config,
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy& config,
     Server::Configuration::FactoryContext& context)
     : context_(context), stats_prefix_(fmt::format("thrift.{}.", config.stat_prefix())),
       stats_(ThriftFilterStats::generateStats(stats_prefix_, context_.scope())),
@@ -131,7 +133,7 @@ ConfigImpl::ConfigImpl(
   if (config.thrift_filters().empty()) {
     ENVOY_LOG(debug, "using default router filter");
 
-    envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftFilter router;
+    envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftFilter router;
     router.set_name(ThriftFilters::ThriftFilterNames::get().ROUTER);
     processFilter(router);
   } else {
@@ -156,13 +158,14 @@ ProtocolPtr ConfigImpl::createProtocol() {
 }
 
 void ConfigImpl::processFilter(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftFilter& proto_config) {
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftFilter& proto_config) {
   const std::string& string_name = proto_config.name();
 
   ENVOY_LOG(debug, "    thrift filter #{}", filter_factories_.size());
   ENVOY_LOG(debug, "      name: {}", string_name);
-  ENVOY_LOG(debug, "    config: {}",
-            MessageUtil::getJsonStringFromMessage(proto_config.config(), true));
+  ENVOY_LOG(
+      debug, "    config: {}",
+      MessageUtil::getJsonStringFromMessage(proto_config.hidden_envoy_deprecated_config(), true));
   auto& factory =
       Envoy::Config::Utility::getAndCheckFactory<ThriftFilters::NamedThriftFilterConfigFactory>(
           string_name);
diff --git a/source/extensions/filters/network/thrift_proxy/config.h b/source/extensions/filters/network/thrift_proxy/config.h
index b51a96ee664a..945e27252433 100644
--- a/source/extensions/filters/network/thrift_proxy/config.h
+++ b/source/extensions/filters/network/thrift_proxy/config.h
@@ -3,8 +3,8 @@
 #include <map>
 #include <string>
 
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/thrift_proxy/conn_manager.h"
@@ -23,7 +23,7 @@ namespace ThriftProxy {
 class ProtocolOptionsConfigImpl : public ProtocolOptionsConfig {
 public:
   ProtocolOptionsConfigImpl(
-      const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProtocolOptions&
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProtocolOptions&
           proto_config);
 
   // ProtocolOptionsConfig
@@ -40,18 +40,18 @@ class ProtocolOptionsConfigImpl : public ProtocolOptionsConfig {
  */
 class ThriftProxyFilterConfigFactory
     : public Common::FactoryBase<
-          envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy,
-          envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProtocolOptions> {
+          envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy,
+          envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProtocolOptions> {
 public:
   ThriftProxyFilterConfigFactory() : FactoryBase(NetworkFilterNames::get().ThriftProxy, true) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy& proto_config,
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy& proto_config,
       Server::Configuration::FactoryContext& context) override;
 
   Upstream::ProtocolOptionsConfigConstSharedPtr createProtocolOptionsTyped(
-      const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProtocolOptions&
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProtocolOptions&
           proto_config) override {
     return std::make_shared<ProtocolOptionsConfigImpl>(proto_config);
   }
@@ -62,7 +62,7 @@ class ConfigImpl : public Config,
                    public ThriftFilters::FilterChainFactory,
                    Logger::Loggable<Logger::Id::config> {
 public:
-  ConfigImpl(const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy& config,
+  ConfigImpl(const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy& config,
              Server::Configuration::FactoryContext& context);
 
   // ThriftFilters::FilterChainFactory
@@ -83,7 +83,7 @@ class ConfigImpl : public Config,
 
 private:
   void processFilter(
-      const envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftFilter& proto_config);
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftFilter& proto_config);
 
   Server::Configuration::FactoryContext& context_;
   const std::string stats_prefix_;
diff --git a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
index 409d28e400fb..8750bf1b11aa 100644
--- a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
+++ b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
@@ -23,7 +23,7 @@ envoy_cc_library(
         "//source/extensions/filters/network/thrift_proxy:app_exception_lib",
         "//source/extensions/filters/network/thrift_proxy/filters:filter_interface",
         "//source/extensions/filters/network/thrift_proxy/router:router_ratelimit_interface",
-        "@envoy_api//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/thrift/rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -41,6 +41,6 @@ envoy_cc_extension(
         "//source/extensions/filters/common/ratelimit:ratelimit_lib",
         "//source/extensions/filters/network/thrift_proxy/filters:factory_base_lib",
         "//source/extensions/filters/network/thrift_proxy/filters:well_known_names",
-        "@envoy_api//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/thrift/rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.cc b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.cc
index 81531193d3b9..24b6fb74c7a8 100644
--- a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.cc
+++ b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.cc
@@ -3,8 +3,8 @@
 #include <chrono>
 #include <string>
 
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.h"
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.validate.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -21,7 +21,7 @@ using namespace Envoy::Extensions::NetworkFilters;
 
 ThriftProxy::ThriftFilters::FilterFactoryCb
 RateLimitFilterConfig::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit& proto_config,
+    const envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit& proto_config,
     const std::string&, Server::Configuration::FactoryContext& context) {
   ASSERT(!proto_config.domain().empty());
   ConfigSharedPtr config(new Config(proto_config, context.localInfo(), context.scope(),
diff --git a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.h b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.h
index 6c24f46fd20a..a645c3d0d3eb 100644
--- a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.h
+++ b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.h"
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.validate.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.validate.h"
 
 #include "extensions/filters/common/ratelimit/ratelimit.h"
 #include "extensions/filters/network/thrift_proxy/filters/factory_base.h"
@@ -18,14 +18,14 @@ using namespace Envoy::Extensions::NetworkFilters;
  * Config registration for the rate limit filter. @see NamedThriftFilterConfigFactory.
  */
 class RateLimitFilterConfig : public ThriftProxy::ThriftFilters::FactoryBase<
-                                  envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit> {
+                                  envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit> {
 public:
   RateLimitFilterConfig()
       : FactoryBase(ThriftProxy::ThriftFilters::ThriftFilterNames::get().RATE_LIMIT) {}
 
 private:
   ThriftProxy::ThriftFilters::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit& proto_config,
+      const envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit.h b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit.h
index dbc3b480d8c8..ef0c719b791a 100644
--- a/source/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit.h
+++ b/source/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit.h
@@ -4,7 +4,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.h"
 #include "envoy/ratelimit/ratelimit.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -27,7 +27,7 @@ using namespace Envoy::Extensions::NetworkFilters;
  */
 class Config {
 public:
-  Config(const envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit& config,
+  Config(const envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit& config,
          const LocalInfo::LocalInfo& local_info, Stats::Scope& scope, Runtime::Loader& runtime,
          Upstream::ClusterManager& cm)
       : domain_(config.domain()), stage_(config.stage()), local_info_(local_info), scope_(scope),
diff --git a/source/extensions/filters/network/thrift_proxy/router/BUILD b/source/extensions/filters/network/thrift_proxy/router/BUILD
index 76502fffbb7a..ee40e468c3fa 100644
--- a/source/extensions/filters/network/thrift_proxy/router/BUILD
+++ b/source/extensions/filters/network/thrift_proxy/router/BUILD
@@ -68,7 +68,7 @@ envoy_cc_library(
         "//source/extensions/filters/network/thrift_proxy:thrift_object_interface",
         "//source/extensions/filters/network/thrift_proxy:transport_interface",
         "//source/extensions/filters/network/thrift_proxy/filters:filter_interface",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -81,6 +81,6 @@ envoy_cc_library(
         ":router_ratelimit_interface",
         "//source/common/http:header_utility_lib",
         "//source/extensions/filters/network/thrift_proxy:metadata_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/thrift_proxy/router/router_impl.cc b/source/extensions/filters/network/thrift_proxy/router/router_impl.cc
index 606dfa88516d..00ec520de328 100644
--- a/source/extensions/filters/network/thrift_proxy/router/router_impl.cc
+++ b/source/extensions/filters/network/thrift_proxy/router/router_impl.cc
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/route.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/route.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 #include "envoy/upstream/thread_local_cluster.h"
 
@@ -21,7 +21,7 @@ namespace ThriftProxy {
 namespace Router {
 
 RouteEntryImplBase::RouteEntryImplBase(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::Route& route)
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::Route& route)
     : cluster_name_(route.route().cluster()),
       config_headers_(Http::HeaderUtility::buildHeaderDataVector(route.match().headers())),
       rate_limit_policy_(route.route().rate_limits()),
@@ -37,7 +37,8 @@ RouteEntryImplBase::RouteEntryImplBase(
   }
 
   if (route.route().cluster_specifier_case() ==
-      envoy::config::filter::network::thrift_proxy::v2alpha1::RouteAction::kWeightedClusters) {
+      envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteAction::
+          ClusterSpecifierCase::kWeightedClusters) {
 
     total_cluster_weight_ = 0UL;
     for (const auto& cluster : route.route().weighted_clusters().clusters()) {
@@ -78,9 +79,8 @@ bool RouteEntryImplBase::headersMatch(const Http::HeaderMap& headers) const {
 }
 
 RouteEntryImplBase::WeightedClusterEntry::WeightedClusterEntry(
-    const RouteEntryImplBase& parent,
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::WeightedCluster_ClusterWeight&
-        cluster)
+    const RouteEntryImplBase& parent, const envoy::extensions::filters::network::thrift_proxy::
+                                          v3alpha::WeightedCluster::ClusterWeight& cluster)
     : parent_(parent), cluster_name_(cluster.name()),
       cluster_weight_(PROTOBUF_GET_WRAPPED_REQUIRED(cluster, weight)) {
   if (cluster.has_metadata_match()) {
@@ -99,7 +99,7 @@ RouteEntryImplBase::WeightedClusterEntry::WeightedClusterEntry(
 }
 
 MethodNameRouteEntryImpl::MethodNameRouteEntryImpl(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::Route& route)
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::Route& route)
     : RouteEntryImplBase(route), method_name_(route.match().method_name()),
       invert_(route.match().invert()) {
   if (method_name_.empty() && invert_) {
@@ -122,7 +122,7 @@ RouteConstSharedPtr MethodNameRouteEntryImpl::matches(const MessageMetadata& met
 }
 
 ServiceNameRouteEntryImpl::ServiceNameRouteEntryImpl(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::Route& route)
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::Route& route)
     : RouteEntryImplBase(route), invert_(route.match().invert()) {
   const std::string service_name = route.match().service_name();
   if (service_name.empty() && invert_) {
@@ -152,8 +152,8 @@ RouteConstSharedPtr ServiceNameRouteEntryImpl::matches(const MessageMetadata& me
 }
 
 RouteMatcher::RouteMatcher(
-    const envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration& config) {
-  using envoy::config::filter::network::thrift_proxy::v2alpha1::RouteMatch;
+    const envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration& config) {
+  using envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteMatch;
 
   for (const auto& route : config.routes()) {
     switch (route.match().match_specifier_case()) {
diff --git a/source/extensions/filters/network/thrift_proxy/router/router_impl.h b/source/extensions/filters/network/thrift_proxy/router/router_impl.h
index f20ee665abe2..99b3043e6857 100644
--- a/source/extensions/filters/network/thrift_proxy/router/router_impl.h
+++ b/source/extensions/filters/network/thrift_proxy/router/router_impl.h
@@ -4,7 +4,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/route.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/route.pb.h"
 #include "envoy/router/router.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -33,7 +33,8 @@ class RouteEntryImplBase : public RouteEntry,
                            public Route,
                            public std::enable_shared_from_this<RouteEntryImplBase> {
 public:
-  RouteEntryImplBase(const envoy::config::filter::network::thrift_proxy::v2alpha1::Route& route);
+  RouteEntryImplBase(
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::Route& route);
 
   // Router::RouteEntry
   const std::string& clusterName() const override;
@@ -57,10 +58,9 @@ class RouteEntryImplBase : public RouteEntry,
 private:
   class WeightedClusterEntry : public RouteEntry, public Route {
   public:
-    WeightedClusterEntry(
-        const RouteEntryImplBase& parent,
-        const envoy::config::filter::network::thrift_proxy::v2alpha1::WeightedCluster_ClusterWeight&
-            cluster);
+    WeightedClusterEntry(const RouteEntryImplBase& parent,
+                         const envoy::extensions::filters::network::thrift_proxy::v3alpha::
+                             WeightedCluster::ClusterWeight& cluster);
 
     uint64_t clusterWeight() const { return cluster_weight_; }
 
@@ -125,7 +125,7 @@ using RouteEntryImplBaseConstSharedPtr = std::shared_ptr<const RouteEntryImplBas
 class MethodNameRouteEntryImpl : public RouteEntryImplBase {
 public:
   MethodNameRouteEntryImpl(
-      const envoy::config::filter::network::thrift_proxy::v2alpha1::Route& route);
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::Route& route);
 
   const std::string& methodName() const { return method_name_; }
 
@@ -141,7 +141,7 @@ class MethodNameRouteEntryImpl : public RouteEntryImplBase {
 class ServiceNameRouteEntryImpl : public RouteEntryImplBase {
 public:
   ServiceNameRouteEntryImpl(
-      const envoy::config::filter::network::thrift_proxy::v2alpha1::Route& route);
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::Route& route);
 
   const std::string& serviceName() const { return service_name_; }
 
@@ -156,7 +156,8 @@ class ServiceNameRouteEntryImpl : public RouteEntryImplBase {
 
 class RouteMatcher {
 public:
-  RouteMatcher(const envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration&);
+  RouteMatcher(
+      const envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration&);
 
   RouteConstSharedPtr route(const MessageMetadata& metadata, uint64_t random_value) const;
 
diff --git a/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.cc b/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.cc
index 847de6ed4fea..dd31b7b52585 100644
--- a/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.cc
+++ b/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.cc
@@ -1,7 +1,7 @@
 #include "extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.h"
 
-#include "envoy/api/v2/route/route.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/ratelimit/ratelimit.h"
 
 #include "extensions/filters/network/thrift_proxy/router/router.h"
@@ -69,7 +69,7 @@ bool GenericKeyAction::populateDescriptor(const RouteEntry&, RateLimit::Descript
 }
 
 HeaderValueMatchAction::HeaderValueMatchAction(
-    const envoy::api::v2::route::RateLimit::Action::HeaderValueMatch& action)
+    const envoy::config::route::v3alpha::RateLimit::Action::HeaderValueMatch& action)
     : descriptor_value_(action.descriptor_value()),
       expect_match_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(action, expect_match, true)),
       action_headers_(Http::HeaderUtility::buildHeaderDataVector(action.headers())) {}
@@ -86,27 +86,28 @@ bool HeaderValueMatchAction::populateDescriptor(const RouteEntry&,
   }
 }
 
-RateLimitPolicyEntryImpl::RateLimitPolicyEntryImpl(const envoy::api::v2::route::RateLimit& config)
+RateLimitPolicyEntryImpl::RateLimitPolicyEntryImpl(
+    const envoy::config::route::v3alpha::RateLimit& config)
     : disable_key_(config.disable_key()),
       stage_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, stage, 0)) {
   for (const auto& action : config.actions()) {
     switch (action.action_specifier_case()) {
-    case envoy::api::v2::route::RateLimit::Action::kSourceCluster:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kSourceCluster:
       actions_.emplace_back(new SourceClusterAction());
       break;
-    case envoy::api::v2::route::RateLimit::Action::kDestinationCluster:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kDestinationCluster:
       actions_.emplace_back(new DestinationClusterAction());
       break;
-    case envoy::api::v2::route::RateLimit::Action::kRequestHeaders:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kRequestHeaders:
       actions_.emplace_back(new RequestHeadersAction(action.request_headers()));
       break;
-    case envoy::api::v2::route::RateLimit::Action::kRemoteAddress:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kRemoteAddress:
       actions_.emplace_back(new RemoteAddressAction());
       break;
-    case envoy::api::v2::route::RateLimit::Action::kGenericKey:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kGenericKey:
       actions_.emplace_back(new GenericKeyAction(action.generic_key()));
       break;
-    case envoy::api::v2::route::RateLimit::Action::kHeaderValueMatch:
+    case envoy::config::route::v3alpha::RateLimit::Action::ActionSpecifierCase::kHeaderValueMatch:
       actions_.emplace_back(new HeaderValueMatchAction(action.header_value_match()));
       break;
     default:
@@ -136,7 +137,7 @@ void RateLimitPolicyEntryImpl::populateDescriptors(
 }
 
 RateLimitPolicyImpl::RateLimitPolicyImpl(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::route::RateLimit>& rate_limits)
+    const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RateLimit>& rate_limits)
     : rate_limit_entries_reference_(RateLimitPolicyImpl::MAX_STAGE_NUMBER + 1) {
   for (const auto& rate_limit : rate_limits) {
     std::unique_ptr<RateLimitPolicyEntry> rate_limit_policy_entry(
diff --git a/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.h b/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.h
index 976456ec2069..05c762eb6e78 100644
--- a/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.h
+++ b/source/extensions/filters/network/thrift_proxy/router/router_ratelimit_impl.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/http/header_utility.h"
 
@@ -46,7 +46,8 @@ class DestinationClusterAction : public RateLimitAction {
  */
 class RequestHeadersAction : public RateLimitAction {
 public:
-  RequestHeadersAction(const envoy::api::v2::route::RateLimit::Action::RequestHeaders& action)
+  RequestHeadersAction(
+      const envoy::config::route::v3alpha::RateLimit::Action::RequestHeaders& action)
       : header_name_(action.header_name()), descriptor_key_(action.descriptor_key()),
         use_method_name_(header_name_ == Headers::get().MethodName) {}
 
@@ -77,7 +78,7 @@ class RemoteAddressAction : public RateLimitAction {
  */
 class GenericKeyAction : public RateLimitAction {
 public:
-  GenericKeyAction(const envoy::api::v2::route::RateLimit::Action::GenericKey& action)
+  GenericKeyAction(const envoy::config::route::v3alpha::RateLimit::Action::GenericKey& action)
       : descriptor_value_(action.descriptor_value()) {}
 
   // Router::RateLimitAction
@@ -94,7 +95,8 @@ class GenericKeyAction : public RateLimitAction {
  */
 class HeaderValueMatchAction : public RateLimitAction {
 public:
-  HeaderValueMatchAction(const envoy::api::v2::route::RateLimit::Action::HeaderValueMatch& action);
+  HeaderValueMatchAction(
+      const envoy::config::route::v3alpha::RateLimit::Action::HeaderValueMatch& action);
 
   // Router::RateLimitAction
   bool populateDescriptor(const Router::RouteEntry& route, RateLimit::Descriptor& descriptor,
@@ -112,7 +114,7 @@ class HeaderValueMatchAction : public RateLimitAction {
  */
 class RateLimitPolicyEntryImpl : public RateLimitPolicyEntry {
 public:
-  RateLimitPolicyEntryImpl(const envoy::api::v2::route::RateLimit& config);
+  RateLimitPolicyEntryImpl(const envoy::config::route::v3alpha::RateLimit& config);
 
   // Router::RateLimitPolicyEntry
   uint32_t stage() const override { return stage_; }
@@ -135,7 +137,7 @@ class RateLimitPolicyEntryImpl : public RateLimitPolicyEntry {
 class RateLimitPolicyImpl : public RateLimitPolicy {
 public:
   RateLimitPolicyImpl(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::route::RateLimit>& rate_limits);
+      const Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RateLimit>& rate_limits);
 
   // Router::RateLimitPolicy
   const std::vector<std::reference_wrapper<const RateLimitPolicyEntry>>&
diff --git a/source/extensions/filters/network/zookeeper_proxy/BUILD b/source/extensions/filters/network/zookeeper_proxy/BUILD
index 5bc50bfaa8a3..2a6c0a66a0a7 100644
--- a/source/extensions/filters/network/zookeeper_proxy/BUILD
+++ b/source/extensions/filters/network/zookeeper_proxy/BUILD
@@ -35,7 +35,7 @@ envoy_cc_library(
         "//source/common/stats:symbol_table_lib",
         "//source/common/stats:utility_lib",
         "//source/extensions/filters/network:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -49,6 +49,6 @@ envoy_cc_extension(
         ":proxy_lib",
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/common:factory_base_lib",
-        "@envoy_api//envoy/config/filter/network/zookeeper_proxy/v1alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/zookeeper_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/network/zookeeper_proxy/config.cc b/source/extensions/filters/network/zookeeper_proxy/config.cc
index ef3d5be585a3..e45d2dbfc080 100644
--- a/source/extensions/filters/network/zookeeper_proxy/config.cc
+++ b/source/extensions/filters/network/zookeeper_proxy/config.cc
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.pb.h"
-#include "envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/zookeeper_proxy/v3alpha/zookeeper_proxy.pb.h"
+#include "envoy/extensions/filters/network/zookeeper_proxy/v3alpha/zookeeper_proxy.pb.validate.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 
@@ -20,7 +20,8 @@ namespace ZooKeeperProxy {
  * Config registration for the ZooKeeper proxy filter. @see NamedNetworkFilterConfigFactory.
  */
 Network::FilterFactoryCb ZooKeeperConfigFactory::createFilterFactoryFromProtoTyped(
-    const envoy::config::filter::network::zookeeper_proxy::v1alpha1::ZooKeeperProxy& proto_config,
+    const envoy::extensions::filters::network::zookeeper_proxy::v3alpha::ZooKeeperProxy&
+        proto_config,
     Server::Configuration::FactoryContext& context) {
 
   ASSERT(!proto_config.stat_prefix().empty());
diff --git a/source/extensions/filters/network/zookeeper_proxy/config.h b/source/extensions/filters/network/zookeeper_proxy/config.h
index 1d813a15ef3c..14d5e75cc13c 100644
--- a/source/extensions/filters/network/zookeeper_proxy/config.h
+++ b/source/extensions/filters/network/zookeeper_proxy/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.pb.h"
-#include "envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/zookeeper_proxy/v3alpha/zookeeper_proxy.pb.h"
+#include "envoy/extensions/filters/network/zookeeper_proxy/v3alpha/zookeeper_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 #include "extensions/filters/network/well_known_names.h"
@@ -17,13 +17,14 @@ namespace ZooKeeperProxy {
  */
 class ZooKeeperConfigFactory
     : public Common::FactoryBase<
-          envoy::config::filter::network::zookeeper_proxy::v1alpha1::ZooKeeperProxy> {
+          envoy::extensions::filters::network::zookeeper_proxy::v3alpha::ZooKeeperProxy> {
 public:
   ZooKeeperConfigFactory() : FactoryBase(NetworkFilterNames::get().ZooKeeperProxy) {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::zookeeper_proxy::v1alpha1::ZooKeeperProxy& proto_config,
+      const envoy::extensions::filters::network::zookeeper_proxy::v3alpha::ZooKeeperProxy&
+          proto_config,
       Server::Configuration::FactoryContext& context) override;
 };
 
diff --git a/source/extensions/filters/network/zookeeper_proxy/filter.cc b/source/extensions/filters/network/zookeeper_proxy/filter.cc
index 277d445085a7..51bbdaf9cb89 100644
--- a/source/extensions/filters/network/zookeeper_proxy/filter.cc
+++ b/source/extensions/filters/network/zookeeper_proxy/filter.cc
@@ -3,7 +3,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/assert.h"
@@ -98,7 +98,7 @@ void ZooKeeperFilter::setDynamicMetadata(const std::string& key, const std::stri
 }
 
 void ZooKeeperFilter::clearDynamicMetadata() {
-  envoy::api::v2::core::Metadata& dynamic_metadata =
+  envoy::config::core::v3alpha::Metadata& dynamic_metadata =
       read_callbacks_->connection().streamInfo().dynamicMetadata();
   auto& metadata =
       (*dynamic_metadata.mutable_filter_metadata())[NetworkFilterNames::get().ZooKeeperProxy];
@@ -107,7 +107,7 @@ void ZooKeeperFilter::clearDynamicMetadata() {
 
 void ZooKeeperFilter::setDynamicMetadata(
     const std::vector<std::pair<const std::string, const std::string>>& data) {
-  envoy::api::v2::core::Metadata& dynamic_metadata =
+  envoy::config::core::v3alpha::Metadata& dynamic_metadata =
       read_callbacks_->connection().streamInfo().dynamicMetadata();
   ProtobufWkt::Struct metadata(
       (*dynamic_metadata.mutable_filter_metadata())[NetworkFilterNames::get().ZooKeeperProxy]);
diff --git a/source/extensions/filters/udp/udp_proxy/config.cc b/source/extensions/filters/udp/udp_proxy/config.cc
index 38bd4aec6e6b..43324d8ced9a 100644
--- a/source/extensions/filters/udp/udp_proxy/config.cc
+++ b/source/extensions/filters/udp/udp_proxy/config.cc
@@ -1,7 +1,5 @@
 #include "extensions/filters/udp/udp_proxy/config.h"
 
-#include "envoy/config/filter/udp/udp_proxy/v2alpha/udp_proxy.pb.validate.h"
-
 namespace Envoy {
 namespace Extensions {
 namespace UdpFilters {
diff --git a/source/extensions/grpc_credentials/aws_iam/BUILD b/source/extensions/grpc_credentials/aws_iam/BUILD
index 89f6b2b3806d..a88900fd8415 100644
--- a/source/extensions/grpc_credentials/aws_iam/BUILD
+++ b/source/extensions/grpc_credentials/aws_iam/BUILD
@@ -30,7 +30,7 @@ envoy_cc_extension(
         "//source/extensions/filters/http/common/aws:signer_impl_lib",
         "//source/extensions/filters/http/common/aws:utility_lib",
         "//source/extensions/grpc_credentials:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/grpc_credential/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/grpc_credential/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/grpc_credentials/aws_iam/config.cc b/source/extensions/grpc_credentials/aws_iam/config.cc
index dbc637ce2126..de2b8f726e61 100644
--- a/source/extensions/grpc_credentials/aws_iam/config.cc
+++ b/source/extensions/grpc_credentials/aws_iam/config.cc
@@ -1,9 +1,9 @@
 #include "extensions/grpc_credentials/aws_iam/config.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
 #include "envoy/common/exception.h"
-#include "envoy/config/grpc_credential/v2alpha/aws_iam.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/aws_iam.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/aws_iam.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/aws_iam.pb.validate.h"
 #include "envoy/grpc/google_grpc_creds.h"
 #include "envoy/registry/registry.h"
 
@@ -23,7 +23,7 @@ namespace GrpcCredentials {
 namespace AwsIam {
 
 std::shared_ptr<grpc::ChannelCredentials> AwsIamGrpcCredentialsFactory::getChannelCredentials(
-    const envoy::api::v2::core::GrpcService& grpc_service_config, Api::Api& api) {
+    const envoy::config::core::v3alpha::GrpcService& grpc_service_config, Api::Api& api) {
 
   const auto& google_grpc = grpc_service_config.google_grpc();
   std::shared_ptr<grpc::ChannelCredentials> creds =
@@ -32,7 +32,8 @@ std::shared_ptr<grpc::ChannelCredentials> AwsIamGrpcCredentialsFactory::getChann
   std::shared_ptr<grpc::CallCredentials> call_creds;
   for (const auto& credential : google_grpc.call_credentials()) {
     switch (credential.credential_specifier_case()) {
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kFromPlugin: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kFromPlugin: {
       if (credential.from_plugin().name() == GrpcCredentialsNames::get().AwsIam) {
         AwsIamGrpcCredentialsFactory credentials_factory;
         // We don't deal with validation failures here at runtime today, see
@@ -42,7 +43,7 @@ std::shared_ptr<grpc::ChannelCredentials> AwsIamGrpcCredentialsFactory::getChann
                 credential.from_plugin(), ProtobufMessage::getNullValidationVisitor(),
                 credentials_factory);
         const auto& config = Envoy::MessageUtil::downcastAndValidate<
-            const envoy::config::grpc_credential::v2alpha::AwsIamConfig&>(
+            const envoy::config::grpc_credential::v3alpha::AwsIamConfig&>(
             *config_message, ProtobufMessage::getNullValidationVisitor());
         auto credentials_provider =
             std::make_shared<HttpFilters::Common::Aws::DefaultCredentialsProviderChain>(
@@ -73,7 +74,7 @@ std::shared_ptr<grpc::ChannelCredentials> AwsIamGrpcCredentialsFactory::getChann
 }
 
 std::string AwsIamGrpcCredentialsFactory::getRegion(
-    const envoy::config::grpc_credential::v2alpha::AwsIamConfig& config) {
+    const envoy::config::grpc_credential::v3alpha::AwsIamConfig& config) {
   std::unique_ptr<HttpFilters::Common::Aws::RegionProvider> region_provider;
   if (!config.region().empty()) {
     region_provider =
diff --git a/source/extensions/grpc_credentials/aws_iam/config.h b/source/extensions/grpc_credentials/aws_iam/config.h
index 68eae7fb9a89..2ab90963ba78 100644
--- a/source/extensions/grpc_credentials/aws_iam/config.h
+++ b/source/extensions/grpc_credentials/aws_iam/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/aws_iam.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/aws_iam.pb.h"
 #include "envoy/grpc/google_grpc_creds.h"
 #include "envoy/http/header_map.h"
 
@@ -21,17 +21,17 @@ namespace AwsIam {
 class AwsIamGrpcCredentialsFactory : public Grpc::GoogleGrpcCredentialsFactory {
 public:
   std::shared_ptr<grpc::ChannelCredentials>
-  getChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  getChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                         Api::Api& api) override;
 
   Envoy::ProtobufTypes::MessagePtr createEmptyConfigProto() {
-    return std::make_unique<envoy::config::grpc_credential::v2alpha::AwsIamConfig>();
+    return std::make_unique<envoy::config::grpc_credential::v3alpha::AwsIamConfig>();
   }
 
   std::string name() const override { return GrpcCredentialsNames::get().AwsIam; }
 
 private:
-  static std::string getRegion(const envoy::config::grpc_credential::v2alpha::AwsIamConfig& config);
+  static std::string getRegion(const envoy::config::grpc_credential::v3alpha::AwsIamConfig& config);
 };
 
 /**
diff --git a/source/extensions/grpc_credentials/example/BUILD b/source/extensions/grpc_credentials/example/BUILD
index e5a68789e53e..fbd870fe88a9 100644
--- a/source/extensions/grpc_credentials/example/BUILD
+++ b/source/extensions/grpc_credentials/example/BUILD
@@ -21,6 +21,6 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/common/grpc:google_grpc_creds_lib",
         "//source/extensions/grpc_credentials:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/grpc_credentials/example/config.cc b/source/extensions/grpc_credentials/example/config.cc
index 5f252bc0c82d..0d3f36a3138b 100644
--- a/source/extensions/grpc_credentials/example/config.cc
+++ b/source/extensions/grpc_credentials/example/config.cc
@@ -1,6 +1,6 @@
 #include "extensions/grpc_credentials/example/config.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/google_grpc_creds.h"
 #include "envoy/registry/registry.h"
 
@@ -13,14 +13,15 @@ namespace Example {
 
 std::shared_ptr<grpc::ChannelCredentials>
 AccessTokenExampleGrpcCredentialsFactory::getChannelCredentials(
-    const envoy::api::v2::core::GrpcService& grpc_service_config, Api::Api& api) {
+    const envoy::config::core::v3alpha::GrpcService& grpc_service_config, Api::Api& api) {
   const auto& google_grpc = grpc_service_config.google_grpc();
   std::shared_ptr<grpc::ChannelCredentials> creds =
       Grpc::CredsUtility::defaultSslChannelCredentials(grpc_service_config, api);
   std::shared_ptr<grpc::CallCredentials> call_creds = nullptr;
   for (const auto& credential : google_grpc.call_credentials()) {
     switch (credential.credential_specifier_case()) {
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kAccessToken: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kAccessToken: {
       if (!credential.access_token().empty()) {
         std::shared_ptr<grpc::CallCredentials> new_call_creds = grpc::MetadataCredentialsFromPlugin(
             std::make_unique<StaticHeaderAuthenticator>(credential.access_token()));
diff --git a/source/extensions/grpc_credentials/example/config.h b/source/extensions/grpc_credentials/example/config.h
index 17d3cf6da001..2d01c86e015b 100644
--- a/source/extensions/grpc_credentials/example/config.h
+++ b/source/extensions/grpc_credentials/example/config.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/google_grpc_creds.h"
 
 #include "extensions/grpc_credentials/well_known_names.h"
@@ -29,7 +29,7 @@ namespace Example {
 class AccessTokenExampleGrpcCredentialsFactory : public Grpc::GoogleGrpcCredentialsFactory {
 public:
   std::shared_ptr<grpc::ChannelCredentials>
-  getChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  getChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                         Api::Api& api) override;
 
   std::string name() const override { return GrpcCredentialsNames::get().AccessTokenExample; }
diff --git a/source/extensions/grpc_credentials/file_based_metadata/BUILD b/source/extensions/grpc_credentials/file_based_metadata/BUILD
index 814508881338..37bce01ee1a8 100644
--- a/source/extensions/grpc_credentials/file_based_metadata/BUILD
+++ b/source/extensions/grpc_credentials/file_based_metadata/BUILD
@@ -24,7 +24,7 @@ envoy_cc_extension(
         "//source/common/grpc:common_lib",
         "//source/common/grpc:google_grpc_creds_lib",
         "//source/extensions/grpc_credentials:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/grpc_credential/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/grpc_credential/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/grpc_credentials/file_based_metadata/config.cc b/source/extensions/grpc_credentials/file_based_metadata/config.cc
index b697b2ffb795..787979aaa7cd 100644
--- a/source/extensions/grpc_credentials/file_based_metadata/config.cc
+++ b/source/extensions/grpc_credentials/file_based_metadata/config.cc
@@ -1,8 +1,8 @@
 #include "extensions/grpc_credentials/file_based_metadata/config.h"
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/file_based_metadata.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/file_based_metadata.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/file_based_metadata.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/file_based_metadata.pb.validate.h"
 #include "envoy/grpc/google_grpc_creds.h"
 #include "envoy/registry/registry.h"
 
@@ -19,14 +19,15 @@ namespace FileBasedMetadata {
 
 std::shared_ptr<grpc::ChannelCredentials>
 FileBasedMetadataGrpcCredentialsFactory::getChannelCredentials(
-    const envoy::api::v2::core::GrpcService& grpc_service_config, Api::Api& api) {
+    const envoy::config::core::v3alpha::GrpcService& grpc_service_config, Api::Api& api) {
   const auto& google_grpc = grpc_service_config.google_grpc();
   std::shared_ptr<grpc::ChannelCredentials> creds =
       Grpc::CredsUtility::defaultSslChannelCredentials(grpc_service_config, api);
   std::shared_ptr<grpc::CallCredentials> call_creds = nullptr;
   for (const auto& credential : google_grpc.call_credentials()) {
     switch (credential.credential_specifier_case()) {
-    case envoy::api::v2::core::GrpcService::GoogleGrpc::CallCredentials::kFromPlugin: {
+    case envoy::config::core::v3alpha::GrpcService::GoogleGrpc::CallCredentials::
+        CredentialSpecifierCase::kFromPlugin: {
       if (credential.from_plugin().name() == GrpcCredentialsNames::get().FileBasedMetadata) {
         FileBasedMetadataGrpcCredentialsFactory file_based_metadata_credentials_factory;
         // We don't deal with validation failures here at runtime today, see
@@ -36,7 +37,7 @@ FileBasedMetadataGrpcCredentialsFactory::getChannelCredentials(
                 credential.from_plugin(), ProtobufMessage::getNullValidationVisitor(),
                 file_based_metadata_credentials_factory);
         const auto& file_based_metadata_config = Envoy::MessageUtil::downcastAndValidate<
-            const envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig&>(
+            const envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig&>(
             *file_based_metadata_config_message, ProtobufMessage::getNullValidationVisitor());
         std::shared_ptr<grpc::CallCredentials> new_call_creds = grpc::MetadataCredentialsFromPlugin(
             std::make_unique<FileBasedMetadataAuthenticator>(file_based_metadata_config, api));
diff --git a/source/extensions/grpc_credentials/file_based_metadata/config.h b/source/extensions/grpc_credentials/file_based_metadata/config.h
index 18dd7cba48ba..682f09592fb4 100644
--- a/source/extensions/grpc_credentials/file_based_metadata/config.h
+++ b/source/extensions/grpc_credentials/file_based_metadata/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/file_based_metadata.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/file_based_metadata.pb.h"
 #include "envoy/grpc/google_grpc_creds.h"
 
 #include "common/protobuf/protobuf.h"
@@ -25,11 +25,11 @@ namespace FileBasedMetadata {
 class FileBasedMetadataGrpcCredentialsFactory : public Grpc::GoogleGrpcCredentialsFactory {
 public:
   std::shared_ptr<grpc::ChannelCredentials>
-  getChannelCredentials(const envoy::api::v2::core::GrpcService& grpc_service_config,
+  getChannelCredentials(const envoy::config::core::v3alpha::GrpcService& grpc_service_config,
                         Api::Api& api) override;
 
   Envoy::ProtobufTypes::MessagePtr createEmptyConfigProto() {
-    return std::make_unique<envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig>();
+    return std::make_unique<envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig>();
   }
 
   std::string name() const override { return GrpcCredentialsNames::get().FileBasedMetadata; }
@@ -38,14 +38,14 @@ class FileBasedMetadataGrpcCredentialsFactory : public Grpc::GoogleGrpcCredentia
 class FileBasedMetadataAuthenticator : public grpc::MetadataCredentialsPlugin {
 public:
   FileBasedMetadataAuthenticator(
-      const envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig& config, Api::Api& api)
+      const envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig& config, Api::Api& api)
       : config_(config), api_(api) {}
 
   grpc::Status GetMetadata(grpc::string_ref, grpc::string_ref, const grpc::AuthContext&,
                            std::multimap<grpc::string, grpc::string>* metadata) override;
 
 private:
-  const envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig config_;
+  const envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig config_;
   Api::Api& api_;
 };
 
diff --git a/source/extensions/health_checkers/redis/BUILD b/source/extensions/health_checkers/redis/BUILD
index b2bd340e5203..970628fa5ad4 100644
--- a/source/extensions/health_checkers/redis/BUILD
+++ b/source/extensions/health_checkers/redis/BUILD
@@ -20,10 +20,10 @@ envoy_cc_library(
         "//source/extensions/filters/network/common/redis:client_lib",
         "//source/extensions/filters/network/redis_proxy:config",
         "//source/extensions/filters/network/redis_proxy:conn_pool_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/health_checker/redis/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/core/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,9 +39,8 @@ envoy_cc_extension(
         "//include/envoy/server:health_checker_config_interface",
         "//source/common/common:assert_lib",
         "//source/extensions/health_checkers:well_known_names",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/health_checker/redis/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -51,7 +50,7 @@ envoy_cc_library(
     deps = [
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/health_checker/redis/v2:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/health_checkers/redis/config.cc b/source/extensions/health_checkers/redis/config.cc
index 7d8ce8b653ad..49839e720c82 100644
--- a/source/extensions/health_checkers/redis/config.cc
+++ b/source/extensions/health_checkers/redis/config.cc
@@ -1,8 +1,8 @@
 #include "extensions/health_checkers/redis/config.h"
 
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
-#include "envoy/config/health_checker/redis/v2/redis.pb.validate.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/config/utility.h"
@@ -15,7 +15,7 @@ namespace HealthCheckers {
 namespace RedisHealthChecker {
 
 Upstream::HealthCheckerSharedPtr RedisHealthCheckerFactory::createCustomHealthChecker(
-    const envoy::api::v2::core::HealthCheck& config,
+    const envoy::config::core::v3alpha::HealthCheck& config,
     Server::Configuration::HealthCheckerFactoryContext& context) {
   return std::make_shared<RedisHealthChecker>(
       context.cluster(), config,
diff --git a/source/extensions/health_checkers/redis/config.h b/source/extensions/health_checkers/redis/config.h
index ab324e5e52a9..3b255939d9db 100644
--- a/source/extensions/health_checkers/redis/config.h
+++ b/source/extensions/health_checkers/redis/config.h
@@ -1,7 +1,8 @@
 #pragma once
 
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 #include "envoy/server/health_checker_config.h"
 
 #include "extensions/health_checkers/redis/redis.h"
@@ -18,7 +19,7 @@ namespace RedisHealthChecker {
 class RedisHealthCheckerFactory : public Server::Configuration::CustomHealthCheckerFactory {
 public:
   Upstream::HealthCheckerSharedPtr
-  createCustomHealthChecker(const envoy::api::v2::core::HealthCheck& config,
+  createCustomHealthChecker(const envoy::config::core::v3alpha::HealthCheck& config,
                             Server::Configuration::HealthCheckerFactoryContext& context) override;
 
   std::string name() override { return HealthCheckerNames::get().RedisHealthChecker; }
diff --git a/source/extensions/health_checkers/redis/redis.cc b/source/extensions/health_checkers/redis/redis.cc
index 1d7506a99dbe..66a96ef34f7b 100644
--- a/source/extensions/health_checkers/redis/redis.cc
+++ b/source/extensions/health_checkers/redis/redis.cc
@@ -1,9 +1,10 @@
 #include "extensions/health_checkers/redis/redis.h"
 
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
 #include "envoy/config/health_checker/redis/v2/redis.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 namespace Envoy {
 namespace Extensions {
@@ -11,7 +12,7 @@ namespace HealthCheckers {
 namespace RedisHealthChecker {
 
 RedisHealthChecker::RedisHealthChecker(
-    const Upstream::Cluster& cluster, const envoy::api::v2::core::HealthCheck& config,
+    const Upstream::Cluster& cluster, const envoy::config::core::v3alpha::HealthCheck& config,
     const envoy::config::health_checker::redis::v2::Redis& redis_config,
     Event::Dispatcher& dispatcher, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
     Upstream::HealthCheckEventLoggerPtr&& event_logger, Api::Api& api,
@@ -92,7 +93,7 @@ void RedisHealthChecker::RedisActiveHealthCheckSession::onResponse(
         value->asInteger() == 0) {
       handleSuccess();
     } else {
-      handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::ACTIVE);
+      handleFailure(envoy::data::core::v3alpha::ACTIVE);
     }
     break;
   case Type::Ping:
@@ -100,7 +101,7 @@ void RedisHealthChecker::RedisActiveHealthCheckSession::onResponse(
         value->asString() == "PONG") {
       handleSuccess();
     } else {
-      handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::ACTIVE);
+      handleFailure(envoy::data::core::v3alpha::ACTIVE);
     }
     break;
   default:
@@ -114,7 +115,7 @@ void RedisHealthChecker::RedisActiveHealthCheckSession::onResponse(
 
 void RedisHealthChecker::RedisActiveHealthCheckSession::onFailure() {
   current_request_ = nullptr;
-  handleFailure(envoy::data::core::v2alpha::HealthCheckFailureType::NETWORK);
+  handleFailure(envoy::data::core::v3alpha::NETWORK);
 }
 
 bool RedisHealthChecker::RedisActiveHealthCheckSession::onRedirection(
diff --git a/source/extensions/health_checkers/redis/redis.h b/source/extensions/health_checkers/redis/redis.h
index b77c66f75eaa..b96fbd6a1e99 100644
--- a/source/extensions/health_checkers/redis/redis.h
+++ b/source/extensions/health_checkers/redis/redis.h
@@ -3,10 +3,11 @@
 #include <chrono>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
 #include "envoy/config/health_checker/redis/v2/redis.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "common/upstream/health_checker_base_impl.h"
 
@@ -25,7 +26,7 @@ namespace RedisHealthChecker {
 class RedisHealthChecker : public Upstream::HealthCheckerImplBase {
 public:
   RedisHealthChecker(
-      const Upstream::Cluster& cluster, const envoy::api::v2::core::HealthCheck& config,
+      const Upstream::Cluster& cluster, const envoy::config::core::v3alpha::HealthCheck& config,
       const envoy::config::health_checker::redis::v2::Redis& redis_config,
       Event::Dispatcher& dispatcher, Runtime::Loader& runtime, Runtime::RandomGenerator& random,
       Upstream::HealthCheckEventLoggerPtr&& event_logger, Api::Api& api,
@@ -43,8 +44,8 @@ class RedisHealthChecker : public Upstream::HealthCheckerImplBase {
   }
 
 protected:
-  envoy::data::core::v2alpha::HealthCheckerType healthCheckerType() const override {
-    return envoy::data::core::v2alpha::HealthCheckerType::REDIS;
+  envoy::data::core::v3alpha::HealthCheckerType healthCheckerType() const override {
+    return envoy::data::core::v3alpha::REDIS;
   }
 
 private:
diff --git a/source/extensions/health_checkers/redis/utility.h b/source/extensions/health_checkers/redis/utility.h
index 214a7be4b080..76bd89630150 100644
--- a/source/extensions/health_checkers/redis/utility.h
+++ b/source/extensions/health_checkers/redis/utility.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/health_check.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
 #include "envoy/config/health_checker/redis/v2/redis.pb.h"
 #include "envoy/config/health_checker/redis/v2/redis.pb.validate.h"
 
@@ -15,12 +15,13 @@ namespace RedisHealthChecker {
 namespace {
 
 static const envoy::config::health_checker::redis::v2::Redis
-getRedisHealthCheckConfig(const envoy::api::v2::core::HealthCheck& health_check_config,
+getRedisHealthCheckConfig(const envoy::config::core::v3alpha::HealthCheck& health_check_config,
                           ProtobufMessage::ValidationVisitor& validation_visitor) {
   ProtobufTypes::MessagePtr config =
       ProtobufTypes::MessagePtr{new envoy::config::health_checker::redis::v2::Redis()};
-  MessageUtil::jsonConvert(health_check_config.custom_health_check().config(), validation_visitor,
-                           *config);
+  MessageUtil::jsonConvert(
+      health_check_config.custom_health_check().hidden_envoy_deprecated_config(),
+      validation_visitor, *config);
   return MessageUtil::downcastAndValidate<const envoy::config::health_checker::redis::v2::Redis&>(
       *config, validation_visitor);
 }
diff --git a/source/extensions/quic_listeners/quiche/BUILD b/source/extensions/quic_listeners/quiche/BUILD
index 747eadfb8eaf..ec83efa8aa9a 100644
--- a/source/extensions/quic_listeners/quiche/BUILD
+++ b/source/extensions/quic_listeners/quiche/BUILD
@@ -232,7 +232,7 @@ envoy_cc_library(
         ":envoy_quic_packet_writer_lib",
         "//include/envoy/event:dispatcher_interface",
         "//source/common/network:socket_option_factory_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -274,7 +274,7 @@ envoy_cc_library(
         "//source/common/network:listener_lib",
         "//source/common/protobuf:utility_lib",
         "//source/server:connection_handler_lib",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -286,7 +286,7 @@ envoy_cc_library(
     deps = [
         ":active_quic_listener_lib",
         "//include/envoy/registry",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -303,7 +303,7 @@ envoy_cc_library(
         "//source/common/network:listen_socket_lib",
         "//source/common/network:socket_option_factory_lib",
         "@com_googlesource_quiche//:quic_core_http_header_list_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -319,6 +319,6 @@ envoy_cc_library(
         "//source/common/common:assert_lib",
         "//source/extensions/transport_sockets:well_known_names",
         "//source/extensions/transport_sockets/tls:context_config_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/quic_listeners/quiche/active_quic_listener.h b/source/extensions/quic_listeners/quiche/active_quic_listener.h
index 9c5c390712fb..3067c28ae73f 100644
--- a/source/extensions/quic_listeners/quiche/active_quic_listener.h
+++ b/source/extensions/quic_listeners/quiche/active_quic_listener.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/listener/quic_config.pb.h"
+#include "envoy/config/listener/v3alpha/quic_config.pb.h"
 #include "envoy/network/connection_handler.h"
 #include "envoy/network/listener.h"
 
@@ -59,7 +59,7 @@ using ActiveQuicListenerPtr = std::unique_ptr<ActiveQuicListener>;
 // A factory to create ActiveQuicListener based on given config.
 class ActiveQuicListenerFactory : public Network::ActiveUdpListenerFactory {
 public:
-  ActiveQuicListenerFactory(const envoy::api::v2::listener::QuicProtocolOptions& config) {
+  ActiveQuicListenerFactory(const envoy::config::listener::v3alpha::QuicProtocolOptions& config) {
     uint64_t idle_network_timeout_ms =
         config.has_idle_timeout() ? DurationUtil::durationToMilliseconds(config.idle_timeout())
                                   : 300000;
diff --git a/source/extensions/quic_listeners/quiche/active_quic_listener_config.cc b/source/extensions/quic_listeners/quiche/active_quic_listener_config.cc
index 3cdadd8e0ae0..89c0c87de477 100644
--- a/source/extensions/quic_listeners/quiche/active_quic_listener_config.cc
+++ b/source/extensions/quic_listeners/quiche/active_quic_listener_config.cc
@@ -1,6 +1,6 @@
 #include "extensions/quic_listeners/quiche/active_quic_listener_config.h"
 
-#include "envoy/api/v2/listener/quic_config.pb.h"
+#include "envoy/config/listener/v3alpha/quic_config.pb.h"
 
 #include "extensions/quic_listeners/quiche/active_quic_listener.h"
 
@@ -8,12 +8,13 @@ namespace Envoy {
 namespace Quic {
 
 ProtobufTypes::MessagePtr ActiveQuicListenerConfigFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::api::v2::listener::QuicProtocolOptions>();
+  return std::make_unique<envoy::config::listener::v3alpha::QuicProtocolOptions>();
 }
 
 Network::ActiveUdpListenerFactoryPtr
 ActiveQuicListenerConfigFactory::createActiveUdpListenerFactory(const Protobuf::Message& message) {
-  auto& config = dynamic_cast<const envoy::api::v2::listener::QuicProtocolOptions&>(message);
+  auto& config =
+      dynamic_cast<const envoy::config::listener::v3alpha::QuicProtocolOptions&>(message);
   return std::make_unique<ActiveQuicListenerFactory>(config);
 }
 
diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc b/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc
index 87182c456403..beed5f226c30 100644
--- a/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc
+++ b/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc
@@ -1,6 +1,6 @@
 #include "extensions/quic_listeners/quiche/envoy_quic_client_connection.h"
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/listen_socket_impl.h"
 #include "common/network/socket_option_factory.h"
@@ -80,8 +80,9 @@ void EnvoyQuicClientConnection::setUpConnectionSocket() {
         [this](uint32_t events) -> void { onFileEvent(events); }, Event::FileTriggerType::Edge,
         Event::FileReadyType::Read | Event::FileReadyType::Write);
 
-    if (!Network::Socket::applyOptions(connectionSocket()->options(), *connectionSocket(),
-                                       envoy::api::v2::core::SocketOption::STATE_LISTENING)) {
+    if (!Network::Socket::applyOptions(
+            connectionSocket()->options(), *connectionSocket(),
+            envoy::config::core::v3alpha::SocketOption::STATE_LISTENING)) {
       ENVOY_CONN_LOG(error, "Fail to apply listening options", *this);
       connectionSocket()->close();
     }
diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_utils.cc b/source/extensions/quic_listeners/quiche/envoy_quic_utils.cc
index 9cdab048c9cf..d46862067555 100644
--- a/source/extensions/quic_listeners/quiche/envoy_quic_utils.cc
+++ b/source/extensions/quic_listeners/quiche/envoy_quic_utils.cc
@@ -1,7 +1,7 @@
 #include "extensions/quic_listeners/quiche/envoy_quic_utils.h"
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/socket_option_factory.h"
 
@@ -123,7 +123,7 @@ createConnectionSocket(Network::Address::InstanceConstSharedPtr& peer_addr,
     connection_socket->addOptions(options);
   }
   if (!Network::Socket::applyOptions(connection_socket->options(), *connection_socket,
-                                     envoy::api::v2::core::SocketOption::STATE_PREBIND)) {
+                                     envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)) {
     connection_socket->close();
     ENVOY_LOG_MISC(error, "Fail to apply pre-bind options");
     return connection_socket;
@@ -135,7 +135,7 @@ createConnectionSocket(Network::Address::InstanceConstSharedPtr& peer_addr,
     local_addr = Network::Address::addressFromFd(connection_socket->ioHandle().fd());
   }
   if (!Network::Socket::applyOptions(connection_socket->options(), *connection_socket,
-                                     envoy::api::v2::core::SocketOption::STATE_BOUND)) {
+                                     envoy::config::core::v3alpha::SocketOption::STATE_BOUND)) {
     ENVOY_LOG_MISC(error, "Fail to apply post-bind options");
     connection_socket->close();
   }
diff --git a/source/extensions/quic_listeners/quiche/quic_transport_socket_factory.cc b/source/extensions/quic_listeners/quiche/quic_transport_socket_factory.cc
index 606739e7caeb..57bfec892af2 100644
--- a/source/extensions/quic_listeners/quiche/quic_transport_socket_factory.cc
+++ b/source/extensions/quic_listeners/quiche/quic_transport_socket_factory.cc
@@ -1,7 +1,7 @@
 #include "extensions/quic_listeners/quiche/quic_transport_socket_factory.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/auth/cert.pb.validate.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.validate.h"
 
 #include "extensions/transport_sockets/tls/context_config_impl.h"
 
@@ -13,14 +13,16 @@ QuicServerTransportSocketConfigFactory::createTransportSocketFactory(
     const Protobuf::Message& config, Server::Configuration::TransportSocketFactoryContext& context,
     const std::vector<std::string>& /*server_names*/) {
   auto server_config = std::make_unique<Extensions::TransportSockets::Tls::ServerContextConfigImpl>(
-      MessageUtil::downcastAndValidate<const envoy::api::v2::auth::DownstreamTlsContext&>(
+      MessageUtil::downcastAndValidate<
+          const envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext&>(
           config, context.messageValidationVisitor()),
       context);
   return std::make_unique<QuicServerTransportSocketFactory>(std::move(server_config));
 }
 
 ProtobufTypes::MessagePtr QuicServerTransportSocketConfigFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::api::v2::auth::DownstreamTlsContext>();
+  return std::make_unique<
+      envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext>();
 }
 
 Network::TransportSocketFactoryPtr
@@ -28,14 +30,15 @@ QuicClientTransportSocketConfigFactory::createTransportSocketFactory(
     const Protobuf::Message& config,
     Server::Configuration::TransportSocketFactoryContext& context) {
   auto client_config = std::make_unique<Extensions::TransportSockets::Tls::ClientContextConfigImpl>(
-      MessageUtil::downcastAndValidate<const envoy::api::v2::auth::UpstreamTlsContext&>(
+      MessageUtil::downcastAndValidate<
+          const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext&>(
           config, context.messageValidationVisitor()),
       context);
   return std::make_unique<QuicClientTransportSocketFactory>(std::move(client_config));
 }
 
 ProtobufTypes::MessagePtr QuicClientTransportSocketConfigFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::api::v2::auth::UpstreamTlsContext>();
+  return std::make_unique<envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext>();
 }
 
 REGISTER_FACTORY(QuicServerTransportSocketConfigFactory,
diff --git a/source/extensions/stat_sinks/dog_statsd/BUILD b/source/extensions/stat_sinks/dog_statsd/BUILD
index b64d07e9ddc2..6ae218d5488e 100644
--- a/source/extensions/stat_sinks/dog_statsd/BUILD
+++ b/source/extensions/stat_sinks/dog_statsd/BUILD
@@ -23,6 +23,6 @@ envoy_cc_extension(
         "//source/extensions/stat_sinks:well_known_names",
         "//source/extensions/stat_sinks/common/statsd:statsd_lib",
         "//source/server:configuration_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/stat_sinks/dog_statsd/config.cc b/source/extensions/stat_sinks/dog_statsd/config.cc
index 6b7ce0182bb5..896b043cd090 100644
--- a/source/extensions/stat_sinks/dog_statsd/config.cc
+++ b/source/extensions/stat_sinks/dog_statsd/config.cc
@@ -2,8 +2,8 @@
 
 #include <memory>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.validate.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/network/resolver_impl.h"
@@ -19,7 +19,7 @@ namespace DogStatsd {
 Stats::SinkPtr DogStatsdSinkFactory::createStatsSink(const Protobuf::Message& config,
                                                      Server::Instance& server) {
   const auto& sink_config =
-      MessageUtil::downcastAndValidate<const envoy::config::metrics::v2::DogStatsdSink&>(
+      MessageUtil::downcastAndValidate<const envoy::config::metrics::v3alpha::DogStatsdSink&>(
           config, server.messageValidationContext().staticValidationVisitor());
   Network::Address::InstanceConstSharedPtr address =
       Network::Address::resolveProtoAddress(sink_config.address());
@@ -29,7 +29,7 @@ Stats::SinkPtr DogStatsdSinkFactory::createStatsSink(const Protobuf::Message& co
 }
 
 ProtobufTypes::MessagePtr DogStatsdSinkFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::metrics::v2::DogStatsdSink>();
+  return std::make_unique<envoy::config::metrics::v3alpha::DogStatsdSink>();
 }
 
 std::string DogStatsdSinkFactory::name() { return StatsSinkNames::get().DogStatsd; }
diff --git a/source/extensions/stat_sinks/hystrix/BUILD b/source/extensions/stat_sinks/hystrix/BUILD
index eb38015ed6d4..75fdff5da129 100644
--- a/source/extensions/stat_sinks/hystrix/BUILD
+++ b/source/extensions/stat_sinks/hystrix/BUILD
@@ -23,7 +23,7 @@ envoy_cc_extension(
         "//source/extensions/stat_sinks:well_known_names",
         "//source/extensions/stat_sinks/hystrix:hystrix_lib",
         "//source/server:configuration_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/stat_sinks/hystrix/config.cc b/source/extensions/stat_sinks/hystrix/config.cc
index a9fc2d697d60..d9639a40ebe7 100644
--- a/source/extensions/stat_sinks/hystrix/config.cc
+++ b/source/extensions/stat_sinks/hystrix/config.cc
@@ -2,8 +2,8 @@
 
 #include <memory>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.validate.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/network/resolver_impl.h"
@@ -19,13 +19,13 @@ namespace Hystrix {
 Stats::SinkPtr HystrixSinkFactory::createStatsSink(const Protobuf::Message& config,
                                                    Server::Instance& server) {
   const auto& hystrix_sink =
-      MessageUtil::downcastAndValidate<const envoy::config::metrics::v2::HystrixSink&>(
+      MessageUtil::downcastAndValidate<const envoy::config::metrics::v3alpha::HystrixSink&>(
           config, server.messageValidationContext().staticValidationVisitor());
   return std::make_unique<Hystrix::HystrixSink>(server, hystrix_sink.num_buckets());
 }
 
 ProtobufTypes::MessagePtr HystrixSinkFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::metrics::v2::HystrixSink>();
+  return std::make_unique<envoy::config::metrics::v3alpha::HystrixSink>();
 }
 
 std::string HystrixSinkFactory::name() { return StatsSinkNames::get().Hystrix; }
diff --git a/source/extensions/stat_sinks/metrics_service/BUILD b/source/extensions/stat_sinks/metrics_service/BUILD
index ec7c57b5c6d7..dc1ad12ec7e4 100644
--- a/source/extensions/stat_sinks/metrics_service/BUILD
+++ b/source/extensions/stat_sinks/metrics_service/BUILD
@@ -22,7 +22,7 @@ envoy_cc_library(
         "//include/envoy/upstream:cluster_manager_interface",
         "//source/common/common:assert_lib",
         "//source/common/grpc:async_client_lib",
-        "@envoy_api//envoy/service/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -48,6 +48,6 @@ envoy_cc_extension(
         "//source/extensions/stat_sinks/metrics_service:metrics_proto_descriptors_lib",
         "//source/extensions/stat_sinks/metrics_service:metrics_service_grpc_lib",
         "//source/server:configuration_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/stat_sinks/metrics_service/config.cc b/source/extensions/stat_sinks/metrics_service/config.cc
index 80e74ea9925f..414827a7396e 100644
--- a/source/extensions/stat_sinks/metrics_service/config.cc
+++ b/source/extensions/stat_sinks/metrics_service/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/stat_sinks/metrics_service/config.h"
 
-#include "envoy/config/metrics/v2/metrics_service.pb.h"
-#include "envoy/config/metrics/v2/metrics_service.pb.validate.h"
+#include "envoy/config/metrics/v3alpha/metrics_service.pb.h"
+#include "envoy/config/metrics/v3alpha/metrics_service.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/common/assert.h"
@@ -21,9 +21,9 @@ Stats::SinkPtr MetricsServiceSinkFactory::createStatsSink(const Protobuf::Messag
                                                           Server::Instance& server) {
   validateProtoDescriptors();
 
-  const auto& sink_config =
-      MessageUtil::downcastAndValidate<const envoy::config::metrics::v2::MetricsServiceConfig&>(
-          config, server.messageValidationContext().staticValidationVisitor());
+  const auto& sink_config = MessageUtil::downcastAndValidate<
+      const envoy::config::metrics::v3alpha::MetricsServiceConfig&>(
+      config, server.messageValidationContext().staticValidationVisitor());
   const auto& grpc_service = sink_config.grpc_service();
   ENVOY_LOG(debug, "Metrics Service gRPC service configuration: {}", grpc_service.DebugString());
 
@@ -37,8 +37,8 @@ Stats::SinkPtr MetricsServiceSinkFactory::createStatsSink(const Protobuf::Messag
 }
 
 ProtobufTypes::MessagePtr MetricsServiceSinkFactory::createEmptyConfigProto() {
-  return std::unique_ptr<envoy::config::metrics::v2::MetricsServiceConfig>(
-      std::make_unique<envoy::config::metrics::v2::MetricsServiceConfig>());
+  return std::unique_ptr<envoy::config::metrics::v3alpha::MetricsServiceConfig>(
+      std::make_unique<envoy::config::metrics::v3alpha::MetricsServiceConfig>());
 }
 
 std::string MetricsServiceSinkFactory::name() { return StatsSinkNames::get().MetricsService; }
diff --git a/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.cc b/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.cc
index 9986848b1d87..e40b82a60f58 100644
--- a/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.cc
+++ b/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.cc
@@ -2,7 +2,7 @@
 
 #include "envoy/common/exception.h"
 #include "envoy/event/dispatcher.h"
-#include "envoy/service/metrics/v2/metrics_service.pb.h"
+#include "envoy/service/metrics/v3alpha/metrics_service.pb.h"
 #include "envoy/stats/histogram.h"
 #include "envoy/stats/stats.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -20,7 +20,8 @@ GrpcMetricsStreamerImpl::GrpcMetricsStreamerImpl(Grpc::AsyncClientFactoryPtr&& f
                                                  const LocalInfo::LocalInfo& local_info)
     : client_(factory->create()), local_info_(local_info) {}
 
-void GrpcMetricsStreamerImpl::send(envoy::service::metrics::v2::StreamMetricsMessage& message) {
+void GrpcMetricsStreamerImpl::send(
+    envoy::service::metrics::v3alpha::StreamMetricsMessage& message) {
   if (stream_ == nullptr) {
     stream_ = client_->start(*Protobuf::DescriptorPool::generated_pool()->FindMethodByName(
                                  "envoy.service.metrics.v2.MetricsService.StreamMetrics"),
diff --git a/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.h b/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.h
index 2a4854fd6d72..b38ceb2e2e5e 100644
--- a/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.h
+++ b/source/extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.h
@@ -3,7 +3,7 @@
 #include "envoy/grpc/async_client.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/network/connection.h"
-#include "envoy/service/metrics/v2/metrics_service.pb.h"
+#include "envoy/service/metrics/v3alpha/metrics_service.pb.h"
 #include "envoy/singleton/instance.h"
 #include "envoy/stats/histogram.h"
 #include "envoy/stats/sink.h"
@@ -22,7 +22,7 @@ namespace MetricsService {
  * Interface for metrics streamer.
  */
 class GrpcMetricsStreamer
-    : public Grpc::AsyncStreamCallbacks<envoy::service::metrics::v2::StreamMetricsResponse> {
+    : public Grpc::AsyncStreamCallbacks<envoy::service::metrics::v3alpha::StreamMetricsResponse> {
 public:
   ~GrpcMetricsStreamer() override = default;
 
@@ -30,14 +30,13 @@ class GrpcMetricsStreamer
    * Send Metrics Message.
    * @param message supplies the metrics to send.
    */
-  virtual void send(envoy::service::metrics::v2::StreamMetricsMessage& message) PURE;
+  virtual void send(envoy::service::metrics::v3alpha::StreamMetricsMessage& message) PURE;
 
   // Grpc::AsyncStreamCallbacks
   void onCreateInitialMetadata(Http::HeaderMap&) override {}
   void onReceiveInitialMetadata(Http::HeaderMapPtr&&) override {}
-  void
-  onReceiveMessage(std::unique_ptr<envoy::service::metrics::v2::StreamMetricsResponse>&&) override {
-  }
+  void onReceiveMessage(
+      std::unique_ptr<envoy::service::metrics::v3alpha::StreamMetricsResponse>&&) override {}
   void onReceiveTrailingMetadata(Http::HeaderMapPtr&&) override {}
   void onRemoteClose(Grpc::Status::GrpcStatus, const std::string&) override{};
 };
@@ -53,15 +52,15 @@ class GrpcMetricsStreamerImpl : public Singleton::Instance, public GrpcMetricsSt
                           const LocalInfo::LocalInfo& local_info);
 
   // GrpcMetricsStreamer
-  void send(envoy::service::metrics::v2::StreamMetricsMessage& message) override;
+  void send(envoy::service::metrics::v3alpha::StreamMetricsMessage& message) override;
 
   // Grpc::AsyncStreamCallbacks
   void onRemoteClose(Grpc::Status::GrpcStatus, const std::string&) override { stream_ = nullptr; }
 
 private:
-  Grpc::AsyncStream<envoy::service::metrics::v2::StreamMetricsMessage> stream_{};
-  Grpc::AsyncClient<envoy::service::metrics::v2::StreamMetricsMessage,
-                    envoy::service::metrics::v2::StreamMetricsResponse>
+  Grpc::AsyncStream<envoy::service::metrics::v3alpha::StreamMetricsMessage> stream_{};
+  Grpc::AsyncClient<envoy::service::metrics::v3alpha::StreamMetricsMessage,
+                    envoy::service::metrics::v3alpha::StreamMetricsResponse>
       client_;
   const LocalInfo::LocalInfo& local_info_;
 };
@@ -83,7 +82,7 @@ class MetricsServiceSink : public Stats::Sink {
 
 private:
   GrpcMetricsStreamerSharedPtr grpc_metrics_streamer_;
-  envoy::service::metrics::v2::StreamMetricsMessage message_;
+  envoy::service::metrics::v3alpha::StreamMetricsMessage message_;
   TimeSource& time_source_;
 };
 
diff --git a/source/extensions/stat_sinks/statsd/BUILD b/source/extensions/stat_sinks/statsd/BUILD
index de13e0c24530..07776f78cdf9 100644
--- a/source/extensions/stat_sinks/statsd/BUILD
+++ b/source/extensions/stat_sinks/statsd/BUILD
@@ -22,6 +22,6 @@ envoy_cc_extension(
         "//source/extensions/stat_sinks:well_known_names",
         "//source/extensions/stat_sinks/common/statsd:statsd_lib",
         "//source/server:configuration_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/stat_sinks/statsd/config.cc b/source/extensions/stat_sinks/statsd/config.cc
index f7e352e30bd4..fd5beb20a340 100644
--- a/source/extensions/stat_sinks/statsd/config.cc
+++ b/source/extensions/stat_sinks/statsd/config.cc
@@ -2,8 +2,8 @@
 
 #include <memory>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.validate.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/network/resolver_impl.h"
@@ -20,17 +20,17 @@ Stats::SinkPtr StatsdSinkFactory::createStatsSink(const Protobuf::Message& confi
                                                   Server::Instance& server) {
 
   const auto& statsd_sink =
-      MessageUtil::downcastAndValidate<const envoy::config::metrics::v2::StatsdSink&>(
+      MessageUtil::downcastAndValidate<const envoy::config::metrics::v3alpha::StatsdSink&>(
           config, server.messageValidationContext().staticValidationVisitor());
   switch (statsd_sink.statsd_specifier_case()) {
-  case envoy::config::metrics::v2::StatsdSink::kAddress: {
+  case envoy::config::metrics::v3alpha::StatsdSink::StatsdSpecifierCase::kAddress: {
     Network::Address::InstanceConstSharedPtr address =
         Network::Address::resolveProtoAddress(statsd_sink.address());
     ENVOY_LOG(debug, "statsd UDP ip address: {}", address->asString());
     return std::make_unique<Common::Statsd::UdpStatsdSink>(server.threadLocal(), std::move(address),
                                                            false, statsd_sink.prefix());
   }
-  case envoy::config::metrics::v2::StatsdSink::kTcpClusterName:
+  case envoy::config::metrics::v3alpha::StatsdSink::StatsdSpecifierCase::kTcpClusterName:
     ENVOY_LOG(debug, "statsd TCP cluster: {}", statsd_sink.tcp_cluster_name());
     return std::make_unique<Common::Statsd::TcpStatsdSink>(
         server.localInfo(), statsd_sink.tcp_cluster_name(), server.threadLocal(),
@@ -42,7 +42,7 @@ Stats::SinkPtr StatsdSinkFactory::createStatsSink(const Protobuf::Message& confi
 }
 
 ProtobufTypes::MessagePtr StatsdSinkFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::metrics::v2::StatsdSink>();
+  return std::make_unique<envoy::config::metrics::v3alpha::StatsdSink>();
 }
 
 std::string StatsdSinkFactory::name() { return StatsSinkNames::get().Statsd; }
diff --git a/source/extensions/tracers/datadog/BUILD b/source/extensions/tracers/datadog/BUILD
index 50f8c9ab53df..3fe928ef7c21 100644
--- a/source/extensions/tracers/datadog/BUILD
+++ b/source/extensions/tracers/datadog/BUILD
@@ -25,7 +25,7 @@ envoy_cc_library(
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common/ot:opentracing_driver_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -38,6 +38,6 @@ envoy_cc_extension(
         ":datadog_tracer_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common:factory_base_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/tracers/datadog/config.cc b/source/extensions/tracers/datadog/config.cc
index 1fdc623138d6..ce7d57fe3241 100644
--- a/source/extensions/tracers/datadog/config.cc
+++ b/source/extensions/tracers/datadog/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/tracers/datadog/config.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/common/utility.h"
@@ -20,7 +20,7 @@ namespace Datadog {
 DatadogTracerFactory::DatadogTracerFactory() : FactoryBase(TracerNames::get().Datadog) {}
 
 Tracing::HttpTracerPtr DatadogTracerFactory::createHttpTracerTyped(
-    const envoy::config::trace::v2::DatadogConfig& proto_config, Server::Instance& server) {
+    const envoy::config::trace::v3alpha::DatadogConfig& proto_config, Server::Instance& server) {
   Tracing::DriverPtr datadog_driver =
       std::make_unique<Driver>(proto_config, server.clusterManager(), server.stats(),
                                server.threadLocal(), server.runtime());
diff --git a/source/extensions/tracers/datadog/config.h b/source/extensions/tracers/datadog/config.h
index c452039d722c..abfbfb7f5a8d 100644
--- a/source/extensions/tracers/datadog/config.h
+++ b/source/extensions/tracers/datadog/config.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/common/factory_base.h"
 
@@ -15,14 +15,15 @@ namespace Datadog {
 /**
  * Config registration for the Datadog tracer. @see TracerFactory.
  */
-class DatadogTracerFactory : public Common::FactoryBase<envoy::config::trace::v2::DatadogConfig> {
+class DatadogTracerFactory
+    : public Common::FactoryBase<envoy::config::trace::v3alpha::DatadogConfig> {
 public:
   DatadogTracerFactory();
 
 private:
   // FactoryBase
   Tracing::HttpTracerPtr
-  createHttpTracerTyped(const envoy::config::trace::v2::DatadogConfig& proto_config,
+  createHttpTracerTyped(const envoy::config::trace::v3alpha::DatadogConfig& proto_config,
                         Server::Instance& server) override;
 };
 
diff --git a/source/extensions/tracers/datadog/datadog_tracer_impl.cc b/source/extensions/tracers/datadog/datadog_tracer_impl.cc
index 9b893dd5c293..c451b0f728d3 100644
--- a/source/extensions/tracers/datadog/datadog_tracer_impl.cc
+++ b/source/extensions/tracers/datadog/datadog_tracer_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/tracers/datadog/datadog_tracer_impl.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/common/enum_to_int.h"
 #include "common/common/fmt.h"
@@ -21,7 +21,7 @@ Driver::TlsTracer::TlsTracer(const std::shared_ptr<opentracing::Tracer>& tracer,
                              TraceReporterPtr&& reporter, Driver& driver)
     : tracer_(tracer), reporter_(std::move(reporter)), driver_(driver) {}
 
-Driver::Driver(const envoy::config::trace::v2::DatadogConfig& datadog_config,
+Driver::Driver(const envoy::config::trace::v3alpha::DatadogConfig& datadog_config,
                Upstream::ClusterManager& cluster_manager, Stats::Store& stats,
                ThreadLocal::SlotAllocator& tls, Runtime::Loader& runtime)
     : OpenTracingDriver{stats},
diff --git a/source/extensions/tracers/datadog/datadog_tracer_impl.h b/source/extensions/tracers/datadog/datadog_tracer_impl.h
index 538c3cade275..81ca9527359f 100644
--- a/source/extensions/tracers/datadog/datadog_tracer_impl.h
+++ b/source/extensions/tracers/datadog/datadog_tracer_impl.h
@@ -2,7 +2,7 @@
 
 #include <datadog/opentracing.h>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/thread_local/thread_local.h"
@@ -42,7 +42,7 @@ class Driver : public Common::Ot::OpenTracingDriver {
   /**
    * Constructor. It adds itself and a newly-created Datadog::Tracer object to a thread-local store.
    */
-  Driver(const envoy::config::trace::v2::DatadogConfig& datadog_config,
+  Driver(const envoy::config::trace::v3alpha::DatadogConfig& datadog_config,
          Upstream::ClusterManager& cluster_manager, Stats::Store& stats,
          ThreadLocal::SlotAllocator& tls, Runtime::Loader& runtime);
 
diff --git a/source/extensions/tracers/dynamic_ot/BUILD b/source/extensions/tracers/dynamic_ot/BUILD
index c14501cf333a..e14f4d9677a7 100644
--- a/source/extensions/tracers/dynamic_ot/BUILD
+++ b/source/extensions/tracers/dynamic_ot/BUILD
@@ -34,6 +34,6 @@ envoy_cc_extension(
         ":dynamic_opentracing_driver_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common:factory_base_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/tracers/dynamic_ot/config.cc b/source/extensions/tracers/dynamic_ot/config.cc
index 3b67c128e047..78968b0ae792 100644
--- a/source/extensions/tracers/dynamic_ot/config.cc
+++ b/source/extensions/tracers/dynamic_ot/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/tracers/dynamic_ot/config.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/common/utility.h"
@@ -19,7 +19,7 @@ DynamicOpenTracingTracerFactory::DynamicOpenTracingTracerFactory()
     : FactoryBase(TracerNames::get().DynamicOt) {}
 
 Tracing::HttpTracerPtr DynamicOpenTracingTracerFactory::createHttpTracerTyped(
-    const envoy::config::trace::v2::DynamicOtConfig& proto_config, Server::Instance& server) {
+    const envoy::config::trace::v3alpha::DynamicOtConfig& proto_config, Server::Instance& server) {
   const std::string& library = proto_config.library();
   const std::string config = MessageUtil::getJsonStringFromMessage(proto_config.config());
   Tracing::DriverPtr dynamic_driver =
diff --git a/source/extensions/tracers/dynamic_ot/config.h b/source/extensions/tracers/dynamic_ot/config.h
index 61853f0d4c81..f9c065bcefb3 100644
--- a/source/extensions/tracers/dynamic_ot/config.h
+++ b/source/extensions/tracers/dynamic_ot/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/common/factory_base.h"
 
@@ -14,14 +14,14 @@ namespace DynamicOt {
  * Config registration for the dynamic opentracing tracer. @see TracerFactory.
  */
 class DynamicOpenTracingTracerFactory
-    : public Common::FactoryBase<envoy::config::trace::v2::DynamicOtConfig> {
+    : public Common::FactoryBase<envoy::config::trace::v3alpha::DynamicOtConfig> {
 public:
   DynamicOpenTracingTracerFactory();
 
 private:
   // FactoryBase
   Tracing::HttpTracerPtr
-  createHttpTracerTyped(const envoy::config::trace::v2::DynamicOtConfig& configuration,
+  createHttpTracerTyped(const envoy::config::trace::v3alpha::DynamicOtConfig& configuration,
                         Server::Instance& server) override;
 };
 
diff --git a/source/extensions/tracers/lightstep/BUILD b/source/extensions/tracers/lightstep/BUILD
index 46936d200754..ffb658923af3 100644
--- a/source/extensions/tracers/lightstep/BUILD
+++ b/source/extensions/tracers/lightstep/BUILD
@@ -27,7 +27,7 @@ envoy_cc_library(
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common/ot:opentracing_driver_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -40,6 +40,6 @@ envoy_cc_extension(
         ":lightstep_tracer_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common:factory_base_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/tracers/lightstep/config.cc b/source/extensions/tracers/lightstep/config.cc
index b2913b804251..87ba27e38408 100644
--- a/source/extensions/tracers/lightstep/config.cc
+++ b/source/extensions/tracers/lightstep/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/tracers/lightstep/config.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/common/utility.h"
@@ -20,7 +20,7 @@ namespace Lightstep {
 LightstepTracerFactory::LightstepTracerFactory() : FactoryBase(TracerNames::get().Lightstep) {}
 
 Tracing::HttpTracerPtr LightstepTracerFactory::createHttpTracerTyped(
-    const envoy::config::trace::v2::LightstepConfig& proto_config, Server::Instance& server) {
+    const envoy::config::trace::v3alpha::LightstepConfig& proto_config, Server::Instance& server) {
   auto opts = std::make_unique<lightstep::LightStepTracerOptions>();
   const auto access_token_file =
       server.api().fileSystem().fileReadToEnd(proto_config.access_token_file());
diff --git a/source/extensions/tracers/lightstep/config.h b/source/extensions/tracers/lightstep/config.h
index 2d38156ce331..d74880807807 100644
--- a/source/extensions/tracers/lightstep/config.h
+++ b/source/extensions/tracers/lightstep/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/common/factory_base.h"
 
@@ -14,14 +14,14 @@ namespace Lightstep {
  * Config registration for the lightstep tracer. @see TracerFactory.
  */
 class LightstepTracerFactory
-    : public Common::FactoryBase<envoy::config::trace::v2::LightstepConfig> {
+    : public Common::FactoryBase<envoy::config::trace::v3alpha::LightstepConfig> {
 public:
   LightstepTracerFactory();
 
 private:
   // FactoryBase
   Tracing::HttpTracerPtr
-  createHttpTracerTyped(const envoy::config::trace::v2::LightstepConfig& proto_config,
+  createHttpTracerTyped(const envoy::config::trace::v3alpha::LightstepConfig& proto_config,
                         Server::Instance& server) override;
 };
 
diff --git a/source/extensions/tracers/lightstep/lightstep_tracer_impl.cc b/source/extensions/tracers/lightstep/lightstep_tracer_impl.cc
index 892b45990219..2fb317e5743e 100644
--- a/source/extensions/tracers/lightstep/lightstep_tracer_impl.cc
+++ b/source/extensions/tracers/lightstep/lightstep_tracer_impl.cc
@@ -5,7 +5,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/common/base64.h"
@@ -132,11 +132,11 @@ void LightStepDriver::TlsLightStepTracer::enableTimer() {
   flush_timer_->enableTimer(std::chrono::milliseconds(flush_interval));
 }
 
-LightStepDriver::LightStepDriver(const envoy::config::trace::v2::LightstepConfig& lightstep_config,
-                                 Upstream::ClusterManager& cluster_manager, Stats::Store& stats,
-                                 ThreadLocal::SlotAllocator& tls, Runtime::Loader& runtime,
-                                 std::unique_ptr<lightstep::LightStepTracerOptions>&& options,
-                                 PropagationMode propagation_mode, Grpc::Context& grpc_context)
+LightStepDriver::LightStepDriver(
+    const envoy::config::trace::v3alpha::LightstepConfig& lightstep_config,
+    Upstream::ClusterManager& cluster_manager, Stats::Store& stats, ThreadLocal::SlotAllocator& tls,
+    Runtime::Loader& runtime, std::unique_ptr<lightstep::LightStepTracerOptions>&& options,
+    PropagationMode propagation_mode, Grpc::Context& grpc_context)
     : OpenTracingDriver{stats}, cm_{cluster_manager},
       tracer_stats_{LIGHTSTEP_TRACER_STATS(POOL_COUNTER_PREFIX(stats, "tracing.lightstep."))},
       tls_{tls.allocateSlot()}, runtime_{runtime}, options_{std::move(options)},
diff --git a/source/extensions/tracers/lightstep/lightstep_tracer_impl.h b/source/extensions/tracers/lightstep/lightstep_tracer_impl.h
index a5298475a9da..fdd7859d32dd 100644
--- a/source/extensions/tracers/lightstep/lightstep_tracer_impl.h
+++ b/source/extensions/tracers/lightstep/lightstep_tracer_impl.h
@@ -4,7 +4,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/thread_local/thread_local.h"
 #include "envoy/tracing/http_tracer.h"
@@ -53,7 +53,7 @@ class LightStepLogger : Logger::Loggable<Logger::Id::tracing> {
  */
 class LightStepDriver : public Common::Ot::OpenTracingDriver {
 public:
-  LightStepDriver(const envoy::config::trace::v2::LightstepConfig& lightstep_config,
+  LightStepDriver(const envoy::config::trace::v3alpha::LightstepConfig& lightstep_config,
                   Upstream::ClusterManager& cluster_manager, Stats::Store& stats,
                   ThreadLocal::SlotAllocator& tls, Runtime::Loader& runtime,
                   std::unique_ptr<lightstep::LightStepTracerOptions>&& options,
diff --git a/source/extensions/tracers/opencensus/BUILD b/source/extensions/tracers/opencensus/BUILD
index 0a4b250e88f1..51e22280ec47 100644
--- a/source/extensions/tracers/opencensus/BUILD
+++ b/source/extensions/tracers/opencensus/BUILD
@@ -20,7 +20,7 @@ envoy_cc_extension(
         ":opencensus_tracer_impl",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common:factory_base_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -43,6 +43,6 @@ envoy_cc_library(
     deps = [
         "//source/common/config:utility_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/tracers/opencensus/config.cc b/source/extensions/tracers/opencensus/config.cc
index 4e8e1a2aa40d..b2608b9683ad 100644
--- a/source/extensions/tracers/opencensus/config.cc
+++ b/source/extensions/tracers/opencensus/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/tracers/opencensus/config.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/tracing/http_tracer_impl.h"
@@ -17,7 +17,7 @@ namespace OpenCensus {
 OpenCensusTracerFactory::OpenCensusTracerFactory() : FactoryBase(TracerNames::get().OpenCensus) {}
 
 Tracing::HttpTracerPtr OpenCensusTracerFactory::createHttpTracerTyped(
-    const envoy::config::trace::v2::OpenCensusConfig& proto_config, Server::Instance& server) {
+    const envoy::config::trace::v3alpha::OpenCensusConfig& proto_config, Server::Instance& server) {
   Tracing::DriverPtr driver = std::make_unique<Driver>(proto_config, server.localInfo());
   return std::make_unique<Tracing::HttpTracerImpl>(std::move(driver), server.localInfo());
 }
diff --git a/source/extensions/tracers/opencensus/config.h b/source/extensions/tracers/opencensus/config.h
index e0d9b876373d..ef9559bdfe06 100644
--- a/source/extensions/tracers/opencensus/config.h
+++ b/source/extensions/tracers/opencensus/config.h
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/common/factory_base.h"
 
@@ -16,14 +16,14 @@ namespace OpenCensus {
  * Config registration for the OpenCensus tracer. @see TracerFactory.
  */
 class OpenCensusTracerFactory
-    : public Common::FactoryBase<envoy::config::trace::v2::OpenCensusConfig> {
+    : public Common::FactoryBase<envoy::config::trace::v3alpha::OpenCensusConfig> {
 public:
   OpenCensusTracerFactory();
 
 private:
   // FactoryBase
   Tracing::HttpTracerPtr
-  createHttpTracerTyped(const envoy::config::trace::v2::OpenCensusConfig& proto_config,
+  createHttpTracerTyped(const envoy::config::trace::v3alpha::OpenCensusConfig& proto_config,
                         Server::Instance& server) override;
 };
 
diff --git a/source/extensions/tracers/opencensus/opencensus_tracer_impl.cc b/source/extensions/tracers/opencensus/opencensus_tracer_impl.cc
index 304b20c14316..d43eabdb3a20 100644
--- a/source/extensions/tracers/opencensus/opencensus_tracer_impl.cc
+++ b/source/extensions/tracers/opencensus/opencensus_tracer_impl.cc
@@ -2,7 +2,7 @@
 
 #include <grpcpp/grpcpp.h>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/http/header_map.h"
 
 #include "common/common/base64.h"
@@ -48,12 +48,13 @@ using Constants = ConstSingleton<ConstantValues>;
  */
 class Span : public Tracing::Span {
 public:
-  Span(const Tracing::Config& config, const envoy::config::trace::v2::OpenCensusConfig& oc_config,
+  Span(const Tracing::Config& config,
+       const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config,
        Http::HeaderMap& request_headers, const std::string& operation_name, SystemTime start_time,
        const Tracing::Decision tracing_decision);
 
   // Used by spawnChild().
-  Span(const envoy::config::trace::v2::OpenCensusConfig& oc_config,
+  Span(const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config,
        ::opencensus::trace::Span&& span);
 
   void setOperation(absl::string_view operation) override;
@@ -67,14 +68,14 @@ class Span : public Tracing::Span {
 
 private:
   ::opencensus::trace::Span span_;
-  const envoy::config::trace::v2::OpenCensusConfig& oc_config_;
+  const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config_;
 };
 
 ::opencensus::trace::Span
 startSpanHelper(const std::string& name, bool traced, const Http::HeaderMap& request_headers,
-                const envoy::config::trace::v2::OpenCensusConfig& oc_config) {
+                const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config) {
   // Determine if there is a parent context.
-  using OpenCensusConfig = envoy::config::trace::v2::OpenCensusConfig;
+  using OpenCensusConfig = envoy::config::trace::v3alpha::OpenCensusConfig;
   ::opencensus::trace::SpanContext parent_ctx;
   for (const auto& incoming : oc_config.incoming_trace_context()) {
     bool found = false;
@@ -160,7 +161,7 @@ startSpanHelper(const std::string& name, bool traced, const Http::HeaderMap& req
 }
 
 Span::Span(const Tracing::Config& config,
-           const envoy::config::trace::v2::OpenCensusConfig& oc_config,
+           const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config,
            Http::HeaderMap& request_headers, const std::string& operation_name,
            SystemTime /*start_time*/, const Tracing::Decision tracing_decision)
     : span_(startSpanHelper(operation_name, tracing_decision.traced, request_headers, oc_config)),
@@ -170,7 +171,7 @@ Span::Span(const Tracing::Config& config,
                                           : "Egress");
 }
 
-Span::Span(const envoy::config::trace::v2::OpenCensusConfig& oc_config,
+Span::Span(const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config,
            ::opencensus::trace::Span&& span)
     : span_(std::move(span)), oc_config_(oc_config) {}
 
@@ -188,7 +189,7 @@ void Span::log(SystemTime /*timestamp*/, const std::string& event) {
 void Span::finishSpan() { span_.End(); }
 
 void Span::injectContext(Http::HeaderMap& request_headers) {
-  using OpenCensusConfig = envoy::config::trace::v2::OpenCensusConfig;
+  using OpenCensusConfig = envoy::config::trace::v3alpha::OpenCensusConfig;
   const auto& ctx = span_.context();
   for (const auto& outgoing : oc_config_.outgoing_trace_context()) {
     switch (outgoing) {
@@ -235,7 +236,7 @@ void Span::setSampled(bool sampled) { span_.AddAnnotation("setSampled", {{"sampl
 
 } // namespace
 
-Driver::Driver(const envoy::config::trace::v2::OpenCensusConfig& oc_config,
+Driver::Driver(const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config,
                const LocalInfo::LocalInfo& localinfo)
     : oc_config_(oc_config), local_info_(localinfo) {
   if (oc_config.has_trace_config()) {
diff --git a/source/extensions/tracers/opencensus/opencensus_tracer_impl.h b/source/extensions/tracers/opencensus/opencensus_tracer_impl.h
index 1805c6536303..6d6c2b22ab2f 100644
--- a/source/extensions/tracers/opencensus/opencensus_tracer_impl.h
+++ b/source/extensions/tracers/opencensus/opencensus_tracer_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/tracing/http_tracer.h"
 
@@ -16,7 +16,7 @@ namespace OpenCensus {
  */
 class Driver : public Tracing::Driver, Logger::Loggable<Logger::Id::tracing> {
 public:
-  Driver(const envoy::config::trace::v2::OpenCensusConfig& oc_config,
+  Driver(const envoy::config::trace::v3alpha::OpenCensusConfig& oc_config,
          const LocalInfo::LocalInfo& localinfo);
 
   /**
@@ -29,7 +29,7 @@ class Driver : public Tracing::Driver, Logger::Loggable<Logger::Id::tracing> {
 private:
   void applyTraceConfig(const opencensus::proto::trace::v1::TraceConfig& config);
 
-  const envoy::config::trace::v2::OpenCensusConfig oc_config_;
+  const envoy::config::trace::v3alpha::OpenCensusConfig oc_config_;
   const LocalInfo::LocalInfo& local_info_;
 };
 
diff --git a/source/extensions/tracers/xray/BUILD b/source/extensions/tracers/xray/BUILD
index 5819e692de97..4c73f6102de3 100644
--- a/source/extensions/tracers/xray/BUILD
+++ b/source/extensions/tracers/xray/BUILD
@@ -62,7 +62,7 @@ envoy_cc_extension(
         "//source/common/config:datasource_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common:factory_base_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/trace/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/tracers/xray/config.cc b/source/extensions/tracers/xray/config.cc
index afbfb68c8fa6..8207771561ea 100644
--- a/source/extensions/tracers/xray/config.cc
+++ b/source/extensions/tracers/xray/config.cc
@@ -2,9 +2,9 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/config/trace/v2alpha/xray.pb.h"
-#include "envoy/config/trace/v2alpha/xray.pb.validate.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/trace/v3alpha/xray.pb.h"
+#include "envoy/config/trace/v3alpha/xray.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/common/utility.h"
@@ -22,7 +22,7 @@ namespace XRay {
 XRayTracerFactory::XRayTracerFactory() : FactoryBase(TracerNames::get().XRay) {}
 
 Tracing::HttpTracerPtr XRayTracerFactory::createHttpTracerTyped(
-    const envoy::config::trace::v2alpha::XRayConfig& proto_config, Server::Instance& server) {
+    const envoy::config::trace::v3alpha::XRayConfig& proto_config, Server::Instance& server) {
   std::string sampling_rules_json;
   try {
     sampling_rules_json =
@@ -31,12 +31,13 @@ Tracing::HttpTracerPtr XRayTracerFactory::createHttpTracerTyped(
     ENVOY_LOG(error, "Failed to read sampling rules manifest because of {}.", e.what());
   }
 
-  if (proto_config.daemon_endpoint().protocol() != envoy::api::v2::core::SocketAddress::UDP) {
+  if (proto_config.daemon_endpoint().protocol() !=
+      envoy::config::core::v3alpha::SocketAddress::UDP) {
     throw EnvoyException("X-Ray daemon endpoint must be a UDP socket address");
   }
 
   if (proto_config.daemon_endpoint().port_specifier_case() !=
-      envoy::api::v2::core::SocketAddress::PortSpecifierCase::kPortValue) {
+      envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::kPortValue) {
     throw EnvoyException("X-Ray daemon port must be specified as number. Not a named port.");
   }
 
diff --git a/source/extensions/tracers/xray/config.h b/source/extensions/tracers/xray/config.h
index 6529b4af9ea2..24d99d17d6d2 100644
--- a/source/extensions/tracers/xray/config.h
+++ b/source/extensions/tracers/xray/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/trace/v2alpha/xray.pb.h"
-#include "envoy/config/trace/v2alpha/xray.pb.validate.h"
+#include "envoy/config/trace/v3alpha/xray.pb.h"
+#include "envoy/config/trace/v3alpha/xray.pb.validate.h"
 
 #include "common/common/logger.h"
 
@@ -15,14 +15,14 @@ namespace XRay {
 /**
  * Config registration for the XRay tracer. @see TracerFactory.
  */
-class XRayTracerFactory : public Common::FactoryBase<envoy::config::trace::v2alpha::XRayConfig>,
+class XRayTracerFactory : public Common::FactoryBase<envoy::config::trace::v3alpha::XRayConfig>,
                           Logger::Loggable<Logger::Id::tracing> {
 public:
   XRayTracerFactory();
 
 private:
   Tracing::HttpTracerPtr
-  createHttpTracerTyped(const envoy::config::trace::v2alpha::XRayConfig& proto_config,
+  createHttpTracerTyped(const envoy::config::trace::v3alpha::XRayConfig& proto_config,
                         Server::Instance& server) override;
 };
 
diff --git a/source/extensions/tracers/zipkin/BUILD b/source/extensions/tracers/zipkin/BUILD
index b645740e4526..caeea09acd10 100644
--- a/source/extensions/tracers/zipkin/BUILD
+++ b/source/extensions/tracers/zipkin/BUILD
@@ -59,7 +59,7 @@ envoy_cc_library(
         "//source/common/tracing:http_tracer_lib",
         "//source/extensions/tracers:well_known_names",
         "@com_github_openzipkin_zipkinapi//:zipkin_cc_proto",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -72,6 +72,6 @@ envoy_cc_extension(
         ":zipkin_lib",
         "//source/extensions/tracers:well_known_names",
         "//source/extensions/tracers/common:factory_base_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/tracers/zipkin/config.cc b/source/extensions/tracers/zipkin/config.cc
index 54fa111ce61a..e11f7f46b47e 100644
--- a/source/extensions/tracers/zipkin/config.cc
+++ b/source/extensions/tracers/zipkin/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/tracers/zipkin/config.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/common/utility.h"
@@ -18,7 +18,7 @@ namespace Zipkin {
 ZipkinTracerFactory::ZipkinTracerFactory() : FactoryBase(TracerNames::get().Zipkin) {}
 
 Tracing::HttpTracerPtr ZipkinTracerFactory::createHttpTracerTyped(
-    const envoy::config::trace::v2::ZipkinConfig& proto_config, Server::Instance& server) {
+    const envoy::config::trace::v3alpha::ZipkinConfig& proto_config, Server::Instance& server) {
   Tracing::DriverPtr zipkin_driver = std::make_unique<Zipkin::Driver>(
       proto_config, server.clusterManager(), server.stats(), server.threadLocal(), server.runtime(),
       server.localInfo(), server.random(), server.timeSource());
diff --git a/source/extensions/tracers/zipkin/config.h b/source/extensions/tracers/zipkin/config.h
index 0fda006259b0..60d0599eab9a 100644
--- a/source/extensions/tracers/zipkin/config.h
+++ b/source/extensions/tracers/zipkin/config.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/common/factory_base.h"
 
@@ -13,14 +13,15 @@ namespace Zipkin {
 /**
  * Config registration for the zipkin tracer. @see TracerFactory.
  */
-class ZipkinTracerFactory : public Common::FactoryBase<envoy::config::trace::v2::ZipkinConfig> {
+class ZipkinTracerFactory
+    : public Common::FactoryBase<envoy::config::trace::v3alpha::ZipkinConfig> {
 public:
   ZipkinTracerFactory();
 
 private:
   // FactoryBase
   Tracing::HttpTracerPtr
-  createHttpTracerTyped(const envoy::config::trace::v2::ZipkinConfig& proto_config,
+  createHttpTracerTyped(const envoy::config::trace::v3alpha::ZipkinConfig& proto_config,
                         Server::Instance& server) override;
 };
 
diff --git a/source/extensions/tracers/zipkin/span_buffer.cc b/source/extensions/tracers/zipkin/span_buffer.cc
index adec867a4d75..8f5b2c2950b0 100644
--- a/source/extensions/tracers/zipkin/span_buffer.cc
+++ b/source/extensions/tracers/zipkin/span_buffer.cc
@@ -1,6 +1,6 @@
 #include "extensions/tracers/zipkin/span_buffer.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -15,12 +15,12 @@ namespace Tracers {
 namespace Zipkin {
 
 SpanBuffer::SpanBuffer(
-    const envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion& version,
+    const envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion& version,
     const bool shared_span_context)
     : serializer_{makeSerializer(version, shared_span_context)} {}
 
 SpanBuffer::SpanBuffer(
-    const envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion& version,
+    const envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion& version,
     const bool shared_span_context, uint64_t size)
     : serializer_{makeSerializer(version, shared_span_context)} {
   allocateBuffer(size);
@@ -45,14 +45,14 @@ bool SpanBuffer::addSpan(Span&& span) {
 }
 
 SerializerPtr SpanBuffer::makeSerializer(
-    const envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion& version,
+    const envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion& version,
     const bool shared_span_context) {
   switch (version) {
-  case envoy::config::trace::v2::ZipkinConfig::HTTP_JSON_V1:
+  case envoy::config::trace::v3alpha::ZipkinConfig::hidden_envoy_deprecated_HTTP_JSON_V1:
     return std::make_unique<JsonV1Serializer>();
-  case envoy::config::trace::v2::ZipkinConfig::HTTP_JSON:
+  case envoy::config::trace::v3alpha::ZipkinConfig::HTTP_JSON:
     return std::make_unique<JsonV2Serializer>(shared_span_context);
-  case envoy::config::trace::v2::ZipkinConfig::HTTP_PROTO:
+  case envoy::config::trace::v3alpha::ZipkinConfig::HTTP_PROTO:
     return std::make_unique<ProtobufSerializer>(shared_span_context);
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
diff --git a/source/extensions/tracers/zipkin/span_buffer.h b/source/extensions/tracers/zipkin/span_buffer.h
index a5718600129e..1b52cb33f644 100644
--- a/source/extensions/tracers/zipkin/span_buffer.h
+++ b/source/extensions/tracers/zipkin/span_buffer.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "extensions/tracers/zipkin/tracer_interface.h"
 #include "extensions/tracers/zipkin/zipkin_core_types.h"
@@ -28,7 +28,7 @@ class SpanBuffer {
    * @param shared_span_context To determine whether client and server spans will share the same
    * span context.
    */
-  SpanBuffer(const envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion& version,
+  SpanBuffer(const envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion& version,
              bool shared_span_context);
 
   /**
@@ -40,7 +40,7 @@ class SpanBuffer {
    * span context.
    * @param size The desired buffer size.
    */
-  SpanBuffer(const envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion& version,
+  SpanBuffer(const envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion& version,
              bool shared_span_context, uint64_t size);
 
   /**
@@ -81,9 +81,9 @@ class SpanBuffer {
   std::string serialize() const { return serializer_->serialize(span_buffer_); }
 
 private:
-  SerializerPtr
-  makeSerializer(const envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion& version,
-                 bool shared_span_context);
+  SerializerPtr makeSerializer(
+      const envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion& version,
+      bool shared_span_context);
 
   // We use a pre-allocated vector to improve performance
   std::vector<Span> span_buffer_;
diff --git a/source/extensions/tracers/zipkin/zipkin_tracer_impl.cc b/source/extensions/tracers/zipkin/zipkin_tracer_impl.cc
index 743e88b9beb9..f65ec8b57fb3 100644
--- a/source/extensions/tracers/zipkin/zipkin_tracer_impl.cc
+++ b/source/extensions/tracers/zipkin/zipkin_tracer_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/tracers/zipkin/zipkin_tracer_impl.h"
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/common/enum_to_int.h"
 #include "common/common/fmt.h"
@@ -66,7 +66,7 @@ Tracing::SpanPtr ZipkinSpan::spawnChild(const Tracing::Config& config, const std
 Driver::TlsTracer::TlsTracer(TracerPtr&& tracer, Driver& driver)
     : tracer_(std::move(tracer)), driver_(driver) {}
 
-Driver::Driver(const envoy::config::trace::v2::ZipkinConfig& zipkin_config,
+Driver::Driver(const envoy::config::trace::v3alpha::ZipkinConfig& zipkin_config,
                Upstream::ClusterManager& cluster_manager, Stats::Store& stats,
                ThreadLocal::SlotAllocator& tls, Runtime::Loader& runtime,
                const LocalInfo::LocalInfo& local_info, Runtime::RandomGenerator& random_generator,
@@ -178,7 +178,7 @@ void ReporterImpl::flushSpans() {
     message->headers().setPath(collector_.endpoint_);
     message->headers().setHost(driver_.cluster()->name());
     message->headers().setReferenceContentType(
-        collector_.version_ == envoy::config::trace::v2::ZipkinConfig::HTTP_PROTO
+        collector_.version_ == envoy::config::trace::v3alpha::ZipkinConfig::HTTP_PROTO
             ? Http::Headers::get().ContentTypeValues.Protobuf
             : Http::Headers::get().ContentTypeValues.Json);
 
diff --git a/source/extensions/tracers/zipkin/zipkin_tracer_impl.h b/source/extensions/tracers/zipkin/zipkin_tracer_impl.h
index 8b708538fd1f..9e5b906baaee 100644
--- a/source/extensions/tracers/zipkin/zipkin_tracer_impl.h
+++ b/source/extensions/tracers/zipkin/zipkin_tracer_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/thread_local/thread_local.h"
@@ -93,7 +93,7 @@ class Driver : public Tracing::Driver {
    * Constructor. It adds itself and a newly-created Zipkin::Tracer object to a thread-local store.
    * Also, it associates the given random-number generator to the Zipkin::Tracer object it creates.
    */
-  Driver(const envoy::config::trace::v2::ZipkinConfig& zipkin_config,
+  Driver(const envoy::config::trace::v3alpha::ZipkinConfig& zipkin_config,
          Upstream::ClusterManager& cluster_manager, Stats::Store& stats,
          ThreadLocal::SlotAllocator& tls, Runtime::Loader& runtime,
          const LocalInfo::LocalInfo& localinfo, Runtime::RandomGenerator& random_generator,
@@ -150,8 +150,8 @@ struct CollectorInfo {
   // The version of the collector. This is related to endpoint's supported payload specification and
   // transport. Currently it defaults to envoy::config::trace::v2::ZipkinConfig::HTTP_JSON_V1. In
   // the future, we will throw when collector_endpoint_version is not specified.
-  envoy::config::trace::v2::ZipkinConfig::CollectorEndpointVersion version_{
-      envoy::config::trace::v2::ZipkinConfig::HTTP_JSON_V1};
+  envoy::config::trace::v3alpha::ZipkinConfig::CollectorEndpointVersion version_{
+      envoy::config::trace::v3alpha::ZipkinConfig::hidden_envoy_deprecated_HTTP_JSON_V1};
 
   bool shared_span_context_{ZipkinCoreConstants::get().DEFAULT_SHARED_SPAN_CONTEXT};
 };
diff --git a/source/extensions/transport_sockets/alts/BUILD b/source/extensions/transport_sockets/alts/BUILD
index fb19c24c2b91..06241fc0b53f 100644
--- a/source/extensions/transport_sockets/alts/BUILD
+++ b/source/extensions/transport_sockets/alts/BUILD
@@ -42,7 +42,7 @@ envoy_cc_extension(
         "//include/envoy/server:transport_socket_config_interface",
         "//source/common/grpc:google_grpc_context_lib",
         "//source/extensions/transport_sockets:well_known_names",
-        "@envoy_api//envoy/config/transport_socket/alts/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/alts/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/transport_sockets/alts/config.cc b/source/extensions/transport_sockets/alts/config.cc
index d4c65c882386..98f074f8d76a 100644
--- a/source/extensions/transport_sockets/alts/config.cc
+++ b/source/extensions/transport_sockets/alts/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/transport_sockets/alts/config.h"
 
-#include "envoy/config/transport_socket/alts/v2alpha/alts.pb.h"
-#include "envoy/config/transport_socket/alts/v2alpha/alts.pb.validate.h"
+#include "envoy/extensions/transport_sockets/alts/v3alpha/alts.pb.h"
+#include "envoy/extensions/transport_sockets/alts/v3alpha/alts.pb.validate.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/transport_socket_config.h"
 
@@ -46,7 +46,7 @@ bool doValidate(const tsi_peer& peer, const std::unordered_set<std::string>& pee
 }
 
 HandshakeValidator
-createHandshakeValidator(const envoy::config::transport_socket::alts::v2alpha::Alts& config) {
+createHandshakeValidator(const envoy::extensions::transport_sockets::alts::v3alpha::Alts& config) {
   const auto& peer_service_accounts = config.peer_service_accounts();
   const std::unordered_set<std::string> peers(peer_service_accounts.cbegin(),
                                               peer_service_accounts.cend());
@@ -89,9 +89,9 @@ Network::TransportSocketFactoryPtr createTransportSocketFactoryHelper(
   auto alts_shared_state = factory_ctxt.singletonManager().getTyped<AltsSharedState>(
       SINGLETON_MANAGER_REGISTERED_NAME(alts_shared_state),
       [] { return std::make_shared<AltsSharedState>(); });
-  auto config =
-      MessageUtil::downcastAndValidate<const envoy::config::transport_socket::alts::v2alpha::Alts&>(
-          message, factory_ctxt.messageValidationVisitor());
+  auto config = MessageUtil::downcastAndValidate<
+      const envoy::extensions::transport_sockets::alts::v3alpha::Alts&>(
+      message, factory_ctxt.messageValidationVisitor());
   HandshakeValidator validator = createHandshakeValidator(config);
 
   const std::string& handshaker_service = config.handshaker_service();
@@ -132,7 +132,7 @@ Network::TransportSocketFactoryPtr createTransportSocketFactoryHelper(
 } // namespace
 
 ProtobufTypes::MessagePtr AltsTransportSocketConfigFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::transport_socket::alts::v2alpha::Alts>();
+  return std::make_unique<envoy::extensions::transport_sockets::alts::v3alpha::Alts>();
 }
 
 Network::TransportSocketFactoryPtr
diff --git a/source/extensions/transport_sockets/tap/BUILD b/source/extensions/transport_sockets/tap/BUILD
index 8b01381dcc23..4b2d6e6a3ec5 100644
--- a/source/extensions/transport_sockets/tap/BUILD
+++ b/source/extensions/transport_sockets/tap/BUILD
@@ -28,8 +28,8 @@ envoy_cc_library(
         ":tap_config_interface",
         "//source/common/network:utility_lib",
         "//source/extensions/common/tap:tap_config_base",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -42,7 +42,7 @@ envoy_cc_library(
         "//include/envoy/network:transport_socket_interface",
         "//source/common/buffer:buffer_lib",
         "//source/extensions/common/tap:extension_config_base",
-        "@envoy_api//envoy/config/transport_socket/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -61,7 +61,7 @@ envoy_cc_extension(
         "//source/common/config:utility_lib",
         "//source/common/protobuf:utility_lib",
         "//source/extensions/transport_sockets:well_known_names",
-        "@envoy_api//envoy/config/transport_socket/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tap/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/transport_sockets/tap/config.cc b/source/extensions/transport_sockets/tap/config.cc
index c45f2def51a3..3c9f7db67ae9 100644
--- a/source/extensions/transport_sockets/tap/config.cc
+++ b/source/extensions/transport_sockets/tap/config.cc
@@ -1,9 +1,9 @@
 #include "extensions/transport_sockets/tap/config.h"
 
-#include "envoy/config/transport_socket/tap/v2alpha/tap.pb.h"
-#include "envoy/config/transport_socket/tap/v2alpha/tap.pb.validate.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/extensions/transport_sockets/tap/v3alpha/tap.pb.h"
+#include "envoy/extensions/transport_sockets/tap/v3alpha/tap.pb.validate.h"
 #include "envoy/registry/registry.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
 
 #include "common/config/utility.h"
 #include "common/protobuf/utility.h"
@@ -22,7 +22,7 @@ class SocketTapConfigFactoryImpl : public Extensions::Common::Tap::TapConfigFact
 
   // TapConfigFactory
   Extensions::Common::Tap::TapConfigSharedPtr
-  createConfigFromProto(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  createConfigFromProto(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                         Extensions::Common::Tap::Sink* admin_streamer) override {
     return std::make_shared<SocketTapConfigImpl>(std::move(proto_config), admin_streamer,
                                                  time_source_);
@@ -35,9 +35,9 @@ class SocketTapConfigFactoryImpl : public Extensions::Common::Tap::TapConfigFact
 Network::TransportSocketFactoryPtr UpstreamTapSocketConfigFactory::createTransportSocketFactory(
     const Protobuf::Message& message,
     Server::Configuration::TransportSocketFactoryContext& context) {
-  const auto& outer_config =
-      MessageUtil::downcastAndValidate<const envoy::config::transport_socket::tap::v2alpha::Tap&>(
-          message, context.messageValidationVisitor());
+  const auto& outer_config = MessageUtil::downcastAndValidate<
+      const envoy::extensions::transport_sockets::tap::v3alpha::Tap&>(
+      message, context.messageValidationVisitor());
   auto& inner_config_factory = Config::Utility::getAndCheckFactory<
       Server::Configuration::UpstreamTransportSocketConfigFactory>(
       outer_config.transport_socket().name());
@@ -54,9 +54,9 @@ Network::TransportSocketFactoryPtr UpstreamTapSocketConfigFactory::createTranspo
 Network::TransportSocketFactoryPtr DownstreamTapSocketConfigFactory::createTransportSocketFactory(
     const Protobuf::Message& message, Server::Configuration::TransportSocketFactoryContext& context,
     const std::vector<std::string>& server_names) {
-  const auto& outer_config =
-      MessageUtil::downcastAndValidate<const envoy::config::transport_socket::tap::v2alpha::Tap&>(
-          message, context.messageValidationVisitor());
+  const auto& outer_config = MessageUtil::downcastAndValidate<
+      const envoy::extensions::transport_sockets::tap::v3alpha::Tap&>(
+      message, context.messageValidationVisitor());
   auto& inner_config_factory = Config::Utility::getAndCheckFactory<
       Server::Configuration::DownstreamTransportSocketConfigFactory>(
       outer_config.transport_socket().name());
@@ -71,7 +71,7 @@ Network::TransportSocketFactoryPtr DownstreamTapSocketConfigFactory::createTrans
 }
 
 ProtobufTypes::MessagePtr TapSocketConfigFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::config::transport_socket::tap::v2alpha::Tap>();
+  return std::make_unique<envoy::extensions::transport_sockets::tap::v3alpha::Tap>();
 }
 
 REGISTER_FACTORY(UpstreamTapSocketConfigFactory,
diff --git a/source/extensions/transport_sockets/tap/tap.cc b/source/extensions/transport_sockets/tap/tap.cc
index 6485886aa87c..b7b5edf846be 100644
--- a/source/extensions/transport_sockets/tap/tap.cc
+++ b/source/extensions/transport_sockets/tap/tap.cc
@@ -1,6 +1,6 @@
 #include "extensions/transport_sockets/tap/tap.h"
 
-#include "envoy/config/transport_socket/tap/v2alpha/tap.pb.h"
+#include "envoy/extensions/transport_sockets/tap/v3alpha/tap.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -56,7 +56,7 @@ void TapSocket::onConnected() { transport_socket_->onConnected(); }
 Ssl::ConnectionInfoConstSharedPtr TapSocket::ssl() const { return transport_socket_->ssl(); }
 
 TapSocketFactory::TapSocketFactory(
-    const envoy::config::transport_socket::tap::v2alpha::Tap& proto_config,
+    const envoy::extensions::transport_sockets::tap::v3alpha::Tap& proto_config,
     Common::Tap::TapConfigFactoryPtr&& config_factory, Server::Admin& admin,
     Singleton::Manager& singleton_manager, ThreadLocal::SlotAllocator& tls,
     Event::Dispatcher& main_thread_dispatcher,
diff --git a/source/extensions/transport_sockets/tap/tap.h b/source/extensions/transport_sockets/tap/tap.h
index 96480544b426..dda39d20b576 100644
--- a/source/extensions/transport_sockets/tap/tap.h
+++ b/source/extensions/transport_sockets/tap/tap.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/transport_socket/tap/v2alpha/tap.pb.h"
 #include "envoy/event/timer.h"
+#include "envoy/extensions/transport_sockets/tap/v3alpha/tap.pb.h"
 #include "envoy/network/transport_socket.h"
 
 #include "extensions/common/tap/extension_config_base.h"
@@ -36,7 +36,7 @@ class TapSocket : public Network::TransportSocket {
 class TapSocketFactory : public Network::TransportSocketFactory,
                          public Common::Tap::ExtensionConfigBase {
 public:
-  TapSocketFactory(const envoy::config::transport_socket::tap::v2alpha::Tap& proto_config,
+  TapSocketFactory(const envoy::extensions::transport_sockets::tap::v3alpha::Tap& proto_config,
                    Common::Tap::TapConfigFactoryPtr&& config_factory, Server::Admin& admin,
                    Singleton::Manager& singleton_manager, ThreadLocal::SlotAllocator& tls,
                    Event::Dispatcher& main_thread_dispatcher,
diff --git a/source/extensions/transport_sockets/tap/tap_config_impl.cc b/source/extensions/transport_sockets/tap/tap_config_impl.cc
index cea959d4f368..815dfbc315d6 100644
--- a/source/extensions/transport_sockets/tap/tap_config_impl.cc
+++ b/source/extensions/transport_sockets/tap/tap_config_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/transport_sockets/tap/tap_config_impl.h"
 
-#include "envoy/data/tap/v2alpha/transport.pb.h"
+#include "envoy/data/tap/v3alpha/transport.pb.h"
 
 #include "common/common/assert.h"
 #include "common/network/utility.h"
@@ -25,7 +25,7 @@ PerSocketTapperImpl::PerSocketTapperImpl(SocketTapConfigSharedPtr config,
   }
 }
 
-void PerSocketTapperImpl::fillConnectionInfo(envoy::data::tap::v2alpha::Connection& connection) {
+void PerSocketTapperImpl::fillConnectionInfo(envoy::data::tap::v3alpha::Connection& connection) {
   Network::Utility::addressToProtobufAddress(*connection_.localAddress(),
                                              *connection.mutable_local_address());
   Network::Utility::addressToProtobufAddress(*connection_.remoteAddress(),
@@ -56,7 +56,7 @@ void PerSocketTapperImpl::closeSocket(Network::ConnectionEvent) {
   sink_handle_.reset();
 }
 
-void PerSocketTapperImpl::initEvent(envoy::data::tap::v2alpha::SocketEvent& event) {
+void PerSocketTapperImpl::initEvent(envoy::data::tap::v3alpha::SocketEvent& event) {
   event.mutable_timestamp()->MergeFrom(Protobuf::util::TimeUtil::NanosecondsToTimestamp(
       std::chrono::duration_cast<std::chrono::nanoseconds>(
           config_->timeSource().systemTime().time_since_epoch())
diff --git a/source/extensions/transport_sockets/tap/tap_config_impl.h b/source/extensions/transport_sockets/tap/tap_config_impl.h
index af6a0f2e8784..e98f60bed9f3 100644
--- a/source/extensions/transport_sockets/tap/tap_config_impl.h
+++ b/source/extensions/transport_sockets/tap/tap_config_impl.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/data/tap/v2alpha/transport.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/transport.pb.h"
 #include "envoy/event/timer.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
 
 #include "extensions/common/tap/tap_config_base.h"
 #include "extensions/transport_sockets/tap/tap_config.h"
@@ -22,8 +22,8 @@ class PerSocketTapperImpl : public PerSocketTapper {
   void onWrite(const Buffer::Instance& data, uint32_t bytes_written, bool end_stream) override;
 
 private:
-  void initEvent(envoy::data::tap::v2alpha::SocketEvent&);
-  void fillConnectionInfo(envoy::data::tap::v2alpha::Connection& connection);
+  void initEvent(envoy::data::tap::v3alpha::SocketEvent&);
+  void fillConnectionInfo(envoy::data::tap::v3alpha::Connection& connection);
   void makeBufferedTraceIfNeeded() {
     if (buffered_trace_ == nullptr) {
       buffered_trace_ = Extensions::Common::Tap::makeTraceWrapper();
@@ -50,7 +50,7 @@ class SocketTapConfigImpl : public Extensions::Common::Tap::TapConfigBaseImpl,
                             public SocketTapConfig,
                             public std::enable_shared_from_this<SocketTapConfigImpl> {
 public:
-  SocketTapConfigImpl(envoy::service::tap::v2alpha::TapConfig&& proto_config,
+  SocketTapConfigImpl(envoy::config::tap::v3alpha::TapConfig&& proto_config,
                       Extensions::Common::Tap::Sink* admin_streamer, TimeSource& time_system)
       : Extensions::Common::Tap::TapConfigBaseImpl(std::move(proto_config), admin_streamer),
         time_source_(time_system) {}
diff --git a/source/extensions/transport_sockets/tls/BUILD b/source/extensions/transport_sockets/tls/BUILD
index 87daa0fa4605..9dab665c298b 100644
--- a/source/extensions/transport_sockets/tls/BUILD
+++ b/source/extensions/transport_sockets/tls/BUILD
@@ -22,7 +22,7 @@ envoy_cc_extension(
         "//include/envoy/registry",
         "//include/envoy/server:transport_socket_config_interface",
         "//source/extensions/transport_sockets:well_known_names",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -73,7 +73,7 @@ envoy_cc_library(
         "//source/common/secret:sds_api_lib",
         "//source/common/ssl:certificate_validation_context_config_impl_lib",
         "//source/common/ssl:tls_certificate_config_impl_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -107,7 +107,8 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/stats:symbol_table_lib",
         "//source/extensions/transport_sockets/tls/private_key:private_key_manager_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/extensions/transport_sockets/tls/config.cc b/source/extensions/transport_sockets/tls/config.cc
index 9e617ebef5ca..697ba93423f2 100644
--- a/source/extensions/transport_sockets/tls/config.cc
+++ b/source/extensions/transport_sockets/tls/config.cc
@@ -1,7 +1,7 @@
 #include "extensions/transport_sockets/tls/config.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/auth/cert.pb.validate.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.validate.h"
 
 #include "common/protobuf/utility.h"
 
@@ -17,7 +17,8 @@ Network::TransportSocketFactoryPtr UpstreamSslSocketFactory::createTransportSock
     const Protobuf::Message& message,
     Server::Configuration::TransportSocketFactoryContext& context) {
   auto client_config = std::make_unique<ClientContextConfigImpl>(
-      MessageUtil::downcastAndValidate<const envoy::api::v2::auth::UpstreamTlsContext&>(
+      MessageUtil::downcastAndValidate<
+          const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext&>(
           message, context.messageValidationVisitor()),
       context);
   return std::make_unique<ClientSslSocketFactory>(
@@ -25,7 +26,7 @@ Network::TransportSocketFactoryPtr UpstreamSslSocketFactory::createTransportSock
 }
 
 ProtobufTypes::MessagePtr UpstreamSslSocketFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::api::v2::auth::UpstreamTlsContext>();
+  return std::make_unique<envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext>();
 }
 
 REGISTER_FACTORY(UpstreamSslSocketFactory,
@@ -35,7 +36,8 @@ Network::TransportSocketFactoryPtr DownstreamSslSocketFactory::createTransportSo
     const Protobuf::Message& message, Server::Configuration::TransportSocketFactoryContext& context,
     const std::vector<std::string>& server_names) {
   auto server_config = std::make_unique<ServerContextConfigImpl>(
-      MessageUtil::downcastAndValidate<const envoy::api::v2::auth::DownstreamTlsContext&>(
+      MessageUtil::downcastAndValidate<
+          const envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext&>(
           message, context.messageValidationVisitor()),
       context);
   return std::make_unique<ServerSslSocketFactory>(
@@ -43,7 +45,8 @@ Network::TransportSocketFactoryPtr DownstreamSslSocketFactory::createTransportSo
 }
 
 ProtobufTypes::MessagePtr DownstreamSslSocketFactory::createEmptyConfigProto() {
-  return std::make_unique<envoy::api::v2::auth::DownstreamTlsContext>();
+  return std::make_unique<
+      envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext>();
 }
 
 REGISTER_FACTORY(DownstreamSslSocketFactory,
diff --git a/source/extensions/transport_sockets/tls/context_config_impl.cc b/source/extensions/transport_sockets/tls/context_config_impl.cc
index 295aab1ced5b..80e6a960651e 100644
--- a/source/extensions/transport_sockets/tls/context_config_impl.cc
+++ b/source/extensions/transport_sockets/tls/context_config_impl.cc
@@ -3,7 +3,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/empty_string.h"
@@ -22,7 +22,7 @@ namespace Tls {
 namespace {
 
 std::vector<Secret::TlsCertificateConfigProviderSharedPtr> getTlsCertificateConfigProviders(
-    const envoy::api::v2::auth::CommonTlsContext& config,
+    const envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext& config,
     Server::Configuration::TransportSocketFactoryContext& factory_context) {
   if (!config.tls_certificates().empty()) {
     std::vector<Secret::TlsCertificateConfigProviderSharedPtr> providers;
@@ -55,9 +55,9 @@ std::vector<Secret::TlsCertificateConfigProviderSharedPtr> getTlsCertificateConf
   return {};
 }
 
-Secret::CertificateValidationContextConfigProviderSharedPtr
-getProviderFromSds(Server::Configuration::TransportSocketFactoryContext& factory_context,
-                   const envoy::api::v2::auth::SdsSecretConfig& sds_secret_config) {
+Secret::CertificateValidationContextConfigProviderSharedPtr getProviderFromSds(
+    Server::Configuration::TransportSocketFactoryContext& factory_context,
+    const envoy::extensions::transport_sockets::tls::v3alpha::SdsSecretConfig& sds_secret_config) {
   if (sds_secret_config.has_sds_config()) {
     // Fetch dynamic secret.
     return factory_context.secretManager().findOrCreateCertificateValidationContextProvider(
@@ -78,24 +78,28 @@ getProviderFromSds(Server::Configuration::TransportSocketFactoryContext& factory
 
 Secret::CertificateValidationContextConfigProviderSharedPtr
 getCertificateValidationContextConfigProvider(
-    const envoy::api::v2::auth::CommonTlsContext& config,
+    const envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext& config,
     Server::Configuration::TransportSocketFactoryContext& factory_context,
-    std::unique_ptr<envoy::api::v2::auth::CertificateValidationContext>* default_cvc) {
+    std::unique_ptr<
+        envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>*
+        default_cvc) {
   switch (config.validation_context_type_case()) {
-  case envoy::api::v2::auth::CommonTlsContext::ValidationContextTypeCase::kValidationContext: {
+  case envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext::
+      ValidationContextTypeCase::kValidationContext: {
     auto secret_provider =
         factory_context.secretManager().createInlineCertificateValidationContextProvider(
             config.validation_context());
     return secret_provider;
   }
-  case envoy::api::v2::auth::CommonTlsContext::ValidationContextTypeCase::
-      kValidationContextSdsSecretConfig: {
+  case envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext::
+      ValidationContextTypeCase::kValidationContextSdsSecretConfig: {
     const auto& sds_secret_config = config.validation_context_sds_secret_config();
     return getProviderFromSds(factory_context, sds_secret_config);
   }
-  case envoy::api::v2::auth::CommonTlsContext::ValidationContextTypeCase::
-      kCombinedValidationContext: {
-    *default_cvc = std::make_unique<envoy::api::v2::auth::CertificateValidationContext>(
+  case envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext::
+      ValidationContextTypeCase::kCombinedValidationContext: {
+    *default_cvc = std::make_unique<
+        envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>(
         config.combined_validation_context().default_validation_context());
     const auto& sds_secret_config =
         config.combined_validation_context().validation_context_sds_secret_config();
@@ -108,13 +112,15 @@ getCertificateValidationContextConfigProvider(
 
 Secret::TlsSessionTicketKeysConfigProviderSharedPtr getTlsSessionTicketKeysConfigProvider(
     Server::Configuration::TransportSocketFactoryContext& factory_context,
-    const envoy::api::v2::auth::DownstreamTlsContext& config) {
+    const envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext& config) {
 
   switch (config.session_ticket_keys_type_case()) {
-  case envoy::api::v2::auth::DownstreamTlsContext::kSessionTicketKeys:
+  case envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext::
+      SessionTicketKeysTypeCase::kSessionTicketKeys:
     return factory_context.secretManager().createInlineTlsSessionTicketKeysProvider(
         config.session_ticket_keys());
-  case envoy::api::v2::auth::DownstreamTlsContext::kSessionTicketKeysSdsSecretConfig: {
+  case envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext::
+      SessionTicketKeysTypeCase::kSessionTicketKeysSdsSecretConfig: {
     const auto& sds_secret_config = config.session_ticket_keys_sds_secret_config();
     if (sds_secret_config.has_sds_config()) {
       // Fetch dynamic secret.
@@ -132,7 +138,8 @@ Secret::TlsSessionTicketKeysConfigProviderSharedPtr getTlsSessionTicketKeysConfi
       return secret_provider;
     }
   }
-  case envoy::api::v2::auth::DownstreamTlsContext::SESSION_TICKET_KEYS_TYPE_NOT_SET:
+  case envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext::
+      SessionTicketKeysTypeCase::SESSION_TICKET_KEYS_TYPE_NOT_SET:
     return nullptr;
   default:
     throw EnvoyException(fmt::format("Unexpected case for oneof session_ticket_keys: {}",
@@ -143,7 +150,7 @@ Secret::TlsSessionTicketKeysConfigProviderSharedPtr getTlsSessionTicketKeysConfi
 } // namespace
 
 ContextConfigImpl::ContextConfigImpl(
-    const envoy::api::v2::auth::CommonTlsContext& config,
+    const envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext& config,
     const unsigned default_min_protocol_version, const unsigned default_max_protocol_version,
     const std::string& default_cipher_suites, const std::string& default_curves,
     Server::Configuration::TransportSocketFactoryContext& factory_context)
@@ -170,7 +177,8 @@ ContextConfigImpl::ContextConfigImpl(
     // get updated.
     cvc_validation_callback_handle_ =
         certificate_validation_context_provider_->addValidationCallback(
-            [this](const envoy::api::v2::auth::CertificateValidationContext& dynamic_cvc) {
+            [this](const envoy::extensions::transport_sockets::tls::v3alpha::
+                       CertificateValidationContext& dynamic_cvc) {
               getCombinedValidationContextConfig(dynamic_cvc);
             });
   }
@@ -191,8 +199,10 @@ ContextConfigImpl::ContextConfigImpl(
 }
 
 Ssl::CertificateValidationContextConfigPtr ContextConfigImpl::getCombinedValidationContextConfig(
-    const envoy::api::v2::auth::CertificateValidationContext& dynamic_cvc) {
-  envoy::api::v2::auth::CertificateValidationContext combined_cvc = *default_cvc_;
+    const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+        dynamic_cvc) {
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext combined_cvc =
+      *default_cvc_;
   combined_cvc.MergeFrom(dynamic_cvc);
   return std::make_unique<Envoy::Ssl::CertificateValidationContextConfigImpl>(combined_cvc, api_);
 }
@@ -256,17 +266,18 @@ ContextConfigImpl::~ContextConfigImpl() {
 }
 
 unsigned ContextConfigImpl::tlsVersionFromProto(
-    const envoy::api::v2::auth::TlsParameters_TlsProtocol& version, unsigned default_version) {
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol& version,
+    unsigned default_version) {
   switch (version) {
-  case envoy::api::v2::auth::TlsParameters::TLS_AUTO:
+  case envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLS_AUTO:
     return default_version;
-  case envoy::api::v2::auth::TlsParameters::TLSv1_0:
+  case envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0:
     return TLS1_VERSION;
-  case envoy::api::v2::auth::TlsParameters::TLSv1_1:
+  case envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_1:
     return TLS1_1_VERSION;
-  case envoy::api::v2::auth::TlsParameters::TLSv1_2:
+  case envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2:
     return TLS1_2_VERSION;
-  case envoy::api::v2::auth::TlsParameters::TLSv1_3:
+  case envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3:
     return TLS1_3_VERSION;
   default:
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
@@ -304,7 +315,8 @@ const std::string ClientContextConfigImpl::DEFAULT_CURVES =
     "P-256";
 
 ClientContextConfigImpl::ClientContextConfigImpl(
-    const envoy::api::v2::auth::UpstreamTlsContext& config, absl::string_view sigalgs,
+    const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext& config,
+    absl::string_view sigalgs,
     Server::Configuration::TransportSocketFactoryContext& factory_context)
     : ContextConfigImpl(config.common_tls_context(), DEFAULT_MIN_VERSION, DEFAULT_MAX_VERSION,
                         DEFAULT_CIPHER_SUITES, DEFAULT_CURVES, factory_context),
@@ -357,7 +369,7 @@ const std::string ServerContextConfigImpl::DEFAULT_CURVES =
     "P-256";
 
 ServerContextConfigImpl::ServerContextConfigImpl(
-    const envoy::api::v2::auth::DownstreamTlsContext& config,
+    const envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext& config,
     Server::Configuration::TransportSocketFactoryContext& factory_context)
     : ContextConfigImpl(config.common_tls_context(), DEFAULT_MIN_VERSION, DEFAULT_MAX_VERSION,
                         DEFAULT_CIPHER_SUITES, DEFAULT_CURVES, factory_context),
@@ -368,7 +380,8 @@ ServerContextConfigImpl::ServerContextConfigImpl(
   if (session_ticket_keys_provider_ != nullptr) {
     // Validate tls session ticket keys early to reject bad sds updates.
     stk_validation_callback_handle_ = session_ticket_keys_provider_->addValidationCallback(
-        [this](const envoy::api::v2::auth::TlsSessionTicketKeys& keys) {
+        [this](
+            const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys& keys) {
           getSessionTicketKeys(keys);
         });
   }
@@ -415,7 +428,7 @@ void ServerContextConfigImpl::setSecretUpdateCallback(std::function<void()> call
 
 std::vector<Ssl::ServerContextConfig::SessionTicketKey>
 ServerContextConfigImpl::getSessionTicketKeys(
-    const envoy::api::v2::auth::TlsSessionTicketKeys& keys) {
+    const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys& keys) {
   std::vector<Ssl::ServerContextConfig::SessionTicketKey> result;
   for (const auto& datasource : keys.keys()) {
     result.emplace_back(getSessionTicketKey(Config::DataSource::read(datasource, false, api_)));
diff --git a/source/extensions/transport_sockets/tls/context_config_impl.h b/source/extensions/transport_sockets/tls/context_config_impl.h
index 89eec432ce57..92bb35995ab3 100644
--- a/source/extensions/transport_sockets/tls/context_config_impl.h
+++ b/source/extensions/transport_sockets/tls/context_config_impl.h
@@ -3,7 +3,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/secret/secret_callbacks.h"
 #include "envoy/secret/secret_provider.h"
 #include "envoy/server/transport_socket_config.h"
@@ -57,20 +57,21 @@ class ContextConfigImpl : public virtual Ssl::ContextConfig {
   void setSecretUpdateCallback(std::function<void()> callback) override;
 
   Ssl::CertificateValidationContextConfigPtr getCombinedValidationContextConfig(
-      const envoy::api::v2::auth::CertificateValidationContext& dynamic_cvc);
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+          dynamic_cvc);
 
 protected:
-  ContextConfigImpl(const envoy::api::v2::auth::CommonTlsContext& config,
-                    const unsigned default_min_protocol_version,
-                    const unsigned default_max_protocol_version,
-                    const std::string& default_cipher_suites, const std::string& default_curves,
-                    Server::Configuration::TransportSocketFactoryContext& factory_context);
+  ContextConfigImpl(
+      const envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext& config,
+      const unsigned default_min_protocol_version, const unsigned default_max_protocol_version,
+      const std::string& default_cipher_suites, const std::string& default_curves,
+      Server::Configuration::TransportSocketFactoryContext& factory_context);
   Api::Api& api_;
 
 private:
-  static unsigned
-  tlsVersionFromProto(const envoy::api::v2::auth::TlsParameters_TlsProtocol& version,
-                      unsigned default_version);
+  static unsigned tlsVersionFromProto(
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol& version,
+      unsigned default_version);
 
   const std::string alpn_protocols_;
   const std::string cipher_suites_;
@@ -81,7 +82,8 @@ class ContextConfigImpl : public virtual Ssl::ContextConfig {
   // If certificate validation context type is combined_validation_context. default_cvc_
   // holds a copy of CombinedCertificateValidationContext::default_validation_context.
   // Otherwise, default_cvc_ is nullptr.
-  std::unique_ptr<envoy::api::v2::auth::CertificateValidationContext> default_cvc_;
+  std::unique_ptr<envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext>
+      default_cvc_;
   std::vector<Secret::TlsCertificateConfigProviderSharedPtr> tls_certificate_providers_;
   // Handle for TLS certificate dynamic secret callback.
   Common::CallbackHandle* tc_update_callback_handle_{};
@@ -97,10 +99,11 @@ class ContextConfigImpl : public virtual Ssl::ContextConfig {
 class ClientContextConfigImpl : public ContextConfigImpl, public Envoy::Ssl::ClientContextConfig {
 public:
   ClientContextConfigImpl(
-      const envoy::api::v2::auth::UpstreamTlsContext& config, absl::string_view sigalgs,
+      const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext& config,
+      absl::string_view sigalgs,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context);
   ClientContextConfigImpl(
-      const envoy::api::v2::auth::UpstreamTlsContext& config,
+      const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext& config,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context)
       : ClientContextConfigImpl(config, "", secret_provider_context) {}
 
@@ -125,7 +128,7 @@ class ClientContextConfigImpl : public ContextConfigImpl, public Envoy::Ssl::Cli
 class ServerContextConfigImpl : public ContextConfigImpl, public Envoy::Ssl::ServerContextConfig {
 public:
   ServerContextConfigImpl(
-      const envoy::api::v2::auth::DownstreamTlsContext& config,
+      const envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext& config,
       Server::Configuration::TransportSocketFactoryContext& secret_provider_context);
   ~ServerContextConfigImpl() override;
 
@@ -156,8 +159,8 @@ class ServerContextConfigImpl : public ContextConfigImpl, public Envoy::Ssl::Ser
   Common::CallbackHandle* stk_update_callback_handle_{};
   Common::CallbackHandle* stk_validation_callback_handle_{};
 
-  std::vector<ServerContextConfig::SessionTicketKey>
-  getSessionTicketKeys(const envoy::api::v2::auth::TlsSessionTicketKeys& keys);
+  std::vector<ServerContextConfig::SessionTicketKey> getSessionTicketKeys(
+      const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys& keys);
   ServerContextConfig::SessionTicketKey getSessionTicketKey(const std::string& key_data);
 };
 
diff --git a/source/extensions/transport_sockets/tls/context_impl.cc b/source/extensions/transport_sockets/tls/context_impl.cc
index 6f1c88c1e4c3..b44a915d229e 100644
--- a/source/extensions/transport_sockets/tls/context_impl.cc
+++ b/source/extensions/transport_sockets/tls/context_impl.cc
@@ -5,10 +5,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/admin/v2alpha/certs.pb.h"
+#include "envoy/admin/v3alpha/certs.pb.h"
 #include "envoy/common/exception.h"
 #include "envoy/common/platform.h"
 #include "envoy/stats/scope.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/base64.h"
@@ -186,7 +187,7 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
     }
 
     if (!cert_validation_config->subjectAltNameMatchers().empty()) {
-      for (const ::envoy::type::matcher::StringMatcher& matcher :
+      for (const envoy::type::matcher::v3alpha::StringMatcher& matcher :
            cert_validation_config->subjectAltNameMatchers()) {
         subject_alt_name_matchers_.push_back(Matchers::StringMatcherImpl(matcher));
       }
@@ -751,7 +752,7 @@ std::vector<Envoy::Ssl::CertificateDetailsPtr> ContextImpl::getCertChainInformat
 Envoy::Ssl::CertificateDetailsPtr ContextImpl::certificateDetails(X509* cert,
                                                                   const std::string& path) const {
   Envoy::Ssl::CertificateDetailsPtr certificate_details =
-      std::make_unique<envoy::admin::v2alpha::CertificateDetails>();
+      std::make_unique<envoy::admin::v3alpha::CertificateDetails>();
   certificate_details->set_path(path);
   certificate_details->set_serial_number(Utility::getSerialNumberFromCertificate(*cert));
   certificate_details->set_days_until_expiration(
@@ -762,12 +763,12 @@ Envoy::Ssl::CertificateDetailsPtr ContextImpl::certificateDetails(X509* cert,
   TimestampUtil::systemClockToTimestamp(Utility::getExpirationTime(*cert), *expiration_time);
 
   for (auto& dns_san : Utility::getSubjectAltNames(*cert, GEN_DNS)) {
-    envoy::admin::v2alpha::SubjectAlternateName& subject_alt_name =
+    envoy::admin::v3alpha::SubjectAlternateName& subject_alt_name =
         *certificate_details->add_subject_alt_names();
     subject_alt_name.set_dns(dns_san);
   }
   for (auto& uri_san : Utility::getSubjectAltNames(*cert, GEN_URI)) {
-    envoy::admin::v2alpha::SubjectAlternateName& subject_alt_name =
+    envoy::admin::v3alpha::SubjectAlternateName& subject_alt_name =
         *certificate_details->add_subject_alt_names();
     subject_alt_name.set_uri(uri_san);
   }
diff --git a/source/extensions/transport_sockets/tls/private_key/BUILD b/source/extensions/transport_sockets/tls/private_key/BUILD
index 1c0283a84ab8..e0700d5c1e0f 100644
--- a/source/extensions/transport_sockets/tls/private_key/BUILD
+++ b/source/extensions/transport_sockets/tls/private_key/BUILD
@@ -21,6 +21,6 @@ envoy_cc_library(
         "//include/envoy/registry",
         "//include/envoy/ssl/private_key:private_key_config_interface",
         "//include/envoy/ssl/private_key:private_key_interface",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.cc b/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.cc
index d2008a40a5cd..d8d53c9aaf70 100644
--- a/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.cc
+++ b/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.cc
@@ -1,6 +1,6 @@
 #include "extensions/transport_sockets/tls/private_key/private_key_manager_impl.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/registry/registry.h"
 
 namespace Envoy {
@@ -10,7 +10,7 @@ namespace Tls {
 
 Envoy::Ssl::PrivateKeyMethodProviderSharedPtr
 PrivateKeyMethodManagerImpl::createPrivateKeyMethodProvider(
-    const envoy::api::v2::auth::PrivateKeyProvider& config,
+    const envoy::extensions::transport_sockets::tls::v3alpha::PrivateKeyProvider& config,
     Server::Configuration::TransportSocketFactoryContext& factory_context) {
 
   Ssl::PrivateKeyMethodProviderInstanceFactory* factory =
diff --git a/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.h b/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.h
index 1ae42d1916ec..0d45ed9079db 100644
--- a/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.h
+++ b/source/extensions/transport_sockets/tls/private_key/private_key_manager_impl.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/ssl/private_key/private_key.h"
 #include "envoy/ssl/private_key/private_key_config.h"
 
@@ -13,7 +13,7 @@ class PrivateKeyMethodManagerImpl : public virtual Ssl::PrivateKeyMethodManager
 public:
   // Ssl::PrivateKeyMethodManager
   Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProvider(
-      const envoy::api::v2::auth::PrivateKeyProvider& config,
+      const envoy::extensions::transport_sockets::tls::v3alpha::PrivateKeyProvider& config,
       Server::Configuration::TransportSocketFactoryContext& factory_context) override;
 };
 
diff --git a/source/server/BUILD b/source/server/BUILD
index 5da0b5fd4721..115cf25bb372 100644
--- a/source/server/BUILD
+++ b/source/server/BUILD
@@ -48,9 +48,9 @@ envoy_cc_library(
         "//source/common/network:utility_lib",
         "//source/common/protobuf:utility_lib",
         "//source/common/tracing:http_tracer_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -91,7 +91,7 @@ envoy_cc_library(
         "//include/envoy/server:instance_interface",
         "//source/common/common:assert_lib",
         "//source/common/common:minimal_logger_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -239,7 +239,7 @@ envoy_cc_library(
         "//source/common/config:utility_lib",
         "//source/common/stats:symbol_table_lib",
         "//source/server:resource_monitor_config_lib",
-        "@envoy_api//envoy/config/overload/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/overload/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -258,10 +258,11 @@ envoy_cc_library(
         "//source/common/config:utility_lib",
         "//source/common/init:target_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -293,9 +294,8 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/listener:well_known_names",
         "//source/extensions/transport_sockets:well_known_names",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -328,10 +328,9 @@ envoy_cc_library(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/listener:well_known_names",
         "//source/extensions/transport_sockets:well_known_names",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -347,7 +346,7 @@ envoy_cc_library(
         "//source/common/network:cidr_range_lib",
         "//source/common/network:lc_trie_lib",
         "//source/server:configuration_lib",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -432,8 +431,8 @@ envoy_cc_library(
         "//source/common/upstream:health_discovery_service_lib",
         "//source/server:overload_manager_lib",
         "//source/server/http:admin_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/server/config_validation/BUILD b/source/server/config_validation/BUILD
index 98f62ae02a87..50c9a1778923 100644
--- a/source/server/config_validation/BUILD
+++ b/source/server/config_validation/BUILD
@@ -49,8 +49,8 @@ envoy_cc_library(
         "//source/common/common:utility_lib",
         "//source/common/http:context_lib",
         "//source/common/upstream:cluster_manager_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -109,9 +109,8 @@ envoy_cc_library(
         "//source/server:configuration_lib",
         "//source/server:server_lib",
         "//source/server/http:admin_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/server/config_validation/cluster_manager.cc b/source/server/config_validation/cluster_manager.cc
index 80599afc5321..798addeb3d21 100644
--- a/source/server/config_validation/cluster_manager.cc
+++ b/source/server/config_validation/cluster_manager.cc
@@ -1,7 +1,7 @@
 #include "server/config_validation/cluster_manager.h"
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 
 #include "common/common/utility.h"
 
@@ -9,15 +9,14 @@ namespace Envoy {
 namespace Upstream {
 
 ClusterManagerPtr ValidationClusterManagerFactory::clusterManagerFromProto(
-    const envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
   return std::make_unique<ValidationClusterManager>(
       bootstrap, *this, stats_, tls_, runtime_, random_, local_info_, log_manager_,
       main_thread_dispatcher_, admin_, validation_context_, api_, http_context_, time_system_);
 }
 
-CdsApiPtr
-ValidationClusterManagerFactory::createCds(const envoy::api::v2::core::ConfigSource& cds_config,
-                                           ClusterManager& cm) {
+CdsApiPtr ValidationClusterManagerFactory::createCds(
+    const envoy::config::core::v3alpha::ConfigSource& cds_config, ClusterManager& cm) {
   // Create the CdsApiImpl...
   ProdClusterManagerFactory::createCds(cds_config, cm);
   // ... and then throw it away, so that we don't actually connect to it.
@@ -25,7 +24,7 @@ ValidationClusterManagerFactory::createCds(const envoy::api::v2::core::ConfigSou
 }
 
 ValidationClusterManager::ValidationClusterManager(
-    const envoy::config::bootstrap::v2::Bootstrap& bootstrap, ClusterManagerFactory& factory,
+    const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap, ClusterManagerFactory& factory,
     Stats::Store& stats, ThreadLocal::Instance& tls, Runtime::Loader& runtime,
     Runtime::RandomGenerator& random, const LocalInfo::LocalInfo& local_info,
     AccessLog::AccessLogManager& log_manager, Event::Dispatcher& main_thread_dispatcher,
diff --git a/source/server/config_validation/cluster_manager.h b/source/server/config_validation/cluster_manager.h
index f861363a7a1e..c3fd7d67d24b 100644
--- a/source/server/config_validation/cluster_manager.h
+++ b/source/server/config_validation/cluster_manager.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/secret/secret_manager.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -36,11 +36,11 @@ class ValidationClusterManagerFactory : public ProdClusterManagerFactory {
         time_system_(time_system) {}
 
   ClusterManagerPtr
-  clusterManagerFromProto(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) override;
+  clusterManagerFromProto(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) override;
 
   // Delegates to ProdClusterManagerFactory::createCds, but discards the result and returns nullptr
   // unconditionally.
-  CdsApiPtr createCds(const envoy::api::v2::core::ConfigSource& cds_config,
+  CdsApiPtr createCds(const envoy::config::core::v3alpha::ConfigSource& cds_config,
                       ClusterManager& cm) override;
 
 private:
@@ -52,7 +52,7 @@ class ValidationClusterManagerFactory : public ProdClusterManagerFactory {
  */
 class ValidationClusterManager : public ClusterManagerImpl {
 public:
-  ValidationClusterManager(const envoy::config::bootstrap::v2::Bootstrap& bootstrap,
+  ValidationClusterManager(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
                            ClusterManagerFactory& factory, Stats::Store& stats,
                            ThreadLocal::Instance& tls, Runtime::Loader& runtime,
                            Runtime::RandomGenerator& random, const LocalInfo::LocalInfo& local_info,
diff --git a/source/server/config_validation/server.cc b/source/server/config_validation/server.cc
index 475e563d24fc..891a77f84473 100644
--- a/source/server/config_validation/server.cc
+++ b/source/server/config_validation/server.cc
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/common/utility.h"
 #include "common/common/version.h"
@@ -74,7 +74,7 @@ void ValidationInstance::initialize(const Options& options,
   // If we get all the way through that stripped-down initialization flow, to the point where we'd
   // be ready to serve, then the config has passed validation.
   // Handle configuration that needs to take place prior to the main configuration load.
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   InstanceUtil::loadBootstrapConfig(bootstrap, options,
                                     messageValidationContext().staticValidationVisitor(), *api_);
 
diff --git a/source/server/config_validation/server.h b/source/server/config_validation/server.h
index 71483c76ce55..326d982a8f6e 100644
--- a/source/server/config_validation/server.h
+++ b/source/server/config_validation/server.h
@@ -2,9 +2,9 @@
 
 #include <iostream>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/server/drain_manager.h"
 #include "envoy/server/instance.h"
@@ -112,23 +112,23 @@ class ValidationInstance final : Logger::Loggable<Logger::Id::main>,
   Configuration::ServerFactoryContext& serverFactoryContext() override { return server_context_; }
 
   // Server::ListenerComponentFactory
-  LdsApiPtr createLdsApi(const envoy::api::v2::core::ConfigSource& lds_config) override {
+  LdsApiPtr createLdsApi(const envoy::config::core::v3alpha::ConfigSource& lds_config) override {
     return std::make_unique<LdsApiImpl>(lds_config, clusterManager(), initManager(), stats(),
                                         listenerManager(),
                                         messageValidationContext().dynamicValidationVisitor());
   }
   std::vector<Network::FilterFactoryCb> createNetworkFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
       Configuration::FactoryContext& context) override {
     return ProdListenerComponentFactory::createNetworkFilterFactoryList_(filters, context);
   }
   std::vector<Network::ListenerFilterFactoryCb> createListenerFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context) override {
     return ProdListenerComponentFactory::createListenerFilterFactoryList_(filters, context);
   }
   std::vector<Network::UdpListenerFilterFactoryCb> createUdpListenerFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context) override {
     return ProdListenerComponentFactory::createUdpListenerFilterFactoryList_(filters, context);
   }
@@ -140,7 +140,8 @@ class ValidationInstance final : Logger::Loggable<Logger::Id::main>,
     // validation mock.
     return nullptr;
   }
-  DrainManagerPtr createDrainManager(envoy::api::v2::Listener::DrainType) override {
+  DrainManagerPtr
+  createDrainManager(envoy::config::listener::v3alpha::Listener::DrainType) override {
     return nullptr;
   }
   uint64_t nextListenerTag() override { return 0; }
diff --git a/source/server/configuration_impl.cc b/source/server/configuration_impl.cc
index eeb325e2d11b..da1739c158da 100644
--- a/source/server/configuration_impl.cc
+++ b/source/server/configuration_impl.cc
@@ -6,9 +6,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/server/instance.h"
@@ -55,7 +55,7 @@ void FilterChainUtility::buildUdpFilterChain(
   }
 }
 
-void MainImpl::initialize(const envoy::config::bootstrap::v2::Bootstrap& bootstrap,
+void MainImpl::initialize(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
                           Instance& server,
                           Upstream::ClusterManagerFactory& cluster_manager_factory) {
   const auto& secrets = bootstrap.static_resources().secrets();
@@ -92,7 +92,7 @@ void MainImpl::initialize(const envoy::config::bootstrap::v2::Bootstrap& bootstr
   initializeStatsSinks(bootstrap, server);
 }
 
-void MainImpl::initializeTracers(const envoy::config::trace::v2::Tracing& configuration,
+void MainImpl::initializeTracers(const envoy::config::trace::v3alpha::Tracing& configuration,
                                  Instance& server) {
   ENVOY_LOG(info, "loading tracing configuration");
 
@@ -112,11 +112,11 @@ void MainImpl::initializeTracers(const envoy::config::trace::v2::Tracing& config
   http_tracer_ = factory.createHttpTracer(*message, server);
 }
 
-void MainImpl::initializeStatsSinks(const envoy::config::bootstrap::v2::Bootstrap& bootstrap,
+void MainImpl::initializeStatsSinks(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
                                     Instance& server) {
   ENVOY_LOG(info, "loading stats sink configuration");
 
-  for (const envoy::config::metrics::v2::StatsSink& sink_object : bootstrap.stats_sinks()) {
+  for (const envoy::config::metrics::v3alpha::StatsSink& sink_object : bootstrap.stats_sinks()) {
     // Generate factory and translate stats sink custom config
     auto& factory = Config::Utility::getAndCheckFactory<StatsSinkFactory>(sink_object.name());
     ProtobufTypes::MessagePtr message = Config::Utility::translateToFactoryConfig(
@@ -126,7 +126,7 @@ void MainImpl::initializeStatsSinks(const envoy::config::bootstrap::v2::Bootstra
   }
 }
 
-InitialImpl::InitialImpl(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+InitialImpl::InitialImpl(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
   const auto& admin = bootstrap.admin();
   admin_.access_log_path_ = admin.access_log_path();
   admin_.profile_path_ =
@@ -151,7 +151,7 @@ InitialImpl::InitialImpl(const envoy::config::bootstrap::v2::Bootstrap& bootstra
       layered_runtime_.add_layers()->mutable_admin_layer();
     }
   } else {
-    Config::translateRuntime(bootstrap.runtime(), layered_runtime_);
+    Config::translateRuntime(bootstrap.hidden_envoy_deprecated_runtime(), layered_runtime_);
   }
 }
 
diff --git a/source/server/configuration_impl.h b/source/server/configuration_impl.h
index 9b167dce863c..c07957d073d7 100644
--- a/source/server/configuration_impl.h
+++ b/source/server/configuration_impl.h
@@ -9,8 +9,8 @@
 #include <unordered_map>
 #include <utility>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/network/filter.h"
 #include "envoy/server/configuration.h"
@@ -111,7 +111,7 @@ class MainImpl : Logger::Loggable<Logger::Id::config>, public Main {
    * @param server supplies the owning server.
    * @param cluster_manager_factory supplies the cluster manager creation factory.
    */
-  void initialize(const envoy::config::bootstrap::v2::Bootstrap& bootstrap, Instance& server,
+  void initialize(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap, Instance& server,
                   Upstream::ClusterManagerFactory& cluster_manager_factory);
 
   // Server::Configuration::Main
@@ -132,9 +132,10 @@ class MainImpl : Logger::Loggable<Logger::Id::config>, public Main {
   /**
    * Initialize tracers and corresponding sinks.
    */
-  void initializeTracers(const envoy::config::trace::v2::Tracing& configuration, Instance& server);
+  void initializeTracers(const envoy::config::trace::v3alpha::Tracing& configuration,
+                         Instance& server);
 
-  void initializeStatsSinks(const envoy::config::bootstrap::v2::Bootstrap& bootstrap,
+  void initializeStatsSinks(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
                             Instance& server);
 
   std::unique_ptr<Upstream::ClusterManager> cluster_manager_;
@@ -152,12 +153,12 @@ class MainImpl : Logger::Loggable<Logger::Id::config>, public Main {
  */
 class InitialImpl : public Initial {
 public:
-  InitialImpl(const envoy::config::bootstrap::v2::Bootstrap& bootstrap);
+  InitialImpl(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap);
 
   // Server::Configuration::Initial
   Admin& admin() override { return admin_; }
   absl::optional<std::string> flagsPath() override { return flags_path_; }
-  const envoy::config::bootstrap::v2::LayeredRuntime& runtime() override {
+  const envoy::config::bootstrap::v3alpha::LayeredRuntime& runtime() override {
     return layered_runtime_;
   }
 
@@ -177,7 +178,7 @@ class InitialImpl : public Initial {
 
   AdminImpl admin_;
   absl::optional<std::string> flags_path_;
-  envoy::config::bootstrap::v2::LayeredRuntime layered_runtime_;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime_;
 };
 
 } // namespace Configuration
diff --git a/source/server/drain_manager_impl.cc b/source/server/drain_manager_impl.cc
index 56872561187a..15a655b1a158 100644
--- a/source/server/drain_manager_impl.cc
+++ b/source/server/drain_manager_impl.cc
@@ -4,7 +4,7 @@
 #include <cstdint>
 #include <functional>
 
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/timer.h"
 #include "envoy/runtime/runtime.h"
@@ -15,7 +15,8 @@
 namespace Envoy {
 namespace Server {
 
-DrainManagerImpl::DrainManagerImpl(Instance& server, envoy::api::v2::Listener::DrainType drain_type)
+DrainManagerImpl::DrainManagerImpl(Instance& server,
+                                   envoy::config::listener::v3alpha::Listener::DrainType drain_type)
     : server_(server), drain_type_(drain_type) {}
 
 bool DrainManagerImpl::drainClose() const {
@@ -25,7 +26,8 @@ bool DrainManagerImpl::drainClose() const {
   // if even in the case of server health check failure we had some period of drain ramp up. This
   // would allow the other side to fail health check for the host which will require some thread
   // jumps versus immediately start GOAWAY/connection thrashing.
-  if (drain_type_ == envoy::api::v2::Listener::DEFAULT && server_.healthCheckFailed()) {
+  if (drain_type_ == envoy::config::listener::v3alpha::Listener::DEFAULT &&
+      server_.healthCheckFailed()) {
     return true;
   }
 
diff --git a/source/server/drain_manager_impl.h b/source/server/drain_manager_impl.h
index 1bee06b92d20..1d7408373622 100644
--- a/source/server/drain_manager_impl.h
+++ b/source/server/drain_manager_impl.h
@@ -3,7 +3,7 @@
 #include <chrono>
 #include <functional>
 
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 #include "envoy/server/drain_manager.h"
 #include "envoy/server/instance.h"
 
@@ -20,7 +20,8 @@ namespace Server {
  */
 class DrainManagerImpl : Logger::Loggable<Logger::Id::main>, public DrainManager {
 public:
-  DrainManagerImpl(Instance& server, envoy::api::v2::Listener::DrainType drain_type);
+  DrainManagerImpl(Instance& server,
+                   envoy::config::listener::v3alpha::Listener::DrainType drain_type);
 
   // Server::DrainManager
   bool drainClose() const override;
@@ -31,7 +32,7 @@ class DrainManagerImpl : Logger::Loggable<Logger::Id::main>, public DrainManager
   void drainSequenceTick();
 
   Instance& server_;
-  const envoy::api::v2::Listener::DrainType drain_type_;
+  const envoy::config::listener::v3alpha::Listener::DrainType drain_type_;
   Event::TimerPtr drain_tick_timer_;
   std::atomic<bool> draining_{false};
   std::atomic<uint32_t> drain_time_completed_{};
diff --git a/source/server/filter_chain_manager_impl.cc b/source/server/filter_chain_manager_impl.cc
index 5bf3073a6fcd..a027229c0d81 100644
--- a/source/server/filter_chain_manager_impl.cc
+++ b/source/server/filter_chain_manager_impl.cc
@@ -1,6 +1,6 @@
 #include "server/filter_chain_manager_impl.h"
 
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/common/fmt.h"
@@ -30,9 +30,9 @@ bool FilterChainManagerImpl::isWildcardServerName(const std::string& name) {
 }
 
 void FilterChainManagerImpl::addFilterChain(
-    absl::Span<const ::envoy::api::v2::listener::FilterChain* const> filter_chain_span,
+    absl::Span<const envoy::config::listener::v3alpha::FilterChain* const> filter_chain_span,
     FilterChainFactoryBuilder& filter_chain_factory_builder) {
-  std::unordered_set<envoy::api::v2::listener::FilterChainMatch, MessageUtil, MessageUtil>
+  std::unordered_set<envoy::config::listener::v3alpha::FilterChainMatch, MessageUtil, MessageUtil>
       filter_chains;
   for (const auto& filter_chain : filter_chain_span) {
     const auto& filter_chain_match = filter_chain->filter_chain_match();
@@ -91,7 +91,7 @@ void FilterChainManagerImpl::addFilterChainForDestinationPorts(
     const std::vector<std::string>& destination_ips,
     const absl::Span<const std::string* const> server_names, const std::string& transport_protocol,
     const absl::Span<const std::string* const> application_protocols,
-    const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+    const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
     const std::vector<std::string>& source_ips,
     const absl::Span<const Protobuf::uint32> source_ports,
     const Network::FilterChainSharedPtr& filter_chain) {
@@ -108,7 +108,7 @@ void FilterChainManagerImpl::addFilterChainForDestinationIPs(
     DestinationIPsMap& destination_ips_map, const std::vector<std::string>& destination_ips,
     const absl::Span<const std::string* const> server_names, const std::string& transport_protocol,
     const absl::Span<const std::string* const> application_protocols,
-    const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+    const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
     const std::vector<std::string>& source_ips,
     const absl::Span<const Protobuf::uint32> source_ports,
     const Network::FilterChainSharedPtr& filter_chain) {
@@ -129,7 +129,7 @@ void FilterChainManagerImpl::addFilterChainForServerNames(
     ServerNamesMapSharedPtr& server_names_map_ptr,
     const absl::Span<const std::string* const> server_names, const std::string& transport_protocol,
     const absl::Span<const std::string* const> application_protocols,
-    const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+    const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
     const std::vector<std::string>& source_ips,
     const absl::Span<const Protobuf::uint32> source_ports,
     const Network::FilterChainSharedPtr& filter_chain) {
@@ -161,7 +161,7 @@ void FilterChainManagerImpl::addFilterChainForServerNames(
 void FilterChainManagerImpl::addFilterChainForApplicationProtocols(
     ApplicationProtocolsMap& application_protocols_map,
     const absl::Span<const std::string* const> application_protocols,
-    const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+    const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
     const std::vector<std::string>& source_ips,
     const absl::Span<const Protobuf::uint32> source_ports,
     const Network::FilterChainSharedPtr& filter_chain) {
@@ -178,7 +178,7 @@ void FilterChainManagerImpl::addFilterChainForApplicationProtocols(
 
 void FilterChainManagerImpl::addFilterChainForSourceTypes(
     SourceTypesArray& source_types_array,
-    const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+    const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
     const std::vector<std::string>& source_ips,
     const absl::Span<const Protobuf::uint32> source_ports,
     const Network::FilterChainSharedPtr& filter_chain) {
@@ -359,10 +359,11 @@ const Network::FilterChain* FilterChainManagerImpl::findFilterChainForApplicatio
 const Network::FilterChain* FilterChainManagerImpl::findFilterChainForSourceTypes(
     const SourceTypesArray& source_types, const Network::ConnectionSocket& socket) const {
 
-  const auto& filter_chain_local = source_types[envoy::api::v2::listener::FilterChainMatch::LOCAL];
+  const auto& filter_chain_local =
+      source_types[envoy::config::listener::v3alpha::FilterChainMatch::SAME_IP_OR_LOOPBACK];
 
   const auto& filter_chain_external =
-      source_types[envoy::api::v2::listener::FilterChainMatch::EXTERNAL];
+      source_types[envoy::config::listener::v3alpha::FilterChainMatch::EXTERNAL];
 
   // isSameIpOrLoopback can be expensive. Call it only if LOCAL or EXTERNAL have entries.
   const bool is_local_connection =
@@ -380,7 +381,8 @@ const Network::FilterChain* FilterChainManagerImpl::findFilterChainForSourceType
     }
   }
 
-  const auto& filter_chain_any = source_types[envoy::api::v2::listener::FilterChainMatch::ANY];
+  const auto& filter_chain_any =
+      source_types[envoy::config::listener::v3alpha::FilterChainMatch::ANY];
 
   if (!filter_chain_any.first.empty()) {
     return findFilterChainForSourceIpAndPort(*filter_chain_any.second, socket);
diff --git a/source/server/filter_chain_manager_impl.h b/source/server/filter_chain_manager_impl.h
index 6a06bcc7c6a0..e209e7964223 100644
--- a/source/server/filter_chain_manager_impl.h
+++ b/source/server/filter_chain_manager_impl.h
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/server/transport_socket_config.h"
 
 #include "common/common/logger.h"
@@ -18,7 +18,7 @@ class FilterChainFactoryBuilder {
 public:
   virtual ~FilterChainFactoryBuilder() = default;
   virtual std::unique_ptr<Network::FilterChain>
-  buildFilterChain(const ::envoy::api::v2::listener::FilterChain& filter_chain) const PURE;
+  buildFilterChain(const envoy::config::listener::v3alpha::FilterChain& filter_chain) const PURE;
 };
 
 /**
@@ -34,9 +34,9 @@ class FilterChainManagerImpl : public Network::FilterChainManager,
   const Network::FilterChain*
   findFilterChain(const Network::ConnectionSocket& socket) const override;
 
-  void
-  addFilterChain(absl::Span<const ::envoy::api::v2::listener::FilterChain* const> filter_chain_span,
-                 FilterChainFactoryBuilder& b);
+  void addFilterChain(
+      absl::Span<const envoy::config::listener::v3alpha::FilterChain* const> filter_chain_span,
+      FilterChainFactoryBuilder& b);
   static bool isWildcardServerName(const std::string& name);
 
 private:
@@ -66,7 +66,7 @@ class FilterChainManagerImpl : public Network::FilterChainManager,
       const absl::Span<const std::string* const> server_names,
       const std::string& transport_protocol,
       const absl::Span<const std::string* const> application_protocols,
-      const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+      const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
       const std::vector<std::string>& source_ips,
       const absl::Span<const Protobuf::uint32> source_ports,
       const Network::FilterChainSharedPtr& filter_chain);
@@ -75,7 +75,7 @@ class FilterChainManagerImpl : public Network::FilterChainManager,
       const absl::Span<const std::string* const> server_names,
       const std::string& transport_protocol,
       const absl::Span<const std::string* const> application_protocols,
-      const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+      const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
       const std::vector<std::string>& source_ips,
       const absl::Span<const Protobuf::uint32> source_ports,
       const Network::FilterChainSharedPtr& filter_chain);
@@ -84,20 +84,20 @@ class FilterChainManagerImpl : public Network::FilterChainManager,
       const absl::Span<const std::string* const> server_names,
       const std::string& transport_protocol,
       const absl::Span<const std::string* const> application_protocols,
-      const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+      const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
       const std::vector<std::string>& source_ips,
       const absl::Span<const Protobuf::uint32> source_ports,
       const Network::FilterChainSharedPtr& filter_chain);
   void addFilterChainForApplicationProtocols(
       ApplicationProtocolsMap& application_protocol_map,
       const absl::Span<const std::string* const> application_protocols,
-      const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+      const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
       const std::vector<std::string>& source_ips,
       const absl::Span<const Protobuf::uint32> source_ports,
       const Network::FilterChainSharedPtr& filter_chain);
   void addFilterChainForSourceTypes(
       SourceTypesArray& source_types_array,
-      const envoy::api::v2::listener::FilterChainMatch_ConnectionSourceType source_type,
+      const envoy::config::listener::v3alpha::FilterChainMatch::ConnectionSourceType source_type,
       const std::vector<std::string>& source_ips,
       const absl::Span<const Protobuf::uint32> source_ports,
       const Network::FilterChainSharedPtr& filter_chain);
diff --git a/source/server/http/BUILD b/source/server/http/BUILD
index 80ad9c393424..df1035813aaa 100644
--- a/source/server/http/BUILD
+++ b/source/server/http/BUILD
@@ -60,10 +60,10 @@ envoy_cc_library(
         "//source/common/stats:stats_lib",
         "//source/common/upstream:host_utility_lib",
         "//source/extensions/access_loggers/file:file_access_log_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/source/server/http/admin.cc b/source/server/http/admin.cc
index eb0f883b612e..92d6589d42db 100644
--- a/source/server/http/admin.cc
+++ b/source/server/http/admin.cc
@@ -10,15 +10,15 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/admin/v2alpha/certs.pb.h"
-#include "envoy/admin/v2alpha/clusters.pb.h"
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/admin/v2alpha/listeners.pb.h"
-#include "envoy/admin/v2alpha/memory.pb.h"
-#include "envoy/admin/v2alpha/metrics.pb.h"
-#include "envoy/admin/v2alpha/mutex_stats.pb.h"
-#include "envoy/admin/v2alpha/server_info.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
+#include "envoy/admin/v3alpha/certs.pb.h"
+#include "envoy/admin/v3alpha/clusters.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/admin/v3alpha/listeners.pb.h"
+#include "envoy/admin/v3alpha/memory.pb.h"
+#include "envoy/admin/v3alpha/metrics.pb.h"
+#include "envoy/admin/v3alpha/mutex_stats.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
 #include "envoy/filesystem/filesystem.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/server/hot_restart.h"
@@ -193,7 +193,7 @@ absl::optional<std::string> maskParam(const Http::Utility::QueryParams& params)
 // Helper method that ensures that we've setting flags based on all the health flag values on the
 // host.
 void setHealthFlag(Upstream::Host::HealthFlag flag, const Upstream::Host& host,
-                   envoy::admin::v2alpha::HostHealthStatus& health_status) {
+                   envoy::admin::v3alpha::HostHealthStatus& health_status) {
   switch (flag) {
   case Upstream::Host::HealthFlag::FAILED_ACTIVE_HC:
     health_status.set_failed_active_health_check(
@@ -206,11 +206,11 @@ void setHealthFlag(Upstream::Host::HealthFlag flag, const Upstream::Host& host,
   case Upstream::Host::HealthFlag::FAILED_EDS_HEALTH:
   case Upstream::Host::HealthFlag::DEGRADED_EDS_HEALTH:
     if (host.healthFlagGet(Upstream::Host::HealthFlag::FAILED_EDS_HEALTH)) {
-      health_status.set_eds_health_status(envoy::api::v2::core::HealthStatus::UNHEALTHY);
+      health_status.set_eds_health_status(envoy::config::core::v3alpha::UNHEALTHY);
     } else if (host.healthFlagGet(Upstream::Host::HealthFlag::DEGRADED_EDS_HEALTH)) {
-      health_status.set_eds_health_status(envoy::api::v2::core::HealthStatus::DEGRADED);
+      health_status.set_eds_health_status(envoy::config::core::v3alpha::DEGRADED);
     } else {
-      health_status.set_eds_health_status(envoy::api::v2::core::HealthStatus::HEALTHY);
+      health_status.set_eds_health_status(envoy::config::core::v3alpha::HEALTHY);
     }
     break;
   case Upstream::Host::HealthFlag::DEGRADED_ACTIVE_HC:
@@ -365,12 +365,12 @@ void AdminImpl::addCircuitSettings(const std::string& cluster_name, const std::s
 }
 
 void AdminImpl::writeClustersAsJson(Buffer::Instance& response) {
-  envoy::admin::v2alpha::Clusters clusters;
+  envoy::admin::v3alpha::Clusters clusters;
   for (auto& cluster_pair : server_.clusterManager().clusters()) {
     const Upstream::Cluster& cluster = cluster_pair.second.get();
     Upstream::ClusterInfoConstSharedPtr cluster_info = cluster.info();
 
-    envoy::admin::v2alpha::ClusterStatus& cluster_status = *clusters.add_cluster_statuses();
+    envoy::admin::v3alpha::ClusterStatus& cluster_status = *clusters.add_cluster_statuses();
     cluster_status.set_name(cluster_info->name());
 
     const Upstream::Outlier::Detector* outlier_detector = cluster.outlierDetector();
@@ -393,7 +393,7 @@ void AdminImpl::writeClustersAsJson(Buffer::Instance& response) {
 
     for (auto& host_set : cluster.prioritySet().hostSetsPerPriority()) {
       for (auto& host : host_set->hosts()) {
-        envoy::admin::v2alpha::HostStatus& host_status = *cluster_status.add_host_statuses();
+        envoy::admin::v3alpha::HostStatus& host_status = *cluster_status.add_host_statuses();
         Network::Utility::addressToProtobufAddress(*host->address(),
                                                    *host_status.mutable_address());
         host_status.set_hostname(host->hostname());
@@ -402,17 +402,17 @@ void AdminImpl::writeClustersAsJson(Buffer::Instance& response) {
           auto& metric = *host_status.add_stats();
           metric.set_name(std::string(named_counter.first));
           metric.set_value(named_counter.second.get().value());
-          metric.set_type(envoy::admin::v2alpha::SimpleMetric::COUNTER);
+          metric.set_type(envoy::admin::v3alpha::SimpleMetric::COUNTER);
         }
 
         for (const auto& named_gauge : host->gauges()) {
           auto& metric = *host_status.add_stats();
           metric.set_name(std::string(named_gauge.first));
           metric.set_value(named_gauge.second.get().value());
-          metric.set_type(envoy::admin::v2alpha::SimpleMetric::GAUGE);
+          metric.set_type(envoy::admin::v3alpha::SimpleMetric::GAUGE);
         }
 
-        envoy::admin::v2alpha::HostHealthStatus& health_status =
+        envoy::admin::v3alpha::HostHealthStatus& health_status =
             *host_status.mutable_health_status();
 
 // Invokes setHealthFlag for each health flag.
@@ -505,9 +505,9 @@ void AdminImpl::writeClustersAsText(Buffer::Instance& response) {
 }
 
 void AdminImpl::writeListenersAsJson(Buffer::Instance& response) {
-  envoy::admin::v2alpha::Listeners listeners;
+  envoy::admin::v3alpha::Listeners listeners;
   for (const auto& listener : server_.listenerManager().listeners()) {
-    envoy::admin::v2alpha::ListenerStatus& listener_status = *listeners.add_listener_statuses();
+    envoy::admin::v3alpha::ListenerStatus& listener_status = *listeners.add_listener_statuses();
     listener_status.set_name(listener.get().name());
     Network::Utility::addressToProtobufAddress(*listener.get().listenSocketFactory().localAddress(),
                                                *listener_status.mutable_local_address());
@@ -537,7 +537,7 @@ Http::Code AdminImpl::handlerClusters(absl::string_view url, Http::HeaderMap& re
   return Http::Code::OK;
 }
 
-void AdminImpl::addAllConfigToDump(envoy::admin::v2alpha::ConfigDump& dump,
+void AdminImpl::addAllConfigToDump(envoy::admin::v3alpha::ConfigDump& dump,
                                    const absl::optional<std::string>& mask) const {
   for (const auto& key_callback_pair : config_tracker_.getCallbacksMap()) {
     ProtobufTypes::MessagePtr message = key_callback_pair.second();
@@ -555,7 +555,7 @@ void AdminImpl::addAllConfigToDump(envoy::admin::v2alpha::ConfigDump& dump,
 }
 
 absl::optional<std::pair<Http::Code, std::string>>
-AdminImpl::addResourceToDump(envoy::admin::v2alpha::ConfigDump& dump,
+AdminImpl::addResourceToDump(envoy::admin::v3alpha::ConfigDump& dump,
                              const absl::optional<std::string>& mask,
                              const std::string& resource) const {
   for (const auto& key_callback_pair : config_tracker_.getCallbacksMap()) {
@@ -599,7 +599,7 @@ Http::Code AdminImpl::handlerConfigDump(absl::string_view url, Http::HeaderMap&
   const auto resource = resourceParam(query_params);
   const auto mask = maskParam(query_params);
 
-  envoy::admin::v2alpha::ConfigDump dump;
+  envoy::admin::v3alpha::ConfigDump dump;
 
   if (resource.has_value()) {
     auto err = addResourceToDump(dump, mask, resource.value());
@@ -623,7 +623,7 @@ Http::Code AdminImpl::handlerContention(absl::string_view, Http::HeaderMap& resp
   if (server_.options().mutexTracingEnabled() && server_.mutexTracer() != nullptr) {
     response_headers.setReferenceContentType(Http::Headers::get().ContentTypeValues.Json);
 
-    envoy::admin::v2alpha::MutexStats mutex_stats;
+    envoy::admin::v3alpha::MutexStats mutex_stats;
     mutex_stats.set_num_contentions(server_.mutexTracer()->numContentions());
     mutex_stats.set_current_wait_cycles(server_.mutexTracer()->currentWaitCycles());
     mutex_stats.set_lifetime_wait_cycles(server_.mutexTracer()->lifetimeWaitCycles());
@@ -756,7 +756,7 @@ Http::Code AdminImpl::handlerLogging(absl::string_view url, Http::HeaderMap&,
 Http::Code AdminImpl::handlerMemory(absl::string_view, Http::HeaderMap& response_headers,
                                     Buffer::Instance& response, AdminStream&) {
   response_headers.setReferenceContentType(Http::Headers::get().ContentTypeValues.Json);
-  envoy::admin::v2alpha::Memory memory;
+  envoy::admin::v3alpha::Memory memory;
   memory.set_allocated(Memory::Stats::totalCurrentlyAllocated());
   memory.set_heap_size(Memory::Stats::totalCurrentlyReserved());
   memory.set_total_thread_cache(Memory::Stats::totalThreadCacheBytes());
@@ -828,7 +828,7 @@ Http::Code AdminImpl::handlerStatsRecentLookupsEnable(absl::string_view, Http::H
 Http::Code AdminImpl::handlerServerInfo(absl::string_view, Http::HeaderMap& headers,
                                         Buffer::Instance& response, AdminStream&) {
   time_t current_time = time(nullptr);
-  envoy::admin::v2alpha::ServerInfo server_info;
+  envoy::admin::v3alpha::ServerInfo server_info;
   server_info.set_version(VersionInfo::version());
   server_info.set_hot_restart_version(server_.hotRestart().version());
   server_info.set_state(
@@ -838,7 +838,7 @@ Http::Code AdminImpl::handlerServerInfo(absl::string_view, Http::HeaderMap& head
                                                           server_.startTimeCurrentEpoch());
   server_info.mutable_uptime_all_epochs()->set_seconds(current_time -
                                                        server_.startTimeFirstEpoch());
-  envoy::admin::v2alpha::CommandLineOptions* command_line_options =
+  envoy::admin::v3alpha::CommandLineOptions* command_line_options =
       server_info.mutable_command_line_options();
   *command_line_options = *server_.options().toCommandLineOptions();
   response.add(MessageUtil::getJsonStringFromMessage(server_info, true, true));
@@ -848,11 +848,11 @@ Http::Code AdminImpl::handlerServerInfo(absl::string_view, Http::HeaderMap& head
 
 Http::Code AdminImpl::handlerReady(absl::string_view, Http::HeaderMap&, Buffer::Instance& response,
                                    AdminStream&) {
-  const envoy::admin::v2alpha::ServerInfo::State state =
+  const envoy::admin::v3alpha::ServerInfo::State state =
       Utility::serverState(server_.initManager().state(), server_.healthCheckFailed());
 
-  response.add(envoy::admin::v2alpha::ServerInfo::State_Name(state) + "\n");
-  Http::Code code = state == envoy::admin::v2alpha::ServerInfo::LIVE
+  response.add(envoy::admin::v3alpha::ServerInfo::State_Name(state) + "\n");
+  Http::Code code = state == envoy::admin::v3alpha::ServerInfo::LIVE
                         ? Http::Code::OK
                         : Http::Code::ServiceUnavailable;
   return code;
@@ -1127,15 +1127,15 @@ Http::Code AdminImpl::handlerCerts(absl::string_view, Http::HeaderMap& response_
   // This set is used to track distinct certificates. We may have multiple listeners, upstreams, etc
   // using the same cert.
   response_headers.setReferenceContentType(Http::Headers::get().ContentTypeValues.Json);
-  envoy::admin::v2alpha::Certificates certificates;
+  envoy::admin::v3alpha::Certificates certificates;
   server_.sslContextManager().iterateContexts([&](const Ssl::Context& context) -> void {
-    envoy::admin::v2alpha::Certificate& certificate = *certificates.add_certificates();
+    envoy::admin::v3alpha::Certificate& certificate = *certificates.add_certificates();
     if (context.getCaCertInformation() != nullptr) {
-      envoy::admin::v2alpha::CertificateDetails* ca_certificate = certificate.add_ca_cert();
+      envoy::admin::v3alpha::CertificateDetails* ca_certificate = certificate.add_ca_cert();
       *ca_certificate = *context.getCaCertInformation();
     }
     for (const auto& cert_details : context.getCertChainInformation()) {
-      envoy::admin::v2alpha::CertificateDetails* cert_chain = certificate.add_cert_chain();
+      envoy::admin::v3alpha::CertificateDetails* cert_chain = certificate.add_cert_chain();
       *cert_chain = *cert_details;
     }
   });
@@ -1547,16 +1547,16 @@ void AdminImpl::addListenerToHandler(Network::ConnectionHandler* handler) {
   }
 }
 
-envoy::admin::v2alpha::ServerInfo::State Utility::serverState(Init::Manager::State state,
+envoy::admin::v3alpha::ServerInfo::State Utility::serverState(Init::Manager::State state,
                                                               bool health_check_failed) {
   switch (state) {
   case Init::Manager::State::Uninitialized:
-    return envoy::admin::v2alpha::ServerInfo::PRE_INITIALIZING;
+    return envoy::admin::v3alpha::ServerInfo::PRE_INITIALIZING;
   case Init::Manager::State::Initializing:
-    return envoy::admin::v2alpha::ServerInfo::INITIALIZING;
+    return envoy::admin::v3alpha::ServerInfo::INITIALIZING;
   case Init::Manager::State::Initialized:
-    return health_check_failed ? envoy::admin::v2alpha::ServerInfo::DRAINING
-                               : envoy::admin::v2alpha::ServerInfo::LIVE;
+    return health_check_failed ? envoy::admin::v3alpha::ServerInfo::DRAINING
+                               : envoy::admin::v3alpha::ServerInfo::LIVE;
   }
   NOT_REACHED_GCOVR_EXCL_LINE;
 }
diff --git a/source/server/http/admin.h b/source/server/http/admin.h
index af4a18219d0a..ba3b9bc39491 100644
--- a/source/server/http/admin.h
+++ b/source/server/http/admin.h
@@ -7,10 +7,11 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/admin/v2alpha/server_info.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/http/filter.h"
 #include "envoy/network/filter.h"
 #include "envoy/network/listen_socket.h"
@@ -42,7 +43,7 @@ namespace Envoy {
 namespace Server {
 
 namespace Utility {
-envoy::admin::v2alpha::ServerInfo::State serverState(Init::Manager::State state,
+envoy::admin::v3alpha::ServerInfo::State serverState(Init::Manager::State state,
                                                      bool health_check_failed);
 } // namespace Utility
 
@@ -182,7 +183,7 @@ class AdminImpl : public Admin,
     absl::optional<ConfigInfo> configInfo() const override { return {}; }
     SystemTime lastUpdated() const override { return time_source_.systemTime(); }
     void onConfigUpdate() override {}
-    void validateConfig(const envoy::api::v2::RouteConfiguration&) const override {}
+    void validateConfig(const envoy::config::route::v3alpha::RouteConfiguration&) const override {}
 
     Router::ConfigConstSharedPtr config_;
     TimeSource& time_source_;
@@ -239,7 +240,7 @@ class AdminImpl : public Admin,
   /**
    * Helper methods for the /config_dump url handler.
    */
-  void addAllConfigToDump(envoy::admin::v2alpha::ConfigDump& dump,
+  void addAllConfigToDump(envoy::admin::v3alpha::ConfigDump& dump,
                           const absl::optional<std::string>& mask) const;
   /**
    * Add the config matching the passed resource to the passed config dump.
@@ -247,7 +248,7 @@ class AdminImpl : public Admin,
    * to the admin response.
    */
   absl::optional<std::pair<Http::Code, std::string>>
-  addResourceToDump(envoy::admin::v2alpha::ConfigDump& dump,
+  addResourceToDump(envoy::admin::v3alpha::ConfigDump& dump,
                     const absl::optional<std::string>& mask, const std::string& resource) const;
 
   template <class StatType>
@@ -263,7 +264,7 @@ class AdminImpl : public Admin,
                                  bool pretty_print = false);
 
   std::vector<const UrlHandler*> sortedHandlers() const;
-  envoy::admin::v2alpha::ServerInfo::State serverState();
+  envoy::admin::v3alpha::ServerInfo::State serverState();
   /**
    * URL handlers.
    */
@@ -390,8 +391,8 @@ class AdminImpl : public Admin,
     const Network::ActiveUdpListenerFactory* udpListenerFactory() override {
       NOT_REACHED_GCOVR_EXCL_LINE;
     }
-    envoy::api::v2::core::TrafficDirection direction() const override {
-      return envoy::api::v2::core::TrafficDirection::UNSPECIFIED;
+    envoy::config::core::v3alpha::TrafficDirection direction() const override {
+      return envoy::config::core::v3alpha::UNSPECIFIED;
     }
     Network::ConnectionBalancer& connectionBalancer() override { return connection_balancer_; }
 
diff --git a/source/server/lds_api.cc b/source/server/lds_api.cc
index 1713e701c3f6..462b5071ec56 100644
--- a/source/server/lds_api.cc
+++ b/source/server/lds_api.cc
@@ -2,12 +2,12 @@
 
 #include <unordered_map>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener.pb.validate.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/api/v2/listener.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.validate.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/cleanup.h"
@@ -21,7 +21,7 @@
 namespace Envoy {
 namespace Server {
 
-LdsApiImpl::LdsApiImpl(const envoy::api::v2::core::ConfigSource& lds_config,
+LdsApiImpl::LdsApiImpl(const envoy::config::core::v3alpha::ConfigSource& lds_config,
                        Upstream::ClusterManager& cm, Init::Manager& init_manager,
                        Stats::Scope& scope, ListenerManager& lm,
                        ProtobufMessage::ValidationVisitor& validation_visitor)
@@ -34,7 +34,7 @@ LdsApiImpl::LdsApiImpl(const envoy::api::v2::core::ConfigSource& lds_config,
 }
 
 void LdsApiImpl::onConfigUpdate(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+    const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added_resources,
     const Protobuf::RepeatedPtrField<std::string>& removed_resources,
     const std::string& system_version_info) {
   std::unique_ptr<Cleanup> maybe_eds_resume;
@@ -60,9 +60,10 @@ void LdsApiImpl::onConfigUpdate(
   std::unordered_set<std::string> listener_names;
   std::string message;
   for (const auto& resource : added_resources) {
-    envoy::api::v2::Listener listener;
+    envoy::config::listener::v3alpha::Listener listener;
     try {
-      listener = MessageUtil::anyConvert<envoy::api::v2::Listener>(resource.resource());
+      listener =
+          MessageUtil::anyConvert<envoy::config::listener::v3alpha::Listener>(resource.resource());
       MessageUtil::validate(listener, validation_visitor_);
       if (!listener_names.insert(listener.name()).second) {
         // NOTE: at this point, the first of these duplicates has already been successfully applied.
@@ -75,7 +76,7 @@ void LdsApiImpl::onConfigUpdate(
         ENVOY_LOG(debug, "lds: add/update listener '{}' skipped", listener.name());
       }
     } catch (const EnvoyException& e) {
-      failure_state.push_back(std::make_unique<envoy::admin::v2alpha::UpdateFailureState>());
+      failure_state.push_back(std::make_unique<envoy::admin::v3alpha::UpdateFailureState>());
       auto& state = failure_state.back();
       state->set_details(e.what());
       state->mutable_failed_configuration()->PackFrom(resource);
@@ -102,12 +103,12 @@ void LdsApiImpl::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::An
     listeners_to_remove.insert(listener.get().name());
   }
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> to_add_repeated;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> to_add_repeated;
   for (const auto& listener_blob : resources) {
     // Add this resource to our delta added/updated pile...
-    envoy::api::v2::Resource* to_add = to_add_repeated.Add();
+    envoy::service::discovery::v3alpha::Resource* to_add = to_add_repeated.Add();
     const std::string listener_name =
-        MessageUtil::anyConvert<envoy::api::v2::Listener>(listener_blob).name();
+        MessageUtil::anyConvert<envoy::config::listener::v3alpha::Listener>(listener_blob).name();
     to_add->set_name(listener_name);
     to_add->set_version(version_info);
     to_add->mutable_resource()->MergeFrom(listener_blob);
@@ -134,11 +135,11 @@ void LdsApiImpl::onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason r
 std::string LdsApiImpl::loadTypeUrl() {
   switch (xds_api_version_) {
   // automatically set api version as V2
-  case envoy::api::v2::core::ConfigSource::AUTO:
-  case envoy::api::v2::core::ConfigSource::V2:
+  case envoy::config::core::v3alpha::ConfigSource::AUTO:
+  case envoy::config::core::v3alpha::ConfigSource::V2:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::api::v2::Listener().GetDescriptor()->full_name()));
-  case envoy::api::v2::core::ConfigSource::V3ALPHA:
+  case envoy::config::core::v3alpha::ConfigSource::V3ALPHA:
     return Grpc::Common::typeUrl(
         API_NO_BOOST(envoy::config::listener::v3alpha::Listener().GetDescriptor()->full_name()));
   default:
diff --git a/source/server/lds_api.h b/source/server/lds_api.h
index 107757b4a71d..d0222e795548 100644
--- a/source/server/lds_api.h
+++ b/source/server/lds_api.h
@@ -2,13 +2,13 @@
 
 #include <functional>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 #include "envoy/config/subscription.h"
 #include "envoy/config/subscription_factory.h"
 #include "envoy/init/manager.h"
 #include "envoy/server/listener_manager.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/logger.h"
@@ -24,9 +24,9 @@ class LdsApiImpl : public LdsApi,
                    Config::SubscriptionCallbacks,
                    Logger::Loggable<Logger::Id::upstream> {
 public:
-  LdsApiImpl(const envoy::api::v2::core::ConfigSource& lds_config, Upstream::ClusterManager& cm,
-             Init::Manager& init_manager, Stats::Scope& scope, ListenerManager& lm,
-             ProtobufMessage::ValidationVisitor& validation_visitor);
+  LdsApiImpl(const envoy::config::core::v3alpha::ConfigSource& lds_config,
+             Upstream::ClusterManager& cm, Init::Manager& init_manager, Stats::Scope& scope,
+             ListenerManager& lm, ProtobufMessage::ValidationVisitor& validation_visitor);
 
   // Server::LdsApi
   std::string versionInfo() const override { return system_version_info_; }
@@ -35,13 +35,15 @@ class LdsApiImpl : public LdsApi,
   // Config::SubscriptionCallbacks
   void onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                       const std::string& version_info) override;
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& system_version_info) override;
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                     added_resources,
+                 const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                 const std::string& system_version_info) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return MessageUtil::anyConvert<envoy::api::v2::Listener>(resource).name();
+    return MessageUtil::anyConvert<envoy::config::listener::v3alpha::Listener>(resource).name();
   }
   std::string loadTypeUrl();
 
@@ -52,7 +54,7 @@ class LdsApiImpl : public LdsApi,
   Upstream::ClusterManager& cm_;
   Init::TargetImpl init_target_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
-  envoy::api::v2::core::ConfigSource::XdsApiVersion xds_api_version_;
+  envoy::config::core::v3alpha::ConfigSource::XdsApiVersion xds_api_version_;
 };
 
 } // namespace Server
diff --git a/source/server/listener_impl.cc b/source/server/listener_impl.cc
index 2aa5956809a8..8b7432a1a21f 100644
--- a/source/server/listener_impl.cc
+++ b/source/server/listener_impl.cc
@@ -1,8 +1,8 @@
 #include "server/listener_impl.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/active_udp_listener_config.h"
 #include "envoy/server/transport_socket_config.h"
@@ -79,8 +79,8 @@ Network::SocketSharedPtr ListenSocketFactoryImpl::createListenSocketAndApplyOpti
   ENVOY_LOG(debug, "Create listen socket for listener {} on address {}", listener_name_,
             local_address_->asString());
   if (socket != nullptr && options_ != nullptr) {
-    const bool ok = Network::Socket::applyOptions(options_, *socket,
-                                                  envoy::api::v2::core::SocketOption::STATE_BOUND);
+    const bool ok = Network::Socket::applyOptions(
+        options_, *socket, envoy::config::core::v3alpha::SocketOption::STATE_BOUND);
     const std::string message =
         fmt::format("{}: Setting socket options {}", listener_name_, ok ? "succeeded" : "failed");
     if (!ok) {
@@ -123,10 +123,10 @@ Network::SocketSharedPtr ListenSocketFactoryImpl::getListenSocket() {
   return createListenSocketAndApplyOptions();
 }
 
-ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, const std::string& version_info,
-                           ListenerManagerImpl& parent, const std::string& name, bool added_via_api,
-                           bool workers_started, uint64_t hash,
-                           ProtobufMessage::ValidationVisitor& validation_visitor,
+ListenerImpl::ListenerImpl(const envoy::config::listener::v3alpha::Listener& config,
+                           const std::string& version_info, ListenerManagerImpl& parent,
+                           const std::string& name, bool added_via_api, bool workers_started,
+                           uint64_t hash, ProtobufMessage::ValidationVisitor& validation_visitor,
                            uint32_t concurrency)
     : parent_(parent), address_(Network::Address::resolveProtoAddress(config.address())),
       filter_chain_manager_(address_), global_scope_(parent_.server_.stats().createScope("")),
@@ -134,7 +134,7 @@ ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, const std::st
           parent_.server_.stats().createScope(fmt::format("listener.{}.", address_->asString()))),
       bind_to_port_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config.deprecated_v1(), bind_to_port, true)),
       hand_off_restored_destination_connections_(
-          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, use_original_dst, false)),
+          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, hidden_envoy_deprecated_use_original_dst, false)),
       per_connection_buffer_limit_bytes_(
           PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, per_connection_buffer_limit_bytes, 1024 * 1024)),
       listener_tag_(parent_.factory_.nextListenerTag()), name_(name), added_via_api_(added_via_api),
@@ -248,7 +248,7 @@ ListenerImpl::ListenerImpl(const envoy::api::v2::Listener& config, const std::st
   }
 
   // Add original dst listener filter if 'use_original_dst' flag is set.
-  if (PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, use_original_dst, false)) {
+  if (PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, hidden_envoy_deprecated_use_original_dst, false)) {
     auto& factory =
         Config::Utility::getAndCheckFactory<Configuration::NamedListenerFilterConfigFactory>(
             Extensions::ListenerFilters::ListenerFilterNames::get().OriginalDst);
@@ -328,10 +328,10 @@ Singleton::Manager& ListenerImpl::singletonManager() { return parent_.server_.si
 OverloadManager& ListenerImpl::overloadManager() { return parent_.server_.overloadManager(); }
 ThreadLocal::Instance& ListenerImpl::threadLocal() { return parent_.server_.threadLocal(); }
 Admin& ListenerImpl::admin() { return parent_.server_.admin(); }
-const envoy::api::v2::core::Metadata& ListenerImpl::listenerMetadata() const {
+const envoy::config::core::v3alpha::Metadata& ListenerImpl::listenerMetadata() const {
   return config_.metadata();
 };
-envoy::api::v2::core::TrafficDirection ListenerImpl::direction() const {
+envoy::config::core::v3alpha::TrafficDirection ListenerImpl::direction() const {
   return config_.traffic_direction();
 };
 TimeSource& ListenerImpl::timeSource() { return api().timeSource(); }
diff --git a/source/server/listener_impl.h b/source/server/listener_impl.h
index 6a81b0d5a96c..3fb321dd2559 100644
--- a/source/server/listener_impl.h
+++ b/source/server/listener_impl.h
@@ -2,8 +2,8 @@
 
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 #include "envoy/network/filter.h"
 #include "envoy/server/drain_manager.h"
 #include "envoy/server/filter_config.h"
@@ -93,9 +93,9 @@ class ListenerImpl : public Network::ListenerConfig,
    * @param hash supplies the hash to use for duplicate checking.
    * @param validation_visitor message validation visitor instance.
    */
-  ListenerImpl(const envoy::api::v2::Listener& config, const std::string& version_info,
-               ListenerManagerImpl& parent, const std::string& name, bool added_via_api,
-               bool workers_started, uint64_t hash,
+  ListenerImpl(const envoy::config::listener::v3alpha::Listener& config,
+               const std::string& version_info, ListenerManagerImpl& parent,
+               const std::string& name, bool added_via_api, bool workers_started, uint64_t hash,
                ProtobufMessage::ValidationVisitor& validation_visitor, uint32_t concurrency);
   ~ListenerImpl() override;
 
@@ -116,7 +116,7 @@ class ListenerImpl : public Network::ListenerConfig,
   }
 
   Network::Address::InstanceConstSharedPtr address() const { return address_; }
-  const envoy::api::v2::Listener& config() const { return config_; }
+  const envoy::config::listener::v3alpha::Listener& config() const { return config_; }
   const Network::ListenSocketFactorySharedPtr& getSocketFactory() const { return socket_factory_; }
   void debugLog(const std::string& message);
   void initialize();
@@ -169,8 +169,8 @@ class ListenerImpl : public Network::ListenerConfig,
   OverloadManager& overloadManager() override;
   ThreadLocal::Instance& threadLocal() override;
   Admin& admin() override;
-  const envoy::api::v2::core::Metadata& listenerMetadata() const override;
-  envoy::api::v2::core::TrafficDirection direction() const override;
+  const envoy::config::core::v3alpha::Metadata& listenerMetadata() const override;
+  envoy::config::core::v3alpha::TrafficDirection direction() const override;
   TimeSource& timeSource() override;
   const Network::ListenerConfig& listenerConfig() const override;
   ProtobufMessage::ValidationVisitor& messageValidationVisitor() override;
@@ -235,7 +235,7 @@ class ListenerImpl : public Network::ListenerConfig,
   std::vector<Network::UdpListenerFilterFactoryCb> udp_listener_filter_factories_;
   DrainManagerPtr local_drain_manager_;
   bool saw_listener_create_failure_{};
-  const envoy::api::v2::Listener config_;
+  const envoy::config::listener::v3alpha::Listener config_;
   const std::string version_info_;
   Network::Socket::OptionsSharedPtr listen_socket_options_;
   const std::chrono::milliseconds listener_filters_timeout_;
diff --git a/source/server/listener_manager_impl.cc b/source/server/listener_manager_impl.cc
index b91622b23e90..72cfff34ee80 100644
--- a/source/server/listener_manager_impl.cc
+++ b/source/server/listener_manager_impl.cc
@@ -2,11 +2,11 @@
 
 #include <algorithm>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/active_udp_listener_config.h"
 #include "envoy/server/transport_socket_config.h"
@@ -46,9 +46,9 @@ std::string toString(Network::Address::SocketType socket_type) {
 
 // Finds and returns the DynamicListener for the name provided from listener_map, creating and
 // inserting one if necessary.
-envoy::admin::v2alpha::ListenersConfigDump_DynamicListener* getOrCreateDynamicListener(
-    const std::string& name, envoy::admin::v2alpha::ListenersConfigDump& dump,
-    absl::flat_hash_map<std::string, envoy::admin::v2alpha::ListenersConfigDump_DynamicListener*>&
+envoy::admin::v3alpha::ListenersConfigDump::DynamicListener* getOrCreateDynamicListener(
+    const std::string& name, envoy::admin::v3alpha::ListenersConfigDump& dump,
+    absl::flat_hash_map<std::string, envoy::admin::v3alpha::ListenersConfigDump::DynamicListener*>&
         listener_map) {
 
   auto it = listener_map.find(name);
@@ -63,7 +63,7 @@ envoy::admin::v2alpha::ListenersConfigDump_DynamicListener* getOrCreateDynamicLi
 
 // Given a listener, dumps the version info, update time and configuration into the
 // DynamicListenerState provided.
-void fillState(envoy::admin::v2alpha::ListenersConfigDump_DynamicListenerState& state,
+void fillState(envoy::admin::v3alpha::ListenersConfigDump::DynamicListenerState& state,
                const ListenerImpl& listener) {
   state.set_version_info(listener.versionInfo());
   state.mutable_listener()->MergeFrom(listener.config());
@@ -82,7 +82,7 @@ bool ListenSocketCreationParams::operator!=(const ListenSocketCreationParams& rh
 }
 
 std::vector<Network::FilterFactoryCb> ProdListenerComponentFactory::createNetworkFilterFactoryList_(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
+    const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
     Configuration::FactoryContext& context) {
   std::vector<Network::FilterFactoryCb> ret;
   for (ssize_t i = 0; i < filters.size(); i++) {
@@ -90,8 +90,9 @@ std::vector<Network::FilterFactoryCb> ProdListenerComponentFactory::createNetwor
     const std::string& string_name = proto_config.name();
     ENVOY_LOG(debug, "  filter #{}:", i);
     ENVOY_LOG(debug, "    name: {}", string_name);
-    ENVOY_LOG(debug, "  config: {}",
-              MessageUtil::getJsonStringFromMessage(proto_config.config(), true));
+    ENVOY_LOG(
+        debug, "  config: {}",
+        MessageUtil::getJsonStringFromMessage(proto_config.hidden_envoy_deprecated_config(), true));
 
     // Now see if there is a factory that will accept the config.
     auto& factory =
@@ -111,7 +112,7 @@ std::vector<Network::FilterFactoryCb> ProdListenerComponentFactory::createNetwor
 
 std::vector<Network::ListenerFilterFactoryCb>
 ProdListenerComponentFactory::createListenerFilterFactoryList_(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+    const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
     Configuration::ListenerFactoryContext& context) {
   std::vector<Network::ListenerFilterFactoryCb> ret;
   for (ssize_t i = 0; i < filters.size(); i++) {
@@ -119,8 +120,9 @@ ProdListenerComponentFactory::createListenerFilterFactoryList_(
     const std::string& string_name = proto_config.name();
     ENVOY_LOG(debug, "  filter #{}:", i);
     ENVOY_LOG(debug, "    name: {}", string_name);
-    ENVOY_LOG(debug, "  config: {}",
-              MessageUtil::getJsonStringFromMessage(proto_config.config(), true));
+    ENVOY_LOG(
+        debug, "  config: {}",
+        MessageUtil::getJsonStringFromMessage(proto_config.hidden_envoy_deprecated_config(), true));
 
     // Now see if there is a factory that will accept the config.
     auto& factory =
@@ -135,7 +137,7 @@ ProdListenerComponentFactory::createListenerFilterFactoryList_(
 
 std::vector<Network::UdpListenerFilterFactoryCb>
 ProdListenerComponentFactory::createUdpListenerFilterFactoryList_(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+    const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
     Configuration::ListenerFactoryContext& context) {
   std::vector<Network::UdpListenerFilterFactoryCb> ret;
   for (ssize_t i = 0; i < filters.size(); i++) {
@@ -143,8 +145,9 @@ ProdListenerComponentFactory::createUdpListenerFilterFactoryList_(
     const std::string& string_name = proto_config.name();
     ENVOY_LOG(debug, "  filter #{}:", i);
     ENVOY_LOG(debug, "    name: {}", string_name);
-    ENVOY_LOG(debug, "  config: {}",
-              MessageUtil::getJsonStringFromMessage(proto_config.config(), true));
+    ENVOY_LOG(
+        debug, "  config: {}",
+        MessageUtil::getJsonStringFromMessage(proto_config.hidden_envoy_deprecated_config(), true));
 
     // Now see if there is a factory that will accept the config.
     auto& factory =
@@ -216,8 +219,8 @@ Network::SocketSharedPtr ProdListenerComponentFactory::createListenSocket(
   }
 }
 
-DrainManagerPtr
-ProdListenerComponentFactory::createDrainManager(envoy::api::v2::Listener::DrainType drain_type) {
+DrainManagerPtr ProdListenerComponentFactory::createDrainManager(
+    envoy::config::listener::v3alpha::Listener::DrainType drain_type) {
   return DrainManagerPtr{new DrainManagerImpl(server_, drain_type)};
 }
 
@@ -237,11 +240,11 @@ ListenerManagerImpl::ListenerManagerImpl(Instance& server,
 }
 
 ProtobufTypes::MessagePtr ListenerManagerImpl::dumpListenerConfigs() {
-  auto config_dump = std::make_unique<envoy::admin::v2alpha::ListenersConfigDump>();
+  auto config_dump = std::make_unique<envoy::admin::v3alpha::ListenersConfigDump>();
   config_dump->set_version_info(lds_api_ != nullptr ? lds_api_->versionInfo() : "");
 
-  using DynamicListener = envoy::admin::v2alpha::ListenersConfigDump_DynamicListener;
-  using DynamicListenerState = envoy::admin::v2alpha::ListenersConfigDump_DynamicListenerState;
+  using DynamicListener = envoy::admin::v3alpha::ListenersConfigDump::DynamicListener;
+  using DynamicListenerState = envoy::admin::v3alpha::ListenersConfigDump::DynamicListenerState;
   absl::flat_hash_map<std::string, DynamicListener*> listener_map;
 
   for (const auto& listener : active_listeners_) {
@@ -287,7 +290,7 @@ ProtobufTypes::MessagePtr ListenerManagerImpl::dumpListenerConfigs() {
     DynamicListener* dynamic_listener =
         getOrCreateDynamicListener(state_and_name.first, *config_dump, listener_map);
 
-    const envoy::admin::v2alpha::UpdateFailureState& state = *state_and_name.second;
+    const envoy::admin::v3alpha::UpdateFailureState& state = *state_and_name.second;
     dynamic_listener->mutable_error_state()->CopyFrom(state);
   }
 
@@ -303,8 +306,9 @@ ListenerManagerStats ListenerManagerImpl::generateStats(Stats::Scope& scope) {
   return {ALL_LISTENER_MANAGER_STATS(POOL_COUNTER(scope), POOL_GAUGE(scope))};
 }
 
-bool ListenerManagerImpl::addOrUpdateListener(const envoy::api::v2::Listener& config,
-                                              const std::string& version_info, bool added_via_api) {
+bool ListenerManagerImpl::addOrUpdateListener(
+    const envoy::config::listener::v3alpha::Listener& config, const std::string& version_info,
+    bool added_via_api) {
   std::string name;
   if (!config.name().empty()) {
     name = config.name();
@@ -329,15 +333,15 @@ bool ListenerManagerImpl::addOrUpdateListener(const envoy::api::v2::Listener& co
   return false;
 }
 
-bool ListenerManagerImpl::addOrUpdateListenerInternal(const envoy::api::v2::Listener& config,
-                                                      const std::string& version_info,
-                                                      bool added_via_api, const std::string& name) {
+bool ListenerManagerImpl::addOrUpdateListenerInternal(
+    const envoy::config::listener::v3alpha::Listener& config, const std::string& version_info,
+    bool added_via_api, const std::string& name) {
 
   if (listenersStopped(config)) {
     ENVOY_LOG(
         debug,
         "listener {} can not be added because listeners in the traffic direction {} are stopped",
-        name, envoy::api::v2::core::TrafficDirection_Name(config.traffic_direction()));
+        name, envoy::config::core::v3alpha::TrafficDirection_Name(config.traffic_direction()));
     return false;
   }
 
@@ -700,7 +704,7 @@ void ListenerManagerImpl::stopListeners(StopListenersType stop_listeners_type) {
   stop_listeners_type_ = stop_listeners_type;
   for (Network::ListenerConfig& listener : listeners()) {
     if (stop_listeners_type != StopListenersType::InboundOnly ||
-        listener.direction() == envoy::api::v2::core::TrafficDirection::INBOUND) {
+        listener.direction() == envoy::config::core::v3alpha::INBOUND) {
       ENVOY_LOG(debug, "begin stop listener: name={}", listener.name());
       auto existing_warming_listener = getListenerByName(warming_listeners_, listener.name());
       // Destroy a warming listener directly.
@@ -749,15 +753,16 @@ ListenerFilterChainFactoryBuilder::ListenerFilterChainFactoryBuilder(
     : parent_(listener), factory_context_(factory_context) {}
 
 std::unique_ptr<Network::FilterChain> ListenerFilterChainFactoryBuilder::buildFilterChain(
-    const ::envoy::api::v2::listener::FilterChain& filter_chain) const {
+    const envoy::config::listener::v3alpha::FilterChain& filter_chain) const {
   // If the cluster doesn't have transport socket configured, then use the default "raw_buffer"
   // transport socket or BoringSSL-based "tls" transport socket if TLS settings are configured.
   // We copy by value first then override if necessary.
   auto transport_socket = filter_chain.transport_socket();
   if (!filter_chain.has_transport_socket()) {
-    if (filter_chain.has_tls_context()) {
+    if (filter_chain.has_hidden_envoy_deprecated_tls_context()) {
       transport_socket.set_name(Extensions::TransportSockets::TransportSocketNames::get().Tls);
-      transport_socket.mutable_typed_config()->PackFrom(filter_chain.tls_context());
+      transport_socket.mutable_typed_config()->PackFrom(
+          filter_chain.hidden_envoy_deprecated_tls_context());
     } else {
       transport_socket.set_name(
           Extensions::TransportSockets::TransportSocketNames::get().RawBuffer);
@@ -778,9 +783,9 @@ std::unique_ptr<Network::FilterChain> ListenerFilterChainFactoryBuilder::buildFi
       parent_.parent_.factory_.createNetworkFilterFactoryList(filter_chain.filters(), parent_));
 }
 
-Network::ListenSocketFactorySharedPtr
-ListenerManagerImpl::createListenSocketFactory(const envoy::api::v2::core::Address& proto_address,
-                                               ListenerImpl& listener, bool reuse_port) {
+Network::ListenSocketFactorySharedPtr ListenerManagerImpl::createListenSocketFactory(
+    const envoy::config::core::v3alpha::Address& proto_address, ListenerImpl& listener,
+    bool reuse_port) {
   Network::Address::SocketType socket_type =
       Network::Utility::protobufAddressSocketType(proto_address);
   return std::make_shared<ListenSocketFactoryImpl>(
diff --git a/source/server/listener_manager_impl.h b/source/server/listener_manager_impl.h
index 3c1f8f3067f5..5f6197254497 100644
--- a/source/server/listener_manager_impl.h
+++ b/source/server/listener_manager_impl.h
@@ -2,12 +2,12 @@
 
 #include <memory>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/network/filter.h"
 #include "envoy/network/listen_socket.h"
 #include "envoy/server/filter_config.h"
@@ -44,40 +44,40 @@ class ProdListenerComponentFactory : public ListenerComponentFactory,
    * Static worker for createNetworkFilterFactoryList() that can be used directly in tests.
    */
   static std::vector<Network::FilterFactoryCb> createNetworkFilterFactoryList_(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
       Configuration::FactoryContext& context);
   /**
    * Static worker for createListenerFilterFactoryList() that can be used directly in tests.
    */
   static std::vector<Network::ListenerFilterFactoryCb> createListenerFilterFactoryList_(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context);
 
   /**
    * Static worker for createUdpListenerFilterFactoryList() that can be used directly in tests.
    */
   static std::vector<Network::UdpListenerFilterFactoryCb> createUdpListenerFilterFactoryList_(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context);
 
   // Server::ListenerComponentFactory
-  LdsApiPtr createLdsApi(const envoy::api::v2::core::ConfigSource& lds_config) override {
+  LdsApiPtr createLdsApi(const envoy::config::core::v3alpha::ConfigSource& lds_config) override {
     return std::make_unique<LdsApiImpl>(
         lds_config, server_.clusterManager(), server_.initManager(), server_.stats(),
         server_.listenerManager(), server_.messageValidationContext().dynamicValidationVisitor());
   }
   std::vector<Network::FilterFactoryCb> createNetworkFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
       Configuration::FactoryContext& context) override {
     return createNetworkFilterFactoryList_(filters, context);
   }
   std::vector<Network::ListenerFilterFactoryCb> createListenerFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context) override {
     return createListenerFilterFactoryList_(filters, context);
   }
   std::vector<Network::UdpListenerFilterFactoryCb> createUdpListenerFilterFactoryList(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+      const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>& filters,
       Configuration::ListenerFactoryContext& context) override {
     return createUdpListenerFilterFactoryList_(filters, context);
   }
@@ -87,7 +87,8 @@ class ProdListenerComponentFactory : public ListenerComponentFactory,
                                               const Network::Socket::OptionsSharedPtr& options,
                                               const ListenSocketCreationParams& params) override;
 
-  DrainManagerPtr createDrainManager(envoy::api::v2::Listener::DrainType drain_type) override;
+  DrainManagerPtr
+  createDrainManager(envoy::config::listener::v3alpha::Listener::DrainType drain_type) override;
   uint64_t nextListenerTag() override { return next_listener_tag_++; }
 
 private:
@@ -130,9 +131,9 @@ class ListenerManagerImpl : public ListenerManager, Logger::Loggable<Logger::Id:
   void onListenerWarmed(ListenerImpl& listener);
 
   // Server::ListenerManager
-  bool addOrUpdateListener(const envoy::api::v2::Listener& config, const std::string& version_info,
-                           bool added_via_api) override;
-  void createLdsApi(const envoy::api::v2::core::ConfigSource& lds_config) override {
+  bool addOrUpdateListener(const envoy::config::listener::v3alpha::Listener& config,
+                           const std::string& version_info, bool added_via_api) override;
+  void createLdsApi(const envoy::config::core::v3alpha::ConfigSource& lds_config) override {
     ASSERT(lds_api_ == nullptr);
     lds_api_ = factory_.createLdsApi(lds_config);
   }
@@ -152,7 +153,7 @@ class ListenerManagerImpl : public ListenerManager, Logger::Loggable<Logger::Id:
 private:
   using ListenerList = std::list<ListenerImplPtr>;
 
-  bool addOrUpdateListenerInternal(const envoy::api::v2::Listener& config,
+  bool addOrUpdateListenerInternal(const envoy::config::listener::v3alpha::Listener& config,
                                    const std::string& version_info, bool added_via_api,
                                    const std::string& name);
   struct DrainingListener {
@@ -177,13 +178,13 @@ class ListenerManagerImpl : public ListenerManager, Logger::Loggable<Logger::Id:
     stats_.total_listeners_warming_.set(warming_listeners_.size());
     stats_.total_listeners_active_.set(active_listeners_.size());
   }
-  bool listenersStopped(const envoy::api::v2::Listener& config) {
+  bool listenersStopped(const envoy::config::listener::v3alpha::Listener& config) {
     // Currently all listeners in a given direction are stopped because of the way admin
     // drain_listener functionality is implemented. This needs to be revisited, if that changes - if
     // we support drain by listener name,for example.
     return stop_listeners_type_ == StopListenersType::All ||
            (stop_listeners_type_ == StopListenersType::InboundOnly &&
-            config.traffic_direction() == envoy::api::v2::core::TrafficDirection::INBOUND);
+            config.traffic_direction() == envoy::config::core::v3alpha::INBOUND);
   }
 
   /**
@@ -211,7 +212,7 @@ class ListenerManagerImpl : public ListenerManager, Logger::Loggable<Logger::Id:
   ListenerList::iterator getListenerByName(ListenerList& listeners, const std::string& name);
 
   Network::ListenSocketFactorySharedPtr
-  createListenSocketFactory(const envoy::api::v2::core::Address& proto_address,
+  createListenSocketFactory(const envoy::config::core::v3alpha::Address& proto_address,
                             ListenerImpl& listener, bool reuse_port);
 
   // Active listeners are listeners that are currently accepting new connections on the workers.
@@ -233,7 +234,7 @@ class ListenerManagerImpl : public ListenerManager, Logger::Loggable<Logger::Id:
   ConfigTracker::EntryOwnerPtr config_tracker_entry_;
   LdsApiPtr lds_api_;
   const bool enable_dispatcher_stats_{};
-  using UpdateFailureState = envoy::admin::v2alpha::UpdateFailureState;
+  using UpdateFailureState = envoy::admin::v3alpha::UpdateFailureState;
   absl::flat_hash_map<std::string, std::unique_ptr<UpdateFailureState>> error_state_tracker_;
   FailureStates overall_error_state_;
 };
@@ -242,8 +243,8 @@ class ListenerFilterChainFactoryBuilder : public FilterChainFactoryBuilder {
 public:
   ListenerFilterChainFactoryBuilder(
       ListenerImpl& listener, Configuration::TransportSocketFactoryContextImpl& factory_context);
-  std::unique_ptr<Network::FilterChain>
-  buildFilterChain(const ::envoy::api::v2::listener::FilterChain& filter_chain) const override;
+  std::unique_ptr<Network::FilterChain> buildFilterChain(
+      const envoy::config::listener::v3alpha::FilterChain& filter_chain) const override;
 
 private:
   ListenerImpl& parent_;
diff --git a/source/server/options_impl.cc b/source/server/options_impl.cc
index 5e5e23e311ae..e4d8d8331a52 100644
--- a/source/server/options_impl.cc
+++ b/source/server/options_impl.cc
@@ -5,7 +5,7 @@
 #include <iostream>
 #include <string>
 
-#include "envoy/admin/v2alpha/server_info.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/common/logger.h"
@@ -279,7 +279,7 @@ void OptionsImpl::logError(const std::string& error) const { throw MalformedArgv
 
 Server::CommandLineOptionsPtr OptionsImpl::toCommandLineOptions() const {
   Server::CommandLineOptionsPtr command_line_options =
-      std::make_unique<envoy::admin::v2alpha::CommandLineOptions>();
+      std::make_unique<envoy::admin::v3alpha::CommandLineOptions>();
   command_line_options->set_base_id(baseId());
   command_line_options->set_concurrency(concurrency());
   command_line_options->set_config_path(configPath());
@@ -297,18 +297,18 @@ Server::CommandLineOptionsPtr OptionsImpl::toCommandLineOptions() const {
   command_line_options->set_service_node(serviceNodeName());
   command_line_options->set_service_zone(serviceZone());
   if (mode() == Server::Mode::Serve) {
-    command_line_options->set_mode(envoy::admin::v2alpha::CommandLineOptions::Serve);
+    command_line_options->set_mode(envoy::admin::v3alpha::CommandLineOptions::Serve);
   } else if (mode() == Server::Mode::Validate) {
-    command_line_options->set_mode(envoy::admin::v2alpha::CommandLineOptions::Validate);
+    command_line_options->set_mode(envoy::admin::v3alpha::CommandLineOptions::Validate);
   } else {
-    command_line_options->set_mode(envoy::admin::v2alpha::CommandLineOptions::InitOnly);
+    command_line_options->set_mode(envoy::admin::v3alpha::CommandLineOptions::InitOnly);
   }
   if (localAddressIpVersion() == Network::Address::IpVersion::v4) {
     command_line_options->set_local_address_ip_version(
-        envoy::admin::v2alpha::CommandLineOptions::v4);
+        envoy::admin::v3alpha::CommandLineOptions::v4);
   } else {
     command_line_options->set_local_address_ip_version(
-        envoy::admin::v2alpha::CommandLineOptions::v6);
+        envoy::admin::v3alpha::CommandLineOptions::v6);
   }
   command_line_options->mutable_file_flush_interval()->MergeFrom(
       Protobuf::util::TimeUtil::MillisecondsToDuration(fileFlushIntervalMsec().count()));
diff --git a/source/server/options_impl.h b/source/server/options_impl.h
index 67f101f94b5a..61f5e40ae088 100644
--- a/source/server/options_impl.h
+++ b/source/server/options_impl.h
@@ -5,7 +5,7 @@
 #include <string>
 
 #include "envoy/common/exception.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/options.h"
 
@@ -52,7 +52,7 @@ class OptionsImpl : public Server::Options, protected Logger::Loggable<Logger::I
   void setBaseId(uint64_t base_id) { base_id_ = base_id; };
   void setConcurrency(uint32_t concurrency) { concurrency_ = concurrency; }
   void setConfigPath(const std::string& config_path) { config_path_ = config_path; }
-  void setConfigProto(const envoy::config::bootstrap::v2::Bootstrap& config_proto) {
+  void setConfigProto(const envoy::config::bootstrap::v3alpha::Bootstrap& config_proto) {
     config_proto_ = config_proto;
   }
   void setConfigYaml(const std::string& config_yaml) { config_yaml_ = config_yaml; }
@@ -100,7 +100,7 @@ class OptionsImpl : public Server::Options, protected Logger::Loggable<Logger::I
   uint64_t baseId() const override { return base_id_; }
   uint32_t concurrency() const override { return concurrency_; }
   const std::string& configPath() const override { return config_path_; }
-  const envoy::config::bootstrap::v2::Bootstrap& configProto() const override {
+  const envoy::config::bootstrap::v3alpha::Bootstrap& configProto() const override {
     return config_proto_;
   }
   const std::string& configYaml() const override { return config_yaml_; }
@@ -153,7 +153,7 @@ class OptionsImpl : public Server::Options, protected Logger::Loggable<Logger::I
   uint64_t base_id_;
   uint32_t concurrency_;
   std::string config_path_;
-  envoy::config::bootstrap::v2::Bootstrap config_proto_;
+  envoy::config::bootstrap::v3alpha::Bootstrap config_proto_;
   std::string config_yaml_;
   bool allow_unknown_static_fields_{false};
   bool reject_unknown_dynamic_fields_{false};
diff --git a/source/server/overload_manager_impl.cc b/source/server/overload_manager_impl.cc
index 8195502cbccd..80fa2b85c714 100644
--- a/source/server/overload_manager_impl.cc
+++ b/source/server/overload_manager_impl.cc
@@ -1,6 +1,6 @@
 #include "server/overload_manager_impl.h"
 
-#include "envoy/config/overload/v2alpha/overload.pb.h"
+#include "envoy/config/overload/v3alpha/overload.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/fmt.h"
@@ -19,7 +19,7 @@ namespace {
 
 class ThresholdTriggerImpl : public OverloadAction::Trigger {
 public:
-  ThresholdTriggerImpl(const envoy::config::overload::v2alpha::ThresholdTrigger& config)
+  ThresholdTriggerImpl(const envoy::config::overload::v3alpha::ThresholdTrigger& config)
       : threshold_(config.value()) {}
 
   bool updateValue(double value) override {
@@ -50,7 +50,7 @@ Stats::Gauge& makeGauge(Stats::Scope& scope, absl::string_view a, absl::string_v
 
 } // namespace
 
-OverloadAction::OverloadAction(const envoy::config::overload::v2alpha::OverloadAction& config,
+OverloadAction::OverloadAction(const envoy::config::overload::v3alpha::OverloadAction& config,
                                Stats::Scope& stats_scope)
     : active_gauge_(
           makeGauge(stats_scope, config.name(), "active", Stats::Gauge::ImportMode::Accumulate)) {
@@ -58,7 +58,7 @@ OverloadAction::OverloadAction(const envoy::config::overload::v2alpha::OverloadA
     TriggerPtr trigger;
 
     switch (trigger_config.trigger_oneof_case()) {
-    case envoy::config::overload::v2alpha::Trigger::kThreshold:
+    case envoy::config::overload::v3alpha::Trigger::TriggerOneofCase::kThreshold:
       trigger = std::make_unique<ThresholdTriggerImpl>(trigger_config.threshold());
       break;
     default:
@@ -99,7 +99,7 @@ bool OverloadAction::isActive() const { return !fired_triggers_.empty(); }
 OverloadManagerImpl::OverloadManagerImpl(
     Event::Dispatcher& dispatcher, Stats::Scope& stats_scope,
     ThreadLocal::SlotAllocator& slot_allocator,
-    const envoy::config::overload::v2alpha::OverloadManager& config,
+    const envoy::config::overload::v3alpha::OverloadManager& config,
     ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api)
     : started_(false), dispatcher_(dispatcher), tls_(slot_allocator.allocateSlot()),
       refresh_interval_(
diff --git a/source/server/overload_manager_impl.h b/source/server/overload_manager_impl.h
index 7516fe54504f..a786ca01111d 100644
--- a/source/server/overload_manager_impl.h
+++ b/source/server/overload_manager_impl.h
@@ -6,7 +6,7 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/config/overload/v2alpha/overload.pb.h"
+#include "envoy/config/overload/v3alpha/overload.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/protobuf/message_validator.h"
 #include "envoy/server/overload_manager.h"
@@ -22,7 +22,7 @@ namespace Server {
 
 class OverloadAction {
 public:
-  OverloadAction(const envoy::config::overload::v2alpha::OverloadAction& config,
+  OverloadAction(const envoy::config::overload::v3alpha::OverloadAction& config,
                  Stats::Scope& stats_scope);
 
   // Updates the current pressure for the given resource and returns whether the action
@@ -54,7 +54,7 @@ class OverloadManagerImpl : Logger::Loggable<Logger::Id::main>, public OverloadM
 public:
   OverloadManagerImpl(Event::Dispatcher& dispatcher, Stats::Scope& stats_scope,
                       ThreadLocal::SlotAllocator& slot_allocator,
-                      const envoy::config::overload::v2alpha::OverloadManager& config,
+                      const envoy::config::overload::v3alpha::OverloadManager& config,
                       ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api);
 
   // Server::OverloadManager
diff --git a/source/server/server.cc b/source/server/server.cc
index 5737aede7b3e..005b63eaf38c 100644
--- a/source/server/server.cc
+++ b/source/server/server.cc
@@ -7,9 +7,9 @@
 #include <string>
 #include <unordered_set>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.validate.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.validate.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/event/signal.h"
 #include "envoy/event/timer.h"
@@ -217,11 +217,11 @@ void InstanceImpl::flushStatsInternal() {
 bool InstanceImpl::healthCheckFailed() { return !live_.load(); }
 
 InstanceUtil::BootstrapVersion InstanceUtil::loadBootstrapConfig(
-    envoy::config::bootstrap::v2::Bootstrap& bootstrap, const Options& options,
+    envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap, const Options& options,
     ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api) {
   const std::string& config_path = options.configPath();
   const std::string& config_yaml = options.configYaml();
-  const envoy::config::bootstrap::v2::Bootstrap& config_proto = options.configProto();
+  const envoy::config::bootstrap::v3alpha::Bootstrap& config_proto = options.configProto();
 
   // Exactly one of config_path and config_yaml should be specified.
   if (config_path.empty() && config_yaml.empty() && config_proto.ByteSize() == 0) {
@@ -233,7 +233,7 @@ InstanceUtil::BootstrapVersion InstanceUtil::loadBootstrapConfig(
     MessageUtil::loadFromFile(config_path, bootstrap, validation_visitor, api);
   }
   if (!config_yaml.empty()) {
-    envoy::config::bootstrap::v2::Bootstrap bootstrap_override;
+    envoy::config::bootstrap::v3alpha::Bootstrap bootstrap_override;
     MessageUtil::loadFromYaml(config_yaml, bootstrap_override, validation_visitor);
     bootstrap.MergeFrom(bootstrap_override);
   }
@@ -648,7 +648,7 @@ void InstanceImpl::notifyCallbacksForStage(Stage stage, Event::PostCb completion
 }
 
 ProtobufTypes::MessagePtr InstanceImpl::dumpBootstrapConfig() {
-  auto config_dump = std::make_unique<envoy::admin::v2alpha::BootstrapConfigDump>();
+  auto config_dump = std::make_unique<envoy::admin::v3alpha::BootstrapConfigDump>();
   config_dump->mutable_bootstrap()->MergeFrom(bootstrap_);
   TimestampUtil::systemClockToTimestamp(bootstrap_config_update_time_,
                                         *(config_dump->mutable_last_updated()));
diff --git a/source/server/server.h b/source/server/server.h
index 13acc78b04eb..8c75a4275459 100644
--- a/source/server/server.h
+++ b/source/server/server.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/server/drain_manager.h"
 #include "envoy/server/guarddog.h"
@@ -121,7 +121,8 @@ class InstanceUtil : Logger::Loggable<Logger::Id::main> {
    * @return BootstrapVersion to indicate which version of the API was parsed.
    */
   static BootstrapVersion
-  loadBootstrapConfig(envoy::config::bootstrap::v2::Bootstrap& bootstrap, const Options& options,
+  loadBootstrapConfig(envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
+                      const Options& options,
                       ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api);
 };
 
@@ -301,7 +302,7 @@ class InstanceImpl final : Logger::Loggable<Logger::Id::main>,
   std::unique_ptr<Server::GuardDog> guard_dog_;
   bool terminated_;
   std::unique_ptr<Logger::FileSinkDelegate> file_logger_;
-  envoy::config::bootstrap::v2::Bootstrap bootstrap_;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap_;
   ConfigTracker::EntryOwnerPtr config_tracker_entry_;
   SystemTime bootstrap_config_update_time_;
   Grpc::AsyncClientManagerPtr async_client_manager_;
diff --git a/test/common/access_log/BUILD b/test/common/access_log/BUILD
index a515f1d65f75..1da2e9e3f30c 100644
--- a/test/common/access_log/BUILD
+++ b/test/common/access_log/BUILD
@@ -41,7 +41,7 @@ envoy_cc_test(
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -60,7 +60,7 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/accesslog/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/access_log/access_log_formatter_test.cc b/test/common/access_log/access_log_formatter_test.cc
index 5040252e95a6..72ccae83586d 100644
--- a/test/common/access_log/access_log_formatter_test.cc
+++ b/test/common/access_log/access_log_formatter_test.cc
@@ -3,7 +3,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/access_log/access_log_formatter.h"
 #include "common/common/utility.h"
@@ -926,7 +926,7 @@ TEST(AccessLogFormatterTest, responseTrailerFormatter) {
  * Populate a metadata object with the following test data:
  * "com.test": {"test_key":"test_value","test_obj":{"inner_key":"inner_value"}}
  */
-void populateMetadataTestData(envoy::api::v2::core::Metadata& metadata) {
+void populateMetadataTestData(envoy::config::core::v3alpha::Metadata& metadata) {
   ProtobufWkt::Struct struct_obj;
   auto& fields_map = *struct_obj.mutable_fields();
   fields_map["test_key"] = stringValue("test_value");
@@ -939,7 +939,7 @@ void populateMetadataTestData(envoy::api::v2::core::Metadata& metadata) {
 }
 
 TEST(AccessLogFormatterTest, DynamicMetadataFormatter) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   populateMetadataTestData(metadata);
   NiceMock<StreamInfo::MockStreamInfo> stream_info;
   EXPECT_CALL(stream_info, dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
@@ -1128,7 +1128,7 @@ TEST(AccessLogFormatterTest, JsonFormatterPlainStringTest) {
   Http::TestHeaderMapImpl response_header;
   Http::TestHeaderMapImpl response_trailer;
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   populateMetadataTestData(metadata);
   absl::optional<Http::Protocol> protocol = Http::Protocol::Http11;
   EXPECT_CALL(stream_info, protocol()).WillRepeatedly(Return(protocol));
@@ -1150,7 +1150,7 @@ TEST(AccessLogFormatterTest, JsonFormatterSingleOperatorTest) {
   Http::TestHeaderMapImpl response_header;
   Http::TestHeaderMapImpl response_trailer;
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   populateMetadataTestData(metadata);
   absl::optional<Http::Protocol> protocol = Http::Protocol::Http11;
   EXPECT_CALL(stream_info, protocol()).WillRepeatedly(Return(protocol));
@@ -1226,7 +1226,7 @@ TEST(AccessLogFormatterTest, JsonFormatterDynamicMetadataTest) {
   Http::TestHeaderMapImpl response_header{{"second", "PUT"}, {"test", "test"}};
   Http::TestHeaderMapImpl response_trailer{{"third", "POST"}, {"test-2", "test-2"}};
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   populateMetadataTestData(metadata);
   EXPECT_CALL(stream_info, dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
   EXPECT_CALL(Const(stream_info), dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
@@ -1253,7 +1253,7 @@ TEST(AccessLogFormatterTest, JsonFormatterTypedDynamicMetadataTest) {
   Http::TestHeaderMapImpl response_header{{"second", "PUT"}, {"test", "test"}};
   Http::TestHeaderMapImpl response_trailer{{"third", "POST"}, {"test-2", "test-2"}};
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   populateMetadataTestData(metadata);
   EXPECT_CALL(stream_info, dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
   EXPECT_CALL(Const(stream_info), dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
@@ -1458,7 +1458,7 @@ TEST(AccessLogFormatterTest, CompositeFormatterSuccess) {
   }
 
   {
-    envoy::api::v2::core::Metadata metadata;
+    envoy::config::core::v3alpha::Metadata metadata;
     populateMetadataTestData(metadata);
     EXPECT_CALL(stream_info, dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
     EXPECT_CALL(Const(stream_info), dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
diff --git a/test/common/access_log/access_log_impl_test.cc b/test/common/access_log/access_log_impl_test.cc
index f01186dda883..056bcb321df1 100644
--- a/test/common/access_log/access_log_impl_test.cc
+++ b/test/common/access_log/access_log_impl_test.cc
@@ -3,8 +3,8 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.validate.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.validate.h"
 #include "envoy/upstream/cluster_manager.h"
 #include "envoy/upstream/upstream.h"
 
@@ -36,8 +36,9 @@ namespace Envoy {
 namespace AccessLog {
 namespace {
 
-envoy::config::filter::accesslog::v2::AccessLog parseAccessLogFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::accesslog::v2::AccessLog access_log;
+envoy::config::filter::accesslog::v3alpha::AccessLog
+parseAccessLogFromV2Yaml(const std::string& yaml) {
+  envoy::config::filter::accesslog::v3alpha::AccessLog access_log;
   TestUtility::loadFromYamlAndValidate(yaml, access_log);
   return access_log;
 }
@@ -635,7 +636,7 @@ TEST(AccessLogFilterTest, DurationWithRuntimeKey) {
 
   NiceMock<Runtime::MockLoader> runtime;
 
-  envoy::config::filter::accesslog::v2::AccessLogFilter config;
+  envoy::config::filter::accesslog::v3alpha::AccessLogFilter config;
   TestUtility::loadFromYaml(filter_yaml, config);
   DurationFilter filter(config.duration_filter(), runtime);
   Http::TestHeaderMapImpl request_headers{{":method", "GET"}, {":path", "/"}};
@@ -672,7 +673,7 @@ TEST(AccessLogFilterTest, StatusCodeWithRuntimeKey) {
 
   NiceMock<Runtime::MockLoader> runtime;
 
-  envoy::config::filter::accesslog::v2::AccessLogFilter config;
+  envoy::config::filter::accesslog::v3alpha::AccessLogFilter config;
   TestUtility::loadFromYaml(filter_yaml, config);
   StatusCodeFilter filter(config.status_code_filter(), runtime);
 
@@ -1050,7 +1051,8 @@ name: envoy.file_access_log
   path: /dev/null
 )EOF";
 
-  const auto desc = envoy::config::filter::accesslog::v2::GrpcStatusFilter::Status_descriptor();
+  const auto desc =
+      envoy::config::filter::accesslog::v3alpha::GrpcStatusFilter::Status_descriptor();
   const int grpcStatuses = static_cast<int>(Grpc::Status::WellKnownGrpcStatus::MaximumKnown) + 1;
   if (desc->value_count() != grpcStatuses) {
     FAIL() << "Mismatch in number of gRPC statuses, GrpcStatus has " << grpcStatuses
@@ -1229,18 +1231,17 @@ class TestHeaderFilterFactory : public ExtensionFilterFactory {
 public:
   ~TestHeaderFilterFactory() override = default;
 
-  FilterPtr createFilter(const envoy::config::filter::accesslog::v2::ExtensionFilter& config,
+  FilterPtr createFilter(const envoy::config::filter::accesslog::v3alpha::ExtensionFilter& config,
                          Runtime::Loader&, Runtime::RandomGenerator&) override {
     auto factory_config = Config::Utility::translateToFactoryConfig(
         config, Envoy::ProtobufMessage::getNullValidationVisitor(), *this);
-    const auto& header_config =
-        TestUtility::downcastAndValidate<const envoy::config::filter::accesslog::v2::HeaderFilter&>(
-            *factory_config);
+    const auto& header_config = TestUtility::downcastAndValidate<
+        const envoy::config::filter::accesslog::v3alpha::HeaderFilter&>(*factory_config);
     return std::make_unique<HeaderFilter>(header_config);
   }
 
   ProtobufTypes::MessagePtr createEmptyConfigProto() override {
-    return std::make_unique<envoy::config::filter::accesslog::v2::HeaderFilter>();
+    return std::make_unique<envoy::config::filter::accesslog::v3alpha::HeaderFilter>();
   }
 
   std::string name() const override { return "test_header_filter"; }
@@ -1304,7 +1305,7 @@ class SampleExtensionFilterFactory : public ExtensionFilterFactory {
 public:
   ~SampleExtensionFilterFactory() override = default;
 
-  FilterPtr createFilter(const envoy::config::filter::accesslog::v2::ExtensionFilter& config,
+  FilterPtr createFilter(const envoy::config::filter::accesslog::v3alpha::ExtensionFilter& config,
                          Runtime::Loader&, Runtime::RandomGenerator&) override {
     auto factory_config = Config::Utility::translateToFactoryConfig(
         config, Envoy::ProtobufMessage::getNullValidationVisitor(), *this);
diff --git a/test/common/common/BUILD b/test/common/common/BUILD
index 62aa458eda7f..05ea9f77682d 100644
--- a/test/common/common/BUILD
+++ b/test/common/common/BUILD
@@ -137,8 +137,8 @@ envoy_cc_test(
         "//source/common/common:matchers_lib",
         "//source/common/config:metadata_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -171,7 +171,7 @@ envoy_cc_test(
     deps = [
         "//source/common/common:regex_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/common/matchers_test.cc b/test/common/common/matchers_test.cc
index f014b607609f..e7213ea0eacb 100644
--- a/test/common/common/matchers_test.cc
+++ b/test/common/common/matchers_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/type/matcher/metadata.pb.h"
-#include "envoy/type/matcher/string.pb.h"
-#include "envoy/type/matcher/value.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/type/matcher/v3alpha/metadata.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
+#include "envoy/type/matcher/v3alpha/value.pb.h"
 
 #include "common/common/matchers.h"
 #include "common/config/metadata.h"
@@ -14,13 +14,13 @@ namespace Matcher {
 namespace {
 
 TEST(MetadataTest, MatchNullValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_null_value(ProtobufWkt::NullValue::NULL_VALUE);
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -31,13 +31,13 @@ TEST(MetadataTest, MatchNullValue) {
 }
 
 TEST(MetadataTest, MatchDoubleValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_number_value(9);
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -65,13 +65,13 @@ TEST(MetadataTest, MatchDoubleValue) {
 }
 
 TEST(MetadataTest, MatchStringExactValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_string_value("prod");
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -82,13 +82,13 @@ TEST(MetadataTest, MatchStringExactValue) {
 }
 
 TEST(MetadataTest, MatchStringPrefixValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_string_value("prodabc");
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -101,13 +101,13 @@ TEST(MetadataTest, MatchStringPrefixValue) {
 }
 
 TEST(MetadataTest, MatchStringSuffixValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_string_value("abcprod");
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -120,13 +120,13 @@ TEST(MetadataTest, MatchStringSuffixValue) {
 }
 
 TEST(MetadataTest, MatchBoolValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_bool_value(true);
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -139,13 +139,13 @@ TEST(MetadataTest, MatchBoolValue) {
 }
 
 TEST(MetadataTest, MatchPresentValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "label")
       .set_string_value("test");
   Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.b", "label")
       .set_number_value(1);
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.b");
   matcher.add_path()->set_key("label");
 
@@ -162,12 +162,13 @@ TEST(MetadataTest, MatchPresentValue) {
 }
 
 // Helper function to retrieve the reference of an entry in a ListMatcher from a MetadataMatcher.
-envoy::type::matcher::ValueMatcher* listMatchEntry(envoy::type::matcher::MetadataMatcher* matcher) {
+envoy::type::matcher::v3alpha::ValueMatcher*
+listMatchEntry(envoy::type::matcher::v3alpha::MetadataMatcher* matcher) {
   return matcher->mutable_value()->mutable_list_match()->mutable_one_of();
 }
 
 TEST(MetadataTest, MatchStringListValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   ProtobufWkt::Value& metadataValue =
       Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "groups");
   ProtobufWkt::ListValue* values = metadataValue.mutable_list_value();
@@ -175,7 +176,7 @@ TEST(MetadataTest, MatchStringListValue) {
   values->add_values()->set_string_value("second");
   values->add_values()->set_string_value("third");
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.a");
   matcher.add_path()->set_key("groups");
 
@@ -195,14 +196,14 @@ TEST(MetadataTest, MatchStringListValue) {
 }
 
 TEST(MetadataTest, MatchBoolListValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   ProtobufWkt::Value& metadataValue =
       Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "groups");
   ProtobufWkt::ListValue* values = metadataValue.mutable_list_value();
   values->add_values()->set_bool_value(false);
   values->add_values()->set_bool_value(false);
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.a");
   matcher.add_path()->set_key("groups");
 
@@ -218,14 +219,14 @@ TEST(MetadataTest, MatchBoolListValue) {
 }
 
 TEST(MetadataTest, MatchDoubleListValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   ProtobufWkt::Value& metadataValue =
       Envoy::Config::Metadata::mutableMetadataValue(metadata, "envoy.filter.a", "groups");
   ProtobufWkt::ListValue* values = metadataValue.mutable_list_value();
   values->add_values()->set_number_value(10);
   values->add_values()->set_number_value(23);
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("envoy.filter.a");
   matcher.add_path()->set_key("groups");
 
@@ -258,7 +259,7 @@ TEST(MetadataTest, MatchDoubleListValue) {
 }
 
 TEST(StringMatcher, SafeRegexValue) {
-  envoy::type::matcher::StringMatcher matcher;
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
   matcher.mutable_safe_regex()->mutable_google_re2();
   matcher.mutable_safe_regex()->set_regex("foo.*");
   EXPECT_TRUE(Matchers::StringMatcherImpl(matcher).match("foo"));
@@ -267,7 +268,7 @@ TEST(StringMatcher, SafeRegexValue) {
 }
 
 TEST(LowerCaseStringMatcher, MatchExactValue) {
-  envoy::type::matcher::StringMatcher matcher;
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
   matcher.set_exact("Foo");
 
   EXPECT_FALSE(Envoy::Matchers::LowerCaseStringMatcher(matcher).match("Foo"));
@@ -275,7 +276,7 @@ TEST(LowerCaseStringMatcher, MatchExactValue) {
 }
 
 TEST(LowerCaseStringMatcher, MatchPrefixValue) {
-  envoy::type::matcher::StringMatcher matcher;
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
   matcher.set_prefix("Foo.");
 
   EXPECT_TRUE(Envoy::Matchers::LowerCaseStringMatcher(matcher).match("foo.bar"));
@@ -283,7 +284,7 @@ TEST(LowerCaseStringMatcher, MatchPrefixValue) {
 }
 
 TEST(LowerCaseStringMatcher, MatchSuffixValue) {
-  envoy::type::matcher::StringMatcher matcher;
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
   matcher.set_suffix(".Bar");
 
   EXPECT_TRUE(Envoy::Matchers::LowerCaseStringMatcher(matcher).match("foo.bar"));
@@ -291,8 +292,8 @@ TEST(LowerCaseStringMatcher, MatchSuffixValue) {
 }
 
 TEST(LowerCaseStringMatcher, MatchRegexValue) {
-  envoy::type::matcher::StringMatcher matcher;
-  matcher.set_regex("Foo.*");
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
+  matcher.set_hidden_envoy_deprecated_regex("Foo.*");
 
   EXPECT_TRUE(Envoy::Matchers::LowerCaseStringMatcher(matcher).match("foo.bar"));
   EXPECT_FALSE(Envoy::Matchers::LowerCaseStringMatcher(matcher).match("Foo.Bar"));
diff --git a/test/common/common/regex_test.cc b/test/common/common/regex_test.cc
index bbfc1564040a..d30c726ecae8 100644
--- a/test/common/common/regex_test.cc
+++ b/test/common/common/regex_test.cc
@@ -1,5 +1,5 @@
 #include "envoy/common/exception.h"
-#include "envoy/type/matcher/regex.pb.h"
+#include "envoy/type/matcher/v3alpha/regex.pb.h"
 
 #include "common/common/regex.h"
 
@@ -29,7 +29,7 @@ TEST(Utility, ParseStdRegex) {
 
 TEST(Utility, ParseRegex) {
   {
-    envoy::type::matcher::RegexMatcher matcher;
+    envoy::type::matcher::v3alpha::RegexMatcher matcher;
     matcher.mutable_google_re2();
     matcher.set_regex("(+invalid)");
     EXPECT_THROW_WITH_MESSAGE(Utility::parseRegex(matcher), EnvoyException,
@@ -38,7 +38,7 @@ TEST(Utility, ParseRegex) {
 
   // Regression test for https://github.com/envoyproxy/envoy/issues/7728
   {
-    envoy::type::matcher::RegexMatcher matcher;
+    envoy::type::matcher::v3alpha::RegexMatcher matcher;
     matcher.mutable_google_re2();
     matcher.set_regex("/asdf/.*");
     const auto compiled_matcher = Utility::parseRegex(matcher);
@@ -48,7 +48,7 @@ TEST(Utility, ParseRegex) {
 
   // Verify max program size.
   {
-    envoy::type::matcher::RegexMatcher matcher;
+    envoy::type::matcher::v3alpha::RegexMatcher matcher;
     matcher.mutable_google_re2()->mutable_max_program_size()->set_value(1);
     matcher.set_regex("/asdf/.*");
 #ifndef GTEST_USES_SIMPLE_RE
diff --git a/test/common/config/BUILD b/test/common/config/BUILD
index 1a19eb3a230b..1012479e11fa 100644
--- a/test/common/config/BUILD
+++ b/test/common/config/BUILD
@@ -42,7 +42,9 @@ envoy_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:logging_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -59,7 +61,8 @@ envoy_cc_test(
         "//test/mocks/local_info:local_info_mocks",
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:logging_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -71,7 +74,7 @@ envoy_cc_test(
         "//test/mocks/event:event_mocks",
         "//test/mocks/filesystem:filesystem_mocks",
         "//test/test_common:logging_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -88,7 +91,8 @@ envoy_cc_test_library(
         "//test/test_common:environment_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -113,6 +117,8 @@ envoy_cc_test(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -135,7 +141,8 @@ envoy_cc_test(
         "//test/test_common:logging_lib",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -148,7 +155,7 @@ envoy_cc_test(
         "//test/mocks/event:event_mocks",
         "//test/mocks/grpc:grpc_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -178,7 +185,9 @@ envoy_cc_test_library(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -195,8 +204,9 @@ envoy_cc_test_library(
         "//test/mocks/grpc:grpc_mocks",
         "//test/mocks/local_info:local_info_mocks",
         "//test/mocks/runtime:runtime_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -225,8 +235,9 @@ envoy_cc_test_library(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -245,8 +256,9 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -281,7 +293,7 @@ envoy_cc_test(
         "//source/common/protobuf:utility_lib",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -291,7 +303,7 @@ envoy_cc_test(
     deps = [
         "//source/common/config:runtime_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -312,10 +324,9 @@ envoy_cc_test(
         "//test/test_common:utility_lib",
         "@com_github_cncf_udpa//udpa/type/v1:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
         "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -335,7 +346,8 @@ envoy_cc_test(
         "//source/common/config:watch_map_lib",
         "//test/mocks/config:config_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -353,8 +365,8 @@ envoy_cc_test(
         "//source/common/protobuf:utility_lib",
         "//test/mocks/server:server_mocks",
         "//test/test_common:simulated_time_system_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -369,7 +381,7 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/config/config_provider_impl_test.cc b/test/common/config/config_provider_impl_test.cc
index 9e9f348d4f7a..1abf5b46380e 100644
--- a/test/common/config/config_provider_impl_test.cc
+++ b/test/common/config/config_provider_impl_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/config_provider_impl.h"
 #include "common/protobuf/utility.h"
@@ -88,8 +88,9 @@ class DummyConfigSubscription : public ConfigSubscriptionInstance,
 
     ConfigSubscriptionCommonBase::onConfigUpdate();
   }
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>&,
-                      const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override {
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&,
+                 const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override {
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
   }
 
@@ -252,8 +253,8 @@ TEST_F(ConfigProviderImplTest, SharedOwnership) {
   Init::ExpectableWatcherImpl watcher;
   factory_context_.init_manager_.initialize(watcher);
 
-  envoy::api::v2::core::ApiConfigSource config_source_proto;
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  envoy::config::core::v3alpha::ApiConfigSource config_source_proto;
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   ConfigProviderPtr provider1 = provider_manager_->createXdsConfigProvider(
       config_source_proto, factory_context_, "dummy_prefix",
       ConfigProviderManager::NullOptionalArg());
@@ -283,7 +284,7 @@ TEST_F(ConfigProviderImplTest, SharedOwnership) {
             provider2->config<const DummyConfig>().get());
 
   // Change the config source and verify that a new subscription is used.
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
   ConfigProviderPtr provider3 = provider_manager_->createXdsConfigProvider(
       config_source_proto, factory_context_, "dummy_prefix",
       ConfigProviderManager::NullOptionalArg());
@@ -352,8 +353,8 @@ TEST_F(ConfigProviderImplTest, DuplicateConfigProto) {
   // This provider manager returns a DummyDynamicConfigProvider.
   auto provider_manager =
       std::make_unique<DummyConfigProviderManagerMockConfigProvider>(factory_context_.admin_);
-  envoy::api::v2::core::ApiConfigSource config_source_proto;
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  envoy::config::core::v3alpha::ApiConfigSource config_source_proto;
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   ConfigProviderPtr provider = provider_manager->createXdsConfigProvider(
       config_source_proto, factory_context_, "dummy_prefix",
       ConfigProviderManager::NullOptionalArg());
@@ -438,8 +439,8 @@ TEST_F(ConfigProviderImplTest, ConfigDump) {
                             expected_config_dump);
   EXPECT_EQ(expected_config_dump.DebugString(), dummy_config_dump2.DebugString());
 
-  envoy::api::v2::core::ApiConfigSource config_source_proto;
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  envoy::config::core::v3alpha::ApiConfigSource config_source_proto;
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   ConfigProviderPtr dynamic_provider = provider_manager_->createXdsConfigProvider(
       config_source_proto, factory_context_, "dummy_prefix",
       ConfigProviderManager::NullOptionalArg());
@@ -497,8 +498,8 @@ TEST_F(ConfigProviderImplTest, LocalInfoNotDefined) {
   factory_context_.local_info_.node_.set_cluster("");
   factory_context_.local_info_.node_.set_id("");
 
-  envoy::api::v2::core::ApiConfigSource config_source_proto;
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  envoy::config::core::v3alpha::ApiConfigSource config_source_proto;
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   EXPECT_THROW_WITH_MESSAGE(
       provider_manager_->createXdsConfigProvider(config_source_proto, factory_context_,
                                                  "dummy_prefix",
@@ -549,8 +550,9 @@ class DeltaDummyConfigSubscription : public DeltaConfigSubscriptionInstance,
     ConfigSubscriptionCommonBase::onConfigUpdate();
     setLastConfigInfo(absl::optional<LastConfigInfo>({absl::nullopt, version_info}));
   }
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>&,
-                      const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override {
+  void
+  onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&,
+                 const Protobuf::RepeatedPtrField<std::string>&, const std::string&) override {
     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
   }
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason,
@@ -674,8 +676,8 @@ class DeltaConfigProviderImplTest : public testing::Test {
 // Validate that delta config subscriptions are shared across delta dynamic config providers and
 // that the underlying Config implementation can be shared as well.
 TEST_F(DeltaConfigProviderImplTest, MultipleDeltaSubscriptions) {
-  envoy::api::v2::core::ApiConfigSource config_source_proto;
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  envoy::config::core::v3alpha::ApiConfigSource config_source_proto;
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   ConfigProviderPtr provider1 = provider_manager_->createXdsConfigProvider(
       config_source_proto, factory_context_, "dummy_prefix",
       ConfigProviderManager::NullOptionalArg());
@@ -722,8 +724,8 @@ TEST_F(DeltaConfigProviderImplTest, MultipleDeltaSubscriptions) {
 
 // Tests a config update failure.
 TEST_F(DeltaConfigProviderImplTest, DeltaSubscriptionFailure) {
-  envoy::api::v2::core::ApiConfigSource config_source_proto;
-  config_source_proto.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  envoy::config::core::v3alpha::ApiConfigSource config_source_proto;
+  config_source_proto.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   ConfigProviderPtr provider = provider_manager_->createXdsConfigProvider(
       config_source_proto, factory_context_, "dummy_prefix",
       ConfigProviderManager::NullOptionalArg());
diff --git a/test/common/config/datasource_test.cc b/test/common/config/datasource_test.cc
index 2664fa654978..3bb4e8c2e03e 100644
--- a/test/common/config/datasource_test.cc
+++ b/test/common/config/datasource_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/config/datasource.h"
@@ -21,7 +21,7 @@ class AsyncDataSourceTest : public testing::Test {
 protected:
   AsyncDataSourceTest() : api_(Api::createApiForTest()) {}
 
-  using AsyncDataSourcePb = envoy::api::v2::core::AsyncDataSource;
+  using AsyncDataSourcePb = envoy::config::core::v3alpha::AsyncDataSource;
 
   NiceMock<Upstream::MockClusterManager> cm_;
   Init::MockManager init_manager_;
diff --git a/test/common/config/delta_subscription_impl_test.cc b/test/common/config/delta_subscription_impl_test.cc
index 8f92ff09bf09..c5363cb20e29 100644
--- a/test/common/config/delta_subscription_impl_test.cc
+++ b/test/common/config/delta_subscription_impl_test.cc
@@ -1,6 +1,7 @@
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/config/api_version.h"
@@ -68,7 +69,7 @@ TEST_F(DeltaSubscriptionImplTest, PauseQueuesAcks) {
   // The server gives us our first version of resource name1.
   // subscription_ now wants to ACK name1 (but can't due to pause).
   {
-    auto message = std::make_unique<envoy::api::v2::DeltaDiscoveryResponse>();
+    auto message = std::make_unique<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>();
     auto* resource = message->mutable_resources()->Add();
     resource->set_name("name1");
     resource->set_version("version1A");
@@ -82,7 +83,7 @@ TEST_F(DeltaSubscriptionImplTest, PauseQueuesAcks) {
   // The server gives us our first version of resource name2.
   // subscription_ now wants to ACK name1 and then name2 (but can't due to pause).
   {
-    auto message = std::make_unique<envoy::api::v2::DeltaDiscoveryResponse>();
+    auto message = std::make_unique<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>();
     auto* resource = message->mutable_resources()->Add();
     resource->set_name("name2");
     resource->set_version("version2A");
@@ -96,7 +97,7 @@ TEST_F(DeltaSubscriptionImplTest, PauseQueuesAcks) {
   // The server gives us an updated version of resource name1.
   // subscription_ now wants to ACK name1A, then name2, then name1B (but can't due to pause).
   {
-    auto message = std::make_unique<envoy::api::v2::DeltaDiscoveryResponse>();
+    auto message = std::make_unique<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>();
     auto* resource = message->mutable_resources()->Add();
     resource->set_name("name1");
     resource->set_version("version1B");
@@ -126,7 +127,7 @@ TEST(DeltaSubscriptionImplFixturelessTest, NoGrpcStream) {
   Stats::IsolatedStoreImpl stats_store;
   SubscriptionStats stats(Utility::generateStats(stats_store));
 
-  envoy::api::v2::core::Node node;
+  envoy::config::core::v3alpha::Node node;
   node.set_id("fo0");
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   EXPECT_CALL(local_info, node()).WillRepeatedly(testing::ReturnRef(node));
@@ -134,7 +135,9 @@ TEST(DeltaSubscriptionImplFixturelessTest, NoGrpcStream) {
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
   Envoy::Config::RateLimitSettings rate_limit_settings;
-  NiceMock<Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment>> callbacks;
+  NiceMock<
+      Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>>
+      callbacks;
   auto* async_client = new Grpc::MockAsyncClient();
 
   const Protobuf::MethodDescriptor* method_descriptor =
diff --git a/test/common/config/delta_subscription_state_test.cc b/test/common/config/delta_subscription_state_test.cc
index 1734d97dc83c..819037a91d06 100644
--- a/test/common/config/delta_subscription_state_test.cc
+++ b/test/common/config/delta_subscription_state_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/delta_subscription_state.h"
 #include "common/config/utility.h"
@@ -27,17 +27,19 @@ class DeltaSubscriptionStateTest : public testing::Test {
   DeltaSubscriptionStateTest()
       : state_(TypeUrl, callbacks_, local_info_, std::chrono::milliseconds(0U), dispatcher_) {
     state_.updateSubscriptionInterest({"name1", "name2", "name3"}, {});
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_THAT(cur_request.resource_names_subscribe(),
                 UnorderedElementsAre("name1", "name2", "name3"));
   }
 
   UpdateAck deliverDiscoveryResponse(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+      const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+          added_resources,
       const Protobuf::RepeatedPtrField<std::string>& removed_resources,
       const std::string& version_info, absl::optional<std::string> nonce = absl::nullopt,
       bool expect_config_update_call = true) {
-    envoy::api::v2::DeltaDiscoveryResponse message;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryResponse message;
     *message.mutable_resources() = added_resources;
     *message.mutable_removed_resources() = removed_resources;
     message.set_system_version_info(version_info);
@@ -49,10 +51,11 @@ class DeltaSubscriptionStateTest : public testing::Test {
   }
 
   UpdateAck deliverBadDiscoveryResponse(
-      const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+      const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+          added_resources,
       const Protobuf::RepeatedPtrField<std::string>& removed_resources,
       const std::string& version_info, std::string nonce) {
-    envoy::api::v2::DeltaDiscoveryResponse message;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryResponse message;
     *message.mutable_resources() = added_resources;
     *message.mutable_removed_resources() = removed_resources;
     message.set_system_version_info(version_info);
@@ -61,16 +64,16 @@ class DeltaSubscriptionStateTest : public testing::Test {
     return state_.handleResponse(message);
   }
 
-  NiceMock<MockSubscriptionCallbacks<envoy::api::v2::Cluster>> callbacks_;
+  NiceMock<MockSubscriptionCallbacks<envoy::config::cluster::v3alpha::Cluster>> callbacks_;
   NiceMock<LocalInfo::MockLocalInfo> local_info_;
   NiceMock<Event::MockDispatcher> dispatcher_;
   // We start out interested in three resources: name1, name2, and name3.
   DeltaSubscriptionState state_;
 };
 
-Protobuf::RepeatedPtrField<envoy::api::v2::Resource>
+Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>
 populateRepeatedResource(std::vector<std::pair<std::string, std::string>> items) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> add_to;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> add_to;
   for (const auto& item : items) {
     auto* resource = add_to.Add();
     resource->set_name(item.first);
@@ -83,13 +86,15 @@ populateRepeatedResource(std::vector<std::pair<std::string, std::string>> items)
 TEST_F(DeltaSubscriptionStateTest, SubscribeAndUnsubscribe) {
   {
     state_.updateSubscriptionInterest({"name4"}, {"name1"});
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name4"));
     EXPECT_THAT(cur_request.resource_names_unsubscribe(), UnorderedElementsAre("name1"));
   }
   {
     state_.updateSubscriptionInterest({"name1"}, {"name3", "name4"});
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name1"));
     EXPECT_THAT(cur_request.resource_names_unsubscribe(), UnorderedElementsAre("name3", "name4"));
   }
@@ -107,7 +112,8 @@ TEST_F(DeltaSubscriptionStateTest, SubscribeAndUnsubscribe) {
 TEST_F(DeltaSubscriptionStateTest, RemoveThenAdd) {
   state_.updateSubscriptionInterest({}, {"name3"});
   state_.updateSubscriptionInterest({"name3"}, {});
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name3"));
   EXPECT_TRUE(cur_request.resource_names_unsubscribe().empty());
 }
@@ -123,7 +129,8 @@ TEST_F(DeltaSubscriptionStateTest, RemoveThenAdd) {
 TEST_F(DeltaSubscriptionStateTest, AddThenRemove) {
   state_.updateSubscriptionInterest({"name4"}, {});
   state_.updateSubscriptionInterest({}, {"name4"});
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   EXPECT_TRUE(cur_request.resource_names_subscribe().empty());
   EXPECT_THAT(cur_request.resource_names_unsubscribe(), UnorderedElementsAre("name4"));
 }
@@ -133,7 +140,8 @@ TEST_F(DeltaSubscriptionStateTest, AddRemoveAdd) {
   state_.updateSubscriptionInterest({"name4"}, {});
   state_.updateSubscriptionInterest({}, {"name4"});
   state_.updateSubscriptionInterest({"name4"}, {});
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name4"));
   EXPECT_TRUE(cur_request.resource_names_unsubscribe().empty());
 }
@@ -143,7 +151,8 @@ TEST_F(DeltaSubscriptionStateTest, RemoveAddRemove) {
   state_.updateSubscriptionInterest({}, {"name3"});
   state_.updateSubscriptionInterest({"name3"}, {});
   state_.updateSubscriptionInterest({}, {"name3"});
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   EXPECT_TRUE(cur_request.resource_names_subscribe().empty());
   EXPECT_THAT(cur_request.resource_names_unsubscribe(), UnorderedElementsAre("name3"));
 }
@@ -154,7 +163,8 @@ TEST_F(DeltaSubscriptionStateTest, BothAddAndRemove) {
   state_.updateSubscriptionInterest({"name4"}, {"name1", "name2", "name3"});
   state_.updateSubscriptionInterest({"name1", "name2", "name3"}, {"name4"});
   state_.updateSubscriptionInterest({"name4"}, {"name1", "name2", "name3"});
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name4"));
   EXPECT_THAT(cur_request.resource_names_unsubscribe(),
               UnorderedElementsAre("name1", "name2", "name3"));
@@ -163,7 +173,8 @@ TEST_F(DeltaSubscriptionStateTest, BothAddAndRemove) {
 TEST_F(DeltaSubscriptionStateTest, CumulativeUpdates) {
   state_.updateSubscriptionInterest({"name4"}, {});
   state_.updateSubscriptionInterest({"name5"}, {});
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name4", "name5"));
   EXPECT_TRUE(cur_request.resource_names_unsubscribe().empty());
 }
@@ -173,7 +184,7 @@ TEST_F(DeltaSubscriptionStateTest, CumulativeUpdates) {
 TEST_F(DeltaSubscriptionStateTest, AckGenerated) {
   // The xDS server's first response includes items for name1 and 2, but not 3.
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> added_resources =
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> added_resources =
         populateRepeatedResource({{"name1", "version1A"}, {"name2", "version2A"}});
     UpdateAck ack = deliverDiscoveryResponse(added_resources, {}, "debug1", "nonce1");
     EXPECT_EQ("nonce1", ack.nonce_);
@@ -181,24 +192,27 @@ TEST_F(DeltaSubscriptionStateTest, AckGenerated) {
   }
   // The next response updates 1 and 2, and adds 3.
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> added_resources = populateRepeatedResource(
-        {{"name1", "version1B"}, {"name2", "version2B"}, {"name3", "version3A"}});
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> added_resources =
+        populateRepeatedResource(
+            {{"name1", "version1B"}, {"name2", "version2B"}, {"name3", "version3A"}});
     UpdateAck ack = deliverDiscoveryResponse(added_resources, {}, "debug2", "nonce2");
     EXPECT_EQ("nonce2", ack.nonce_);
     EXPECT_EQ(Grpc::Status::WellKnownGrpcStatus::Ok, ack.error_detail_.code());
   }
   // The next response tries but fails to update all 3, and so should produce a NACK.
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> added_resources = populateRepeatedResource(
-        {{"name1", "version1C"}, {"name2", "version2C"}, {"name3", "version3B"}});
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> added_resources =
+        populateRepeatedResource(
+            {{"name1", "version1C"}, {"name2", "version2C"}, {"name3", "version3B"}});
     UpdateAck ack = deliverBadDiscoveryResponse(added_resources, {}, "debug3", "nonce3");
     EXPECT_EQ("nonce3", ack.nonce_);
     EXPECT_NE(Grpc::Status::WellKnownGrpcStatus::Ok, ack.error_detail_.code());
   }
   // The last response successfully updates all 3.
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> added_resources = populateRepeatedResource(
-        {{"name1", "version1D"}, {"name2", "version2D"}, {"name3", "version3C"}});
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> added_resources =
+        populateRepeatedResource(
+            {{"name1", "version1D"}, {"name2", "version2D"}, {"name3", "version3C"}});
     UpdateAck ack = deliverDiscoveryResponse(added_resources, {}, "debug4", "nonce4");
     EXPECT_EQ("nonce4", ack.nonce_);
     EXPECT_EQ(Grpc::Status::WellKnownGrpcStatus::Ok, ack.error_detail_.code());
@@ -213,11 +227,12 @@ TEST_F(DeltaSubscriptionStateTest, AckGenerated) {
 TEST_F(DeltaSubscriptionStateTest, ResourceGoneLeadsToBlankInitialVersion) {
   {
     // The xDS server's first update includes items for name1 and 2, but not 3.
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> add1_2 =
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> add1_2 =
         populateRepeatedResource({{"name1", "version1A"}, {"name2", "version2A"}});
     deliverDiscoveryResponse(add1_2, {}, "debugversion1");
     state_.markStreamFresh(); // simulate a stream reconnection
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_EQ("version1A", cur_request.initial_resource_versions().at("name1"));
     EXPECT_EQ("version2A", cur_request.initial_resource_versions().at("name2"));
     EXPECT_EQ(cur_request.initial_resource_versions().end(),
@@ -226,13 +241,14 @@ TEST_F(DeltaSubscriptionStateTest, ResourceGoneLeadsToBlankInitialVersion) {
 
   {
     // The next update updates 1, removes 2, and adds 3. The map should then have 1 and 3.
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> add1_3 =
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> add1_3 =
         populateRepeatedResource({{"name1", "version1B"}, {"name3", "version3A"}});
     Protobuf::RepeatedPtrField<std::string> remove2;
     *remove2.Add() = "name2";
     deliverDiscoveryResponse(add1_3, remove2, "debugversion2");
     state_.markStreamFresh(); // simulate a stream reconnection
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_EQ("version1B", cur_request.initial_resource_versions().at("name1"));
     EXPECT_EQ(cur_request.initial_resource_versions().end(),
               cur_request.initial_resource_versions().find("name2"));
@@ -246,7 +262,8 @@ TEST_F(DeltaSubscriptionStateTest, ResourceGoneLeadsToBlankInitialVersion) {
     *remove1_3.Add() = "name3";
     deliverDiscoveryResponse({}, remove1_3, "debugversion3");
     state_.markStreamFresh(); // simulate a stream reconnection
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_TRUE(cur_request.initial_resource_versions().empty());
   }
 
@@ -254,7 +271,8 @@ TEST_F(DeltaSubscriptionStateTest, ResourceGoneLeadsToBlankInitialVersion) {
     // ...but our own map should remember our interest. In particular, losing interest in a
     // resource should cause its name to appear in the next request's resource_names_unsubscribe.
     state_.updateSubscriptionInterest({"name4"}, {"name1", "name2"});
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_THAT(cur_request.resource_names_subscribe(), UnorderedElementsAre("name4"));
     EXPECT_THAT(cur_request.resource_names_unsubscribe(), UnorderedElementsAre("name1", "name2"));
   }
@@ -269,13 +287,14 @@ TEST_F(DeltaSubscriptionStateTest, ResourceGoneLeadsToBlankInitialVersion) {
 // lost interest in a resource. The unsubscription implicitly takes effect by simply saying
 // nothing about the resource in the newly reconnected stream.
 TEST_F(DeltaSubscriptionStateTest, SubscribeAndUnsubscribeAfterReconnect) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> add1_2 =
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> add1_2 =
       populateRepeatedResource({{"name1", "version1A"}, {"name2", "version2A"}});
   deliverDiscoveryResponse(add1_2, {}, "debugversion1");
 
   state_.updateSubscriptionInterest({"name4"}, {"name1"});
   state_.markStreamFresh(); // simulate a stream reconnection
-  envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+      state_.getNextRequestAckless();
   // Regarding the resource_names_subscribe field:
   // name1: do not include: we lost interest.
   // name2: yes do include: we're interested and we have a version of it.
@@ -292,11 +311,13 @@ TEST_F(DeltaSubscriptionStateTest, InitialVersionMapFirstMessageOnly) {
   // First, verify that the first message of a new stream sends initial versions.
   {
     // The xDS server's first update gives us all three resources.
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> add_all = populateRepeatedResource(
-        {{"name1", "version1A"}, {"name2", "version2A"}, {"name3", "version3A"}});
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> add_all =
+        populateRepeatedResource(
+            {{"name1", "version1A"}, {"name2", "version2A"}, {"name3", "version3A"}});
     deliverDiscoveryResponse(add_all, {}, "debugversion1");
     state_.markStreamFresh(); // simulate a stream reconnection
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_EQ("version1A", cur_request.initial_resource_versions().at("name1"));
     EXPECT_EQ("version2A", cur_request.initial_resource_versions().at("name2"));
     EXPECT_EQ("version3A", cur_request.initial_resource_versions().at("name3"));
@@ -306,13 +327,14 @@ TEST_F(DeltaSubscriptionStateTest, InitialVersionMapFirstMessageOnly) {
   {
     state_.updateSubscriptionInterest({"name4"}, {});
     // The xDS server updates our resources, and gives us our newly requested one too.
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> add_all =
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> add_all =
         populateRepeatedResource({{"name1", "version1B"},
                                   {"name2", "version2B"},
                                   {"name3", "version3B"},
                                   {"name4", "version4A"}});
     deliverDiscoveryResponse(add_all, {}, "debugversion2");
-    envoy::api::v2::DeltaDiscoveryRequest cur_request = state_.getNextRequestAckless();
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest cur_request =
+        state_.getNextRequestAckless();
     EXPECT_TRUE(cur_request.initial_resource_versions().empty());
   }
 }
@@ -335,7 +357,7 @@ TEST_F(DeltaSubscriptionStateTest, CheckUpdatePending) {
 // DeltaSubscriptionState to reject the update without even trying to hand it to the consuming API's
 // onConfigUpdate().
 TEST_F(DeltaSubscriptionStateTest, DuplicatedAdd) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> additions =
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> additions =
       populateRepeatedResource({{"name1", "version1A"}, {"name1", "sdfsdfsdfds"}});
   UpdateAck ack = deliverDiscoveryResponse(additions, {}, "debugversion1", absl::nullopt, false);
   EXPECT_EQ("duplicate name name1 found among added/updated resources",
@@ -352,7 +374,7 @@ TEST_F(DeltaSubscriptionStateTest, DuplicatedRemove) {
 }
 
 TEST_F(DeltaSubscriptionStateTest, AddedAndRemoved) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> additions =
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> additions =
       populateRepeatedResource({{"name1", "version1A"}});
   Protobuf::RepeatedPtrField<std::string> removals;
   *removals.Add() = "name1";
diff --git a/test/common/config/delta_subscription_test_harness.h b/test/common/config/delta_subscription_test_harness.h
index 778a426dbae1..8a69277d1f1e 100644
--- a/test/common/config/delta_subscription_test_harness.h
+++ b/test/common/config/delta_subscription_test_harness.h
@@ -2,9 +2,9 @@
 
 #include <queue>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/delta_subscription_impl.h"
 #include "common/config/version_converter.h"
@@ -88,7 +88,7 @@ class DeltaSubscriptionTestHarness : public SubscriptionTestHarness {
                          const std::set<std::string>& unsubscribe, const Protobuf::int32 error_code,
                          const std::string& error_message,
                          std::map<std::string, std::string> initial_resource_versions) {
-    envoy::api::v2::DeltaDiscoveryRequest expected_request;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest expected_request;
     expected_request.mutable_node()->CopyFrom(node_);
     std::copy(
         subscribe.begin(), subscribe.end(),
@@ -115,7 +115,7 @@ class DeltaSubscriptionTestHarness : public SubscriptionTestHarness {
                 sendMessageRaw_(
                     Grpc::ProtoBufferEqIgnoringField(expected_request, "response_nonce"), false))
         .WillOnce([this](Buffer::InstancePtr& buffer, bool) {
-          envoy::api::v2::DeltaDiscoveryRequest message;
+          envoy::service::discovery::v3alpha::DeltaDiscoveryRequest message;
           EXPECT_TRUE(Grpc::Common::parseBufferInstance(std::move(buffer), message));
           const std::string nonce = message.response_nonce();
           if (!nonce.empty()) {
@@ -126,17 +126,19 @@ class DeltaSubscriptionTestHarness : public SubscriptionTestHarness {
 
   void deliverConfigUpdate(const std::vector<std::string>& cluster_names,
                            const std::string& version, bool accept) override {
-    auto response = std::make_unique<envoy::api::v2::DeltaDiscoveryResponse>();
+    auto response = std::make_unique<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>();
     last_response_nonce_ = std::to_string(HashUtil::xxHash64(version));
     response->set_nonce(last_response_nonce_);
     response->set_system_version_info(version);
     response->set_type_url(Config::TypeUrl::get().ClusterLoadAssignment);
 
-    Protobuf::RepeatedPtrField<envoy::api::v2::ClusterLoadAssignment> typed_resources;
+    Protobuf::RepeatedPtrField<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>
+        typed_resources;
     for (const auto& cluster : cluster_names) {
       if (std::find(last_cluster_names_.begin(), last_cluster_names_.end(), cluster) !=
           last_cluster_names_.end()) {
-        envoy::api::v2::ClusterLoadAssignment* load_assignment = typed_resources.Add();
+        envoy::config::endpoint::v3alpha::ClusterLoadAssignment* load_assignment =
+            typed_resources.Add();
         load_assignment->set_cluster_name(cluster);
         auto* resource = response->add_resources();
         resource->set_name(cluster);
@@ -200,8 +202,10 @@ class DeltaSubscriptionTestHarness : public SubscriptionTestHarness {
   std::set<std::string> last_cluster_names_;
   Envoy::Config::RateLimitSettings rate_limit_settings_;
   Event::MockTimer* init_timeout_timer_;
-  envoy::api::v2::core::Node node_;
-  NiceMock<Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment>> callbacks_;
+  envoy::config::core::v3alpha::Node node_;
+  NiceMock<
+      Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>>
+      callbacks_;
   std::queue<std::string> nonce_acks_required_;
   std::queue<std::string> nonce_acks_sent_;
   bool subscription_started_{};
diff --git a/test/common/config/filesystem_subscription_impl_test.cc b/test/common/config/filesystem_subscription_impl_test.cc
index 7b83c61cc59a..11f9e7bff19a 100644
--- a/test/common/config/filesystem_subscription_impl_test.cc
+++ b/test/common/config/filesystem_subscription_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 
 #include "test/common/config/filesystem_subscription_test_harness.h"
 #include "test/mocks/event/mocks.h"
@@ -47,7 +47,9 @@ TEST(MiscFilesystemSubscriptionImplTest, BadWatch) {
   auto* watcher = new Filesystem::MockWatcher();
   EXPECT_CALL(dispatcher, createFilesystemWatcher_()).WillOnce(Return(watcher));
   EXPECT_CALL(*watcher, addWatch(_, _, _)).WillOnce(Throw(EnvoyException("bad path")));
-  NiceMock<Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment>> callbacks;
+  NiceMock<
+      Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>>
+      callbacks;
   EXPECT_THROW_WITH_MESSAGE(FilesystemSubscriptionImpl(dispatcher, "##!@/dev/null", callbacks,
                                                        stats, validation_visitor, *api),
                             EnvoyException, "bad path");
diff --git a/test/common/config/filesystem_subscription_test_harness.h b/test/common/config/filesystem_subscription_test_harness.h
index f05d36cd2479..f4c5c005d231 100644
--- a/test/common/config/filesystem_subscription_test_harness.h
+++ b/test/common/config/filesystem_subscription_test_harness.h
@@ -2,8 +2,8 @@
 
 #include <fstream>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/filesystem_subscription_impl.h"
 #include "common/config/utility.h"
@@ -75,7 +75,7 @@ class FilesystemSubscriptionTestHarness : public SubscriptionTestHarness {
     }
     file_json.pop_back();
     file_json += "]}";
-    envoy::api::v2::DiscoveryResponse response_pb;
+    envoy::service::discovery::v3alpha::DiscoveryResponse response_pb;
     TestUtility::loadFromJson(file_json, response_pb);
     EXPECT_CALL(callbacks_, onConfigUpdate(RepeatedProtoEq(response_pb.resources()), version))
         .WillOnce(ThrowOnRejectedConfig(accept));
@@ -115,7 +115,9 @@ class FilesystemSubscriptionTestHarness : public SubscriptionTestHarness {
   NiceMock<ProtobufMessage::MockValidationVisitor> validation_visitor_;
   Api::ApiPtr api_;
   Event::DispatcherPtr dispatcher_;
-  NiceMock<Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment>> callbacks_;
+  NiceMock<
+      Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>>
+      callbacks_;
   FilesystemSubscriptionImpl subscription_;
   bool file_at_start_{false};
 };
diff --git a/test/common/config/grpc_mux_impl_test.cc b/test/common/config/grpc_mux_impl_test.cc
index 20cbe450ee42..4911d00e9e1d 100644
--- a/test/common/config/grpc_mux_impl_test.cc
+++ b/test/common/config/grpc_mux_impl_test.cc
@@ -1,7 +1,8 @@
 #include <memory>
 
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/config/api_version.h"
@@ -202,8 +203,8 @@ TEST_F(GrpcMuxImplTest, PauseResume) {
 TEST_F(GrpcMuxImplTest, TypeUrlMismatch) {
   setup();
 
-  std::unique_ptr<envoy::api::v2::DiscoveryResponse> invalid_response(
-      new envoy::api::v2::DiscoveryResponse());
+  std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> invalid_response(
+      new envoy::service::discovery::v3alpha::DiscoveryResponse());
   InSequence s;
   auto foo_sub = grpc_mux_->subscribe("foo", {"x", "y"}, callbacks_);
 
@@ -212,8 +213,8 @@ TEST_F(GrpcMuxImplTest, TypeUrlMismatch) {
   grpc_mux_->start();
 
   {
-    std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-        new envoy::api::v2::DiscoveryResponse());
+    std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+        new envoy::service::discovery::v3alpha::DiscoveryResponse());
     response->set_type_url("bar");
     grpc_mux_->grpcStreamForTest().onReceiveMessage(std::move(response));
   }
@@ -249,11 +250,11 @@ TEST_F(GrpcMuxImplTest, WildcardWatch) {
   grpc_mux_->start();
 
   {
-    std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-        new envoy::api::v2::DiscoveryResponse());
+    std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+        new envoy::service::discovery::v3alpha::DiscoveryResponse());
     response->set_type_url(type_url);
     response->set_version_info("1");
-    envoy::api::v2::ClusterLoadAssignment load_assignment;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment;
     load_assignment.set_cluster_name("x");
     response->add_resources()->PackFrom(API_DOWNGRADE(load_assignment));
     EXPECT_CALL(callbacks_, onConfigUpdate(_, "1"))
@@ -261,8 +262,9 @@ TEST_F(GrpcMuxImplTest, WildcardWatch) {
             Invoke([&load_assignment](const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                                       const std::string&) {
               EXPECT_EQ(1, resources.size());
-              envoy::api::v2::ClusterLoadAssignment expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[0]);
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment expected_assignment =
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+                      resources[0]);
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment));
             }));
     expectSendMessage(type_url, {}, "1");
@@ -285,11 +287,11 @@ TEST_F(GrpcMuxImplTest, WatchDemux) {
   grpc_mux_->start();
 
   {
-    std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-        new envoy::api::v2::DiscoveryResponse());
+    std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+        new envoy::service::discovery::v3alpha::DiscoveryResponse());
     response->set_type_url(type_url);
     response->set_version_info("1");
-    envoy::api::v2::ClusterLoadAssignment load_assignment;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment;
     load_assignment.set_cluster_name("x");
     response->add_resources()->PackFrom(API_DOWNGRADE(load_assignment));
     EXPECT_CALL(bar_callbacks, onConfigUpdate(_, "1")).Times(0);
@@ -298,8 +300,9 @@ TEST_F(GrpcMuxImplTest, WatchDemux) {
             Invoke([&load_assignment](const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                                       const std::string&) {
               EXPECT_EQ(1, resources.size());
-              envoy::api::v2::ClusterLoadAssignment expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[0]);
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment expected_assignment =
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+                      resources[0]);
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment));
             }));
     expectSendMessage(type_url, {"y", "z", "x"}, "1");
@@ -307,17 +310,17 @@ TEST_F(GrpcMuxImplTest, WatchDemux) {
   }
 
   {
-    std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-        new envoy::api::v2::DiscoveryResponse());
+    std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+        new envoy::service::discovery::v3alpha::DiscoveryResponse());
     response->set_type_url(type_url);
     response->set_version_info("2");
-    envoy::api::v2::ClusterLoadAssignment load_assignment_x;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment_x;
     load_assignment_x.set_cluster_name("x");
     response->add_resources()->PackFrom(API_DOWNGRADE(load_assignment_x));
-    envoy::api::v2::ClusterLoadAssignment load_assignment_y;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment_y;
     load_assignment_y.set_cluster_name("y");
     response->add_resources()->PackFrom(API_DOWNGRADE(load_assignment_y));
-    envoy::api::v2::ClusterLoadAssignment load_assignment_z;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment_z;
     load_assignment_z.set_cluster_name("z");
     response->add_resources()->PackFrom(API_DOWNGRADE(load_assignment_z));
     EXPECT_CALL(bar_callbacks, onConfigUpdate(_, "2"))
@@ -325,11 +328,13 @@ TEST_F(GrpcMuxImplTest, WatchDemux) {
             [&load_assignment_y, &load_assignment_z](
                 const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources, const std::string&) {
               EXPECT_EQ(2, resources.size());
-              envoy::api::v2::ClusterLoadAssignment expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[0]);
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment expected_assignment =
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+                      resources[0]);
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment_y));
               expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[1]);
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+                      resources[1]);
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment_z));
             }));
     EXPECT_CALL(foo_callbacks, onConfigUpdate(_, "2"))
@@ -337,11 +342,13 @@ TEST_F(GrpcMuxImplTest, WatchDemux) {
             [&load_assignment_x, &load_assignment_y](
                 const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources, const std::string&) {
               EXPECT_EQ(2, resources.size());
-              envoy::api::v2::ClusterLoadAssignment expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[0]);
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment expected_assignment =
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+                      resources[0]);
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment_x));
               expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resources[1]);
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+                      resources[1]);
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment_y));
             }));
     expectSendMessage(type_url, {"y", "z", "x"}, "2");
@@ -364,8 +371,8 @@ TEST_F(GrpcMuxImplTest, MultipleWatcherWithEmptyUpdates) {
   expectSendMessage(type_url, {"x", "y"}, "", true);
   grpc_mux_->start();
 
-  std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-      new envoy::api::v2::DiscoveryResponse());
+  std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+      new envoy::service::discovery::v3alpha::DiscoveryResponse());
   response->set_type_url(type_url);
   response->set_version_info("1");
 
@@ -387,8 +394,8 @@ TEST_F(GrpcMuxImplTest, SingleWatcherWithEmptyUpdates) {
   expectSendMessage(type_url, {}, "", true);
   grpc_mux_->start();
 
-  std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-      new envoy::api::v2::DiscoveryResponse());
+  std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+      new envoy::service::discovery::v3alpha::DiscoveryResponse());
   response->set_type_url(type_url);
   response->set_version_info("1");
   // Validate that onConfigUpdate is called with empty resources.
@@ -428,8 +435,8 @@ TEST_F(GrpcMuxImplTestWithMockTimeSystem, TooManyRequestsWithDefaultSettings) {
 
   const auto onReceiveMessage = [&](uint64_t burst) {
     for (uint64_t i = 0; i < burst; i++) {
-      std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-          new envoy::api::v2::DiscoveryResponse());
+      std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+          new envoy::service::discovery::v3alpha::DiscoveryResponse());
       response->set_version_info("baz");
       response->set_nonce("bar");
       response->set_type_url("foo");
@@ -481,8 +488,8 @@ TEST_F(GrpcMuxImplTestWithMockTimeSystem, TooManyRequestsWithEmptyRateLimitSetti
 
   const auto onReceiveMessage = [&](uint64_t burst) {
     for (uint64_t i = 0; i < burst; i++) {
-      std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-          new envoy::api::v2::DiscoveryResponse());
+      std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+          new envoy::service::discovery::v3alpha::DiscoveryResponse());
       response->set_version_info("baz");
       response->set_nonce("bar");
       response->set_type_url("foo");
@@ -537,8 +544,8 @@ TEST_F(GrpcMuxImplTest, TooManyRequestsWithCustomRateLimitSettings) {
 
   const auto onReceiveMessage = [&](uint64_t burst) {
     for (uint64_t i = 0; i < burst; i++) {
-      std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-          new envoy::api::v2::DiscoveryResponse());
+      std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+          new envoy::service::discovery::v3alpha::DiscoveryResponse());
       response->set_version_info("baz");
       response->set_nonce("bar");
       response->set_type_url("foo");
@@ -588,8 +595,8 @@ TEST_F(GrpcMuxImplTest, UnwatchedTypeAcceptsEmptyResources) {
   }
 
   // simulate the server sending empty CLA message to notify envoy that the CLA was removed.
-  std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-      new envoy::api::v2::DiscoveryResponse());
+  std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+      new envoy::service::discovery::v3alpha::DiscoveryResponse());
   response->set_nonce("bar");
   response->set_version_info("1");
   response->set_type_url(type_url);
@@ -624,13 +631,13 @@ TEST_F(GrpcMuxImplTest, UnwatchedTypeRejectsResources) {
 
   // simulate the server sending CLA message to notify envoy that the CLA was added,
   // even though envoy doesn't expect it. Envoy should reject this update.
-  std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-      new envoy::api::v2::DiscoveryResponse());
+  std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+      new envoy::service::discovery::v3alpha::DiscoveryResponse());
   response->set_nonce("bar");
   response->set_version_info("1");
   response->set_type_url(type_url);
 
-  envoy::api::v2::ClusterLoadAssignment load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment;
   load_assignment.set_cluster_name("x");
   response->add_resources()->PackFrom(load_assignment);
 
diff --git a/test/common/config/grpc_stream_test.cc b/test/common/config/grpc_stream_test.cc
index bb575711ea20..8f1040deec92 100644
--- a/test/common/config/grpc_stream_test.cc
+++ b/test/common/config/grpc_stream_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/grpc_stream.h"
 #include "common/protobuf/protobuf.h"
@@ -38,7 +38,9 @@ class GrpcStreamTest : public testing::Test {
   std::unique_ptr<Grpc::MockAsyncClient> async_client_owner_;
   Grpc::MockAsyncClient* async_client_;
 
-  GrpcStream<envoy::api::v2::DiscoveryRequest, envoy::api::v2::DiscoveryResponse> grpc_stream_;
+  GrpcStream<envoy::service::discovery::v3alpha::DiscoveryRequest,
+             envoy::service::discovery::v3alpha::DiscoveryResponse>
+      grpc_stream_;
 };
 
 // Tests that establishNewStream() establishes it, a second call does nothing, and a third call
@@ -84,7 +86,7 @@ TEST_F(GrpcStreamTest, FailToEstablishNewStream) {
 TEST_F(GrpcStreamTest, SendMessage) {
   EXPECT_CALL(*async_client_, startRaw(_, _, _, _)).WillOnce(Return(&async_stream_));
   grpc_stream_.establishNewStream();
-  envoy::api::v2::DiscoveryRequest request;
+  envoy::service::discovery::v3alpha::DiscoveryRequest request;
   request.set_response_nonce("grpc_stream_test_noncense");
   EXPECT_CALL(async_stream_, sendMessageRaw_(Grpc::ProtoBufferEq(request), false));
   grpc_stream_.sendMessage(request);
@@ -94,14 +96,17 @@ TEST_F(GrpcStreamTest, SendMessage) {
 // underlying gRPC machinery, the received proto will make it up to the GrpcStreamCallbacks that the
 // GrpcStream was given.
 TEST_F(GrpcStreamTest, ReceiveMessage) {
-  envoy::api::v2::DiscoveryResponse response_copy;
+  envoy::service::discovery::v3alpha::DiscoveryResponse response_copy;
   response_copy.set_type_url("faketypeURL");
-  auto response = std::make_unique<envoy::api::v2::DiscoveryResponse>(response_copy);
-  envoy::api::v2::DiscoveryResponse received_message;
+  auto response =
+      std::make_unique<envoy::service::discovery::v3alpha::DiscoveryResponse>(response_copy);
+  envoy::service::discovery::v3alpha::DiscoveryResponse received_message;
   EXPECT_CALL(callbacks_, onDiscoveryResponse(_))
-      .WillOnce([&received_message](std::unique_ptr<envoy::api::v2::DiscoveryResponse>&& message) {
-        received_message = *message;
-      });
+      .WillOnce(
+          [&received_message](
+              std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse>&& message) {
+            received_message = *message;
+          });
   grpc_stream_.onReceiveMessage(std::move(response));
   EXPECT_TRUE(TestUtility::protoEqual(response_copy, received_message));
 }
diff --git a/test/common/config/grpc_subscription_test_harness.h b/test/common/config/grpc_subscription_test_harness.h
index b173e379700a..c29298f62d19 100644
--- a/test/common/config/grpc_subscription_test_harness.h
+++ b/test/common/config/grpc_subscription_test_harness.h
@@ -2,9 +2,10 @@
 
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/hash.h"
 #include "common/config/api_version.h"
@@ -93,17 +94,19 @@ class GrpcSubscriptionTestHarness : public SubscriptionTestHarness {
 
   void deliverConfigUpdate(const std::vector<std::string>& cluster_names,
                            const std::string& version, bool accept) override {
-    std::unique_ptr<envoy::api::v2::DiscoveryResponse> response(
-        new envoy::api::v2::DiscoveryResponse());
+    std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse> response(
+        new envoy::service::discovery::v3alpha::DiscoveryResponse());
     response->set_version_info(version);
     last_response_nonce_ = std::to_string(HashUtil::xxHash64(version));
     response->set_nonce(last_response_nonce_);
     response->set_type_url(Config::TypeUrl::get().ClusterLoadAssignment);
-    Protobuf::RepeatedPtrField<envoy::api::v2::ClusterLoadAssignment> typed_resources;
+    Protobuf::RepeatedPtrField<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>
+        typed_resources;
     for (const auto& cluster : cluster_names) {
       if (std::find(last_cluster_names_.begin(), last_cluster_names_.end(), cluster) !=
           last_cluster_names_.end()) {
-        envoy::api::v2::ClusterLoadAssignment* load_assignment = typed_resources.Add();
+        envoy::config::endpoint::v3alpha::ClusterLoadAssignment* load_assignment =
+            typed_resources.Add();
         load_assignment->set_cluster_name(cluster);
         response->add_resources()->PackFrom(API_DOWNGRADE(*load_assignment));
       }
@@ -169,8 +172,10 @@ class GrpcSubscriptionTestHarness : public SubscriptionTestHarness {
   Runtime::MockRandomGenerator random_;
   Event::MockTimer* timer_;
   Event::TimerCb timer_cb_;
-  envoy::api::v2::core::Node node_;
-  NiceMock<Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment>> callbacks_;
+  envoy::config::core::v3alpha::Node node_;
+  NiceMock<
+      Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>>
+      callbacks_;
   NiceMock<Grpc::MockAsyncStream> async_stream_;
   std::unique_ptr<GrpcSubscriptionImpl> subscription_;
   std::string last_response_nonce_;
diff --git a/test/common/config/http_subscription_test_harness.h b/test/common/config/http_subscription_test_harness.h
index 07862eafdae5..7796664edc72 100644
--- a/test/common/config/http_subscription_test_harness.h
+++ b/test/common/config/http_subscription_test_harness.h
@@ -2,10 +2,10 @@
 
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 #include "envoy/http/async_client.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/utility.h"
 #include "common/config/http_subscription_impl.h"
@@ -131,7 +131,7 @@ class HttpSubscriptionTestHarness : public SubscriptionTestHarness {
     }
     response_json.pop_back();
     response_json += "]}";
-    envoy::api::v2::DiscoveryResponse response_pb;
+    envoy::service::discovery::v3alpha::DiscoveryResponse response_pb;
     TestUtility::loadFromJson(response_json, response_pb);
     Http::HeaderMapPtr response_headers{new Http::TestHeaderMapImpl{{":status", response_code}}};
     Http::MessagePtr message{new Http::ResponseMessageImpl(std::move(response_headers))};
@@ -183,11 +183,12 @@ class HttpSubscriptionTestHarness : public SubscriptionTestHarness {
   Event::MockDispatcher dispatcher_;
   Event::MockTimer* timer_;
   Event::TimerCb timer_cb_;
-  envoy::api::v2::core::Node node_;
+  envoy::config::core::v3alpha::Node node_;
   Runtime::MockRandomGenerator random_gen_;
   Http::MockAsyncClientRequest http_request_;
   Http::AsyncClient::Callbacks* http_callbacks_;
-  Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment> callbacks_;
+  Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>
+      callbacks_;
   std::unique_ptr<HttpSubscriptionImpl> subscription_;
   NiceMock<LocalInfo::MockLocalInfo> local_info_;
   Event::MockTimer* init_timeout_timer_;
diff --git a/test/common/config/metadata_test.cc b/test/common/config/metadata_test.cc
index 548f5078f54a..0116a834c435 100644
--- a/test/common/config/metadata_test.cc
+++ b/test/common/config/metadata_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/config/metadata.h"
 #include "common/config/well_known_names.h"
@@ -15,7 +15,7 @@ namespace Config {
 namespace {
 
 TEST(MetadataTest, MetadataValue) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Metadata::mutableMetadataValue(metadata, MetadataFilters::get().ENVOY_LB,
                                  MetadataEnvoyLbKeys::get().CANARY)
       .set_bool_value(true);
@@ -29,7 +29,7 @@ TEST(MetadataTest, MetadataValue) {
 
 TEST(MetadataTest, MetadataValuePath) {
   const std::string filter = "com.test";
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   std::vector<std::string> path{"test_obj", "inner_key"};
   // not found case
   EXPECT_EQ(Metadata::metadataValue(metadata, filter, path).kind_case(),
@@ -79,7 +79,7 @@ class TypedMetadataTest : public testing::Test {
 };
 
 TEST_F(TypedMetadataTest, OkTest) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   (*metadata.mutable_filter_metadata())[foo_factory_.name()] =
       MessageUtil::keyValueStruct("name", "foo");
   TypedMetadataImpl<TypedMetadataFactory> typed(metadata);
@@ -90,13 +90,13 @@ TEST_F(TypedMetadataTest, OkTest) {
 }
 
 TEST_F(TypedMetadataTest, NoMetadataTest) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   TypedMetadataImpl<TypedMetadataFactory> typed(metadata);
   EXPECT_EQ(nullptr, typed.get<Foo>(foo_factory_.name()));
 }
 
 TEST_F(TypedMetadataTest, MetadataRefreshTest) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   (*metadata.mutable_filter_metadata())[foo_factory_.name()] =
       MessageUtil::keyValueStruct("name", "foo");
   TypedMetadataImpl<TypedMetadataFactory> typed(metadata);
@@ -117,7 +117,7 @@ TEST_F(TypedMetadataTest, MetadataRefreshTest) {
 }
 
 TEST_F(TypedMetadataTest, InvalidMetadataTest) {
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   (*metadata.mutable_filter_metadata())[foo_factory_.name()] = ProtobufWkt::Struct();
   EXPECT_THROW_WITH_MESSAGE(TypedMetadataImpl<TypedMetadataFactory> typed(metadata),
                             Envoy::EnvoyException, "Cannot create a Foo when metadata is empty.");
diff --git a/test/common/config/new_grpc_mux_impl_test.cc b/test/common/config/new_grpc_mux_impl_test.cc
index fd138174afdc..3f475f00826d 100644
--- a/test/common/config/new_grpc_mux_impl_test.cc
+++ b/test/common/config/new_grpc_mux_impl_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/config/new_grpc_mux_impl.h"
@@ -57,7 +57,9 @@ class NewGrpcMuxImplTestBase : public testing::Test {
   Grpc::MockAsyncClient* async_client_;
   NiceMock<Grpc::MockAsyncStream> async_stream_;
   std::unique_ptr<NewGrpcMuxImpl> grpc_mux_;
-  NiceMock<Config::MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment>> callbacks_;
+  NiceMock<
+      Config::MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>>
+      callbacks_;
   NiceMock<LocalInfo::MockLocalInfo> local_info_;
   Stats::IsolatedStoreImpl stats_;
   Envoy::Config::RateLimitSettings rate_limit_settings_;
@@ -86,27 +88,29 @@ TEST_F(NewGrpcMuxImplTest, DiscoveryResponseNonexistentSub) {
   grpc_mux_->start();
 
   {
-    auto unexpected_response = std::make_unique<envoy::api::v2::DeltaDiscoveryResponse>();
+    auto unexpected_response =
+        std::make_unique<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>();
     unexpected_response->set_type_url(type_url);
     unexpected_response->set_system_version_info("0");
     EXPECT_CALL(callbacks_, onConfigUpdate(_, _, "0")).Times(0);
     grpc_mux_->onDiscoveryResponse(std::move(unexpected_response));
   }
   {
-    auto response = std::make_unique<envoy::api::v2::DeltaDiscoveryResponse>();
+    auto response = std::make_unique<envoy::service::discovery::v3alpha::DeltaDiscoveryResponse>();
     response->set_type_url(type_url);
     response->set_system_version_info("1");
-    envoy::api::v2::ClusterLoadAssignment load_assignment;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment load_assignment;
     load_assignment.set_cluster_name("x");
     response->add_resources()->mutable_resource()->PackFrom(API_DOWNGRADE(load_assignment));
     EXPECT_CALL(callbacks_, onConfigUpdate(_, _, "1"))
-        .WillOnce(
-            Invoke([&load_assignment](
-                       const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
-                       const Protobuf::RepeatedPtrField<std::string>&, const std::string&) {
+        .WillOnce(Invoke(
+            [&load_assignment](
+                const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                    added_resources,
+                const Protobuf::RepeatedPtrField<std::string>&, const std::string&) {
               EXPECT_EQ(1, added_resources.size());
-              envoy::api::v2::ClusterLoadAssignment expected_assignment =
-                  MessageUtil::anyConvert<envoy::api::v2::ClusterLoadAssignment>(
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment expected_assignment =
+                  MessageUtil::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
                       added_resources[0].resource());
               EXPECT_TRUE(TestUtility::protoEqual(expected_assignment, load_assignment));
             }));
diff --git a/test/common/config/runtime_utility_test.cc b/test/common/config/runtime_utility_test.cc
index 76352810b118..67d0c42ee1bd 100644
--- a/test/common/config/runtime_utility_test.cc
+++ b/test/common/config/runtime_utility_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/config/runtime_utility.h"
 
@@ -12,9 +12,9 @@ namespace Config {
 namespace {
 
 TEST(RuntimeUtility, TranslateEmpty) {
-  envoy::config::bootstrap::v2::LayeredRuntime layered_runtime_config;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime_config;
   translateRuntime({}, layered_runtime_config);
-  envoy::config::bootstrap::v2::LayeredRuntime expected_runtime_config;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime expected_runtime_config;
   {
     auto* layer = expected_runtime_config.add_layers();
     layer->set_name("base");
@@ -29,12 +29,12 @@ TEST(RuntimeUtility, TranslateEmpty) {
 }
 
 TEST(RuntimeUtility, TranslateSubdirOnly) {
-  envoy::config::bootstrap::v2::Runtime runtime_config;
+  envoy::config::bootstrap::v3alpha::Runtime runtime_config;
   runtime_config.set_symlink_root("foo");
   runtime_config.set_subdirectory("bar");
-  envoy::config::bootstrap::v2::LayeredRuntime layered_runtime_config;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime_config;
   translateRuntime(runtime_config, layered_runtime_config);
-  envoy::config::bootstrap::v2::LayeredRuntime expected_runtime_config;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime expected_runtime_config;
   {
     auto* layer = expected_runtime_config.add_layers();
     layer->set_name("base");
@@ -55,13 +55,13 @@ TEST(RuntimeUtility, TranslateSubdirOnly) {
 }
 
 TEST(RuntimeUtility, TranslateSubdirOverride) {
-  envoy::config::bootstrap::v2::Runtime runtime_config;
+  envoy::config::bootstrap::v3alpha::Runtime runtime_config;
   runtime_config.set_symlink_root("foo");
   runtime_config.set_subdirectory("bar");
   runtime_config.set_override_subdirectory("baz");
-  envoy::config::bootstrap::v2::LayeredRuntime layered_runtime_config;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime_config;
   translateRuntime(runtime_config, layered_runtime_config);
-  envoy::config::bootstrap::v2::LayeredRuntime expected_runtime_config;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime expected_runtime_config;
   {
     auto* layer = expected_runtime_config.add_layers();
     layer->set_name("base");
diff --git a/test/common/config/subscription_factory_impl_test.cc b/test/common/config/subscription_factory_impl_test.cc
index 547ae7fa876e..332f3c3895fe 100644
--- a/test/common/config/subscription_factory_impl_test.cc
+++ b/test/common/config/subscription_factory_impl_test.cc
@@ -1,10 +1,11 @@
 #include <memory>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/api/v2/eds.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/subscription_factory_impl.h"
@@ -37,7 +38,7 @@ class SubscriptionFactoryTest : public testing::Test {
       : http_request_(&cm_.async_client_), api_(Api::createApiForTest(stats_store_)) {}
 
   std::unique_ptr<Subscription>
-  subscriptionFromConfigSource(const envoy::api::v2::core::ConfigSource& config) {
+  subscriptionFromConfigSource(const envoy::config::core::v3alpha::ConfigSource& config) {
     return SubscriptionFactoryImpl(local_info_, dispatcher_, cm_, random_, validation_visitor_,
                                    *api_)
         .subscriptionFromConfigSource(config, Config::TypeUrl::get().ClusterLoadAssignment,
@@ -47,7 +48,7 @@ class SubscriptionFactoryTest : public testing::Test {
   Upstream::MockClusterManager cm_;
   Event::MockDispatcher dispatcher_;
   Runtime::MockRandomGenerator random_;
-  MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment> callbacks_;
+  MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment> callbacks_;
   Http::MockAsyncClientRequest http_request_;
   Stats::MockIsolatedStatsStore stats_store_;
   NiceMock<LocalInfo::MockLocalInfo> local_info_;
@@ -57,20 +58,21 @@ class SubscriptionFactoryTest : public testing::Test {
 
 class SubscriptionFactoryTestApiConfigSource
     : public SubscriptionFactoryTest,
-      public testing::WithParamInterface<::envoy::api::v2::core::ApiConfigSource_ApiType> {};
+      public testing::WithParamInterface<envoy::config::core::v3alpha::ApiConfigSource::ApiType> {};
 
 TEST_F(SubscriptionFactoryTest, NoConfigSpecifier) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   EXPECT_THROW_WITH_MESSAGE(
       subscriptionFromConfigSource(config), EnvoyException,
       "Missing config source specifier in envoy::api::v2::core::ConfigSource");
 }
 
 TEST_F(SubscriptionFactoryTest, RestClusterEmpty) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
 
-  config.mutable_api_config_source()->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  config.mutable_api_config_source()->set_api_type(
+      envoy::config::core::v3alpha::ApiConfigSource::REST);
 
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(cluster_map));
   EXPECT_THROW_WITH_REGEX(subscriptionFromConfigSource(config), EnvoyException,
@@ -78,10 +80,11 @@ TEST_F(SubscriptionFactoryTest, RestClusterEmpty) {
 }
 
 TEST_F(SubscriptionFactoryTest, GrpcClusterEmpty) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
 
-  config.mutable_api_config_source()->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  config.mutable_api_config_source()->set_api_type(
+      envoy::config::core::v3alpha::ApiConfigSource::GRPC);
 
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(cluster_map));
   EXPECT_THROW_WITH_REGEX(subscriptionFromConfigSource(config), EnvoyException,
@@ -89,11 +92,12 @@ TEST_F(SubscriptionFactoryTest, GrpcClusterEmpty) {
 }
 
 TEST_F(SubscriptionFactoryTest, RestClusterSingleton) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   NiceMock<Upstream::MockClusterMockPrioritySet> cluster;
 
-  config.mutable_api_config_source()->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  config.mutable_api_config_source()->set_api_type(
+      envoy::config::core::v3alpha::ApiConfigSource::REST);
   config.mutable_api_config_source()->mutable_refresh_delay()->set_seconds(1);
   config.mutable_api_config_source()->add_cluster_names("static_cluster");
   cluster_map.emplace("static_cluster", cluster);
@@ -101,29 +105,31 @@ TEST_F(SubscriptionFactoryTest, RestClusterSingleton) {
   EXPECT_CALL(dispatcher_, createTimer_(_));
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(cluster_map));
   EXPECT_CALL(*cluster.info_, addedViaApi()).WillOnce(Return(false));
-  EXPECT_CALL(*cluster.info_, type()).WillOnce(Return(envoy::api::v2::Cluster::STATIC));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillOnce(Return(envoy::config::cluster::v3alpha::Cluster::STATIC));
   subscriptionFromConfigSource(config);
 }
 
 TEST_F(SubscriptionFactoryTest, GrpcClusterSingleton) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   NiceMock<Upstream::MockClusterMockPrioritySet> cluster;
 
-  config.mutable_api_config_source()->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  config.mutable_api_config_source()->set_api_type(
+      envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   config.mutable_api_config_source()->mutable_refresh_delay()->set_seconds(1);
   config.mutable_api_config_source()->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name(
       "static_cluster");
   cluster_map.emplace("static_cluster", cluster);
 
-  envoy::api::v2::core::GrpcService expected_grpc_service;
+  envoy::config::core::v3alpha::GrpcService expected_grpc_service;
   expected_grpc_service.mutable_envoy_grpc()->set_cluster_name("static_cluster");
 
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(cluster_map));
   EXPECT_CALL(cm_, grpcAsyncClientManager()).WillOnce(ReturnRef(cm_.async_client_manager_));
   EXPECT_CALL(cm_.async_client_manager_,
               factoryForGrpcService(ProtoEq(expected_grpc_service), _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         auto async_client_factory = std::make_unique<Grpc::MockAsyncClientFactory>();
         EXPECT_CALL(*async_client_factory, create()).WillOnce(Invoke([] {
           return std::make_unique<Grpc::MockAsyncClient>();
@@ -131,18 +137,20 @@ TEST_F(SubscriptionFactoryTest, GrpcClusterSingleton) {
         return async_client_factory;
       }));
   EXPECT_CALL(*cluster.info_, addedViaApi()).WillOnce(Return(false));
-  EXPECT_CALL(*cluster.info_, type()).WillOnce(Return(envoy::api::v2::Cluster::STATIC));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillOnce(Return(envoy::config::cluster::v3alpha::Cluster::STATIC));
   EXPECT_CALL(dispatcher_, createTimer_(_));
 
   subscriptionFromConfigSource(config);
 }
 
 TEST_F(SubscriptionFactoryTest, RestClusterMultiton) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   NiceMock<Upstream::MockClusterMockPrioritySet> cluster;
 
-  config.mutable_api_config_source()->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  config.mutable_api_config_source()->set_api_type(
+      envoy::config::core::v3alpha::ApiConfigSource::REST);
 
   config.mutable_api_config_source()->add_cluster_names("static_cluster_foo");
   cluster_map.emplace("static_cluster_foo", cluster);
@@ -152,18 +160,20 @@ TEST_F(SubscriptionFactoryTest, RestClusterMultiton) {
 
   EXPECT_CALL(cm_, clusters()).WillRepeatedly(Return(cluster_map));
   EXPECT_CALL(*cluster.info_, addedViaApi()).WillRepeatedly(Return(false));
-  EXPECT_CALL(*cluster.info_, type()).WillRepeatedly(Return(envoy::api::v2::Cluster::STATIC));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillRepeatedly(Return(envoy::config::cluster::v3alpha::Cluster::STATIC));
   EXPECT_THROW_WITH_REGEX(
       subscriptionFromConfigSource(config), EnvoyException,
       "envoy::api::v2::core::ConfigSource must have a singleton cluster name specified:");
 }
 
 TEST_F(SubscriptionFactoryTest, GrpcClusterMultiton) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   NiceMock<Upstream::MockClusterMockPrioritySet> cluster;
 
-  config.mutable_api_config_source()->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  config.mutable_api_config_source()->set_api_type(
+      envoy::config::core::v3alpha::ApiConfigSource::GRPC);
 
   config.mutable_api_config_source()->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name(
       "static_cluster_foo");
@@ -175,7 +185,8 @@ TEST_F(SubscriptionFactoryTest, GrpcClusterMultiton) {
   EXPECT_CALL(cm_, clusters()).WillRepeatedly(Return(cluster_map));
   EXPECT_CALL(cm_, grpcAsyncClientManager()).WillRepeatedly(ReturnRef(cm_.async_client_manager_));
   EXPECT_CALL(*cluster.info_, addedViaApi()).WillRepeatedly(Return(false));
-  EXPECT_CALL(*cluster.info_, type()).WillRepeatedly(Return(envoy::api::v2::Cluster::STATIC));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillRepeatedly(Return(envoy::config::cluster::v3alpha::Cluster::STATIC));
 
   EXPECT_THROW_WITH_REGEX(subscriptionFromConfigSource(config), EnvoyException,
                           "envoy::api::v2::core::ConfigSource::.DELTA_.GRPC must have a "
@@ -183,7 +194,7 @@ TEST_F(SubscriptionFactoryTest, GrpcClusterMultiton) {
 }
 
 TEST_F(SubscriptionFactoryTest, FilesystemSubscription) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   std::string test_path = TestEnvironment::temporaryDirectory();
   config.set_path(test_path);
   auto* watcher = new Filesystem::MockWatcher();
@@ -194,7 +205,7 @@ TEST_F(SubscriptionFactoryTest, FilesystemSubscription) {
 }
 
 TEST_F(SubscriptionFactoryTest, FilesystemSubscriptionNonExistentFile) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   config.set_path("/blahblah");
   EXPECT_THROW_WITH_MESSAGE(subscriptionFromConfigSource(config)->start({"foo"}), EnvoyException,
                             "envoy::api::v2::Path must refer to an existing path in the system: "
@@ -202,9 +213,10 @@ TEST_F(SubscriptionFactoryTest, FilesystemSubscriptionNonExistentFile) {
 }
 
 TEST_F(SubscriptionFactoryTest, LegacySubscription) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::UNSUPPORTED_REST_LEGACY);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::
+                                      hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY);
   api_config_source->add_cluster_names("static_cluster");
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   Upstream::MockClusterMockPrioritySet cluster;
@@ -217,9 +229,9 @@ TEST_F(SubscriptionFactoryTest, LegacySubscription) {
 }
 
 TEST_F(SubscriptionFactoryTest, HttpSubscriptionCustomRequestTimeout) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
   api_config_source->add_cluster_names("static_cluster");
   api_config_source->mutable_refresh_delay()->set_seconds(1);
   api_config_source->mutable_request_timeout()->set_seconds(5);
@@ -238,9 +250,9 @@ TEST_F(SubscriptionFactoryTest, HttpSubscriptionCustomRequestTimeout) {
 }
 
 TEST_F(SubscriptionFactoryTest, HttpSubscription) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
   api_config_source->add_cluster_names("static_cluster");
   api_config_source->mutable_refresh_delay()->set_seconds(1);
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
@@ -267,9 +279,9 @@ TEST_F(SubscriptionFactoryTest, HttpSubscription) {
 
 // Confirm error when no refresh delay is set (not checked by schema).
 TEST_F(SubscriptionFactoryTest, HttpSubscriptionNoRefreshDelay) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
   api_config_source->add_cluster_names("static_cluster");
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   Upstream::MockClusterMockPrioritySet cluster;
@@ -283,11 +295,11 @@ TEST_F(SubscriptionFactoryTest, HttpSubscriptionNoRefreshDelay) {
 }
 
 TEST_F(SubscriptionFactoryTest, GrpcSubscription) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
   api_config_source->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("static_cluster");
-  envoy::api::v2::core::GrpcService expected_grpc_service;
+  envoy::config::core::v3alpha::GrpcService expected_grpc_service;
   expected_grpc_service.mutable_envoy_grpc()->set_cluster_name("static_cluster");
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
   NiceMock<Upstream::MockClusterMockPrioritySet> cluster;
@@ -296,7 +308,7 @@ TEST_F(SubscriptionFactoryTest, GrpcSubscription) {
   EXPECT_CALL(cm_, grpcAsyncClientManager()).WillOnce(ReturnRef(cm_.async_client_manager_));
   EXPECT_CALL(cm_.async_client_manager_,
               factoryForGrpcService(ProtoEq(expected_grpc_service), _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         auto async_client_factory = std::make_unique<Grpc::MockAsyncClientFactory>();
         EXPECT_CALL(*async_client_factory, create()).WillOnce(Invoke([] {
           return std::make_unique<NiceMock<Grpc::MockAsyncClient>>();
@@ -312,14 +324,14 @@ TEST_F(SubscriptionFactoryTest, GrpcSubscription) {
 
 INSTANTIATE_TEST_SUITE_P(SubscriptionFactoryTestApiConfigSource,
                          SubscriptionFactoryTestApiConfigSource,
-                         ::testing::Values(envoy::api::v2::core::ApiConfigSource::REST,
-                                           envoy::api::v2::core::ApiConfigSource::GRPC));
+                         ::testing::Values(envoy::config::core::v3alpha::ApiConfigSource::REST,
+                                           envoy::config::core::v3alpha::ApiConfigSource::GRPC));
 
 TEST_P(SubscriptionFactoryTestApiConfigSource, NonExistentCluster) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
   api_config_source->set_api_type(GetParam());
-  if (api_config_source->api_type() == envoy::api::v2::core::ApiConfigSource::GRPC) {
+  if (api_config_source->api_type() == envoy::config::core::v3alpha::ApiConfigSource::GRPC) {
     api_config_source->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name(
         "static_cluster");
   } else {
@@ -334,10 +346,10 @@ TEST_P(SubscriptionFactoryTestApiConfigSource, NonExistentCluster) {
 }
 
 TEST_P(SubscriptionFactoryTestApiConfigSource, DynamicCluster) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
   api_config_source->set_api_type(GetParam());
-  if (api_config_source->api_type() == envoy::api::v2::core::ApiConfigSource::GRPC) {
+  if (api_config_source->api_type() == envoy::config::core::v3alpha::ApiConfigSource::GRPC) {
     api_config_source->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name(
         "static_cluster");
   } else {
@@ -356,10 +368,10 @@ TEST_P(SubscriptionFactoryTestApiConfigSource, DynamicCluster) {
 }
 
 TEST_P(SubscriptionFactoryTestApiConfigSource, EDSClusterBackingEDSCluster) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
   api_config_source->set_api_type(GetParam());
-  if (api_config_source->api_type() == envoy::api::v2::core::ApiConfigSource::GRPC) {
+  if (api_config_source->api_type() == envoy::config::core::v3alpha::ApiConfigSource::GRPC) {
     api_config_source->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name(
         "static_cluster");
   } else {
@@ -371,7 +383,8 @@ TEST_P(SubscriptionFactoryTestApiConfigSource, EDSClusterBackingEDSCluster) {
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(cluster_map));
   EXPECT_CALL(cluster, info()).Times(2);
   EXPECT_CALL(*cluster.info_, addedViaApi());
-  EXPECT_CALL(*cluster.info_, type()).WillOnce(Return(envoy::api::v2::Cluster::EDS));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillOnce(Return(envoy::config::cluster::v3alpha::Cluster::EDS));
   EXPECT_THROW_WITH_MESSAGE(
       subscriptionFromConfigSource(config)->start({"static_cluster"}), EnvoyException,
       "envoy::api::v2::core::ConfigSource must have a statically defined "
diff --git a/test/common/config/utility_test.cc b/test/common/config/utility_test.cc
index 8972189b2a59..3ab9945f1894 100644
--- a/test/common/config/utility_test.cc
+++ b/test/common/config/utility_test.cc
@@ -1,10 +1,9 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/api/v2/cluster.pb.h"
 #include "envoy/common/exception.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
 #include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/config/api_version.h"
@@ -38,65 +37,66 @@ TEST(UtilityTest, ComputeHashedVersion) {
 }
 
 TEST(UtilityTest, ApiConfigSourceRefreshDelay) {
-  envoy::api::v2::core::ApiConfigSource api_config_source;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source;
   api_config_source.mutable_refresh_delay()->CopyFrom(
       Protobuf::util::TimeUtil::MillisecondsToDuration(1234));
   EXPECT_EQ(1234, Utility::apiConfigSourceRefreshDelay(api_config_source).count());
 }
 
 TEST(UtilityTest, ApiConfigSourceDefaultRequestTimeout) {
-  envoy::api::v2::core::ApiConfigSource api_config_source;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source;
   EXPECT_EQ(1000, Utility::apiConfigSourceRequestTimeout(api_config_source).count());
 }
 
 TEST(UtilityTest, ApiConfigSourceRequestTimeout) {
-  envoy::api::v2::core::ApiConfigSource api_config_source;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source;
   api_config_source.mutable_request_timeout()->CopyFrom(
       Protobuf::util::TimeUtil::MillisecondsToDuration(1234));
   EXPECT_EQ(1234, Utility::apiConfigSourceRequestTimeout(api_config_source).count());
 }
 
 TEST(UtilityTest, ConfigSourceDefaultInitFetchTimeout) {
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   EXPECT_EQ(15000, Utility::configSourceInitialFetchTimeout(config_source).count());
 }
 
 TEST(UtilityTest, ConfigSourceInitFetchTimeout) {
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   config_source.mutable_initial_fetch_timeout()->CopyFrom(
       Protobuf::util::TimeUtil::MillisecondsToDuration(654));
   EXPECT_EQ(654, Utility::configSourceInitialFetchTimeout(config_source).count());
 }
 
 TEST(UtilityTest, TranslateApiConfigSource) {
-  envoy::api::v2::core::ApiConfigSource api_config_source_rest_legacy;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source_rest_legacy;
   Utility::translateApiConfigSource("test_rest_legacy_cluster", 10000,
                                     ApiType::get().UnsupportedRestLegacy,
                                     api_config_source_rest_legacy);
-  EXPECT_EQ(envoy::api::v2::core::ApiConfigSource::UNSUPPORTED_REST_LEGACY,
+  EXPECT_EQ(envoy::config::core::v3alpha::ApiConfigSource::
+                hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY,
             api_config_source_rest_legacy.api_type());
   EXPECT_EQ(10000,
             DurationUtil::durationToMilliseconds(api_config_source_rest_legacy.refresh_delay()));
   EXPECT_EQ("test_rest_legacy_cluster", api_config_source_rest_legacy.cluster_names(0));
 
-  envoy::api::v2::core::ApiConfigSource api_config_source_rest;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source_rest;
   Utility::translateApiConfigSource("test_rest_cluster", 20000, ApiType::get().Rest,
                                     api_config_source_rest);
-  EXPECT_EQ(envoy::api::v2::core::ApiConfigSource::REST, api_config_source_rest.api_type());
+  EXPECT_EQ(envoy::config::core::v3alpha::ApiConfigSource::REST, api_config_source_rest.api_type());
   EXPECT_EQ(20000, DurationUtil::durationToMilliseconds(api_config_source_rest.refresh_delay()));
   EXPECT_EQ("test_rest_cluster", api_config_source_rest.cluster_names(0));
 
-  envoy::api::v2::core::ApiConfigSource api_config_source_grpc;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source_grpc;
   Utility::translateApiConfigSource("test_grpc_cluster", 30000, ApiType::get().Grpc,
                                     api_config_source_grpc);
-  EXPECT_EQ(envoy::api::v2::core::ApiConfigSource::GRPC, api_config_source_grpc.api_type());
+  EXPECT_EQ(envoy::config::core::v3alpha::ApiConfigSource::GRPC, api_config_source_grpc.api_type());
   EXPECT_EQ(30000, DurationUtil::durationToMilliseconds(api_config_source_grpc.refresh_delay()));
   EXPECT_EQ("test_grpc_cluster",
             api_config_source_grpc.grpc_services(0).envoy_grpc().cluster_name());
 }
 
 TEST(UtilityTest, createTagProducer) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   auto producer = Utility::createTagProducer(bootstrap);
   ASSERT(producer != nullptr);
   std::vector<Stats::Tag> tags;
@@ -116,7 +116,7 @@ TEST(UtilityTest, CheckFilesystemSubscriptionBackingPath) {
 }
 
 TEST(UtilityTest, ParseDefaultRateLimitSettings) {
-  envoy::api::v2::core::ApiConfigSource api_config_source;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source;
   const RateLimitSettings& rate_limit_settings = Utility::parseRateLimitSettings(api_config_source);
   EXPECT_EQ(false, rate_limit_settings.enabled_);
   EXPECT_EQ(100, rate_limit_settings.max_tokens_);
@@ -124,7 +124,7 @@ TEST(UtilityTest, ParseDefaultRateLimitSettings) {
 }
 
 TEST(UtilityTest, ParseEmptyRateLimitSettings) {
-  envoy::api::v2::core::ApiConfigSource api_config_source;
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source;
   api_config_source.mutable_rate_limit_settings();
   const RateLimitSettings& rate_limit_settings = Utility::parseRateLimitSettings(api_config_source);
   EXPECT_EQ(true, rate_limit_settings.enabled_);
@@ -133,8 +133,8 @@ TEST(UtilityTest, ParseEmptyRateLimitSettings) {
 }
 
 TEST(UtilityTest, ParseRateLimitSettings) {
-  envoy::api::v2::core::ApiConfigSource api_config_source;
-  ::envoy::api::v2::core::RateLimitSettings* rate_limits =
+  envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+  envoy::config::core::v3alpha::RateLimitSettings* rate_limits =
       api_config_source.mutable_rate_limit_settings();
   rate_limits->mutable_max_tokens()->set_value(500);
   rate_limits->mutable_fill_rate()->set_value(4);
@@ -151,16 +151,16 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   Stats::MockStore scope;
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     EXPECT_THROW_WITH_REGEX(
         Utility::factoryForGrpcApiConfigSource(async_client_manager, api_config_source, scope),
         EnvoyException, "API configs must have either a gRPC service or a cluster name defined:");
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     api_config_source.add_grpc_services();
     api_config_source.add_grpc_services();
     EXPECT_THROW_WITH_REGEX(
@@ -171,8 +171,8 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     api_config_source.add_cluster_names();
     // this also logs a warning for setting REST cluster names for a gRPC API config.
     EXPECT_THROW_WITH_REGEX(
@@ -183,8 +183,8 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     api_config_source.add_cluster_names();
     api_config_source.add_cluster_names();
     EXPECT_THROW_WITH_REGEX(
@@ -195,8 +195,8 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
     api_config_source.add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("foo");
     // this also logs a warning for configuring gRPC clusters for a REST API config.
     EXPECT_THROW_WITH_REGEX(
@@ -207,8 +207,8 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
     api_config_source.add_cluster_names("foo");
     EXPECT_THROW_WITH_REGEX(
         Utility::factoryForGrpcApiConfigSource(async_client_manager, api_config_source, scope),
@@ -216,10 +216,10 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     api_config_source.add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("foo");
-    envoy::api::v2::core::GrpcService expected_grpc_service;
+    envoy::config::core::v3alpha::GrpcService expected_grpc_service;
     expected_grpc_service.mutable_envoy_grpc()->set_cluster_name("foo");
     EXPECT_CALL(async_client_manager,
                 factoryForGrpcService(ProtoEq(expected_grpc_service), Ref(scope), _));
@@ -227,8 +227,8 @@ TEST(UtilityTest, FactoryForGrpcApiConfigSource) {
   }
 
   {
-    envoy::api::v2::core::ApiConfigSource api_config_source;
-    api_config_source.set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    envoy::config::core::v3alpha::ApiConfigSource api_config_source;
+    api_config_source.set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     api_config_source.add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("foo");
     EXPECT_CALL(async_client_manager,
                 factoryForGrpcService(ProtoEq(api_config_source.grpc_services(0)), Ref(scope), _));
@@ -241,14 +241,14 @@ TEST(UtilityTest, PrepareDnsRefreshStrategy) {
 
   {
     // dns_failure_refresh_rate not set.
-    envoy::api::v2::Cluster cluster;
+    envoy::config::cluster::v3alpha::Cluster cluster;
     BackOffStrategyPtr strategy = Utility::prepareDnsRefreshStrategy(cluster, 5000, random);
     EXPECT_NE(nullptr, dynamic_cast<FixedBackOffStrategy*>(strategy.get()));
   }
 
   {
     // dns_failure_refresh_rate set.
-    envoy::api::v2::Cluster cluster;
+    envoy::config::cluster::v3alpha::Cluster cluster;
     cluster.mutable_dns_failure_refresh_rate()->mutable_base_interval()->set_seconds(7);
     cluster.mutable_dns_failure_refresh_rate()->mutable_max_interval()->set_seconds(10);
     BackOffStrategyPtr strategy = Utility::prepareDnsRefreshStrategy(cluster, 5000, random);
@@ -257,7 +257,7 @@ TEST(UtilityTest, PrepareDnsRefreshStrategy) {
 
   {
     // dns_failure_refresh_rate set with invalid max_interval.
-    envoy::api::v2::Cluster cluster;
+    envoy::config::cluster::v3alpha::Cluster cluster;
     cluster.mutable_dns_failure_refresh_rate()->mutable_base_interval()->set_seconds(7);
     cluster.mutable_dns_failure_refresh_rate()->mutable_max_interval()->set_seconds(2);
     EXPECT_THROW_WITH_REGEX(Utility::prepareDnsRefreshStrategy(cluster, 5000, random),
@@ -442,7 +442,7 @@ TEST(UtilityTest, AnyToClusterV3) {
 // Verify that translation from udpa.type.v1.TypedStruct into message of incorrect type fails
 TEST(UtilityTest, TypedStructToInvalidType) {
   ProtobufWkt::Any typed_config;
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   const std::string bootstrap_config_yaml = R"EOF(
     admin:
       access_log_path: /dev/null
@@ -461,12 +461,12 @@ TEST(UtilityTest, TypedStructToInvalidType) {
 }
 
 TEST(CheckApiConfigSourceSubscriptionBackingClusterTest, GrpcClusterTestAcrossTypes) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
 
   // API of type GRPC
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
 
   // GRPC cluster without GRPC services.
   EXPECT_THROW_WITH_REGEX(
@@ -495,7 +495,8 @@ TEST(CheckApiConfigSourceSubscriptionBackingClusterTest, GrpcClusterTestAcrossTy
   // EDS Cluster backing EDS Cluster.
   EXPECT_CALL(cluster, info()).Times(2);
   EXPECT_CALL(*cluster.info_, addedViaApi());
-  EXPECT_CALL(*cluster.info_, type()).WillOnce(Return(envoy::api::v2::Cluster::EDS));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillOnce(Return(envoy::config::cluster::v3alpha::Cluster::EDS));
   EXPECT_THROW_WITH_MESSAGE(
       Utility::checkApiConfigSourceSubscriptionBackingCluster(cluster_map, *api_config_source),
       EnvoyException,
@@ -518,10 +519,10 @@ TEST(CheckApiConfigSourceSubscriptionBackingClusterTest, GrpcClusterTestAcrossTy
 }
 
 TEST(CheckApiConfigSourceSubscriptionBackingClusterTest, RestClusterTestAcrossTypes) {
-  envoy::api::v2::core::ConfigSource config;
+  envoy::config::core::v3alpha::ConfigSource config;
   auto* api_config_source = config.mutable_api_config_source();
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
-  api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::REST);
+  api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::REST);
 
   // Non-existent cluster.
   api_config_source->add_cluster_names("foo_cluster");
@@ -545,7 +546,8 @@ TEST(CheckApiConfigSourceSubscriptionBackingClusterTest, RestClusterTestAcrossTy
   // EDS Cluster backing EDS Cluster.
   EXPECT_CALL(cluster, info()).Times(2);
   EXPECT_CALL(*cluster.info_, addedViaApi());
-  EXPECT_CALL(*cluster.info_, type()).WillOnce(Return(envoy::api::v2::Cluster::EDS));
+  EXPECT_CALL(*cluster.info_, type())
+      .WillOnce(Return(envoy::config::cluster::v3alpha::Cluster::EDS));
   EXPECT_THROW_WITH_MESSAGE(
       Utility::checkApiConfigSourceSubscriptionBackingCluster(cluster_map, *api_config_source),
       EnvoyException,
diff --git a/test/common/config/version_converter_test.cc b/test/common/config/version_converter_test.cc
index d6aa22346529..aac510b8e9b8 100644
--- a/test/common/config/version_converter_test.cc
+++ b/test/common/config/version_converter_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/api/v2/cluster.pb.h"
 #include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/config/api_version.h"
diff --git a/test/common/config/watch_map_test.cc b/test/common/config/watch_map_test.cc
index e70129fb51e8..4c75855c89f7 100644
--- a/test/common/config/watch_map_test.cc
+++ b/test/common/config/watch_map_test.cc
@@ -1,8 +1,8 @@
 #include <memory>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/watch_map.h"
@@ -21,10 +21,12 @@ namespace Config {
 namespace {
 
 class NamedMockSubscriptionCallbacks
-    : public MockSubscriptionCallbacks<envoy::api::v2::ClusterLoadAssignment> {
+    : public MockSubscriptionCallbacks<envoy::config::endpoint::v3alpha::ClusterLoadAssignment> {
 public:
   std::string resourceName(const ProtobufWkt::Any& resource) override {
-    return TestUtility::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resource).cluster_name();
+    return TestUtility::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+               resource)
+        .cluster_name();
   }
 };
 
@@ -35,7 +37,7 @@ class NamedMockSubscriptionCallbacks
 // update. We can therefore use the same expected_resources for both.
 void expectDeltaAndSotwUpdate(
     NamedMockSubscriptionCallbacks& callbacks,
-    const std::vector<envoy::api::v2::ClusterLoadAssignment>& expected_resources,
+    const std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>& expected_resources,
     const std::vector<std::string>& expected_removals, const std::string& version) {
   EXPECT_CALL(callbacks, onConfigUpdate(_, version))
       .WillOnce(Invoke(
@@ -43,7 +45,7 @@ void expectDeltaAndSotwUpdate(
                                const std::string&) {
             EXPECT_EQ(expected_resources.size(), gotten_resources.size());
             for (size_t i = 0; i < expected_resources.size(); i++) {
-              envoy::api::v2::ClusterLoadAssignment cur_gotten_resource;
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment cur_gotten_resource;
               gotten_resources[i].UnpackTo(&cur_gotten_resource);
               EXPECT_TRUE(TestUtility::protoEqual(cur_gotten_resource, expected_resources[i]));
             }
@@ -51,13 +53,14 @@ void expectDeltaAndSotwUpdate(
   EXPECT_CALL(callbacks, onConfigUpdate(_, _, _))
       .WillOnce(
           Invoke([expected_resources, expected_removals, version](
-                     const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& gotten_resources,
+                     const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>&
+                         gotten_resources,
                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
                      const std::string&) {
             EXPECT_EQ(expected_resources.size(), gotten_resources.size());
             for (size_t i = 0; i < expected_resources.size(); i++) {
               EXPECT_EQ(gotten_resources[i].version(), version);
-              envoy::api::v2::ClusterLoadAssignment cur_gotten_resource;
+              envoy::config::endpoint::v3alpha::ClusterLoadAssignment cur_gotten_resource;
               gotten_resources[i].resource().UnpackTo(&cur_gotten_resource);
               EXPECT_TRUE(TestUtility::protoEqual(cur_gotten_resource, expected_resources[i]));
             }
@@ -81,12 +84,12 @@ void expectEmptySotwNoDeltaUpdate(NamedMockSubscriptionCallbacks& callbacks,
   EXPECT_CALL(callbacks, onConfigUpdate(_, _, version)).Times(0);
 }
 
-Protobuf::RepeatedPtrField<envoy::api::v2::Resource>
+Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>
 wrapInResource(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& anys,
                const std::string& version) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> ret;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> ret;
   for (const auto& a : anys) {
-    envoy::api::v2::ClusterLoadAssignment cur_endpoint;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment cur_endpoint;
     a.UnpackTo(&cur_endpoint);
     auto* cur_resource = ret.Add();
     cur_resource->set_name(cur_endpoint.cluster_name());
@@ -104,7 +107,7 @@ void doDeltaAndSotwUpdate(SubscriptionCallbacks& watch_map,
                           const std::string& version) {
   watch_map.onConfigUpdate(sotw_resources, version);
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> delta_resources =
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> delta_resources =
       wrapInResource(sotw_resources, version);
   Protobuf::RepeatedPtrField<std::string> removed_names_proto;
   for (const auto& n : removed_names) {
@@ -130,15 +133,15 @@ TEST(WatchMapTest, Basic) {
 
     // ...the update is going to contain Bob and Carol...
     Protobuf::RepeatedPtrField<ProtobufWkt::Any> updated_resources;
-    envoy::api::v2::ClusterLoadAssignment bob;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment bob;
     bob.set_cluster_name("bob");
     updated_resources.Add()->PackFrom(bob);
-    envoy::api::v2::ClusterLoadAssignment carol;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment carol;
     carol.set_cluster_name("carol");
     updated_resources.Add()->PackFrom(carol);
 
     // ...so the watch should receive only Bob.
-    std::vector<envoy::api::v2::ClusterLoadAssignment> expected_resources;
+    std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment> expected_resources;
     expected_resources.push_back(bob);
 
     expectDeltaAndSotwUpdate(callbacks, expected_resources, {}, "version1");
@@ -153,18 +156,18 @@ TEST(WatchMapTest, Basic) {
 
     // ...the update is going to contain Alice, Carol, Dave...
     Protobuf::RepeatedPtrField<ProtobufWkt::Any> updated_resources;
-    envoy::api::v2::ClusterLoadAssignment alice;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment alice;
     alice.set_cluster_name("alice");
     updated_resources.Add()->PackFrom(alice);
-    envoy::api::v2::ClusterLoadAssignment carol;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment carol;
     carol.set_cluster_name("carol");
     updated_resources.Add()->PackFrom(carol);
-    envoy::api::v2::ClusterLoadAssignment dave;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment dave;
     dave.set_cluster_name("dave");
     updated_resources.Add()->PackFrom(dave);
 
     // ...so the watch should receive only Carol and Dave.
-    std::vector<envoy::api::v2::ClusterLoadAssignment> expected_resources;
+    std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment> expected_resources;
     expected_resources.push_back(carol);
     expected_resources.push_back(dave);
 
@@ -188,7 +191,7 @@ TEST(WatchMapTest, Overlap) {
   Watch* watch2 = watch_map.addWatch(callbacks2);
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> updated_resources;
-  envoy::api::v2::ClusterLoadAssignment alice;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment alice;
   alice.set_cluster_name("alice");
   updated_resources.Add()->PackFrom(alice);
 
@@ -254,7 +257,7 @@ TEST(WatchMapTest, AddRemoveAdd) {
   Watch* watch2 = watch_map.addWatch(callbacks2);
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> updated_resources;
-  envoy::api::v2::ClusterLoadAssignment alice;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment alice;
   alice.set_cluster_name("alice");
   updated_resources.Add()->PackFrom(alice);
 
@@ -306,12 +309,12 @@ TEST(WatchMapTest, UninterestingUpdate) {
   watch_map.updateWatchInterest(watch, {"alice"});
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> alice_update;
-  envoy::api::v2::ClusterLoadAssignment alice;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment alice;
   alice.set_cluster_name("alice");
   alice_update.Add()->PackFrom(alice);
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> bob_update;
-  envoy::api::v2::ClusterLoadAssignment bob;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment bob;
   bob.set_cluster_name("bob");
   bob_update.Add()->PackFrom(bob);
 
@@ -350,17 +353,17 @@ TEST(WatchMapTest, WatchingEverything) {
   watch_map.updateWatchInterest(watch2, {"alice"});
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> updated_resources;
-  envoy::api::v2::ClusterLoadAssignment alice;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment alice;
   alice.set_cluster_name("alice");
   updated_resources.Add()->PackFrom(alice);
-  envoy::api::v2::ClusterLoadAssignment bob;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment bob;
   bob.set_cluster_name("bob");
   updated_resources.Add()->PackFrom(bob);
 
-  std::vector<envoy::api::v2::ClusterLoadAssignment> expected_resources1;
+  std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment> expected_resources1;
   expected_resources1.push_back(alice);
   expected_resources1.push_back(bob);
-  std::vector<envoy::api::v2::ClusterLoadAssignment> expected_resources2;
+  std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment> expected_resources2;
   expected_resources2.push_back(alice);
 
   expectDeltaAndSotwUpdate(callbacks1, expected_resources1, {}, "version1");
@@ -390,7 +393,7 @@ TEST(WatchMapTest, DeltaOnConfigUpdate) {
   // will just not trigger any onConfigUpdate at all.
   {
     Protobuf::RepeatedPtrField<ProtobufWkt::Any> prepare_removed;
-    envoy::api::v2::ClusterLoadAssignment will_be_removed_later;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment will_be_removed_later;
     will_be_removed_later.set_cluster_name("removed");
     prepare_removed.Add()->PackFrom(will_be_removed_later);
     expectDeltaAndSotwUpdate(callbacks2, {will_be_removed_later}, {}, "version0");
@@ -399,7 +402,7 @@ TEST(WatchMapTest, DeltaOnConfigUpdate) {
   }
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> update;
-  envoy::api::v2::ClusterLoadAssignment updated;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment updated;
   updated.set_cluster_name("updated");
   update.Add()->PackFrom(updated);
 
diff --git a/test/common/grpc/BUILD b/test/common/grpc/BUILD
index 5bffedb3f73c..fb194bc33203 100644
--- a/test/common/grpc/BUILD
+++ b/test/common/grpc/BUILD
@@ -21,7 +21,7 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/proto:helloworld_proto_cc_proto",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -35,7 +35,7 @@ envoy_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -133,7 +133,7 @@ envoy_cc_test_library(
         "//source/common/common:assert_lib",
         "//test/mocks/secret:secret_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -153,8 +153,8 @@ envoy_cc_test_library(
         "//test/test_common:global_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -175,6 +175,6 @@ envoy_cc_test_library(
     data = ["//test/config/integration/certs"],
     deps = [
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/common/grpc/async_client_impl_test.cc b/test/common/grpc/async_client_impl_test.cc
index c50f76669ecf..21425474d9d1 100644
--- a/test/common/grpc/async_client_impl_test.cc
+++ b/test/common/grpc/async_client_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/grpc/async_client_impl.h"
 
@@ -25,7 +25,7 @@ class EnvoyAsyncClientImplTest : public testing::Test {
 public:
   EnvoyAsyncClientImplTest()
       : method_descriptor_(helloworld::Greeter::descriptor()->FindMethodByName("SayHello")) {
-    envoy::api::v2::core::GrpcService config;
+    envoy::config::core::v3alpha::GrpcService config;
     config.mutable_envoy_grpc()->set_cluster_name("test_cluster");
     grpc_client_ = std::make_unique<AsyncClientImpl>(cm_, config, test_time_.timeSystem());
     ON_CALL(cm_, httpAsyncClientForCluster("test_cluster")).WillByDefault(ReturnRef(http_client_));
diff --git a/test/common/grpc/async_client_manager_impl_test.cc b/test/common/grpc/async_client_manager_impl_test.cc
index c42a1528a974..008bc186cc9f 100644
--- a/test/common/grpc/async_client_manager_impl_test.cc
+++ b/test/common/grpc/async_client_manager_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/api/api_impl.h"
 #include "common/grpc/async_client_manager_impl.h"
@@ -31,7 +31,7 @@ class AsyncClientManagerImplTest : public testing::Test {
 
 TEST_F(AsyncClientManagerImplTest, EnvoyGrpcOk) {
   AsyncClientManagerImpl async_client_manager(cm_, tls_, test_time_.timeSystem(), *api_);
-  envoy::api::v2::core::GrpcService grpc_service;
+  envoy::config::core::v3alpha::GrpcService grpc_service;
   grpc_service.mutable_envoy_grpc()->set_cluster_name("foo");
 
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
@@ -46,7 +46,7 @@ TEST_F(AsyncClientManagerImplTest, EnvoyGrpcOk) {
 
 TEST_F(AsyncClientManagerImplTest, EnvoyGrpcUnknown) {
   AsyncClientManagerImpl async_client_manager(cm_, tls_, test_time_.timeSystem(), *api_);
-  envoy::api::v2::core::GrpcService grpc_service;
+  envoy::config::core::v3alpha::GrpcService grpc_service;
   grpc_service.mutable_envoy_grpc()->set_cluster_name("foo");
 
   EXPECT_CALL(cm_, clusters());
@@ -56,7 +56,7 @@ TEST_F(AsyncClientManagerImplTest, EnvoyGrpcUnknown) {
 
 TEST_F(AsyncClientManagerImplTest, EnvoyGrpcDynamicCluster) {
   AsyncClientManagerImpl async_client_manager(cm_, tls_, test_time_.timeSystem(), *api_);
-  envoy::api::v2::core::GrpcService grpc_service;
+  envoy::config::core::v3alpha::GrpcService grpc_service;
   grpc_service.mutable_envoy_grpc()->set_cluster_name("foo");
 
   Upstream::ClusterManager::ClusterInfoMap cluster_map;
@@ -72,7 +72,7 @@ TEST_F(AsyncClientManagerImplTest, EnvoyGrpcDynamicCluster) {
 TEST_F(AsyncClientManagerImplTest, GoogleGrpc) {
   EXPECT_CALL(scope_, createScope_("grpc.foo."));
   AsyncClientManagerImpl async_client_manager(cm_, tls_, test_time_.timeSystem(), *api_);
-  envoy::api::v2::core::GrpcService grpc_service;
+  envoy::config::core::v3alpha::GrpcService grpc_service;
   grpc_service.mutable_google_grpc()->set_stat_prefix("foo");
 
 #ifdef ENVOY_GOOGLE_GRPC
@@ -85,7 +85,7 @@ TEST_F(AsyncClientManagerImplTest, GoogleGrpc) {
 
 TEST_F(AsyncClientManagerImplTest, EnvoyGrpcUnknownOk) {
   AsyncClientManagerImpl async_client_manager(cm_, tls_, test_time_.timeSystem(), *api_);
-  envoy::api::v2::core::GrpcService grpc_service;
+  envoy::config::core::v3alpha::GrpcService grpc_service;
   grpc_service.mutable_envoy_grpc()->set_cluster_name("foo");
 
   EXPECT_CALL(cm_, clusters()).Times(0);
diff --git a/test/common/grpc/google_async_client_impl_test.cc b/test/common/grpc/google_async_client_impl_test.cc
index c1cfa9539537..5deac451b34b 100644
--- a/test/common/grpc/google_async_client_impl_test.cc
+++ b/test/common/grpc/google_async_client_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/api/api_impl.h"
@@ -52,7 +52,7 @@ class EnvoyGoogleAsyncClientImplTest : public testing::Test {
       : stats_store_(new Stats::IsolatedStoreImpl), api_(Api::createApiForTest(*stats_store_)),
         dispatcher_(api_->allocateDispatcher()), scope_(stats_store_),
         method_descriptor_(helloworld::Greeter::descriptor()->FindMethodByName("SayHello")) {
-    envoy::api::v2::core::GrpcService config;
+    envoy::config::core::v3alpha::GrpcService config;
     auto* google_grpc = config.mutable_google_grpc();
     google_grpc->set_target_uri("fake_address");
     google_grpc->set_stat_prefix("test_cluster");
diff --git a/test/common/grpc/google_grpc_creds_test.cc b/test/common/grpc/google_grpc_creds_test.cc
index 27affb248f6d..ba363edb8c43 100644
--- a/test/common/grpc/google_grpc_creds_test.cc
+++ b/test/common/grpc/google_grpc_creds_test.cc
@@ -1,6 +1,6 @@
 #include <cstdlib>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/grpc/google_grpc_creds_impl.h"
 
@@ -29,7 +29,7 @@ class CredsUtilityTest : public testing::Test {
 
 TEST_F(CredsUtilityTest, GetChannelCredentials) {
   EXPECT_EQ(nullptr, CredsUtility::getChannelCredentials({}, *api_));
-  envoy::api::v2::core::GrpcService::GoogleGrpc config;
+  envoy::config::core::v3alpha::GrpcService::GoogleGrpc config;
   auto* creds = config.mutable_channel_credentials();
   EXPECT_EQ(nullptr, CredsUtility::getChannelCredentials(config, *api_));
   creds->mutable_ssl_credentials();
@@ -48,7 +48,7 @@ TEST_F(CredsUtilityTest, GetChannelCredentials) {
 
 TEST_F(CredsUtilityTest, DefaultSslChannelCredentials) {
   EXPECT_NE(nullptr, CredsUtility::defaultSslChannelCredentials({}, *api_));
-  envoy::api::v2::core::GrpcService config;
+  envoy::config::core::v3alpha::GrpcService config;
   auto* creds = config.mutable_google_grpc()->mutable_channel_credentials();
   EXPECT_NE(nullptr, CredsUtility::defaultSslChannelCredentials(config, *api_));
   creds->mutable_ssl_credentials();
@@ -59,19 +59,19 @@ TEST_F(CredsUtilityTest, CallCredentials) {
   EXPECT_TRUE(CredsUtility::callCredentials({}).empty());
   {
     // Invalid refresh token doesn't crash and gets elided.
-    envoy::api::v2::core::GrpcService::GoogleGrpc config;
+    envoy::config::core::v3alpha::GrpcService::GoogleGrpc config;
     config.add_call_credentials()->set_google_refresh_token("invalid");
     EXPECT_TRUE(CredsUtility::callCredentials(config).empty());
   }
   {
     // Singleton access token succeeds.
-    envoy::api::v2::core::GrpcService::GoogleGrpc config;
+    envoy::config::core::v3alpha::GrpcService::GoogleGrpc config;
     config.add_call_credentials()->set_access_token("foo");
     EXPECT_EQ(1, CredsUtility::callCredentials(config).size());
   }
   {
     // Multiple call credentials.
-    envoy::api::v2::core::GrpcService::GoogleGrpc config;
+    envoy::config::core::v3alpha::GrpcService::GoogleGrpc config;
     config.add_call_credentials()->set_access_token("foo");
     config.add_call_credentials()->mutable_google_compute_engine();
     EXPECT_EQ(2, CredsUtility::callCredentials(config).size());
@@ -83,12 +83,12 @@ TEST_F(CredsUtilityTest, CallCredentials) {
 TEST_F(CredsUtilityTest, DefaultChannelCredentials) {
   { EXPECT_NE(nullptr, CredsUtility::defaultChannelCredentials({}, *api_)); }
   {
-    envoy::api::v2::core::GrpcService config;
+    envoy::config::core::v3alpha::GrpcService config;
     TestUtility::setTestSslGoogleGrpcConfig(config, true);
     EXPECT_NE(nullptr, CredsUtility::defaultChannelCredentials(config, *api_));
   }
   {
-    envoy::api::v2::core::GrpcService config;
+    envoy::config::core::v3alpha::GrpcService config;
     TestUtility::setTestSslGoogleGrpcConfig(config, true);
     auto* google_grpc = config.mutable_google_grpc();
     google_grpc->add_call_credentials()->set_access_token("foo");
@@ -125,7 +125,7 @@ TEST_F(CredsUtilityTest, DefaultChannelCredentials) {
     EXPECT_NE(nullptr, CredsUtility::defaultChannelCredentials(config, *api_));
   }
   {
-    envoy::api::v2::core::GrpcService config;
+    envoy::config::core::v3alpha::GrpcService config;
     TestUtility::setTestSslGoogleGrpcConfig(config, true);
     auto* sts_service = config.mutable_google_grpc()->add_call_credentials()->mutable_sts_service();
     sts_service->set_token_exchange_service_uri("http://tokenexchangeservice.com");
diff --git a/test/common/grpc/grpc_client_integration.h b/test/common/grpc/grpc_client_integration.h
index e54805ba3966..686dcadb7306 100644
--- a/test/common/grpc/grpc_client_integration.h
+++ b/test/common/grpc/grpc_client_integration.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/common/assert.h"
 
@@ -22,7 +22,7 @@ class BaseGrpcClientIntegrationParamTest {
   virtual Network::Address::IpVersion ipVersion() const PURE;
   virtual ClientType clientType() const PURE;
 
-  void setGrpcService(envoy::api::v2::core::GrpcService& grpc_service,
+  void setGrpcService(envoy::config::core::v3alpha::GrpcService& grpc_service,
                       const std::string& cluster_name,
                       Network::Address::InstanceConstSharedPtr address) {
     switch (clientType()) {
diff --git a/test/common/grpc/grpc_client_integration_test.cc b/test/common/grpc/grpc_client_integration_test.cc
index 6858c3fa65d9..e7eb4e25d5fb 100644
--- a/test/common/grpc/grpc_client_integration_test.cc
+++ b/test/common/grpc/grpc_client_integration_test.cc
@@ -1,5 +1,5 @@
 #ifdef ENVOY_GOOGLE_GRPC
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "common/grpc/google_async_client_impl.h"
 
@@ -411,7 +411,7 @@ class GrpcAccessTokenClientIntegrationTest : public GrpcSslClientIntegrationTest
     }
   }
 
-  envoy::api::v2::core::GrpcService createGoogleGrpcConfig() override {
+  envoy::config::core::v3alpha::GrpcService createGoogleGrpcConfig() override {
     auto config = GrpcClientIntegrationTest::createGoogleGrpcConfig();
     auto* google_grpc = config.mutable_google_grpc();
     google_grpc->set_credentials_factory_name(credentials_factory_name_);
diff --git a/test/common/grpc/grpc_client_integration_test_harness.h b/test/common/grpc/grpc_client_integration_test_harness.h
index 730e4a84812d..d379b4227ba5 100644
--- a/test/common/grpc/grpc_client_integration_test_harness.h
+++ b/test/common/grpc/grpc_client_integration_test_harness.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/api/api_impl.h"
@@ -261,7 +261,7 @@ class GrpcClientIntegrationTest : public GrpcClientIntegrationParamTest {
     }
   }
 
-  void fillServiceWideInitialMetadata(envoy::api::v2::core::GrpcService& config) {
+  void fillServiceWideInitialMetadata(envoy::config::core::v3alpha::GrpcService& config) {
     for (const auto& item : service_wide_initial_metadata_) {
       auto* header_value = config.add_initial_metadata();
       header_value->set_key(item.first.get());
@@ -295,14 +295,14 @@ class GrpcClientIntegrationTest : public GrpcClientIntegrationParamTest {
     EXPECT_CALL(cm_, httpAsyncClientForCluster(fake_cluster_name_))
         .WillRepeatedly(ReturnRef(*http_async_client_));
     EXPECT_CALL(cm_, get(Eq(fake_cluster_name_))).WillRepeatedly(Return(&thread_local_cluster_));
-    envoy::api::v2::core::GrpcService config;
+    envoy::config::core::v3alpha::GrpcService config;
     config.mutable_envoy_grpc()->set_cluster_name(fake_cluster_name_);
     fillServiceWideInitialMetadata(config);
     return std::make_unique<AsyncClientImpl>(cm_, config, dispatcher_->timeSource());
   }
 
-  virtual envoy::api::v2::core::GrpcService createGoogleGrpcConfig() {
-    envoy::api::v2::core::GrpcService config;
+  virtual envoy::config::core::v3alpha::GrpcService createGoogleGrpcConfig() {
+    envoy::config::core::v3alpha::GrpcService config;
     auto* google_grpc = config.mutable_google_grpc();
     google_grpc->set_target_uri(fake_upstream_->localAddress()->asString());
     google_grpc->set_stat_prefix("fake_cluster");
@@ -448,7 +448,7 @@ class GrpcClientIntegrationTest : public GrpcClientIntegrationParamTest {
   Http::AsyncClientPtr http_async_client_;
   Http::ConnectionPool::InstancePtr http_conn_pool_;
   Http::ContextImpl http_context_;
-  envoy::api::v2::core::Locality host_locality_;
+  envoy::config::core::v3alpha::Locality host_locality_;
   Upstream::MockHost* mock_host_ = new NiceMock<Upstream::MockHost>();
   Upstream::MockHostDescription* mock_host_description_ =
       new NiceMock<Upstream::MockHostDescription>();
@@ -474,14 +474,14 @@ class GrpcSslClientIntegrationTest : public GrpcClientIntegrationTest {
     client_connection_.reset();
   }
 
-  envoy::api::v2::core::GrpcService createGoogleGrpcConfig() override {
+  envoy::config::core::v3alpha::GrpcService createGoogleGrpcConfig() override {
     auto config = GrpcClientIntegrationTest::createGoogleGrpcConfig();
     TestUtility::setTestSslGoogleGrpcConfig(config, use_client_cert_);
     return config;
   }
 
   void initialize() override {
-    envoy::api::v2::auth::UpstreamTlsContext tls_context;
+    envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
     auto* common_tls_context = tls_context.mutable_common_tls_context();
     auto* validation_context = common_tls_context->mutable_validation_context();
     validation_context->mutable_trusted_ca()->set_filename(
@@ -509,7 +509,7 @@ class GrpcSslClientIntegrationTest : public GrpcClientIntegrationTest {
   }
 
   Network::TransportSocketFactoryPtr createUpstreamSslContext() {
-    envoy::api::v2::auth::DownstreamTlsContext tls_context;
+    envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
     auto* common_tls_context = tls_context.mutable_common_tls_context();
     common_tls_context->add_alpn_protocols("h2");
     auto* tls_cert = common_tls_context->add_tls_certificates();
diff --git a/test/common/grpc/utility.h b/test/common/grpc/utility.h
index 9f695379c9d4..3016238615ad 100644
--- a/test/common/grpc/utility.h
+++ b/test/common/grpc/utility.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 
 #include "test/test_common/environment.h"
 
@@ -9,7 +9,7 @@ namespace Grpc {
 
 class TestUtility {
 public:
-  static void setTestSslGoogleGrpcConfig(envoy::api::v2::core::GrpcService& config,
+  static void setTestSslGoogleGrpcConfig(envoy::config::core::v3alpha::GrpcService& config,
                                          bool use_client_cert) {
     auto* google_grpc = config.mutable_google_grpc();
     auto* ssl_creds = google_grpc->mutable_channel_credentials()->mutable_ssl_credentials();
diff --git a/test/common/http/BUILD b/test/common/http/BUILD
index edf83118d839..3f8eb8b2138c 100644
--- a/test/common/http/BUILD
+++ b/test/common/http/BUILD
@@ -31,8 +31,8 @@ envoy_cc_test(
         "//test/mocks/stats:stats_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -164,7 +164,7 @@ envoy_cc_fuzz_test(
         "//test/mocks/tracing:tracing_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -206,9 +206,9 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:logging_lib",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/type/tracing/v2:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -231,8 +231,8 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:test_runtime_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -290,7 +290,7 @@ envoy_cc_test(
     deps = [
         "//source/common/http:header_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -334,7 +334,7 @@ envoy_cc_test(
         "//test/mocks/http:http_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/http/async_client_impl_test.cc b/test/common/http/async_client_impl_test.cc
index 43a0be0e70c3..da122e76c095 100644
--- a/test/common/http/async_client_impl_test.cc
+++ b/test/common/http/async_client_impl_test.cc
@@ -3,8 +3,8 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/http/async_client_impl.h"
@@ -49,7 +49,7 @@ class AsyncClientImplTest : public testing::Test {
     message_->headers().setHost("host");
     message_->headers().setPath("/");
     ON_CALL(*cm_.conn_pool_.host_, locality())
-        .WillByDefault(ReturnRef(envoy::api::v2::core::Locality().default_instance()));
+        .WillByDefault(ReturnRef(envoy::config::core::v3alpha::Locality().default_instance()));
   }
 
   void expectSuccess(uint64_t code) {
@@ -274,7 +274,7 @@ TEST_F(AsyncClientImplTest, BasicHashPolicy) {
   expectSuccess(200);
 
   AsyncClient::RequestOptions options;
-  Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy> hash_policy;
+  Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy> hash_policy;
   hash_policy.Add()->mutable_header()->set_header_name(":path");
   options.setHashPolicy(hash_policy);
   client_.send(std::move(message_), callbacks_, options);
@@ -1235,7 +1235,7 @@ class AsyncClientImplUnitTest : public testing::Test {
 public:
   AsyncStreamImpl::RouteImpl route_impl_{
       "foo", absl::nullopt,
-      Protobuf::RepeatedPtrField<envoy::api::v2::route::RouteAction::HashPolicy>()};
+      Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::RouteAction::HashPolicy>()};
   AsyncStreamImpl::NullVirtualHost vhost_;
   AsyncStreamImpl::NullConfig config_;
 };
diff --git a/test/common/http/conn_manager_impl_fuzz_test.cc b/test/common/http/conn_manager_impl_fuzz_test.cc
index 5d4ac9498068..528f50da2db4 100644
--- a/test/common/http/conn_manager_impl_fuzz_test.cc
+++ b/test/common/http/conn_manager_impl_fuzz_test.cc
@@ -12,7 +12,7 @@
 // * Idle/drain timeouts.
 // * HTTP 1.0 special cases
 // * Fuzz config settings
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/http/conn_manager_impl.h"
@@ -133,7 +133,8 @@ class FuzzConfig : public ConnectionManagerConfig {
   bool shouldNormalizePath() const override { return false; }
   bool shouldMergeSlashes() const override { return false; }
 
-  const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager config_;
+  const envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+      config_;
   std::list<AccessLog::InstanceSharedPtr> access_logs_;
   MockServerConnection* codec_{};
   MockStreamDecoderFilter* decoder_filter_{};
diff --git a/test/common/http/conn_manager_impl_test.cc b/test/common/http/conn_manager_impl_test.cc
index 0765d5d4a400..13875418a3d7 100644
--- a/test/common/http/conn_manager_impl_test.cc
+++ b/test/common/http/conn_manager_impl_test.cc
@@ -6,11 +6,11 @@
 
 #include "envoy/access_log/access_log.h"
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/tracing/http_tracer.h"
-#include "envoy/type/percent.pb.h"
 #include "envoy/type/tracing/v2/custom_tag.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/access_log/access_log_formatter.h"
 #include "common/access_log/access_log_impl.h"
@@ -123,11 +123,11 @@ class HttpConnectionManagerImplTest : public testing::Test, public ConnectionMan
     conn_manager_->initializeReadFilterCallbacks(filter_callbacks_);
 
     if (tracing) {
-      envoy::type::FractionalPercent percent1;
+      envoy::type::v3alpha::FractionalPercent percent1;
       percent1.set_numerator(100);
-      envoy::type::FractionalPercent percent2;
+      envoy::type::v3alpha::FractionalPercent percent2;
       percent2.set_numerator(10000);
-      percent2.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+      percent2.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
       tracing_config_ = std::make_unique<TracingConnectionManagerConfig>(
           TracingConnectionManagerConfig{Tracing::OperationName::Ingress,
                                          {{":method", requestHeaderCustomTag(":method")}},
@@ -809,11 +809,11 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlow) {
   // No decorator.
   EXPECT_CALL(*route_config_provider_.route_config_->route_, decorator())
       .WillRepeatedly(Return(nullptr));
-  envoy::type::FractionalPercent percent1;
+  envoy::type::v3alpha::FractionalPercent percent1;
   percent1.set_numerator(100);
-  envoy::type::FractionalPercent percent2;
+  envoy::type::v3alpha::FractionalPercent percent2;
   percent2.set_numerator(10000);
-  percent2.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+  percent2.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
 
   struct TracingTagMetaSuite {
     using Factory =
@@ -903,8 +903,9 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlow) {
   }
   // Verify if the activeSpan interface returns reference to the current span.
   EXPECT_CALL(*span, setTag(Eq("service-cluster"), Eq("scoobydoo")));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
   EXPECT_CALL(*span, setOperation(_)).Times(0);
 
@@ -969,8 +970,9 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowIngressDecorat
           [&](const Tracing::Span& apply_to_span) -> void { EXPECT_EQ(span, &apply_to_span); }));
   EXPECT_CALL(*span, finishSpan());
   EXPECT_CALL(*span, setTag(_, _)).Times(testing::AnyNumber());
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
   EXPECT_CALL(*span, setOperation(_)).Times(0);
 
@@ -1032,8 +1034,9 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowIngressDecorat
           [&](const Tracing::Span& apply_to_span) -> void { EXPECT_EQ(span, &apply_to_span); }));
   EXPECT_CALL(*span, finishSpan());
   EXPECT_CALL(*span, setTag(_, _)).Times(testing::AnyNumber());
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
   EXPECT_CALL(*span, setOperation(Eq("testOp")));
 
@@ -1081,11 +1084,11 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowIngressDecorat
 
 TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowEgressDecorator) {
   setup(false, "");
-  envoy::type::FractionalPercent percent1;
+  envoy::type::v3alpha::FractionalPercent percent1;
   percent1.set_numerator(100);
-  envoy::type::FractionalPercent percent2;
+  envoy::type::v3alpha::FractionalPercent percent2;
   percent2.set_numerator(10000);
-  percent2.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+  percent2.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
   tracing_config_ = std::make_unique<TracingConnectionManagerConfig>(
       TracingConnectionManagerConfig{Tracing::OperationName::Egress,
                                      {{":method", requestHeaderCustomTag(":method")}},
@@ -1111,8 +1114,9 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowEgressDecorato
           [&](const Tracing::Span& apply_to_span) -> void { EXPECT_EQ(span, &apply_to_span); }));
   EXPECT_CALL(*span, finishSpan());
   EXPECT_CALL(*span, setTag(_, _)).Times(testing::AnyNumber());
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
   EXPECT_CALL(*span, setOperation(_)).Times(0);
 
@@ -1160,11 +1164,11 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowEgressDecorato
 
 TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowEgressDecoratorOverrideOp) {
   setup(false, "");
-  envoy::type::FractionalPercent percent1;
+  envoy::type::v3alpha::FractionalPercent percent1;
   percent1.set_numerator(100);
-  envoy::type::FractionalPercent percent2;
+  envoy::type::v3alpha::FractionalPercent percent2;
   percent2.set_numerator(10000);
-  percent2.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+  percent2.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
   tracing_config_ = std::make_unique<TracingConnectionManagerConfig>(
       TracingConnectionManagerConfig{Tracing::OperationName::Egress,
                                      {{":method", requestHeaderCustomTag(":method")}},
@@ -1190,8 +1194,9 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowEgressDecorato
           [&](const Tracing::Span& apply_to_span) -> void { EXPECT_EQ(span, &apply_to_span); }));
   EXPECT_CALL(*span, finishSpan());
   EXPECT_CALL(*span, setTag(_, _)).Times(testing::AnyNumber());
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
   // Verify that span operation overridden by value supplied in response header.
   EXPECT_CALL(*span, setOperation(Eq("testOp")));
@@ -1234,11 +1239,11 @@ TEST_F(HttpConnectionManagerImplTest, StartAndFinishSpanNormalFlowEgressDecorato
 TEST_F(HttpConnectionManagerImplTest,
        StartAndFinishSpanNormalFlowEgressDecoratorOverrideOpNoActiveSpan) {
   setup(false, "");
-  envoy::type::FractionalPercent percent1;
+  envoy::type::v3alpha::FractionalPercent percent1;
   percent1.set_numerator(100);
-  envoy::type::FractionalPercent percent2;
+  envoy::type::v3alpha::FractionalPercent percent2;
   percent2.set_numerator(10000);
-  percent2.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+  percent2.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
   tracing_config_ = std::make_unique<TracingConnectionManagerConfig>(
       TracingConnectionManagerConfig{Tracing::OperationName::Egress,
                                      {{":method", requestHeaderCustomTag(":method")}},
@@ -1248,8 +1253,9 @@ TEST_F(HttpConnectionManagerImplTest,
                                      false,
                                      256});
 
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(false));
   std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());
 
@@ -1522,7 +1528,8 @@ TEST_F(HttpConnectionManagerImplTest, DoNotStartSpanIfTracingIsNotEnabled) {
 
   EXPECT_CALL(tracer_, startSpan_(_, _, _, _)).Times(0);
   ON_CALL(runtime_.snapshot_,
-          featureEnabled("tracing.global_enabled", An<const envoy::type::FractionalPercent&>(), _))
+          featureEnabled("tracing.global_enabled",
+                         An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillByDefault(Return(true));
 
   std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());
@@ -2616,8 +2623,9 @@ TEST_F(HttpConnectionManagerImplTest, FrameFloodErrorWithLog) {
     throw FrameFloodException("too many outbound frames.");
   }));
 
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("http.connection_manager.log_flood_exception",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("http.connection_manager.log_flood_exception",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .WillOnce(Return(true));
 
   EXPECT_CALL(response_encoder_.stream_, removeCallbacks(_));
diff --git a/test/common/http/conn_manager_utility_test.cc b/test/common/http/conn_manager_utility_test.cc
index 6177f70494de..e106801261e7 100644
--- a/test/common/http/conn_manager_utility_test.cc
+++ b/test/common/http/conn_manager_utility_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/http/conn_manager_utility.h"
 #include "common/http/header_utility.h"
@@ -104,11 +104,11 @@ class ConnectionManagerUtilityTest : public testing::Test {
   ConnectionManagerUtilityTest() {
     ON_CALL(config_, userAgent()).WillByDefault(ReturnRef(user_agent_));
 
-    envoy::type::FractionalPercent percent1;
+    envoy::type::v3alpha::FractionalPercent percent1;
     percent1.set_numerator(100);
-    envoy::type::FractionalPercent percent2;
+    envoy::type::v3alpha::FractionalPercent percent2;
     percent2.set_numerator(10000);
-    percent2.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+    percent2.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
     tracing_config_ = {
         Tracing::OperationName::Ingress, {}, percent1, percent2, percent1, false, 256};
     ON_CALL(config_, tracingConfig()).WillByDefault(Return(&tracing_config_));
@@ -396,8 +396,9 @@ TEST_F(ConnectionManagerUtilityTest, InternalServiceForceTrace) {
     TestHeaderMapImpl headers{
         {"x-forwarded-for", "10.0.0.1"}, {"x-request-id", uuid}, {"x-envoy-force-trace", "true"}};
     EXPECT_CALL(random_, uuid()).Times(0);
-    EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                   An<const envoy::type::FractionalPercent&>(), _))
+    EXPECT_CALL(runtime_.snapshot_,
+                featureEnabled("tracing.global_enabled",
+                               An<const envoy::type::v3alpha::FractionalPercent&>(), _))
         .WillOnce(Return(true));
 
     EXPECT_EQ((MutateRequestRet{"10.0.0.1:0", true}),
@@ -411,11 +412,13 @@ TEST_F(ConnectionManagerUtilityTest, InternalServiceForceTrace) {
     TestHeaderMapImpl headers{
         {"x-forwarded-for", "34.0.0.1"}, {"x-request-id", uuid}, {"x-envoy-force-trace", "true"}};
     EXPECT_CALL(random_, uuid()).Times(0);
-    EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                   An<const envoy::type::FractionalPercent&>(), _))
+    EXPECT_CALL(runtime_.snapshot_,
+                featureEnabled("tracing.random_sampling",
+                               An<const envoy::type::v3alpha::FractionalPercent&>(), _))
         .WillOnce(Return(false));
-    EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                   An<const envoy::type::FractionalPercent&>(), _))
+    EXPECT_CALL(runtime_.snapshot_,
+                featureEnabled("tracing.global_enabled",
+                               An<const envoy::type::v3alpha::FractionalPercent&>(), _))
         .WillOnce(Return(true));
 
     EXPECT_EQ((MutateRequestRet{"34.0.0.1:0", false}),
@@ -430,7 +433,8 @@ TEST_F(ConnectionManagerUtilityTest, EdgeRequestRegenerateRequestIdAndWipeDownst
   connection_.remote_address_ = std::make_shared<Network::Address::Ipv4Instance>("34.0.0.1");
   ON_CALL(config_, useRemoteAddress()).WillByDefault(Return(true));
   ON_CALL(runtime_.snapshot_,
-          featureEnabled("tracing.global_enabled", An<const envoy::type::FractionalPercent&>(), _))
+          featureEnabled("tracing.global_enabled",
+                         An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillByDefault(Return(true));
 
   {
@@ -454,8 +458,9 @@ TEST_F(ConnectionManagerUtilityTest, EdgeRequestRegenerateRequestIdAndWipeDownst
                               {"x-request-id", "will_be_regenerated"},
                               {"x-client-trace-id", "trace-id"}};
     EXPECT_CALL(random_, uuid());
-    EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.client_enabled",
-                                                   An<const envoy::type::FractionalPercent&>()))
+    EXPECT_CALL(runtime_.snapshot_,
+                featureEnabled("tracing.client_enabled",
+                               An<const envoy::type::v3alpha::FractionalPercent&>()))
         .WillOnce(Return(false));
 
     EXPECT_EQ((MutateRequestRet{"34.0.0.1:0", false}),
@@ -470,8 +475,9 @@ TEST_F(ConnectionManagerUtilityTest, EdgeRequestRegenerateRequestIdAndWipeDownst
                               {"x-request-id", "will_be_regenerated"},
                               {"x-client-trace-id", "trace-id"}};
     EXPECT_CALL(random_, uuid());
-    EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.client_enabled",
-                                                   An<const envoy::type::FractionalPercent&>()))
+    EXPECT_CALL(runtime_.snapshot_,
+                featureEnabled("tracing.client_enabled",
+                               An<const envoy::type::v3alpha::FractionalPercent&>()))
         .WillOnce(Return(true));
 
     EXPECT_EQ((MutateRequestRet{"34.0.0.1:0", false}),
@@ -1057,11 +1063,13 @@ TEST_F(ConnectionManagerUtilityTest, NonTlsAlwaysForwardClientCert) {
 
 // Sampling, global on.
 TEST_F(ConnectionManagerUtilityTest, RandomSamplingWhenGlobalSet) {
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.random_sampling",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
 
   Http::TestHeaderMapImpl request_headers{{"x-request-id", "125a4afb-6f55-44ba-ad80-413f09f48a28"}};
@@ -1072,11 +1080,13 @@ TEST_F(ConnectionManagerUtilityTest, RandomSamplingWhenGlobalSet) {
 }
 
 TEST_F(ConnectionManagerUtilityTest, SamplingWithoutRouteOverride) {
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.random_sampling",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
 
   Http::TestHeaderMapImpl request_headers{{"x-request-id", "125a4afb-6f55-44ba-ad80-413f09f48a28"}};
@@ -1087,16 +1097,18 @@ TEST_F(ConnectionManagerUtilityTest, SamplingWithoutRouteOverride) {
 }
 
 TEST_F(ConnectionManagerUtilityTest, SamplingWithRouteOverride) {
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.random_sampling",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(false));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(false));
 
   NiceMock<Router::MockRouteTracing> tracingConfig;
   EXPECT_CALL(route_, tracingConfig()).WillRepeatedly(Return(&tracingConfig));
-  const envoy::type::FractionalPercent percent;
+  const envoy::type::v3alpha::FractionalPercent percent;
   EXPECT_CALL(tracingConfig, getClientSampling()).WillRepeatedly(ReturnRef(percent));
   EXPECT_CALL(tracingConfig, getRandomSampling()).WillRepeatedly(ReturnRef(percent));
   EXPECT_CALL(tracingConfig, getOverallSampling()).WillRepeatedly(ReturnRef(percent));
@@ -1110,11 +1122,13 @@ TEST_F(ConnectionManagerUtilityTest, SamplingWithRouteOverride) {
 
 // Sampling must not be done on client traced.
 TEST_F(ConnectionManagerUtilityTest, SamplingMustNotBeDoneOnClientTraced) {
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.random_sampling",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .Times(0);
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
 
   // The x_request_id has TRACE_FORCED(a) set in the TRACE_BYTE_POSITION(14) character.
@@ -1127,11 +1141,13 @@ TEST_F(ConnectionManagerUtilityTest, SamplingMustNotBeDoneOnClientTraced) {
 
 // Sampling, global off.
 TEST_F(ConnectionManagerUtilityTest, NoTraceWhenSamplingSetButGlobalNotSet) {
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.random_sampling",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(false));
 
   Http::TestHeaderMapImpl request_headers{{"x-request-id", "125a4afb-6f55-44ba-ad80-413f09f48a28"}};
@@ -1144,10 +1160,12 @@ TEST_F(ConnectionManagerUtilityTest, NoTraceWhenSamplingSetButGlobalNotSet) {
 // Client, client enabled, global on.
 TEST_F(ConnectionManagerUtilityTest, ClientSamplingWhenGlobalSet) {
   EXPECT_CALL(runtime_.snapshot_,
-              featureEnabled("tracing.client_enabled", An<const envoy::type::FractionalPercent&>()))
+              featureEnabled("tracing.client_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>()))
       .WillOnce(Return(true));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
 
   Http::TestHeaderMapImpl request_headers{
@@ -1162,13 +1180,16 @@ TEST_F(ConnectionManagerUtilityTest, ClientSamplingWhenGlobalSet) {
 // Client, client disabled, global on.
 TEST_F(ConnectionManagerUtilityTest, NoTraceWhenClientSamplingNotSetAndGlobalSet) {
   EXPECT_CALL(runtime_.snapshot_,
-              featureEnabled("tracing.client_enabled", An<const envoy::type::FractionalPercent&>()))
+              featureEnabled("tracing.client_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>()))
       .WillOnce(Return(false));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.random_sampling",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.random_sampling",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(false));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
 
   Http::TestHeaderMapImpl request_headers{
@@ -1188,8 +1209,9 @@ TEST_F(ConnectionManagerUtilityTest, ForcedTracedWhenGlobalSet) {
                             {"x-request-id", "125a4afb-6f55-44ba-ad80-413f09f48a28"},
                             {"x-envoy-force-trace", "true"}};
   EXPECT_CALL(random_, uuid()).Times(0);
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(true));
 
   EXPECT_EQ((MutateRequestRet{"10.0.0.1:0", true}),
@@ -1205,8 +1227,9 @@ TEST_F(ConnectionManagerUtilityTest, NoTraceWhenForcedTracedButGlobalNotSet) {
                             {"x-request-id", "125a4afb-6f55-44ba-ad80-413f09f48a28"},
                             {"x-envoy-force-trace", "true"}};
   EXPECT_CALL(random_, uuid()).Times(0);
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("tracing.global_enabled",
-                                                 An<const envoy::type::FractionalPercent&>(), _))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("tracing.global_enabled",
+                             An<const envoy::type::v3alpha::FractionalPercent&>(), _))
       .WillOnce(Return(false));
 
   EXPECT_EQ((MutateRequestRet{"10.0.0.1:0", true}),
diff --git a/test/common/http/header_utility_test.cc b/test/common/http/header_utility_test.cc
index a54dd4c10ffc..d66d953b0f54 100644
--- a/test/common/http/header_utility_test.cc
+++ b/test/common/http/header_utility_test.cc
@@ -1,7 +1,7 @@
 #include <regex>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/json/json_object.h"
 
 #include "common/http/header_utility.h"
@@ -14,8 +14,8 @@
 namespace Envoy {
 namespace Http {
 
-envoy::api::v2::route::HeaderMatcher parseHeaderMatcherFromYaml(const std::string& yaml) {
-  envoy::api::v2::route::HeaderMatcher header_matcher;
+envoy::config::route::v3alpha::HeaderMatcher parseHeaderMatcherFromYaml(const std::string& yaml) {
+  envoy::config::route::v3alpha::HeaderMatcher header_matcher;
   TestUtility::loadFromYaml(yaml, header_matcher);
   return header_matcher;
 }
diff --git a/test/common/http/utility_test.cc b/test/common/http/utility_test.cc
index f6fd886de24a..db77f659fc10 100644
--- a/test/common/http/utility_test.cc
+++ b/test/common/http/utility_test.cc
@@ -2,9 +2,9 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/api/v2/core/http_uri.pb.h"
-#include "envoy/api/v2/core/protocol.pb.h"
-#include "envoy/api/v2/core/protocol.pb.validate.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/protocol.pb.h"
+#include "envoy/config/core/v3alpha/protocol.pb.validate.h"
 
 #include "common/common/fmt.h"
 #include "common/http/exception.h"
@@ -249,7 +249,7 @@ TEST(HttpUtility, createSslRedirectPath) {
 namespace {
 
 Http2Settings parseHttp2SettingsFromV2Yaml(const std::string& yaml) {
-  envoy::api::v2::core::Http2ProtocolOptions http2_protocol_options;
+  envoy::config::core::v3alpha::Http2ProtocolOptions http2_protocol_options;
   TestUtility::loadFromYamlAndValidate(yaml, http2_protocol_options);
   return Utility::parseHttp2Settings(http2_protocol_options);
 }
@@ -580,7 +580,7 @@ TEST(HttpUtility, TestExtractHostPathFromUri) {
 }
 
 TEST(HttpUtility, TestPrepareHeaders) {
-  envoy::api::v2::core::HttpUri http_uri;
+  envoy::config::core::v3alpha::HttpUri http_uri;
   http_uri.set_uri("scheme://dns.name/x/y/z");
 
   Http::MessagePtr message = Utility::prepareHeaders(http_uri);
diff --git a/test/common/network/BUILD b/test/common/network/BUILD
index ccbee827116d..24243d1d47f1 100644
--- a/test/common/network/BUILD
+++ b/test/common/network/BUILD
@@ -84,7 +84,7 @@ envoy_cc_test(
         "//test/test_common:network_utility_lib",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -107,7 +107,7 @@ envoy_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -134,8 +134,8 @@ envoy_cc_test(
         "//test/mocks/upstream:host_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/rate_limit/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ratelimit/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -162,7 +162,7 @@ envoy_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -181,7 +181,7 @@ envoy_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -202,7 +202,7 @@ envoy_cc_test(
         "//test/test_common:network_utility_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -216,7 +216,7 @@ envoy_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:registry_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -231,7 +231,7 @@ envoy_cc_test_library(
         "//test/mocks/network:network_mocks",
         "//test/test_common:logging_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -241,7 +241,7 @@ envoy_cc_test(
     deps = [
         ":socket_option_test",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -257,7 +257,7 @@ envoy_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -268,7 +268,7 @@ envoy_cc_test(
         ":socket_option_test",
         "//source/common/network:addr_family_aware_socket_option_lib",
         "//source/common/network:address_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -280,7 +280,7 @@ envoy_cc_test(
         "//source/common/network:utility_lib",
         "//test/mocks/network:network_mocks",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/network/addr_family_aware_socket_option_impl_test.cc b/test/common/network/addr_family_aware_socket_option_impl_test.cc
index ef4fb9c41fdd..19a870b8298c 100644
--- a/test/common/network/addr_family_aware_socket_option_impl_test.cc
+++ b/test/common/network/addr_family_aware_socket_option_impl_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/addr_family_aware_socket_option_impl.h"
 #include "common/network/io_socket_handle_impl.h"
@@ -24,13 +24,14 @@ class AddrFamilyAwareSocketOptionImplTest : public SocketOptionTest {
 
 // We fail to set the option when the underlying setsockopt syscall fails.
 TEST_F(AddrFamilyAwareSocketOptionImplTest, SetOptionFailure) {
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                {},
-                                                1};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
+      {},
+      1};
   EXPECT_LOG_CONTAINS("warning", "Failed to set IP socket option on non-IP socket",
                       EXPECT_FALSE(socket_option.setOption(
-                          socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                          socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
 
   Address::InstanceConstSharedPtr pipe_address =
       std::make_shared<Network::Address::PipeInstance>("/foo");
@@ -38,7 +39,7 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, SetOptionFailure) {
     EXPECT_CALL(socket_, localAddress).WillRepeatedly(testing::ReturnRef(pipe_address));
     EXPECT_LOG_CONTAINS("warning", "Failed to set IP socket option on non-IP socket",
                         EXPECT_FALSE(socket_option.setOption(
-                            socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                            socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
   }
 }
 
@@ -48,12 +49,13 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, SetOptionSuccess) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                {},
-                                                1};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
+      {},
+      1};
   testSetSocketOptionSuccess(socket_option, ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1,
-                             {envoy::api::v2::core::SocketOption::STATE_PREBIND});
+                             {envoy::config::core::v3alpha::SocketOption::STATE_PREBIND});
 }
 
 // If a platform doesn't support IPv4 socket option variant for an IPv4 address we fail
@@ -62,11 +64,11 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V4EmptyOptionNames) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
   AddrFamilyAwareSocketOptionImpl socket_option{
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, {}, {}, 1};
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, {}, {}, 1};
 
   EXPECT_LOG_CONTAINS("warning", "Failed to set unsupported option on socket",
                       EXPECT_FALSE(socket_option.setOption(
-                          socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                          socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
 }
 
 // If a platform doesn't support IPv4 and IPv6 socket option variants for an IPv4 address, we fail
@@ -75,11 +77,11 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V6EmptyOptionNames) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
   AddrFamilyAwareSocketOptionImpl socket_option{
-      envoy::api::v2::core::SocketOption::STATE_PREBIND, {}, {}, 1};
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, {}, {}, 1};
 
   EXPECT_LOG_CONTAINS("warning", "Failed to set unsupported option on socket",
                       EXPECT_FALSE(socket_option.setOption(
-                          socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                          socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
 }
 
 // If a platform supports IPv4 and IPv6 socket option variants for an IPv4 address, we apply the
@@ -89,11 +91,11 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V4IgnoreV6) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1};
   testSetSocketOptionSuccess(socket_option, ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1,
-                             {envoy::api::v2::core::SocketOption::STATE_PREBIND});
+                             {envoy::config::core::v3alpha::SocketOption::STATE_PREBIND});
 }
 
 // If a platform supports IPv6 socket option variant for an IPv6 address it works
@@ -102,12 +104,13 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V6Only) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                {},
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11),
-                                                1};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      {},
+      ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11),
+      1};
   testSetSocketOptionSuccess(socket_option, ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1,
-                             {envoy::api::v2::core::SocketOption::STATE_PREBIND});
+                             {envoy::config::core::v3alpha::SocketOption::STATE_PREBIND});
 }
 
 // If a platform supports only the IPv4 variant for an IPv6 address,
@@ -117,12 +120,13 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V6OnlyV4Fallback) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                {},
-                                                1};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
+      {},
+      1};
   testSetSocketOptionSuccess(socket_option, ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1,
-                             {envoy::api::v2::core::SocketOption::STATE_PREBIND});
+                             {envoy::config::core::v3alpha::SocketOption::STATE_PREBIND});
 }
 
 // If a platform supports IPv4 and IPv6 socket option variants for an IPv6 address,
@@ -132,22 +136,22 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V6Precedence) {
   IoHandlePtr io_handle = address.socket(Address::SocketType::Stream);
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillRepeatedly(testing::ReturnRef(*io_handle));
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1};
   testSetSocketOptionSuccess(socket_option, ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1,
-                             {envoy::api::v2::core::SocketOption::STATE_PREBIND});
+                             {envoy::config::core::v3alpha::SocketOption::STATE_PREBIND});
 }
 
 // GetSocketOptionName returns the v4 information for a v4 address
 TEST_F(AddrFamilyAwareSocketOptionImplTest, V4GetSocketOptionName) {
   socket_.local_address_ = Utility::parseInternetAddress("1.2.3.4", 5678);
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1};
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 1};
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   ASSERT_TRUE(result.has_value());
   EXPECT_EQ(result.value(), makeDetails(ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1));
 }
@@ -156,11 +160,11 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V4GetSocketOptionName) {
 TEST_F(AddrFamilyAwareSocketOptionImplTest, V6GetSocketOptionName) {
   socket_.local_address_ = Utility::parseInternetAddress("2::1", 5678);
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5};
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5};
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   ASSERT_TRUE(result.has_value());
   EXPECT_EQ(result.value(), makeDetails(ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5));
 }
@@ -169,24 +173,24 @@ TEST_F(AddrFamilyAwareSocketOptionImplTest, V6GetSocketOptionName) {
 TEST_F(AddrFamilyAwareSocketOptionImplTest, GetSocketOptionWrongState) {
   socket_.local_address_ = Utility::parseInternetAddress("2::1", 5678);
 
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5};
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_BOUND);
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5};
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_BOUND);
   EXPECT_FALSE(result.has_value());
 }
 
 // GetSocketOptionName returns nullopt if the version could not be determined
 TEST_F(AddrFamilyAwareSocketOptionImplTest, GetSocketOptionCannotDetermineVersion) {
-  AddrFamilyAwareSocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10),
-                                                ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5};
+  AddrFamilyAwareSocketOptionImpl socket_option{
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+      ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), ENVOY_MAKE_SOCKET_OPTION_NAME(6, 11), 5};
 
   IoHandlePtr io_handle = std::make_unique<IoSocketHandleImpl>();
   EXPECT_CALL(testing::Const(socket_), ioHandle()).WillOnce(testing::ReturnRef(*io_handle));
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   EXPECT_FALSE(result.has_value());
 }
 
diff --git a/test/common/network/connection_impl_test.cc b/test/common/network/connection_impl_test.cc
index b5bc5380525d..69d41bbcd8fa 100644
--- a/test/common/network/connection_impl_test.cc
+++ b/test/common/network/connection_impl_test.cc
@@ -2,8 +2,8 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/empty_string.h"
@@ -313,7 +313,7 @@ TEST_P(ConnectionImplTest, SocketOptions) {
 
   auto option = std::make_shared<MockSocketOption>();
 
-  EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_PREBIND))
+  EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND))
       .WillOnce(Return(true));
   EXPECT_CALL(listener_callbacks_, onAccept_(_))
       .WillOnce(Invoke([&](Network::ConnectionSocketPtr& socket) -> void {
@@ -362,7 +362,7 @@ TEST_P(ConnectionImplTest, SocketOptionsFailureTest) {
 
   auto option = std::make_shared<MockSocketOption>();
 
-  EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_PREBIND))
+  EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND))
       .WillOnce(Return(false));
   EXPECT_CALL(listener_callbacks_, onAccept_(_))
       .WillOnce(Invoke([&](Network::ConnectionSocketPtr& socket) -> void {
@@ -933,11 +933,12 @@ TEST_P(ConnectionImplTest, BindFromSocketTest) {
         new Network::Address::Ipv6Instance(address_string, 0)};
   }
   auto option = std::make_shared<NiceMock<MockSocketOption>>();
-  EXPECT_CALL(*option, setOption(_, Eq(envoy::api::v2::core::SocketOption::STATE_PREBIND)))
-      .WillOnce(Invoke([&](Socket& socket, envoy::api::v2::core::SocketOption::SocketState) {
-        socket.setLocalAddress(new_source_address);
-        return true;
-      }));
+  EXPECT_CALL(*option, setOption(_, Eq(envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)))
+      .WillOnce(
+          Invoke([&](Socket& socket, envoy::config::core::v3alpha::SocketOption::SocketState) {
+            socket.setLocalAddress(new_source_address);
+            return true;
+          }));
 
   socket_options_ = std::make_shared<Socket::Options>();
   socket_options_->emplace_back(std::move(option));
diff --git a/test/common/network/dns_impl_test.cc b/test/common/network/dns_impl_test.cc
index 388621247de1..d23d6663cbde 100644
--- a/test/common/network/dns_impl_test.cc
+++ b/test/common/network/dns_impl_test.cc
@@ -8,7 +8,7 @@
 #include <unordered_map>
 #include <vector>
 
-#include "envoy/api/v2/core/address.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/network/address.h"
 #include "envoy/network/dns.h"
@@ -394,7 +394,7 @@ TEST_F(DnsImplConstructor, SupportCustomAddressInstances) {
 }
 
 TEST_F(DnsImplConstructor, BadCustomResolvers) {
-  envoy::api::v2::core::Address pipe_address;
+  envoy::config::core::v3alpha::Address pipe_address;
   pipe_address.mutable_pipe()->set_path("foo");
   auto pipe_instance = Network::Utility::protobufAddressToAddress(pipe_address);
   EXPECT_THROW_WITH_MESSAGE(dispatcher_->createDnsResolver({pipe_instance}, false), EnvoyException,
diff --git a/test/common/network/filter_manager_impl_test.cc b/test/common/network/filter_manager_impl_test.cc
index c3ce9cd19362..d451948f8829 100644
--- a/test/common/network/filter_manager_impl_test.cc
+++ b/test/common/network/filter_manager_impl_test.cc
@@ -1,8 +1,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/network/filter_manager_impl.h"
@@ -381,7 +381,7 @@ stat_prefix: name
           featureEnabled("ratelimit.tcp_filter_enforcing", 100))
       .WillByDefault(Return(true));
 
-  envoy::config::filter::network::rate_limit::v2::RateLimit proto_config{};
+  envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit proto_config{};
   TestUtility::loadFromYaml(rl_yaml, proto_config);
 
   Extensions::NetworkFilters::RateLimitFilter::ConfigSharedPtr rl_config(
@@ -392,7 +392,7 @@ stat_prefix: name
   manager.addReadFilter(std::make_shared<Extensions::NetworkFilters::RateLimitFilter::Filter>(
       rl_config, Extensions::Filters::Common::RateLimit::ClientPtr{rl_client}));
 
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy;
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy tcp_proxy;
   tcp_proxy.set_stat_prefix("name");
   tcp_proxy.set_cluster("fake_cluster");
   TcpProxy::ConfigSharedPtr tcp_proxy_config(new TcpProxy::Config(tcp_proxy, factory_context));
diff --git a/test/common/network/listen_socket_impl_test.cc b/test/common/network/listen_socket_impl_test.cc
index 56adea5ef64a..16bb881606a8 100644
--- a/test/common/network/listen_socket_impl_test.cc
+++ b/test/common/network/listen_socket_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/io_socket_handle_impl.h"
 #include "common/network/listen_socket_impl.h"
@@ -57,7 +57,7 @@ class ListenSocketImplTest : public testing::TestWithParam<Address::IpVersion> {
 
       auto option = std::make_unique<MockSocketOption>();
       auto options = std::make_shared<std::vector<Network::Socket::OptionConstSharedPtr>>();
-      EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_PREBIND))
+      EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND))
           .WillOnce(Return(true));
       options->emplace_back(std::move(option));
       std::unique_ptr<ListenSocketImpl> socket1;
@@ -88,7 +88,7 @@ class ListenSocketImplTest : public testing::TestWithParam<Address::IpVersion> {
 
       auto option2 = std::make_unique<MockSocketOption>();
       auto options2 = std::make_shared<std::vector<Network::Socket::OptionConstSharedPtr>>();
-      EXPECT_CALL(*option2, setOption(_, envoy::api::v2::core::SocketOption::STATE_PREBIND))
+      EXPECT_CALL(*option2, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND))
           .WillOnce(Return(true));
       options2->emplace_back(std::move(option2));
       // The address and port are bound already, should throw exception.
diff --git a/test/common/network/listener_impl_test.cc b/test/common/network/listener_impl_test.cc
index 9653012ddbb6..d409c99bbddd 100644
--- a/test/common/network/listener_impl_test.cc
+++ b/test/common/network/listener_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/network/listener_impl.h"
@@ -82,7 +82,7 @@ TEST_P(ListenerImplTest, SetListeningSocketOptionsSuccess) {
       Network::Test::getCanonicalLoopbackAddress(version_), nullptr, true);
   std::shared_ptr<MockSocketOption> option = std::make_shared<MockSocketOption>();
   socket->addOption(option);
-  EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_LISTENING))
+  EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_LISTENING))
       .WillOnce(Return(true));
   TestListenerImpl listener(dispatcherImpl(), socket, listener_callbacks, true);
 }
@@ -96,7 +96,7 @@ TEST_P(ListenerImplTest, SetListeningSocketOptionsError) {
       Network::Test::getCanonicalLoopbackAddress(version_), nullptr, true);
   std::shared_ptr<MockSocketOption> option = std::make_shared<MockSocketOption>();
   socket->addOption(option);
-  EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_LISTENING))
+  EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_LISTENING))
       .WillOnce(Return(false));
   EXPECT_THROW_WITH_MESSAGE(TestListenerImpl(dispatcherImpl(), socket, listener_callbacks, true),
                             CreateListenerException,
@@ -173,7 +173,7 @@ TEST_P(ListenerImplTest, WildcardListenerUseActualDst) {
 TEST_P(ListenerImplTest, WildcardListenerIpv4Compat) {
   auto option = std::make_unique<MockSocketOption>();
   auto options = std::make_shared<std::vector<Network::Socket::OptionConstSharedPtr>>();
-  EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_PREBIND))
+  EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND))
       .WillOnce(Return(true));
   options->emplace_back(std::move(option));
 
diff --git a/test/common/network/resolver_impl_test.cc b/test/common/network/resolver_impl_test.cc
index f5fa8daf536a..d1b327bb3dfa 100644
--- a/test/common/network/resolver_impl_test.cc
+++ b/test/common/network/resolver_impl_test.cc
@@ -2,8 +2,8 @@
 #include <list>
 #include <string>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/network/resolver.h"
 #include "envoy/registry/registry.h"
 
@@ -29,7 +29,7 @@ class IpResolverTest : public testing::Test {
 };
 
 TEST_F(IpResolverTest, Basic) {
-  envoy::api::v2::core::SocketAddress socket_address;
+  envoy::config::core::v3alpha::SocketAddress socket_address;
   socket_address.set_address("1.2.3.4");
   socket_address.set_port_value(443);
   auto address = resolver_->resolve(socket_address);
@@ -38,26 +38,27 @@ TEST_F(IpResolverTest, Basic) {
 }
 
 TEST_F(IpResolverTest, DisallowsNamedPort) {
-  envoy::api::v2::core::SocketAddress socket_address;
+  envoy::config::core::v3alpha::SocketAddress socket_address;
   socket_address.set_address("1.2.3.4");
   socket_address.set_named_port("http");
-  EXPECT_THROW_WITH_MESSAGE(resolver_->resolve(socket_address), EnvoyException,
-                            fmt::format("IP resolver can't handle port specifier type {}",
-                                        envoy::api::v2::core::SocketAddress::kNamedPort));
+  EXPECT_THROW_WITH_MESSAGE(
+      resolver_->resolve(socket_address), EnvoyException,
+      fmt::format("IP resolver can't handle port specifier type {}",
+                  envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::kNamedPort));
 }
 
 TEST(ResolverTest, FromProtoAddress) {
-  envoy::api::v2::core::Address ipv4_address;
+  envoy::config::core::v3alpha::Address ipv4_address;
   ipv4_address.mutable_socket_address()->set_address("1.2.3.4");
   ipv4_address.mutable_socket_address()->set_port_value(5);
   EXPECT_EQ("1.2.3.4:5", resolveProtoAddress(ipv4_address)->asString());
 
-  envoy::api::v2::core::Address ipv6_address;
+  envoy::config::core::v3alpha::Address ipv6_address;
   ipv6_address.mutable_socket_address()->set_address("1::1");
   ipv6_address.mutable_socket_address()->set_port_value(2);
   EXPECT_EQ("[1::1]:2", resolveProtoAddress(ipv6_address)->asString());
 
-  envoy::api::v2::core::Address pipe_address;
+  envoy::config::core::v3alpha::Address pipe_address;
   pipe_address.mutable_pipe()->set_path("/foo/bar");
   EXPECT_EQ("/foo/bar", resolveProtoAddress(pipe_address)->asString());
 }
@@ -65,14 +66,14 @@ TEST(ResolverTest, FromProtoAddress) {
 // Validate correct handling of ipv4_compat field.
 TEST(ResolverTest, FromProtoAddressV4Compat) {
   {
-    envoy::api::v2::core::Address ipv6_address;
+    envoy::config::core::v3alpha::Address ipv6_address;
     ipv6_address.mutable_socket_address()->set_address("1::1");
     ipv6_address.mutable_socket_address()->set_port_value(2);
     auto resolved_addr = resolveProtoAddress(ipv6_address);
     EXPECT_EQ("[1::1]:2", resolved_addr->asString());
   }
   {
-    envoy::api::v2::core::Address ipv6_address;
+    envoy::config::core::v3alpha::Address ipv6_address;
     ipv6_address.mutable_socket_address()->set_address("1::1");
     ipv6_address.mutable_socket_address()->set_port_value(2);
     ipv6_address.mutable_socket_address()->set_ipv4_compat(true);
@@ -84,7 +85,7 @@ TEST(ResolverTest, FromProtoAddressV4Compat) {
 class TestResolver : public Resolver {
 public:
   InstanceConstSharedPtr
-  resolve(const envoy::api::v2::core::SocketAddress& socket_address) override {
+  resolve(const envoy::config::core::v3alpha::SocketAddress& socket_address) override {
     const std::string& logical = socket_address.address();
     const std::string physical = getPhysicalName(logical);
     const std::string port = getPort(socket_address);
@@ -107,13 +108,13 @@ class TestResolver : public Resolver {
     return it->second;
   }
 
-  std::string getPort(const envoy::api::v2::core::SocketAddress& socket_address) {
+  std::string getPort(const envoy::config::core::v3alpha::SocketAddress& socket_address) {
     switch (socket_address.port_specifier_case()) {
-    case envoy::api::v2::core::SocketAddress::kNamedPort:
+    case envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::kNamedPort:
       return socket_address.named_port();
-    case envoy::api::v2::core::SocketAddress::kPortValue:
+    case envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::kPortValue:
     // default to port 0 if no port value is specified
-    case envoy::api::v2::core::SocketAddress::PORT_SPECIFIER_NOT_SET:
+    case envoy::config::core::v3alpha::SocketAddress::PortSpecifierCase::PORT_SPECIFIER_NOT_SET:
       return fmt::format("{}", socket_address.port_value());
 
     default:
@@ -132,7 +133,7 @@ TEST(ResolverTest, NonStandardResolver) {
   Registry::InjectFactory<Resolver> register_resolver(test_resolver);
 
   {
-    envoy::api::v2::core::Address address;
+    envoy::config::core::v3alpha::Address address;
     auto socket = address.mutable_socket_address();
     socket->set_address("foo");
     socket->set_port_value(5);
@@ -142,7 +143,7 @@ TEST(ResolverTest, NonStandardResolver) {
     EXPECT_EQ("foo:5", instance->logicalName());
   }
   {
-    envoy::api::v2::core::Address address;
+    envoy::config::core::v3alpha::Address address;
     auto socket = address.mutable_socket_address();
     socket->set_address("bar");
     socket->set_named_port("http");
@@ -154,13 +155,13 @@ TEST(ResolverTest, NonStandardResolver) {
 }
 
 TEST(ResolverTest, UninitializedAddress) {
-  envoy::api::v2::core::Address address;
+  envoy::config::core::v3alpha::Address address;
   EXPECT_THROW_WITH_MESSAGE(resolveProtoAddress(address), EnvoyException,
                             "Address must be a socket or pipe: ");
 }
 
 TEST(ResolverTest, NoSuchResolver) {
-  envoy::api::v2::core::Address address;
+  envoy::config::core::v3alpha::Address address;
   auto socket = address.mutable_socket_address();
   socket->set_address("foo");
   socket->set_port_value(5);
diff --git a/test/common/network/socket_option_factory_test.cc b/test/common/network/socket_option_factory_test.cc
index da2c441a871d..83ea901cdb79 100644
--- a/test/common/network/socket_option_factory_test.cc
+++ b/test/common/network/socket_option_factory_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/network/socket_option_factory.h"
@@ -68,8 +68,8 @@ TEST_F(SocketOptionFactoryTest, TestBuildSocketMarkOptions) {
         return 0;
       }));
 
-  EXPECT_TRUE(Network::Socket::applyOptions(options, socket_mock_,
-                                            envoy::api::v2::core::SocketOption::STATE_PREBIND));
+  EXPECT_TRUE(Network::Socket::applyOptions(
+      options, socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND));
 }
 
 TEST_F(SocketOptionFactoryTest, TestBuildIpv4TransparentOptions) {
@@ -93,10 +93,10 @@ TEST_F(SocketOptionFactoryTest, TestBuildIpv4TransparentOptions) {
         return 0;
       }));
 
-  EXPECT_TRUE(Network::Socket::applyOptions(options, socket_mock_,
-                                            envoy::api::v2::core::SocketOption::STATE_PREBIND));
-  EXPECT_TRUE(Network::Socket::applyOptions(options, socket_mock_,
-                                            envoy::api::v2::core::SocketOption::STATE_BOUND));
+  EXPECT_TRUE(Network::Socket::applyOptions(
+      options, socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND));
+  EXPECT_TRUE(Network::Socket::applyOptions(
+      options, socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_BOUND));
 }
 
 TEST_F(SocketOptionFactoryTest, TestBuildIpv6TransparentOptions) {
@@ -120,16 +120,16 @@ TEST_F(SocketOptionFactoryTest, TestBuildIpv6TransparentOptions) {
         return 0;
       }));
 
-  EXPECT_TRUE(Network::Socket::applyOptions(options, socket_mock_,
-                                            envoy::api::v2::core::SocketOption::STATE_PREBIND));
-  EXPECT_TRUE(Network::Socket::applyOptions(options, socket_mock_,
-                                            envoy::api::v2::core::SocketOption::STATE_BOUND));
+  EXPECT_TRUE(Network::Socket::applyOptions(
+      options, socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND));
+  EXPECT_TRUE(Network::Socket::applyOptions(
+      options, socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_BOUND));
 }
 
 TEST_F(SocketOptionFactoryTest, TestBuildLiteralOptions) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::core::SocketOption> socket_options_proto;
+  Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::SocketOption> socket_options_proto;
   Envoy::Protobuf::TextFormat::Parser parser;
-  envoy::api::v2::core::SocketOption socket_option_proto;
+  envoy::config::core::v3alpha::SocketOption socket_option_proto;
   static const char linger_option_format[] = R"proto(
     state: STATE_PREBIND
     level: %d
@@ -152,7 +152,7 @@ TEST_F(SocketOptionFactoryTest, TestBuildLiteralOptions) {
   auto socket_options = SocketOptionFactory::buildLiteralOptions(socket_options_proto);
   EXPECT_EQ(2, socket_options->size());
   auto option_details = socket_options->at(0)->getOptionDetails(
-      socket_mock_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+      socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   EXPECT_TRUE(option_details.has_value());
   EXPECT_EQ(SOL_SOCKET, option_details->name_.level());
   EXPECT_EQ(SO_LINGER, option_details->name_.option());
@@ -164,7 +164,7 @@ TEST_F(SocketOptionFactoryTest, TestBuildLiteralOptions) {
   EXPECT_EQ(linger_bstr, option_details->value_);
 
   option_details = socket_options->at(1)->getOptionDetails(
-      socket_mock_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+      socket_mock_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   EXPECT_TRUE(option_details.has_value());
   EXPECT_EQ(SOL_SOCKET, option_details->name_.level());
   EXPECT_EQ(SO_KEEPALIVE, option_details->name_.option());
diff --git a/test/common/network/socket_option_impl_test.cc b/test/common/network/socket_option_impl_test.cc
index 65031311814e..c13dfdb6df54 100644
--- a/test/common/network/socket_option_impl_test.cc
+++ b/test/common/network/socket_option_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "test/common/network/socket_option_test.h"
 
@@ -31,7 +31,8 @@ TEST_F(SocketOptionImplTest, HasName) {
 
   // If we fail to set an option, verify that the log message
   // contains the option name so the operator can debug.
-  SocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND, optname, 1};
+  SocketOptionImpl socket_option{envoy::config::core::v3alpha::SocketOption::STATE_PREBIND, optname,
+                                 1};
   EXPECT_CALL(os_sys_calls_, setsockopt_(_, _, _, _, _))
       .WillOnce(Invoke([](int, int, int, const void* optval, socklen_t) -> int {
         EXPECT_EQ(1, *static_cast<const int*>(optval));
@@ -40,55 +41,56 @@ TEST_F(SocketOptionImplTest, HasName) {
 
   EXPECT_LOG_CONTAINS(
       "warning", "Setting SOL_SOCKET/SO_SNDBUF option on socket failed",
-      socket_option.setOption(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND));
+      socket_option.setOption(socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND));
 }
 
 TEST_F(SocketOptionImplTest, SetOptionSuccessTrue) {
-  SocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  SocketOptionImpl socket_option{envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
                                  ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1};
   EXPECT_CALL(os_sys_calls_, setsockopt_(_, 5, 10, _, sizeof(int)))
       .WillOnce(Invoke([](int, int, int, const void* optval, socklen_t) -> int {
         EXPECT_EQ(1, *static_cast<const int*>(optval));
         return 0;
       }));
-  EXPECT_TRUE(socket_option.setOption(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND));
+  EXPECT_TRUE(
+      socket_option.setOption(socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND));
 }
 
 TEST_F(SocketOptionImplTest, GetOptionDetailsCorrectState) {
-  SocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  SocketOptionImpl socket_option{envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
                                  ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1};
 
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   ASSERT_TRUE(result.has_value());
   EXPECT_EQ(*result, makeDetails(ENVOY_MAKE_SOCKET_OPTION_NAME(5, 10), 1));
 }
 
 TEST_F(SocketOptionImplTest, GetMoreOptionDetailsCorrectState) {
-  SocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_LISTENING,
+  SocketOptionImpl socket_option{envoy::config::core::v3alpha::SocketOption::STATE_LISTENING,
                                  ENVOY_MAKE_SOCKET_OPTION_NAME(7, 9), 5};
 
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_LISTENING);
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_LISTENING);
   ASSERT_TRUE(result.has_value());
   EXPECT_EQ(*result, makeDetails(ENVOY_MAKE_SOCKET_OPTION_NAME(7, 9), 5));
 }
 
 TEST_F(SocketOptionImplTest, GetOptionDetailsFailureWrongState) {
-  SocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_LISTENING,
+  SocketOptionImpl socket_option{envoy::config::core::v3alpha::SocketOption::STATE_LISTENING,
                                  ENVOY_MAKE_SOCKET_OPTION_NAME(7, 9), 5};
 
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_BOUND);
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_BOUND);
   EXPECT_FALSE(result.has_value());
 }
 
 TEST_F(SocketOptionImplTest, GetUnsupportedOptReturnsNullopt) {
-  SocketOptionImpl socket_option{envoy::api::v2::core::SocketOption::STATE_LISTENING,
+  SocketOptionImpl socket_option{envoy::config::core::v3alpha::SocketOption::STATE_LISTENING,
                                  Network::SocketOptionName(), 5};
 
-  auto result =
-      socket_option.getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_LISTENING);
+  auto result = socket_option.getOptionDetails(
+      socket_, envoy::config::core::v3alpha::SocketOption::STATE_LISTENING);
   EXPECT_FALSE(result.has_value());
 }
 
diff --git a/test/common/network/socket_option_test.h b/test/common/network/socket_option_test.h
index 21cd2767d561..81d1300e9607 100644
--- a/test/common/network/socket_option_test.h
+++ b/test/common/network/socket_option_test.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/network/socket_option_impl.h"
@@ -37,7 +37,7 @@ class SocketOptionTest : public testing::Test {
 
   void testSetSocketOptionSuccess(
       Socket::Option& socket_option, Network::SocketOptionName option_name, int option_val,
-      const std::set<envoy::api::v2::core::SocketOption::SocketState>& when) {
+      const std::set<envoy::config::core::v3alpha::SocketOption::SocketState>& when) {
     for (auto state : when) {
       if (option_name.has_value()) {
         EXPECT_CALL(os_sys_calls_,
@@ -54,13 +54,13 @@ class SocketOptionTest : public testing::Test {
 
     // The set of SocketOption::SocketState for which this option should not be set.
     // Initialize to all the states, and remove states that are passed in.
-    std::list<envoy::api::v2::core::SocketOption::SocketState> unset_socketstates{
-        envoy::api::v2::core::SocketOption::STATE_PREBIND,
-        envoy::api::v2::core::SocketOption::STATE_BOUND,
-        envoy::api::v2::core::SocketOption::STATE_LISTENING,
+    std::list<envoy::config::core::v3alpha::SocketOption::SocketState> unset_socketstates{
+        envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
+        envoy::config::core::v3alpha::SocketOption::STATE_BOUND,
+        envoy::config::core::v3alpha::SocketOption::STATE_LISTENING,
     };
     unset_socketstates.remove_if(
-        [&](envoy::api::v2::core::SocketOption::SocketState state) -> bool {
+        [&](envoy::config::core::v3alpha::SocketOption::SocketState state) -> bool {
           return when.find(state) != when.end();
         });
     for (auto state : unset_socketstates) {
diff --git a/test/common/network/udp_listener_impl_test.cc b/test/common/network/udp_listener_impl_test.cc
index be04ef586408..3fd5eafe56c9 100644
--- a/test/common/network/udp_listener_impl_test.cc
+++ b/test/common/network/udp_listener_impl_test.cc
@@ -2,7 +2,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/network/socket_option_factory.h"
@@ -109,7 +109,7 @@ TEST_P(UdpListenerImplTest, UdpSetListeningSocketOptionsSuccess) {
                                                            nullptr, true);
   std::shared_ptr<MockSocketOption> option = std::make_shared<MockSocketOption>();
   socket->addOption(option);
-  EXPECT_CALL(*option, setOption(_, envoy::api::v2::core::SocketOption::STATE_BOUND))
+  EXPECT_CALL(*option, setOption(_, envoy::config::core::v3alpha::SocketOption::STATE_BOUND))
       .WillOnce(Return(true));
   UdpListenerImpl listener(dispatcherImpl(), socket, listener_callbacks,
                            dispatcherImpl().timeSource());
diff --git a/test/common/network/utility_test.cc b/test/common/network/utility_test.cc
index 9995e13c7b44..4b0368cecebf 100644
--- a/test/common/network/utility_test.cc
+++ b/test/common/network/utility_test.cc
@@ -2,8 +2,8 @@
 #include <list>
 #include <string>
 
-#include "envoy/api/v2/core/address.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 
 #include "common/common/thread.h"
 #include "common/network/address_impl.h"
@@ -298,25 +298,25 @@ TEST(NetworkUtility, AnyAddress) {
 
 TEST(NetworkUtility, ParseProtobufAddress) {
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     proto_address.mutable_socket_address()->set_address("127.0.0.1");
     proto_address.mutable_socket_address()->set_port_value(1234);
     EXPECT_EQ("127.0.0.1:1234", Utility::protobufAddressToAddress(proto_address)->asString());
   }
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     proto_address.mutable_socket_address()->set_address("::1");
     proto_address.mutable_socket_address()->set_port_value(1234);
     EXPECT_EQ("[::1]:1234", Utility::protobufAddressToAddress(proto_address)->asString());
   }
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     proto_address.mutable_pipe()->set_path("/tmp/unix-socket");
     EXPECT_EQ("/tmp/unix-socket", Utility::protobufAddressToAddress(proto_address)->asString());
   }
 #if defined(__linux__)
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     proto_address.mutable_pipe()->set_path("@/tmp/abstract-unix-socket");
     EXPECT_EQ("@/tmp/abstract-unix-socket",
               Utility::protobufAddressToAddress(proto_address)->asString());
@@ -326,7 +326,7 @@ TEST(NetworkUtility, ParseProtobufAddress) {
 
 TEST(NetworkUtility, AddressToProtobufAddress) {
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     Address::Ipv4Instance address("127.0.0.1");
     Utility::addressToProtobufAddress(address, proto_address);
     EXPECT_EQ(true, proto_address.has_socket_address());
@@ -334,7 +334,7 @@ TEST(NetworkUtility, AddressToProtobufAddress) {
     EXPECT_EQ(0, proto_address.socket_address().port_value());
   }
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     Address::PipeInstance address("/hello");
     Utility::addressToProtobufAddress(address, proto_address);
     EXPECT_EQ(true, proto_address.has_pipe());
@@ -344,22 +344,24 @@ TEST(NetworkUtility, AddressToProtobufAddress) {
 
 TEST(NetworkUtility, ProtobufAddressSocketType) {
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     proto_address.mutable_socket_address();
     EXPECT_EQ(Address::SocketType::Stream, Utility::protobufAddressSocketType(proto_address));
   }
   {
-    envoy::api::v2::core::Address proto_address;
-    proto_address.mutable_socket_address()->set_protocol(envoy::api::v2::core::SocketAddress::TCP);
+    envoy::config::core::v3alpha::Address proto_address;
+    proto_address.mutable_socket_address()->set_protocol(
+        envoy::config::core::v3alpha::SocketAddress::TCP);
     EXPECT_EQ(Address::SocketType::Stream, Utility::protobufAddressSocketType(proto_address));
   }
   {
-    envoy::api::v2::core::Address proto_address;
-    proto_address.mutable_socket_address()->set_protocol(envoy::api::v2::core::SocketAddress::UDP);
+    envoy::config::core::v3alpha::Address proto_address;
+    proto_address.mutable_socket_address()->set_protocol(
+        envoy::config::core::v3alpha::SocketAddress::UDP);
     EXPECT_EQ(Address::SocketType::Datagram, Utility::protobufAddressSocketType(proto_address));
   }
   {
-    envoy::api::v2::core::Address proto_address;
+    envoy::config::core::v3alpha::Address proto_address;
     proto_address.mutable_pipe();
     EXPECT_EQ(Address::SocketType::Stream, Utility::protobufAddressSocketType(proto_address));
   }
diff --git a/test/common/protobuf/BUILD b/test/common/protobuf/BUILD
index 8d6c41c0e68e..3fac0a5ae88b 100644
--- a/test/common/protobuf/BUILD
+++ b/test/common/protobuf/BUILD
@@ -35,9 +35,9 @@ envoy_cc_test(
         "//test/test_common:logging_lib",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/protobuf/utility_test.cc b/test/common/protobuf/utility_test.cc
index 600b41a1db28..fbc79d0bb727 100644
--- a/test/common/protobuf/utility_test.cc
+++ b/test/common/protobuf/utility_test.cc
@@ -1,11 +1,11 @@
 #include <unordered_set>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/cluster.pb.validate.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.validate.h"
+#include "envoy/api/v2/cluster.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.validate.h"
 #include "envoy/config/cluster/v3alpha/cluster.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/common/base64.h"
 #include "common/config/api_version.h"
@@ -36,7 +36,7 @@ class ProtobufUtilityTest : public testing::Test {
 };
 
 TEST_F(ProtobufUtilityTest, convertPercentNaNDouble) {
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   common_config_.mutable_healthy_panic_threshold()->set_value(
       std::numeric_limits<double>::quiet_NaN());
   EXPECT_THROW(PROTOBUF_PERCENT_TO_DOUBLE_OR_DEFAULT(common_config_, healthy_panic_threshold, 0.5),
@@ -44,7 +44,7 @@ TEST_F(ProtobufUtilityTest, convertPercentNaNDouble) {
 }
 
 TEST_F(ProtobufUtilityTest, convertPercentNaN) {
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   common_config_.mutable_healthy_panic_threshold()->set_value(
       std::numeric_limits<double>::quiet_NaN());
   EXPECT_THROW(PROTOBUF_PERCENT_TO_ROUNDED_INTEGER_OR_DEFAULT(common_config_,
@@ -56,14 +56,14 @@ namespace ProtobufPercentHelper {
 
 TEST_F(ProtobufUtilityTest, evaluateFractionalPercent) {
   { // 0/100 (default)
-    envoy::type::FractionalPercent percent;
+    envoy::type::v3alpha::FractionalPercent percent;
     EXPECT_FALSE(evaluateFractionalPercent(percent, 0));
     EXPECT_FALSE(evaluateFractionalPercent(percent, 50));
     EXPECT_FALSE(evaluateFractionalPercent(percent, 100));
     EXPECT_FALSE(evaluateFractionalPercent(percent, 1000));
   }
   { // 5/100
-    envoy::type::FractionalPercent percent;
+    envoy::type::v3alpha::FractionalPercent percent;
     percent.set_numerator(5);
     EXPECT_TRUE(evaluateFractionalPercent(percent, 0));
     EXPECT_TRUE(evaluateFractionalPercent(percent, 4));
@@ -76,7 +76,7 @@ TEST_F(ProtobufUtilityTest, evaluateFractionalPercent) {
     EXPECT_TRUE(evaluateFractionalPercent(percent, 1000));
   }
   { // 75/100
-    envoy::type::FractionalPercent percent;
+    envoy::type::v3alpha::FractionalPercent percent;
     percent.set_numerator(75);
     EXPECT_TRUE(evaluateFractionalPercent(percent, 0));
     EXPECT_TRUE(evaluateFractionalPercent(percent, 4));
@@ -91,8 +91,8 @@ TEST_F(ProtobufUtilityTest, evaluateFractionalPercent) {
     EXPECT_FALSE(evaluateFractionalPercent(percent, 280));
   }
   { // 5/10000
-    envoy::type::FractionalPercent percent;
-    percent.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+    envoy::type::v3alpha::FractionalPercent percent;
+    percent.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
     percent.set_numerator(5);
     EXPECT_TRUE(evaluateFractionalPercent(percent, 0));
     EXPECT_TRUE(evaluateFractionalPercent(percent, 4));
@@ -106,8 +106,8 @@ TEST_F(ProtobufUtilityTest, evaluateFractionalPercent) {
     EXPECT_TRUE(evaluateFractionalPercent(percent, 20004));
   }
   { // 5/MILLION
-    envoy::type::FractionalPercent percent;
-    percent.set_denominator(envoy::type::FractionalPercent::MILLION);
+    envoy::type::v3alpha::FractionalPercent percent;
+    percent.set_denominator(envoy::type::v3alpha::FractionalPercent::MILLION);
     percent.set_numerator(5);
     EXPECT_TRUE(evaluateFractionalPercent(percent, 0));
     EXPECT_TRUE(evaluateFractionalPercent(percent, 4));
@@ -160,41 +160,42 @@ TEST_F(ProtobufUtilityTest, RepeatedPtrUtilDebugString) {
 
 // Validated exception thrown when downcastAndValidate observes a PGV failures.
 TEST_F(ProtobufUtilityTest, DowncastAndValidateFailedValidation) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.mutable_static_resources()->add_clusters();
   EXPECT_THROW(TestUtility::validate(bootstrap), ProtoValidationException);
   EXPECT_THROW(
-      TestUtility::downcastAndValidate<const envoy::config::bootstrap::v2::Bootstrap&>(bootstrap),
+      TestUtility::downcastAndValidate<const envoy::config::bootstrap::v3alpha::Bootstrap&>(
+          bootstrap),
       ProtoValidationException);
 }
 
 // Validated exception thrown when downcastAndValidate observes a unknown field.
 TEST_F(ProtobufUtilityTest, DowncastAndValidateUnknownFields) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.GetReflection()->MutableUnknownFields(&bootstrap)->AddVarint(1, 0);
   EXPECT_THROW_WITH_MESSAGE(TestUtility::validate(bootstrap), EnvoyException,
-                            "Protobuf message (type envoy.config.bootstrap.v2.Bootstrap with "
+                            "Protobuf message (type envoy.config.bootstrap.v3alpha.Bootstrap with "
                             "unknown field set {1}) has unknown fields");
   EXPECT_THROW_WITH_MESSAGE(TestUtility::validate(bootstrap), EnvoyException,
-                            "Protobuf message (type envoy.config.bootstrap.v2.Bootstrap with "
+                            "Protobuf message (type envoy.config.bootstrap.v3alpha.Bootstrap with "
                             "unknown field set {1}) has unknown fields");
 }
 
 // Validated exception thrown when downcastAndValidate observes a nested unknown field.
 TEST_F(ProtobufUtilityTest, DowncastAndValidateUnknownFieldsNested) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   auto* cluster = bootstrap.mutable_static_resources()->add_clusters();
   cluster->GetReflection()->MutableUnknownFields(cluster)->AddVarint(1, 0);
   EXPECT_THROW_WITH_MESSAGE(TestUtility::validate(*cluster), EnvoyException,
-                            "Protobuf message (type envoy.api.v2.Cluster with "
+                            "Protobuf message (type envoy.config.cluster.v3alpha.Cluster with "
                             "unknown field set {1}) has unknown fields");
   EXPECT_THROW_WITH_MESSAGE(TestUtility::validate(bootstrap), EnvoyException,
-                            "Protobuf message (type envoy.api.v2.Cluster with "
+                            "Protobuf message (type envoy.config.cluster.v3alpha.Cluster with "
                             "unknown field set {1}) has unknown fields");
 }
 
 TEST_F(ProtobufUtilityTest, LoadBinaryProtoFromFile) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.mutable_cluster_manager()
       ->mutable_upstream_bind_config()
       ->mutable_source_address()
@@ -203,7 +204,7 @@ TEST_F(ProtobufUtilityTest, LoadBinaryProtoFromFile) {
   const std::string filename =
       TestEnvironment::writeStringToFileForTest("proto.pb", bootstrap.SerializeAsString());
 
-  envoy::config::bootstrap::v2::Bootstrap proto_from_file;
+  envoy::config::bootstrap::v3alpha::Bootstrap proto_from_file;
   TestUtility::loadFromFile(filename, proto_from_file, *api_);
   EXPECT_TRUE(TestUtility::protoEqual(bootstrap, proto_from_file));
 }
@@ -214,10 +215,10 @@ TEST_F(ProtobufUtilityTest, LoadBinaryProtoUnknownFieldFromFile) {
   source_duration.set_seconds(42);
   const std::string filename =
       TestEnvironment::writeStringToFileForTest("proto.pb", source_duration.SerializeAsString());
-  envoy::config::bootstrap::v2::Bootstrap proto_from_file;
+  envoy::config::bootstrap::v3alpha::Bootstrap proto_from_file;
   EXPECT_THROW_WITH_MESSAGE(TestUtility::loadFromFile(filename, proto_from_file, *api_),
                             EnvoyException,
-                            "Protobuf message (type envoy.config.bootstrap.v2.Bootstrap with "
+                            "Protobuf message (type envoy.config.bootstrap.v3alpha.Bootstrap with "
                             "unknown field set {1}) has unknown fields");
 }
 
@@ -228,15 +229,15 @@ TEST_F(ProtobufUtilityTest, LoadBinaryProtoUnknownMultipleFieldsFromFile) {
   source_duration.set_nanos(42);
   const std::string filename =
       TestEnvironment::writeStringToFileForTest("proto.pb", source_duration.SerializeAsString());
-  envoy::config::bootstrap::v2::Bootstrap proto_from_file;
+  envoy::config::bootstrap::v3alpha::Bootstrap proto_from_file;
   EXPECT_THROW_WITH_MESSAGE(TestUtility::loadFromFile(filename, proto_from_file, *api_),
                             EnvoyException,
-                            "Protobuf message (type envoy.config.bootstrap.v2.Bootstrap with "
+                            "Protobuf message (type envoy.config.bootstrap.v3alpha.Bootstrap with "
                             "unknown field set {1, 2}) has unknown fields");
 }
 
 TEST_F(ProtobufUtilityTest, LoadTextProtoFromFile) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.mutable_cluster_manager()
       ->mutable_upstream_bind_config()
       ->mutable_source_address()
@@ -247,7 +248,7 @@ TEST_F(ProtobufUtilityTest, LoadTextProtoFromFile) {
   const std::string filename =
       TestEnvironment::writeStringToFileForTest("proto.pb_text", bootstrap_text);
 
-  envoy::config::bootstrap::v2::Bootstrap proto_from_file;
+  envoy::config::bootstrap::v3alpha::Bootstrap proto_from_file;
   TestUtility::loadFromFile(filename, proto_from_file, *api_);
   EXPECT_TRUE(TestUtility::protoEqual(bootstrap, proto_from_file));
 }
@@ -256,11 +257,11 @@ TEST_F(ProtobufUtilityTest, LoadTextProtoFromFile_Failure) {
   const std::string filename =
       TestEnvironment::writeStringToFileForTest("proto.pb_text", "invalid {");
 
-  envoy::config::bootstrap::v2::Bootstrap proto_from_file;
-  EXPECT_THROW_WITH_MESSAGE(TestUtility::loadFromFile(filename, proto_from_file, *api_),
-                            EnvoyException,
-                            "Unable to parse file \"" + filename +
-                                "\" as a text protobuf (type envoy.config.bootstrap.v2.Bootstrap)");
+  envoy::config::bootstrap::v3alpha::Bootstrap proto_from_file;
+  EXPECT_THROW_WITH_MESSAGE(
+      TestUtility::loadFromFile(filename, proto_from_file, *api_), EnvoyException,
+      "Unable to parse file \"" + filename +
+          "\" as a text protobuf (type envoy.config.bootstrap.v3alpha.Bootstrap)");
 }
 
 TEST_F(ProtobufUtilityTest, KeyValueStruct) {
@@ -490,7 +491,7 @@ TEST_F(ProtobufUtilityTest, UnpackToNextVersion) {
 
 // MessageUtility::loadFromJson() throws on garbage JSON.
 TEST_F(ProtobufUtilityTest, LoadFromJsonGarbage) {
-  envoy::api::v2::Cluster dst;
+  envoy::config::cluster::v3alpha::Cluster dst;
   EXPECT_THROW_WITH_REGEX(MessageUtil::loadFromJson("{drain_connections_on_host_removal: true", dst,
                                                     ProtobufMessage::getNullValidationVisitor()),
                           EnvoyException, "Unable to parse JSON as proto.*after key:value pair.");
@@ -553,10 +554,10 @@ TEST_F(ProtobufUtilityTest, LoadFromJsonNextVersion) {
 }
 
 TEST_F(ProtobufUtilityTest, JsonConvertSuccess) {
-  envoy::config::bootstrap::v2::Bootstrap source;
+  envoy::config::bootstrap::v3alpha::Bootstrap source;
   source.set_flags_path("foo");
   ProtobufWkt::Struct tmp;
-  envoy::config::bootstrap::v2::Bootstrap dest;
+  envoy::config::bootstrap::v3alpha::Bootstrap dest;
   TestUtility::jsonConvert(source, tmp);
   TestUtility::jsonConvert(tmp, dest);
   EXPECT_EQ("foo", dest.flags_path());
@@ -564,7 +565,7 @@ TEST_F(ProtobufUtilityTest, JsonConvertSuccess) {
 
 TEST_F(ProtobufUtilityTest, JsonConvertUnknownFieldSuccess) {
   const ProtobufWkt::Struct obj = MessageUtil::keyValueStruct("test_key", "test_value");
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   EXPECT_NO_THROW(
       MessageUtil::jsonConvert(obj, ProtobufMessage::getNullValidationVisitor(), bootstrap));
 }
@@ -580,7 +581,7 @@ TEST_F(ProtobufUtilityTest, JsonConvertFail) {
 
 // Regression test for https://github.com/envoyproxy/envoy/issues/3665.
 TEST_F(ProtobufUtilityTest, JsonConvertCamelSnake) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   // Make sure we use a field eligible for snake/camel case translation.
   bootstrap.mutable_cluster_manager()->set_local_cluster_name("foo");
   ProtobufWkt::Struct json;
@@ -599,10 +600,10 @@ TEST_F(ProtobufUtilityTest, JsonConvertCamelSnake) {
 // Test the jsonConvertValue happy path. Failure modes are converted by jsonConvert tests.
 TEST_F(ProtobufUtilityTest, JsonConvertValueSuccess) {
   {
-    envoy::config::bootstrap::v2::Bootstrap source;
+    envoy::config::bootstrap::v3alpha::Bootstrap source;
     source.set_flags_path("foo");
     ProtobufWkt::Value tmp;
-    envoy::config::bootstrap::v2::Bootstrap dest;
+    envoy::config::bootstrap::v3alpha::Bootstrap dest;
     MessageUtil::jsonConvertValue(source, tmp);
     TestUtility::jsonConvert(tmp, dest);
     EXPECT_EQ("foo", dest.flags_path());
@@ -621,7 +622,7 @@ TEST_F(ProtobufUtilityTest, JsonConvertValueSuccess) {
 }
 
 TEST_F(ProtobufUtilityTest, YamlLoadFromStringFail) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   // Verify loadFromYaml can parse valid YAML string.
   TestUtility::loadFromYaml("node: { id: node1 }", bootstrap);
   // Verify loadFromYaml throws error when the input is an invalid YAML string.
@@ -640,19 +641,19 @@ TEST_F(ProtobufUtilityTest, YamlLoadFromStringFail) {
 }
 
 TEST_F(ProtobufUtilityTest, GetFlowYamlStringFromMessage) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.set_flags_path("foo");
   EXPECT_EQ("{flags_path: foo}", MessageUtil::getYamlStringFromMessage(bootstrap, false, false));
 }
 
 TEST_F(ProtobufUtilityTest, GetBlockYamlStringFromMessage) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.set_flags_path("foo");
   EXPECT_EQ("flags_path: foo", MessageUtil::getYamlStringFromMessage(bootstrap, true, false));
 }
 
 TEST_F(ProtobufUtilityTest, GetBlockYamlStringFromRecursiveMessage) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   bootstrap.set_flags_path("foo");
   bootstrap.mutable_node();
   bootstrap.mutable_static_resources()->add_listeners()->set_name("http");
@@ -695,7 +696,7 @@ class DeprecatedFieldsTest : public testing::Test {
   DeprecatedFieldsTest()
       : api_(Api::createApiForTest(store_)),
         runtime_deprecated_feature_use_(store_.counter("runtime.deprecated_feature_use")) {
-    envoy::config::bootstrap::v2::LayeredRuntime config;
+    envoy::config::bootstrap::v3alpha::LayeredRuntime config;
     config.add_layers()->mutable_admin_layer();
     loader_ = std::make_unique<Runtime::ScopedLoaderSingleton>(Runtime::LoaderPtr{
         new Runtime::LoaderImpl(dispatcher_, tls_, config, local_info_, init_manager_, store_,
diff --git a/test/common/router/BUILD b/test/common/router/BUILD
index 69243a849536..bfdaf67c8bda 100644
--- a/test/common/router/BUILD
+++ b/test/common/router/BUILD
@@ -33,9 +33,8 @@ envoy_cc_test_library(
         "//test/test_common:environment_lib",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,7 +43,7 @@ envoy_proto_library(
     srcs = ["header_parser_fuzz.proto"],
     deps = [
         "//test/fuzz:common_proto",
-        "@envoy_api//envoy/api/v2/core:pkg",
+        "@envoy_api//envoy/config/core/v3alpha:pkg",
     ],
 )
 
@@ -74,9 +73,10 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -90,8 +90,8 @@ envoy_cc_test(
         "//source/common/router:scoped_config_lib",
         "//test/mocks/router:router_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -116,10 +116,12 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -139,8 +141,8 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -155,7 +157,7 @@ envoy_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -164,7 +166,7 @@ envoy_proto_library(
     srcs = ["route_fuzz.proto"],
     deps = [
         "//test/fuzz:common_proto",
-        "@envoy_api//envoy/api/v2:pkg",
+        "@envoy_api//envoy/config/route/v3alpha:pkg",
     ],
 )
 
@@ -220,8 +222,7 @@ envoy_cc_fuzz_test(
         "//source/common/router:config_lib",
         "//test/fuzz:utility_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -238,8 +239,7 @@ envoy_cc_test(
         "//test/mocks/router:router_mocks",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -266,8 +266,8 @@ envoy_cc_test(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_runtime_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -294,9 +294,9 @@ envoy_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/router/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/router/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -326,9 +326,8 @@ envoy_cc_test(
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/router/config_impl_test.cc b/test/common/router/config_impl_test.cc
index a43806f7d84e..cb87c41e5c5c 100644
--- a/test/common/router/config_impl_test.cc
+++ b/test/common/router/config_impl_test.cc
@@ -5,11 +5,11 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route.pb.validate.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.validate.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/server/filter_config.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/config/metadata.h"
 #include "common/config/well_known_names.h"
@@ -50,7 +50,7 @@ namespace {
 //     --test_env="ROUTE_CORPUS_PATH=$PWD/test/common/router/route_corpus"
 class TestConfigImpl : public ConfigImpl {
 public:
-  TestConfigImpl(const envoy::api::v2::RouteConfiguration& config,
+  TestConfigImpl(const envoy::config::route::v3alpha::RouteConfiguration& config,
                  Server::Configuration::ServerFactoryContext& factory_context,
                  bool validate_clusters_default)
       : ConfigImpl(config, factory_context, ProtobufMessage::getNullValidationVisitor(),
@@ -83,7 +83,7 @@ class TestConfigImpl : public ConfigImpl {
     return route(headers, NiceMock<Envoy::StreamInfo::MockStreamInfo>(), random_value);
   }
 
-  const envoy::api::v2::RouteConfiguration config_;
+  const envoy::config::route::v3alpha::RouteConfiguration config_;
 };
 
 Http::TestHeaderMapImpl genHeaders(const std::string& host, const std::string& path,
@@ -94,8 +94,9 @@ Http::TestHeaderMapImpl genHeaders(const std::string& host, const std::string& p
                                  {"x-route-nope", "route"},   {"x-forwarded-proto", "http"}};
 }
 
-envoy::api::v2::RouteConfiguration parseRouteConfigurationFromV2Yaml(const std::string& yaml) {
-  envoy::api::v2::RouteConfiguration route_config;
+envoy::config::route::v3alpha::RouteConfiguration
+parseRouteConfigurationFromV2Yaml(const std::string& yaml) {
+  envoy::config::route::v3alpha::RouteConfiguration route_config;
   TestUtility::loadFromYaml(yaml, route_config);
   TestUtility::validate(route_config);
   return route_config;
@@ -1183,7 +1184,8 @@ TEST_F(RouteMatcherTest, TestRequestHeadersToAddWithAppendFalse) {
   const std::string yaml = requestHeadersConfig(false);
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
 
-  envoy::api::v2::RouteConfiguration route_config = parseRouteConfigurationFromV2Yaml(yaml);
+  envoy::config::route::v3alpha::RouteConfiguration route_config =
+      parseRouteConfigurationFromV2Yaml(yaml);
 
   TestConfigImpl config(route_config, factory_context_, true);
 
@@ -1421,7 +1423,8 @@ name: foo
 
     NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
 
-    envoy::api::v2::RouteConfiguration route_config = parseRouteConfigurationFromV2Yaml(yaml);
+    envoy::config::route::v3alpha::RouteConfiguration route_config =
+        parseRouteConfigurationFromV2Yaml(yaml);
 
     EXPECT_THROW_WITH_MESSAGE(TestConfigImpl config(route_config, factory_context_, true),
                               EnvoyException, ":-prefixed headers may not be modified");
@@ -1444,7 +1447,8 @@ name: foo
 
     NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
 
-    envoy::api::v2::RouteConfiguration route_config = parseRouteConfigurationFromV2Yaml(yaml);
+    envoy::config::route::v3alpha::RouteConfiguration route_config =
+        parseRouteConfigurationFromV2Yaml(yaml);
 
     EXPECT_THROW_WITH_MESSAGE(TestConfigImpl config(route_config, factory_context_, true),
                               EnvoyException, ":-prefixed or host headers may not be removed");
@@ -1909,7 +1913,7 @@ class RouterMatcherHashPolicyTest : public testing::Test, public ConfigImplTestB
     route_config_ = parseRouteConfigurationFromV2Yaml(yaml);
   }
 
-  envoy::api::v2::route::RouteAction_HashPolicy* firstRouteHashPolicy() {
+  envoy::config::route::v3alpha::RouteAction::HashPolicy* firstRouteHashPolicy() {
     auto hash_policies = route_config_.mutable_virtual_hosts(0)
                              ->mutable_routes(0)
                              ->mutable_route()
@@ -1928,7 +1932,7 @@ class RouterMatcherHashPolicyTest : public testing::Test, public ConfigImplTestB
     return *config_;
   }
 
-  envoy::api::v2::RouteConfiguration route_config_;
+  envoy::config::route::v3alpha::RouteConfiguration route_config_;
   Http::HashPolicy::AddCookieCallback add_cookie_nop_;
 
 private:
@@ -2340,7 +2344,8 @@ TEST_F(RouterMatcherHashPolicyTest, HashTerminal) {
 TEST_F(RouterMatcherHashPolicyTest, InvalidHashPolicies) {
   {
     auto hash_policy = firstRouteHashPolicy();
-    EXPECT_EQ(envoy::api::v2::route::RouteAction::HashPolicy::POLICY_SPECIFIER_NOT_SET,
+    EXPECT_EQ(envoy::config::route::v3alpha::RouteAction::HashPolicy::PolicySpecifierCase::
+                  POLICY_SPECIFIER_NOT_SET,
               hash_policy->policy_specifier_case());
     EXPECT_THROW(config(), EnvoyException);
   }
@@ -2349,7 +2354,8 @@ TEST_F(RouterMatcherHashPolicyTest, InvalidHashPolicies) {
     route->add_hash_policy()->mutable_header()->set_header_name("foo_header");
     route->add_hash_policy()->mutable_connection_properties()->set_source_ip(true);
     auto hash_policy = route->add_hash_policy();
-    EXPECT_EQ(envoy::api::v2::route::RouteAction::HashPolicy::POLICY_SPECIFIER_NOT_SET,
+    EXPECT_EQ(envoy::config::route::v3alpha::RouteAction::HashPolicy::PolicySpecifierCase::
+                  POLICY_SPECIFIER_NOT_SET,
               hash_policy->policy_specifier_case());
     EXPECT_THROW(config(), EnvoyException);
   }
@@ -2505,15 +2511,17 @@ TEST_F(RouteMatcherTest, FractionalRuntime) {
 
   TestConfigImpl config(parseRouteConfigurationFromV2Yaml(yaml), factory_context_, false);
 
-  EXPECT_CALL(snapshot,
-              featureEnabled("bogus_key", Matcher<const envoy::type::FractionalPercent&>(_), 41))
+  EXPECT_CALL(
+      snapshot,
+      featureEnabled("bogus_key", Matcher<const envoy::type::v3alpha::FractionalPercent&>(_), 41))
       .WillRepeatedly(Return(true));
   EXPECT_EQ(
       "something_else",
       config.route(genHeaders("www.lyft.com", "/foo", "GET"), 41)->routeEntry()->clusterName());
 
-  EXPECT_CALL(snapshot,
-              featureEnabled("bogus_key", Matcher<const envoy::type::FractionalPercent&>(_), 43))
+  EXPECT_CALL(
+      snapshot,
+      featureEnabled("bogus_key", Matcher<const envoy::type::v3alpha::FractionalPercent&>(_), 43))
       .WillRepeatedly(Return(false));
   EXPECT_EQ(
       "www2",
@@ -2816,7 +2824,7 @@ name: foo
                                   ->shadowPolicies()[0]
                                   ->defaultValue();
   EXPECT_EQ(20, default_value.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED, default_value.denominator());
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED, default_value.denominator());
 }
 
 TEST_F(RouteMatcherTest, Retry) {
@@ -3193,7 +3201,7 @@ name: HedgeRouteLevel
                        ->routeEntry()
                        ->hedgePolicy()
                        .hedgeOnPerTryTimeout());
-  envoy::type::FractionalPercent percent =
+  envoy::type::v3alpha::FractionalPercent percent =
       config.route(genHeaders("www.lyft.com", "/foo", "GET"), 0)
           ->routeEntry()
           ->hedgePolicy()
@@ -3262,7 +3270,7 @@ name: HedgeVirtualHostLevel
                       ->routeEntry()
                       ->hedgePolicy()
                       .hedgeOnPerTryTimeout());
-  envoy::type::FractionalPercent percent =
+  envoy::type::v3alpha::FractionalPercent percent =
       config.route(genHeaders("www.lyft.com", "/foo", "GET"), 0)
           ->routeEntry()
           ->hedgePolicy()
@@ -4793,11 +4801,11 @@ TEST_F(RoutePropertyTest, DEPRECATED_FEATURE_TEST(TestVHostCorsConfig)) {
 )EOF";
 
   Runtime::MockSnapshot snapshot;
-  EXPECT_CALL(snapshot,
-              featureEnabled("cors.www.enabled", Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(snapshot, featureEnabled("cors.www.enabled",
+                                       Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .WillOnce(Return(false));
   EXPECT_CALL(snapshot, featureEnabled("cors.www.shadow_enabled",
-                                       Matcher<const envoy::type::FractionalPercent&>(_)))
+                                       Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .WillOnce(Return(true));
   EXPECT_CALL(factory_context_.runtime_loader_, snapshot()).WillRepeatedly(ReturnRef(snapshot));
 
@@ -4850,11 +4858,11 @@ TEST_F(RoutePropertyTest, TestRouteCorsConfig) {
 )EOF";
 
   Runtime::MockSnapshot snapshot;
-  EXPECT_CALL(snapshot,
-              featureEnabled("cors.www.enabled", Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(snapshot, featureEnabled("cors.www.enabled",
+                                       Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .WillOnce(Return(false));
   EXPECT_CALL(snapshot, featureEnabled("cors.www.shadow_enabled",
-                                       Matcher<const envoy::type::FractionalPercent&>(_)))
+                                       Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .WillOnce(Return(true));
   EXPECT_CALL(factory_context_.runtime_loader_, snapshot()).WillRepeatedly(ReturnRef(snapshot));
 
@@ -5194,7 +5202,7 @@ TEST(MetadataMatchCriteriaImpl, Filter) {
 class RouteEntryMetadataMatchTest : public testing::Test, public ConfigImplTestBase {};
 
 TEST_F(RouteEntryMetadataMatchTest, ParsesMetadata) {
-  auto route_config = envoy::api::v2::RouteConfiguration();
+  auto route_config = envoy::config::route::v3alpha::RouteConfiguration();
   auto* vhost = route_config.add_virtual_hosts();
   vhost->set_name("vhost");
   vhost->add_domains("www.lyft.com");
@@ -5307,15 +5315,16 @@ class ConfigUtilityTest : public testing::Test, public ConfigImplTestBase {};
 
 TEST_F(ConfigUtilityTest, ParseResponseCode) {
   const std::vector<
-      std::pair<envoy::api::v2::route::RedirectAction::RedirectResponseCode, Http::Code>>
+      std::pair<envoy::config::route::v3alpha::RedirectAction::RedirectResponseCode, Http::Code>>
       test_set = {
-          std::make_pair(envoy::api::v2::route::RedirectAction::MOVED_PERMANENTLY,
+          std::make_pair(envoy::config::route::v3alpha::RedirectAction::MOVED_PERMANENTLY,
                          Http::Code::MovedPermanently),
-          std::make_pair(envoy::api::v2::route::RedirectAction::FOUND, Http::Code::Found),
-          std::make_pair(envoy::api::v2::route::RedirectAction::SEE_OTHER, Http::Code::SeeOther),
-          std::make_pair(envoy::api::v2::route::RedirectAction::TEMPORARY_REDIRECT,
+          std::make_pair(envoy::config::route::v3alpha::RedirectAction::FOUND, Http::Code::Found),
+          std::make_pair(envoy::config::route::v3alpha::RedirectAction::SEE_OTHER,
+                         Http::Code::SeeOther),
+          std::make_pair(envoy::config::route::v3alpha::RedirectAction::TEMPORARY_REDIRECT,
                          Http::Code::TemporaryRedirect),
-          std::make_pair(envoy::api::v2::route::RedirectAction::PERMANENT_REDIRECT,
+          std::make_pair(envoy::config::route::v3alpha::RedirectAction::PERMANENT_REDIRECT,
                          Http::Code::PermanentRedirect)};
   for (const auto& test_case : test_set) {
     EXPECT_EQ(test_case.second, ConfigUtility::parseRedirectResponseCode(test_case.first));
@@ -5323,7 +5332,7 @@ TEST_F(ConfigUtilityTest, ParseResponseCode) {
 }
 
 TEST_F(ConfigUtilityTest, ParseDirectResponseBody) {
-  envoy::api::v2::route::Route route;
+  envoy::config::route::v3alpha::Route route;
   EXPECT_EQ(EMPTY_STRING, ConfigUtility::parseDirectResponseBody(route, *api_));
 
   route.mutable_direct_response()->mutable_body()->set_filename("missing_file");
diff --git a/test/common/router/header_formatter_test.cc b/test/common/router/header_formatter_test.cc
index 3e9fc126033f..5d91047ae574 100644
--- a/test/common/router/header_formatter_test.cc
+++ b/test/common/router/header_formatter_test.cc
@@ -1,9 +1,9 @@
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route.pb.validate.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.validate.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/protocol.h"
 
 #include "common/config/metadata.h"
@@ -32,8 +32,8 @@ namespace Envoy {
 namespace Router {
 namespace {
 
-static envoy::api::v2::route::Route parseRouteFromV2Yaml(const std::string& yaml) {
-  envoy::api::v2::route::Route route;
+static envoy::config::route::v3alpha::Route parseRouteFromV2Yaml(const std::string& yaml) {
+  envoy::config::route::v3alpha::Route route;
   TestUtility::loadFromYaml(yaml, route);
   return route;
 }
@@ -434,8 +434,8 @@ TEST_F(StreamInfoHeaderFormatterTest, TestFormatWithUpstreamMetadataVariable) {
   std::shared_ptr<NiceMock<Envoy::Upstream::MockHostDescription>> host(
       new NiceMock<Envoy::Upstream::MockHostDescription>());
 
-  auto metadata = std::make_shared<envoy::api::v2::core::Metadata>(
-      TestUtility::parseYaml<envoy::api::v2::core::Metadata>(
+  auto metadata = std::make_shared<envoy::config::core::v3alpha::Metadata>(
+      TestUtility::parseYaml<envoy::config::core::v3alpha::Metadata>(
           R"EOF(
         filter_metadata:
           namespace:
@@ -513,8 +513,9 @@ TEST_F(StreamInfoHeaderFormatterTest, TestFormatWithUpstreamMetadataVariable) {
 // size checks on user defined headers.
 TEST_F(StreamInfoHeaderFormatterTest, ValidateLimitsOnUserDefinedHeaders) {
   {
-    envoy::api::v2::RouteConfiguration route;
-    envoy::api::v2::core::HeaderValueOption* header = route.mutable_request_headers_to_add()->Add();
+    envoy::config::route::v3alpha::RouteConfiguration route;
+    envoy::config::core::v3alpha::HeaderValueOption* header =
+        route.mutable_request_headers_to_add()->Add();
     std::string long_string(16385, 'a');
     header->mutable_header()->set_key("header_name");
     header->mutable_header()->set_value(long_string);
@@ -523,9 +524,9 @@ TEST_F(StreamInfoHeaderFormatterTest, ValidateLimitsOnUserDefinedHeaders) {
                             "Proto constraint validation failed.*");
   }
   {
-    envoy::api::v2::RouteConfiguration route;
+    envoy::config::route::v3alpha::RouteConfiguration route;
     for (int i = 0; i < 1001; ++i) {
-      envoy::api::v2::core::HeaderValueOption* header =
+      envoy::config::core::v3alpha::HeaderValueOption* header =
           route.mutable_request_headers_to_add()->Add();
       header->mutable_header()->set_key("header_name");
       header->mutable_header()->set_value("value");
@@ -802,8 +803,8 @@ TEST(HeaderParserTest, TestParseInternal) {
   ON_CALL(stream_info, getRequestHeaders()).WillByDefault(Return(&request_headers));
 
   // Upstream metadata with percent signs in the key.
-  auto metadata = std::make_shared<envoy::api::v2::core::Metadata>(
-      TestUtility::parseYaml<envoy::api::v2::core::Metadata>(
+  auto metadata = std::make_shared<envoy::config::core::v3alpha::Metadata>(
+      TestUtility::parseYaml<envoy::config::core::v3alpha::Metadata>(
           R"EOF(
         filter_metadata:
           ns:
@@ -826,8 +827,8 @@ TEST(HeaderParserTest, TestParseInternal) {
   ON_CALL(Const(stream_info), filterState()).WillByDefault(ReturnRef(filter_state));
 
   for (const auto& test_case : test_cases) {
-    Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption> to_add;
-    envoy::api::v2::core::HeaderValueOption* header = to_add.Add();
+    Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption> to_add;
+    envoy::config::core::v3alpha::HeaderValueOption* header = to_add.Add();
     header->mutable_header()->set_key("x-header");
     header->mutable_header()->set_value(test_case.input_);
 
@@ -900,7 +901,7 @@ match: { prefix: "/new_endpoint" }
   std::shared_ptr<NiceMock<Envoy::Upstream::MockHostDescription>> host(
       new NiceMock<Envoy::Upstream::MockHostDescription>());
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
-  auto metadata = std::make_shared<envoy::api::v2::core::Metadata>();
+  auto metadata = std::make_shared<envoy::config::core::v3alpha::Metadata>();
   ON_CALL(stream_info, upstreamHost()).WillByDefault(Return(host));
   ON_CALL(*host, metadata()).WillByDefault(Return(metadata));
   req_header_parser->evaluateHeaders(header_map, stream_info);
@@ -978,8 +979,8 @@ request_headers_to_remove: ["x-nope"]
   ON_CALL(stream_info, upstreamHost()).WillByDefault(Return(host));
 
   // Metadata with percent signs in the key.
-  auto metadata = std::make_shared<envoy::api::v2::core::Metadata>(
-      TestUtility::parseYaml<envoy::api::v2::core::Metadata>(
+  auto metadata = std::make_shared<envoy::config::core::v3alpha::Metadata>(
+      TestUtility::parseYaml<envoy::config::core::v3alpha::Metadata>(
           R"EOF(
         filter_metadata:
           namespace:
@@ -1058,7 +1059,7 @@ match: { prefix: "/new_endpoint" }
 )EOF";
 
   // Disable append mode.
-  envoy::api::v2::route::Route route = parseRouteFromV2Yaml(ymal);
+  envoy::config::route::v3alpha::Route route = parseRouteFromV2Yaml(ymal);
   route.mutable_request_headers_to_add(0)->mutable_append()->set_value(false);
   route.mutable_request_headers_to_add(1)->mutable_append()->set_value(false);
   route.mutable_request_headers_to_add(2)->mutable_append()->set_value(false);
diff --git a/test/common/router/header_parser_fuzz.proto b/test/common/router/header_parser_fuzz.proto
index 49bd632370ef..4d08efde33f8 100644
--- a/test/common/router/header_parser_fuzz.proto
+++ b/test/common/router/header_parser_fuzz.proto
@@ -2,13 +2,13 @@ syntax = "proto3";
 
 package test.common.router;
 
-import "envoy/api/v2/core/base.proto";
+import "envoy/config/core/v3alpha/base.proto";
 import "test/fuzz/common.proto";
 
 // Structured input for header_parser_fuzz_test.
 
 message TestCase {
-  repeated envoy.api.v2.core.HeaderValueOption headers_to_add = 1;
+  repeated envoy.config.core.v3alpha.HeaderValueOption headers_to_add = 1;
   repeated string headers_to_remove = 2;
   test.fuzz.StreamInfo stream_info = 3;
 }
diff --git a/test/common/router/rds_impl_test.cc b/test/common/router/rds_impl_test.cc
index 45c8c22a0439..5f2ccc005840 100644
--- a/test/common/router/rds_impl_test.cc
+++ b/test/common/router/rds_impl_test.cc
@@ -2,11 +2,11 @@
 #include <memory>
 #include <string>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/admin/v2alpha/config_dump.pb.validate.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.validate.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/utility.h"
@@ -38,9 +38,9 @@ namespace Envoy {
 namespace Router {
 namespace {
 
-envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager
+envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
 parseHttpConnectionManagerFromYaml(const std::string& yaml_string) {
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
       http_connection_manager;
   TestUtility::loadFromYaml(yaml_string, http_connection_manager);
   return http_connection_manager;
@@ -171,7 +171,8 @@ TEST_F(RdsImplTest, Basic) {
   ]
 }
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   EXPECT_CALL(init_watcher_, ready());
   rds_callbacks_->onConfigUpdate(response1.resources(), response1.version_info());
@@ -215,7 +216,8 @@ TEST_F(RdsImplTest, Basic) {
   ]
 }
   )EOF";
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_json);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_json);
 
   // Make sure we don't lookup/verify clusters.
   EXPECT_CALL(mock_factory_context_.cluster_manager_, get(Eq("bar"))).Times(0);
@@ -247,7 +249,8 @@ TEST_F(RdsImplTest, FailureInvalidConfig) {
   ]
 }
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   EXPECT_CALL(init_watcher_, ready());
   EXPECT_THROW_WITH_MESSAGE(
@@ -295,9 +298,8 @@ TEST_F(RdsRouteConfigSubscriptionTest, CreatesNoopInitManager) {
           cluster_name: xds_cluster
 )EOF";
   EXPECT_CALL(outer_init_manager_, state()).WillOnce(Return(Init::Manager::State::Initialized));
-  const auto rds =
-      TestUtility::parseYaml<envoy::config::filter::network::http_connection_manager::v2::Rds>(
-          rds_config);
+  const auto rds = TestUtility::parseYaml<
+      envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds>(rds_config);
   const auto route_config_provider = route_config_provider_manager_->createRdsRouteConfigProvider(
       rds, mock_factory_context_, "stat_prefix", outer_init_manager_);
   RdsRouteConfigSubscription& subscription =
@@ -332,13 +334,14 @@ class RouteConfigProviderManagerImplTest : public RdsTestBase {
     server_factory_context_.thread_local_.shutdownThread();
   }
 
-  envoy::config::filter::network::http_connection_manager::v2::Rds rds_;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds rds_;
   std::unique_ptr<RouteConfigProviderManagerImpl> route_config_provider_manager_;
   RouteConfigProviderSharedPtr provider_;
 };
 
-envoy::api::v2::RouteConfiguration parseRouteConfigurationFromV2Yaml(const std::string& yaml) {
-  envoy::api::v2::RouteConfiguration route_config;
+envoy::config::route::v3alpha::RouteConfiguration
+parseRouteConfigurationFromV2Yaml(const std::string& yaml) {
+  envoy::config::route::v3alpha::RouteConfiguration route_config;
   TestUtility::loadFromYaml(yaml, route_config);
   return route_config;
 }
@@ -347,11 +350,11 @@ TEST_F(RouteConfigProviderManagerImplTest, ConfigDump) {
   auto message_ptr =
       server_factory_context_.admin_.config_tracker_.config_tracker_callbacks_["routes"]();
   const auto& route_config_dump =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::RoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::RoutesConfigDump&>(
           *message_ptr);
 
   // No routes at all, no last_updated timestamp
-  envoy::admin::v2alpha::RoutesConfigDump expected_route_config_dump;
+  envoy::admin::v3alpha::RoutesConfigDump expected_route_config_dump;
   TestUtility::loadFromYaml(R"EOF(
 static_route_configs:
 dynamic_route_configs:
@@ -378,7 +381,7 @@ name: foo
   message_ptr =
       server_factory_context_.admin_.config_tracker_.config_tracker_callbacks_["routes"]();
   const auto& route_config_dump2 =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::RoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::RoutesConfigDump&>(
           *message_ptr);
   TestUtility::loadFromYaml(R"EOF(
 static_route_configs:
@@ -416,14 +419,15 @@ name: foo
   ]
 }
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   EXPECT_CALL(init_watcher_, ready());
   rds_callbacks_->onConfigUpdate(response1.resources(), response1.version_info());
   message_ptr =
       server_factory_context_.admin_.config_tracker_.config_tracker_callbacks_["routes"]();
   const auto& route_config_dump3 =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::RoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::RoutesConfigDump&>(
           *message_ptr);
   TestUtility::loadFromYaml(R"EOF(
 static_route_configs:
@@ -487,7 +491,7 @@ name: foo_route_config
             &dynamic_cast<RdsRouteConfigProviderImpl&>(*provider2).subscription());
   EXPECT_EQ(&provider_->configInfo().value().config_, &provider2->configInfo().value().config_);
 
-  envoy::config::filter::network::http_connection_manager::v2::Rds rds2;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds rds2;
   rds2.set_route_config_name("foo_route_config");
   rds2.mutable_config_source()->set_path("bar_path");
   RouteConfigProviderSharedPtr provider3 =
@@ -564,7 +568,7 @@ name: foo_route_config
 TEST_F(RouteConfigProviderManagerImplTest, ValidateFail) {
   setup();
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> route_configs;
-  envoy::api::v2::RouteConfiguration route_config;
+  envoy::config::route::v3alpha::RouteConfiguration route_config;
   route_config.set_name("foo_route_config");
   route_config.mutable_virtual_hosts()->Add();
   route_configs.Add()->PackFrom(route_config);
@@ -603,11 +607,11 @@ TEST_F(RouteConfigProviderManagerImplTest, ConfigDumpAfterConfigRejected) {
   auto message_ptr =
       server_factory_context_.admin_.config_tracker_.config_tracker_callbacks_["routes"]();
   const auto& route_config_dump =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::RoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::RoutesConfigDump&>(
           *message_ptr);
 
   // No routes at all, no last_updated timestamp
-  envoy::admin::v2alpha::RoutesConfigDump expected_route_config_dump;
+  envoy::admin::v3alpha::RoutesConfigDump expected_route_config_dump;
   TestUtility::loadFromYaml(R"EOF(
 static_route_configs:
 dynamic_route_configs:
@@ -646,7 +650,8 @@ version_info: '1'
       route:
         cluster_header: ":authority"
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_yaml);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_yaml);
 
   EXPECT_CALL(init_watcher_, ready());
 
@@ -657,7 +662,7 @@ version_info: '1'
   message_ptr =
       server_factory_context_.admin_.config_tracker_.config_tracker_callbacks_["routes"]();
   const auto& route_config_dump3 =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::RoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::RoutesConfigDump&>(
           *message_ptr);
   TestUtility::loadFromYaml(R"EOF(
 static_route_configs:
diff --git a/test/common/router/retry_state_impl_test.cc b/test/common/router/retry_state_impl_test.cc
index 095553fe27af..03717b147359 100644
--- a/test/common/router/retry_state_impl_test.cc
+++ b/test/common/router/retry_state_impl_test.cc
@@ -1,6 +1,6 @@
 #include <chrono>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/stats/stats.h"
 
 #include "common/http/header_map_impl.h"
@@ -418,7 +418,7 @@ TEST_F(RouterRetryStateImplTest, RetriableStatusCodesHeader) {
 TEST_F(RouterRetryStateImplTest, RetriableHeadersPolicySetViaRequestHeader) {
   policy_.retry_on_ = RetryPolicy::RETRY_ON_5XX;
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::route::HeaderMatcher> matchers;
+  Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::HeaderMatcher> matchers;
   auto* matcher = matchers.Add();
   matcher->set_name("X-Upstream-Pushback");
 
@@ -451,7 +451,7 @@ TEST_F(RouterRetryStateImplTest, RetriableHeadersPolicySetViaRequestHeader) {
 TEST_F(RouterRetryStateImplTest, RetriableHeadersPolicyViaRetryPolicyConfiguration) {
   policy_.retry_on_ = RetryPolicy::RETRY_ON_RETRIABLE_HEADERS;
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::route::HeaderMatcher> matchers;
+  Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::HeaderMatcher> matchers;
 
   auto* matcher1 = matchers.Add();
   matcher1->set_name("X-Upstream-Pushback");
@@ -596,7 +596,7 @@ TEST_F(RouterRetryStateImplTest, RetriableHeadersSetViaRequestHeader) {
 TEST_F(RouterRetryStateImplTest, RetriableHeadersMergedConfigAndRequestHeaders) {
   policy_.retry_on_ = RetryPolicy::RETRY_ON_RETRIABLE_HEADERS;
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::route::HeaderMatcher> matchers;
+  Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::HeaderMatcher> matchers;
 
   // Config says: retry if response is not 200.
   auto* matcher = matchers.Add();
@@ -644,7 +644,7 @@ TEST_F(RouterRetryStateImplTest, PolicyResetRemoteReset) {
 }
 
 TEST_F(RouterRetryStateImplTest, PolicyLimitedByRequestHeaders) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::route::HeaderMatcher> matchers;
+  Protobuf::RepeatedPtrField<envoy::config::route::v3alpha::HeaderMatcher> matchers;
   auto* matcher = matchers.Add();
   matcher->set_name(":method");
   matcher->set_exact_match("GET");
diff --git a/test/common/router/route_fuzz.proto b/test/common/router/route_fuzz.proto
index c9d362c5d0a0..a73ac07a1964 100644
--- a/test/common/router/route_fuzz.proto
+++ b/test/common/router/route_fuzz.proto
@@ -2,13 +2,13 @@ syntax = "proto3";
 
 package test.common.router;
 
-import "envoy/api/v2/rds.proto";
+import "envoy/config/route/v3alpha/route.proto";
 import "test/fuzz/common.proto";
 
 // Structured input for route_fuzz_test.
 
 message RouteTestCase {
-  envoy.api.v2.RouteConfiguration config = 1;
+  envoy.config.route.v3alpha.RouteConfiguration config = 1;
   test.fuzz.Headers headers = 2;
   uint32 random_value = 3;
 }
diff --git a/test/common/router/route_fuzz_test.cc b/test/common/router/route_fuzz_test.cc
index 8549c5671b45..ae86302cfc7d 100644
--- a/test/common/router/route_fuzz_test.cc
+++ b/test/common/router/route_fuzz_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route.pb.validate.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.validate.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/router/config_impl.h"
 
@@ -31,24 +31,25 @@ template <class T> T replaceInvalidHeaders(const T& config) {
 }
 
 // Removes invalid headers from the RouteConfiguration as well as in each of the virtual hosts.
-envoy::api::v2::RouteConfiguration
-cleanRouteConfig(envoy::api::v2::RouteConfiguration route_config) {
+envoy::config::route::v3alpha::RouteConfiguration
+cleanRouteConfig(envoy::config::route::v3alpha::RouteConfiguration route_config) {
   // A route config contains a list of HTTP headers that should be added and/or removed to each
   // request and/or response the connection manager routes. This removes invalid characters the
   // headers.
-  envoy::api::v2::RouteConfiguration clean_config =
-      replaceInvalidHeaders<envoy::api::v2::RouteConfiguration>(route_config);
+  envoy::config::route::v3alpha::RouteConfiguration clean_config =
+      replaceInvalidHeaders<envoy::config::route::v3alpha::RouteConfiguration>(route_config);
   auto internal_only_headers = clean_config.mutable_internal_only_headers();
   std::for_each(internal_only_headers->begin(), internal_only_headers->end(),
                 [](std::string& n) { n = Fuzz::replaceInvalidCharacters(n); });
   auto virtual_hosts = clean_config.mutable_virtual_hosts();
   std::for_each(
       virtual_hosts->begin(), virtual_hosts->end(),
-      [](envoy::api::v2::route::VirtualHost& virtual_host) {
+      [](envoy::config::route::v3alpha::VirtualHost& virtual_host) {
         // Each virtual host in the routing configuration contains a list of headers to add and/or
         // remove from each request and response that get routed through it. This replaces invalid
         // header characters in these fields.
-        virtual_host = replaceInvalidHeaders<envoy::api::v2::route::VirtualHost>(virtual_host);
+        virtual_host =
+            replaceInvalidHeaders<envoy::config::route::v3alpha::VirtualHost>(virtual_host);
         // Envoy can determine the cluster to route to by reading the HTTP header named by the
         // cluster_header from the request header. Because these cluster_headers are destined to be
         // added to a Header Map, we iterate through each route in and remove invalid characters
@@ -59,7 +60,8 @@ cleanRouteConfig(envoy::api::v2::RouteConfiguration route_config) {
           // wildcards are matched against very long headers.
           // See https://github.com/envoyproxy/envoy/issues/7728.
           if (routes->Get(i).match().path_specifier_case() ==
-              envoy::api::v2::route::RouteMatch::kRegex) {
+              envoy::config::route::v3alpha::RouteMatch::PathSpecifierCase::
+                  kHiddenEnvoyDeprecatedRegex) {
             routes->erase(routes->begin() + i);
           } else {
             if (routes->Get(i).has_route()) {
diff --git a/test/common/router/router_ratelimit_test.cc b/test/common/router/router_ratelimit_test.cc
index d5b195238715..7b9b8bf83465 100644
--- a/test/common/router/router_ratelimit_test.cc
+++ b/test/common/router/router_ratelimit_test.cc
@@ -2,9 +2,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/api/v2/route/route_components.pb.validate.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.validate.h"
 
 #include "common/http/header_map_impl.h"
 #include "common/network/address_impl.h"
@@ -28,8 +28,8 @@ namespace Envoy {
 namespace Router {
 namespace {
 
-envoy::api::v2::route::RateLimit parseRateLimitFromV2Yaml(const std::string& yaml_string) {
-  envoy::api::v2::route::RateLimit rate_limit;
+envoy::config::route::v3alpha::RateLimit parseRateLimitFromV2Yaml(const std::string& yaml_string) {
+  envoy::config::route::v3alpha::RateLimit rate_limit;
   TestUtility::loadFromYaml(yaml_string, rate_limit);
   TestUtility::validate(rate_limit);
   return rate_limit;
@@ -77,7 +77,7 @@ static Http::TestHeaderMapImpl genHeaders(const std::string& host, const std::st
 class RateLimitConfiguration : public testing::Test {
 public:
   void setupTest(const std::string& yaml) {
-    envoy::api::v2::RouteConfiguration route_config;
+    envoy::config::route::v3alpha::RouteConfiguration route_config;
     TestUtility::loadFromYaml(yaml, route_config);
     config_ =
         std::make_unique<ConfigImpl>(route_config, factory_context_, any_validation_visitor_, true);
diff --git a/test/common/router/router_test.cc b/test/common/router/router_test.cc
index 1cef1e260e3e..2b3f60fe06b6 100644
--- a/test/common/router/router_test.cc
+++ b/test/common/router/router_test.cc
@@ -2,8 +2,8 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/empty_string.h"
@@ -225,10 +225,10 @@ class RouterTestBase : public testing::Test {
   void enableHedgeOnPerTryTimeout() {
     callbacks_.route_->route_entry_.hedge_policy_.hedge_on_per_try_timeout_ = true;
     callbacks_.route_->route_entry_.hedge_policy_.additional_request_chance_ =
-        envoy::type::FractionalPercent{};
+        envoy::type::v3alpha::FractionalPercent{};
     callbacks_.route_->route_entry_.hedge_policy_.additional_request_chance_.set_numerator(0);
     callbacks_.route_->route_entry_.hedge_policy_.additional_request_chance_.set_denominator(
-        envoy::type::FractionalPercent::HUNDRED);
+        envoy::type::v3alpha::FractionalPercent::HUNDRED);
   }
 
   void testAppendCluster(absl::optional<Http::LowerCaseString> cluster_header_name);
@@ -238,7 +238,7 @@ class RouterTestBase : public testing::Test {
 
   Event::SimulatedTimeSystem test_time_;
   std::string upstream_zone_{"to_az"};
-  envoy::api::v2::core::Locality upstream_locality_;
+  envoy::config::core::v3alpha::Locality upstream_locality_;
   NiceMock<Stats::MockIsolatedStatsStore> stats_store_;
   NiceMock<Upstream::MockClusterManager> cm_;
   NiceMock<Runtime::MockLoader> runtime_;
@@ -4162,13 +4162,14 @@ TEST(RouterFilterUtilityTest, ShouldShadow) {
   }
   // Use default value instead of runtime key.
   {
-    envoy::type::FractionalPercent fractional_percent;
+    envoy::type::v3alpha::FractionalPercent fractional_percent;
     fractional_percent.set_numerator(5);
-    fractional_percent.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+    fractional_percent.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
     TestShadowPolicy policy("cluster", "foo", fractional_percent);
     NiceMock<Runtime::MockLoader> runtime;
-    EXPECT_CALL(runtime.snapshot_,
-                featureEnabled("foo", Matcher<const envoy::type::FractionalPercent&>(_), 3))
+    EXPECT_CALL(
+        runtime.snapshot_,
+        featureEnabled("foo", Matcher<const envoy::type::v3alpha::FractionalPercent&>(_), 3))
         .WillOnce(Return(true));
     EXPECT_TRUE(FilterUtility::shouldShadow(policy, runtime, 3));
   }
diff --git a/test/common/router/router_upstream_log_test.cc b/test/common/router/router_upstream_log_test.cc
index 09ad8471df97..b794412a5b26 100644
--- a/test/common/router/router_upstream_log_test.cc
+++ b/test/common/router/router_upstream_log_test.cc
@@ -1,9 +1,9 @@
 #include <ctime>
 #include <regex>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
-#include "envoy/config/filter/http/router/v2/router.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
 
 #include "common/network/utility.h"
 #include "common/router/router.h"
@@ -35,7 +35,7 @@ namespace Envoy {
 namespace Router {
 namespace {
 
-absl::optional<envoy::config::filter::accesslog::v2::AccessLog> testUpstreamLog() {
+absl::optional<envoy::config::filter::accesslog::v3alpha::AccessLog> testUpstreamLog() {
   // Custom format without timestamps or durations.
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
@@ -47,10 +47,10 @@ name: envoy.file_access_log
   path: "/dev/null"
   )EOF";
 
-  envoy::config::filter::accesslog::v2::AccessLog upstream_log;
+  envoy::config::filter::accesslog::v3alpha::AccessLog upstream_log;
   TestUtility::loadFromYaml(yaml, upstream_log);
 
-  return absl::optional<envoy::config::filter::accesslog::v2::AccessLog>(upstream_log);
+  return absl::optional<envoy::config::filter::accesslog::v3alpha::AccessLog>(upstream_log);
 }
 
 } // namespace
@@ -78,15 +78,15 @@ class TestFilter : public Filter {
 
 class RouterUpstreamLogTest : public testing::Test {
 public:
-  void init(absl::optional<envoy::config::filter::accesslog::v2::AccessLog> upstream_log) {
-    envoy::config::filter::http::router::v2::Router router_proto;
+  void init(absl::optional<envoy::config::filter::accesslog::v3alpha::AccessLog> upstream_log) {
+    envoy::extensions::filters::http::router::v3alpha::Router router_proto;
 
     if (upstream_log) {
       ON_CALL(*context_.access_log_manager_.file_, write(_))
           .WillByDefault(
               Invoke([&](absl::string_view data) { output_.push_back(std::string(data)); }));
 
-      envoy::config::filter::accesslog::v2::AccessLog* current_upstream_log =
+      envoy::config::filter::accesslog::v3alpha::AccessLog* current_upstream_log =
           router_proto.add_upstream_log();
       current_upstream_log->CopyFrom(upstream_log.value());
     }
@@ -219,7 +219,7 @@ class RouterUpstreamLogTest : public testing::Test {
 
   NiceMock<Server::Configuration::MockFactoryContext> context_;
 
-  envoy::api::v2::core::Locality upstream_locality_;
+  envoy::config::core::v3alpha::Locality upstream_locality_;
   Network::Address::InstanceConstSharedPtr host_address_{
       Network::Utility::resolveUrl("tcp://10.0.0.5:9211")};
   Network::Address::InstanceConstSharedPtr upstream_local_address1_{
@@ -288,10 +288,10 @@ name: envoy.file_access_log
   path: "/dev/null"
   )EOF";
 
-  envoy::config::filter::accesslog::v2::AccessLog upstream_log;
+  envoy::config::filter::accesslog::v3alpha::AccessLog upstream_log;
   TestUtility::loadFromYaml(yaml, upstream_log);
 
-  init(absl::optional<envoy::config::filter::accesslog::v2::AccessLog>(upstream_log));
+  init(absl::optional<envoy::config::filter::accesslog::v3alpha::AccessLog>(upstream_log));
   run(200, {{"x-envoy-original-path", "/foo"}}, {}, {});
 
   EXPECT_EQ(output_.size(), 1U);
diff --git a/test/common/router/scoped_config_impl_test.cc b/test/common/router/scoped_config_impl_test.cc
index 2d9d5922a1f0..76760d116933 100644
--- a/test/common/router/scoped_config_impl_test.cc
+++ b/test/common/router/scoped_config_impl_test.cc
@@ -1,8 +1,8 @@
 #include <memory>
 
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/srds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/router/scoped_config_impl.h"
 
@@ -365,14 +365,14 @@ class ScopedRouteInfoTest : public testing::Test {
     route_config_->name_ = "foo_route";
   }
 
-  envoy::api::v2::RouteConfiguration route_configuration_;
-  envoy::api::v2::ScopedRouteConfiguration scoped_route_config_;
+  envoy::config::route::v3alpha::RouteConfiguration route_configuration_;
+  envoy::config::route::v3alpha::ScopedRouteConfiguration scoped_route_config_;
   std::shared_ptr<MockConfig> route_config_;
   std::unique_ptr<ScopedRouteInfo> info_;
 };
 
 TEST_F(ScopedRouteInfoTest, Creation) {
-  envoy::api::v2::ScopedRouteConfiguration config_copy = scoped_route_config_;
+  envoy::config::route::v3alpha::ScopedRouteConfiguration config_copy = scoped_route_config_;
   info_ = std::make_unique<ScopedRouteInfo>(std::move(scoped_route_config_), route_config_);
   EXPECT_EQ(info_->routeConfig().get(), route_config_.get());
   EXPECT_TRUE(TestUtility::protoEqual(info_->configProto(), config_copy));
@@ -424,7 +424,7 @@ class ScopedConfigImplTest : public testing::Test {
 )EOF");
   }
   std::shared_ptr<ScopedRouteInfo> makeScopedRouteInfo(const std::string& route_config_yaml) {
-    envoy::api::v2::ScopedRouteConfiguration scoped_route_config;
+    envoy::config::route::v3alpha::ScopedRouteConfiguration scoped_route_config;
     TestUtility::loadFromYaml(route_config_yaml, scoped_route_config);
 
     std::shared_ptr<MockConfig> route_config = std::make_shared<NiceMock<MockConfig>>();
diff --git a/test/common/router/scoped_rds_test.cc b/test/common/router/scoped_rds_test.cc
index 7d50efa32eee..5e77f0a4e970 100644
--- a/test/common/router/scoped_rds_test.cc
+++ b/test/common/router/scoped_rds_test.cc
@@ -1,14 +1,15 @@
 #include <string>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/admin/v2alpha/config_dump.pb.validate.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/srds.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.validate.h"
+#include "envoy/api/v2/route.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.h"
 #include "envoy/config/subscription.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/init/manager.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/api_version.h"
@@ -40,9 +41,9 @@ namespace {
 
 using ::Envoy::Http::TestHeaderMapImpl;
 
-envoy::api::v2::ScopedRouteConfiguration
+envoy::config::route::v3alpha::ScopedRouteConfiguration
 parseScopedRouteConfigurationFromYaml(const std::string& yaml) {
-  envoy::api::v2::ScopedRouteConfiguration scoped_route_config;
+  envoy::config::route::v3alpha::ScopedRouteConfiguration scoped_route_config;
   TestUtility::loadFromYaml(yaml, scoped_route_config);
   return scoped_route_config;
 }
@@ -52,9 +53,9 @@ void parseScopedRouteConfigurationFromYaml(ProtobufWkt::Any& scoped_route_config
   scoped_route_config.PackFrom(parseScopedRouteConfigurationFromYaml(yaml));
 }
 
-envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager
+envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
 parseHttpConnectionManagerFromYaml(const std::string& config_yaml) {
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
       http_connection_manager;
   TestUtility::loadFromYaml(config_yaml, http_connection_manager);
   return http_connection_manager;
@@ -79,12 +80,14 @@ class ScopedRoutesTestBase : public testing::Test {
   ~ScopedRoutesTestBase() override { factory_context_.thread_local_.shutdownThread(); }
 
   // The delta style API helper.
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource>
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>
   anyToResource(Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                 const std::string& version) {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> added_resources;
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> added_resources;
     for (const auto& resource_any : resources) {
-      auto config = TestUtility::anyConvert<envoy::api::v2::ScopedRouteConfiguration>(resource_any);
+      auto config =
+          TestUtility::anyConvert<envoy::config::route::v3alpha::ScopedRouteConfiguration>(
+              resource_any);
       auto* to_add = added_resources.Add();
       to_add->set_name(config.name());
       to_add->set_version(version);
@@ -131,8 +134,8 @@ class ScopedRdsTest : public ScopedRoutesTestBase {
                 API_NO_BOOST(envoy::api::v2::RouteConfiguration)().GetDescriptor()->full_name())),
             _, _))
         .Times(AnyNumber())
-        .WillRepeatedly(Invoke([this](const envoy::api::v2::core::ConfigSource&, absl::string_view,
-                                      Stats::Scope&,
+        .WillRepeatedly(Invoke([this](const envoy::config::core::v3alpha::ConfigSource&,
+                                      absl::string_view, Stats::Scope&,
                                       Envoy::Config::SubscriptionCallbacks& callbacks) {
           auto ret = std::make_unique<NiceMock<Envoy::Config::MockSubscription>>();
           rds_subscription_by_config_subscription_[ret.get()] = &callbacks;
@@ -167,7 +170,8 @@ name: foo_scoped_routes
           key: x-foo-key
           separator: ;
 )EOF";
-    envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes scoped_routes_config;
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes
+        scoped_routes_config;
     TestUtility::loadFromYaml(config_yaml, scoped_routes_config);
     provider_ = config_provider_manager_->createXdsConfigProvider(
         scoped_routes_config.scoped_rds(), factory_context_, "foo.",
@@ -192,8 +196,9 @@ name: foo_scoped_routes
 )EOF";
     for (const std::string& name : route_config_names) {
       Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
-      resources.Add()->PackFrom(TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(
-          fmt::format(route_config_tmpl, name)));
+      resources.Add()->PackFrom(
+          TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+              fmt::format(route_config_tmpl, name)));
       rds_subscription_by_name_[name]->onConfigUpdate(resources, version);
     }
   }
@@ -692,11 +697,11 @@ TEST_F(ScopedRdsTest, ConfigDump) {
   auto message_ptr =
       factory_context_.admin_.config_tracker_.config_tracker_callbacks_["route_scopes"]();
   const auto& scoped_routes_config_dump =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::ScopedRoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::ScopedRoutesConfigDump&>(
           *message_ptr);
 
   // No routes at all(no SRDS push yet), no last_updated timestamp
-  envoy::admin::v2alpha::ScopedRoutesConfigDump expected_config_dump;
+  envoy::admin::v3alpha::ScopedRoutesConfigDump expected_config_dump;
   TestUtility::loadFromYaml(R"EOF(
 inline_scoped_route_configs:
 dynamic_scoped_route_configs:
@@ -740,7 +745,7 @@ stat_prefix: foo
       factory_context_, "foo.", *config_provider_manager_);
   message_ptr = factory_context_.admin_.config_tracker_.config_tracker_callbacks_["route_scopes"]();
   const auto& scoped_routes_config_dump2 =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::ScopedRoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::ScopedRoutesConfigDump&>(
           *message_ptr);
   TestUtility::loadFromYaml(R"EOF(
 inline_scoped_route_configs:
@@ -804,7 +809,7 @@ route_configuration_name: dynamic-foo-route-config
                             expected_config_dump);
   message_ptr = factory_context_.admin_.config_tracker_.config_tracker_callbacks_["route_scopes"]();
   const auto& scoped_routes_config_dump3 =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::ScopedRoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::ScopedRoutesConfigDump&>(
           *message_ptr);
   EXPECT_TRUE(TestUtility::protoEqual(expected_config_dump, scoped_routes_config_dump3));
 
@@ -835,7 +840,7 @@ route_configuration_name: dynamic-foo-route-config
                             expected_config_dump);
   message_ptr = factory_context_.admin_.config_tracker_.config_tracker_callbacks_["route_scopes"]();
   const auto& scoped_routes_config_dump4 =
-      TestUtility::downcastAndValidate<const envoy::admin::v2alpha::ScopedRoutesConfigDump&>(
+      TestUtility::downcastAndValidate<const envoy::admin::v3alpha::ScopedRoutesConfigDump&>(
           *message_ptr);
   EXPECT_TRUE(TestUtility::protoEqual(expected_config_dump, scoped_routes_config_dump4));
 }
diff --git a/test/common/router/vhds_test.cc b/test/common/router/vhds_test.cc
index 6b3950d477bd..8807adf27d4b 100644
--- a/test/common/router/vhds_test.cc
+++ b/test/common/router/vhds_test.cc
@@ -2,9 +2,9 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/utility.h"
@@ -44,21 +44,22 @@ name: my_route
 )EOF";
   }
 
-  envoy::api::v2::route::VirtualHost buildVirtualHost(const std::string& name,
-                                                      const std::string& domain) {
-    return TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(fmt::format(R"EOF(
+  envoy::config::route::v3alpha::VirtualHost buildVirtualHost(const std::string& name,
+                                                              const std::string& domain) {
+    return TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(fmt::format(R"EOF(
       name: {}
       domains: [{}]
       routes:
       - match: {{ prefix: "/" }}
         route: {{ cluster: "my_service" }}
     )EOF",
-                                                                                  name, domain));
+                                                                                          name,
+                                                                                          domain));
   }
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource>
-  buildAddedResources(const std::vector<envoy::api::v2::route::VirtualHost>& added_or_updated) {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> to_ret;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> buildAddedResources(
+      const std::vector<envoy::config::route::v3alpha::VirtualHost>& added_or_updated) {
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> to_ret;
 
     for (const auto& vhost : added_or_updated) {
       auto* resource = to_ret.Add();
@@ -74,7 +75,8 @@ name: my_route
   buildRemovedResources(const std::vector<std::string>& removed) {
     return Protobuf::RepeatedPtrField<std::string>{removed.begin(), removed.end()};
   }
-  RouteConfigUpdatePtr makeRouteConfigUpdate(const envoy::api::v2::RouteConfiguration& rc) {
+  RouteConfigUpdatePtr
+  makeRouteConfigUpdate(const envoy::config::route::v3alpha::RouteConfiguration& rc) {
     RouteConfigUpdatePtr config_update_info = std::make_unique<RouteConfigUpdateReceiverImpl>(
         factory_context_.timeSource(), factory_context_.messageValidationVisitor());
     config_update_info->onRdsUpdate(rc, "1");
@@ -94,7 +96,8 @@ name: my_route
 // verify that api_type: DELTA_GRPC passes validation
 TEST_F(VhdsTest, VhdsInstantiationShouldSucceedWithDELTA_GRPC) {
   const auto route_config =
-      TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(default_vhds_config_);
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+          default_vhds_config_);
   RouteConfigUpdatePtr config_update_info = makeRouteConfigUpdate(route_config);
 
   EXPECT_NO_THROW(VhdsSubscription(config_update_info, factory_context_, context_, providers_));
@@ -102,7 +105,8 @@ TEST_F(VhdsTest, VhdsInstantiationShouldSucceedWithDELTA_GRPC) {
 
 // verify that api_type: GRPC fails validation
 TEST_F(VhdsTest, VhdsInstantiationShouldFailWithoutDELTA_GRPC) {
-  const auto route_config = TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(R"EOF(
+  const auto route_config =
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(R"EOF(
 name: my_route
 vhds:
   config_source:
@@ -121,7 +125,8 @@ name: my_route
 // verify addition/updating of virtual hosts
 TEST_F(VhdsTest, VhdsAddsVirtualHosts) {
   const auto route_config =
-      TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(default_vhds_config_);
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+          default_vhds_config_);
   RouteConfigUpdatePtr config_update_info = makeRouteConfigUpdate(route_config);
 
   VhdsSubscription subscription(config_update_info, factory_context_, context_, providers_);
@@ -140,7 +145,8 @@ TEST_F(VhdsTest, VhdsAddsVirtualHosts) {
 
 // verify addition/updating of virtual hosts to already existing ones
 TEST_F(VhdsTest, VhdsAddsToExistingVirtualHosts) {
-  const auto route_config = TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(R"EOF(
+  const auto route_config =
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(R"EOF(
 name: my_route
 virtual_hosts:
 - name: vhost_rds1
@@ -178,7 +184,8 @@ name: my_route
 
 // verify removal of virtual hosts
 TEST_F(VhdsTest, VhdsRemovesAnExistingVirtualHost) {
-  const auto route_config = TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(R"EOF(
+  const auto route_config =
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(R"EOF(
 name: my_route
 virtual_hosts:
 - name: vhost_rds1
@@ -199,7 +206,7 @@ name: my_route
   EXPECT_EQ(1UL, config_update_info->routeConfiguration().virtual_hosts_size());
   EXPECT_EQ("vhost_rds1", config_update_info->routeConfiguration().virtual_hosts(0).name());
 
-  const Protobuf::RepeatedPtrField<envoy::api::v2::Resource> added_resources;
+  const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> added_resources;
   const auto removed_resources = buildRemovedResources({"vhost_rds1"});
   factory_context_.cluster_manager_.subscription_factory_.callbacks_->onConfigUpdate(
       added_resources, removed_resources, "1");
@@ -209,7 +216,8 @@ name: my_route
 
 // verify vhds overwrites existing virtual hosts
 TEST_F(VhdsTest, VhdsOverwritesAnExistingVirtualHost) {
-  const auto route_config = TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(R"EOF(
+  const auto route_config =
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(R"EOF(
 name: my_route
 virtual_hosts:
 - name: vhost_rds1
@@ -245,12 +253,13 @@ name: my_route
 // verify vhds validates VirtualHosts in added_resources
 TEST_F(VhdsTest, VhdsValidatesAddedVirtualHosts) {
   const auto route_config =
-      TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(default_vhds_config_);
+      TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+          default_vhds_config_);
   RouteConfigUpdatePtr config_update_info = makeRouteConfigUpdate(route_config);
 
   VhdsSubscription subscription(config_update_info, factory_context_, context_, providers_);
 
-  auto vhost = TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(R"EOF(
+  auto vhost = TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(R"EOF(
         name: invalid_vhost
         domains: []
         routes:
diff --git a/test/common/runtime/BUILD b/test/common/runtime/BUILD
index b3f3033ca312..3820a728a1ed 100644
--- a/test/common/runtime/BUILD
+++ b/test/common/runtime/BUILD
@@ -33,8 +33,8 @@ envoy_cc_test(
         "//source/common/runtime:runtime_lib",
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -56,11 +56,11 @@ envoy_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/runtime/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/runtime/runtime_features_test.cc b/test/common/runtime/runtime_features_test.cc
index 282d7ab10715..fc8d61e16043 100644
--- a/test/common/runtime/runtime_features_test.cc
+++ b/test/common/runtime/runtime_features_test.cc
@@ -1,8 +1,8 @@
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/base.pb.validate.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/runtime/runtime_features.h"
 
@@ -25,7 +25,7 @@ class FeatureFlagTest : public testing::Test {
 };
 
 TEST_F(FeatureFlagTest, FeatureFlagBasicTest) {
-  envoy::api::v2::core::RuntimeFeatureFlag feature_flag_proto;
+  envoy::config::core::v3alpha::RuntimeFeatureFlag feature_flag_proto;
   std::string yaml(R"EOF(
 runtime_key: "foo.bar"
 default_value: true
@@ -39,7 +39,7 @@ default_value: true
   EXPECT_CALL(runtime_.snapshot_, getBoolean("foo.bar", true)).WillOnce(Return(false));
   EXPECT_EQ(false, test_feature.enabled());
 
-  envoy::api::v2::core::RuntimeFeatureFlag feature_flag_proto2;
+  envoy::config::core::v3alpha::RuntimeFeatureFlag feature_flag_proto2;
   yaml = R"EOF(
 runtime_key: "bar.foo"
 default_value: false
@@ -55,7 +55,7 @@ default_value: false
 }
 
 TEST_F(FeatureFlagTest, FeatureFlagEmptyProtoTest) {
-  envoy::api::v2::core::RuntimeFeatureFlag empty_proto;
+  envoy::config::core::v3alpha::RuntimeFeatureFlag empty_proto;
   FeatureFlag test(empty_proto, runtime_);
 
   EXPECT_CALL(runtime_.snapshot_, getBoolean("", true));
@@ -63,7 +63,7 @@ TEST_F(FeatureFlagTest, FeatureFlagEmptyProtoTest) {
 }
 
 TEST_F(FeatureFlagTest, FractionalPercentBasicTest) {
-  envoy::api::v2::core::RuntimeFractionalPercent runtime_fractional_percent_proto;
+  envoy::config::core::v3alpha::RuntimeFractionalPercent runtime_fractional_percent_proto;
   std::string yaml(R"EOF(
 runtime_key: "foo.bar"
 default_value:
@@ -74,18 +74,20 @@ runtime_key: "foo.bar"
   FractionalPercent test_fractional_percent(runtime_fractional_percent_proto, runtime_);
 
   EXPECT_CALL(runtime_.snapshot_,
-              featureEnabled("foo.bar",
-                             testing::Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+              featureEnabled(
+                  "foo.bar",
+                  testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
   EXPECT_EQ(true, test_fractional_percent.enabled());
 
   EXPECT_CALL(runtime_.snapshot_,
-              featureEnabled("foo.bar",
-                             testing::Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+              featureEnabled(
+                  "foo.bar",
+                  testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(false));
   EXPECT_EQ(false, test_fractional_percent.enabled());
 
-  envoy::api::v2::core::RuntimeFractionalPercent runtime_fractional_percent_proto2;
+  envoy::config::core::v3alpha::RuntimeFractionalPercent runtime_fractional_percent_proto2;
   yaml = (R"EOF(
 runtime_key: "foo.bar"
 default_value:
@@ -95,15 +97,17 @@ runtime_key: "foo.bar"
   TestUtility::loadFromYamlAndValidate(yaml, runtime_fractional_percent_proto2);
   FractionalPercent test_fractional_percent2(runtime_fractional_percent_proto2, runtime_);
 
-  EXPECT_CALL(runtime_.snapshot_,
-              featureEnabled("foo.bar",
-                             testing::Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+  EXPECT_CALL(
+      runtime_.snapshot_,
+      featureEnabled("foo.bar",
+                     testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(true));
   EXPECT_EQ(true, test_fractional_percent2.enabled());
 
-  EXPECT_CALL(runtime_.snapshot_,
-              featureEnabled("foo.bar",
-                             testing::Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+  EXPECT_CALL(
+      runtime_.snapshot_,
+      featureEnabled("foo.bar",
+                     testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
   EXPECT_EQ(false, test_fractional_percent2.enabled());
 }
diff --git a/test/common/runtime/runtime_impl_test.cc b/test/common/runtime/runtime_impl_test.cc
index 7e0bf18df555..7049e96cac84 100644
--- a/test/common/runtime/runtime_impl_test.cc
+++ b/test/common/runtime/runtime_impl_test.cc
@@ -1,11 +1,11 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/service/discovery/v2/rtds.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
+#include "envoy/service/runtime/v3alpha/rtds.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/config/runtime_utility.h"
 #include "common/runtime/runtime_impl.h"
@@ -135,14 +135,14 @@ class DiskLoaderImplTest : public LoaderImplTest {
   }
 
   void run(const std::string& primary_dir, const std::string& override_dir) {
-    envoy::config::bootstrap::v2::Runtime runtime;
+    envoy::config::bootstrap::v3alpha::Runtime runtime;
     runtime.mutable_base()->MergeFrom(base_);
     expected_watch_root_ = TestEnvironment::temporaryPath(primary_dir);
     runtime.set_symlink_root(expected_watch_root_);
     runtime.set_subdirectory("envoy");
     runtime.set_override_subdirectory(override_dir);
 
-    envoy::config::bootstrap::v2::LayeredRuntime layered_runtime;
+    envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime;
     Config::translateRuntime(runtime, layered_runtime);
     loader_ =
         std::make_unique<LoaderImpl>(dispatcher_, tls_, layered_runtime, local_info_, init_manager_,
@@ -254,9 +254,9 @@ TEST_F(DiskLoaderImplTest, All) {
   EXPECT_FALSE(loader_->snapshot().featureEnabled("file3", 1));
 
   // Fractional percent feature enablement
-  envoy::type::FractionalPercent fractional_percent;
+  envoy::type::v3alpha::FractionalPercent fractional_percent;
   fractional_percent.set_numerator(5);
-  fractional_percent.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+  fractional_percent.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
 
   EXPECT_CALL(generator_, random()).WillOnce(Return(50));
   EXPECT_TRUE(loader_->snapshot().featureEnabled("file8", fractional_percent)); // valid data
@@ -371,7 +371,7 @@ TEST_F(DiskLoaderImplTest, PercentHandling) {
   setup();
   run("test/common/runtime/test_data/current", "envoy_override");
 
-  envoy::type::FractionalPercent default_value;
+  envoy::type::v3alpha::FractionalPercent default_value;
 
   // Smoke test integer value of 0, should be interpreted as 0%
   {
@@ -531,7 +531,7 @@ TEST_F(DiskLoaderImplTest, LayersOverride) {
 // Validate that multiple admin layers leads to a configuration load failure.
 TEST_F(DiskLoaderImplTest, MultipleAdminLayersFail) {
   setup();
-  envoy::config::bootstrap::v2::LayeredRuntime layered_runtime;
+  envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime;
   {
     auto* layer = layered_runtime.add_layers();
     layer->set_name("admin_0");
@@ -553,7 +553,7 @@ class StaticLoaderImplTest : public LoaderImplTest {
 protected:
   void setup() override {
     LoaderImplTest::setup();
-    envoy::config::bootstrap::v2::LayeredRuntime layered_runtime;
+    envoy::config::bootstrap::v3alpha::LayeredRuntime layered_runtime;
     {
       auto* layer = layered_runtime.add_layers();
       layer->set_name("base");
@@ -647,9 +647,9 @@ TEST_F(StaticLoaderImplTest, ProtoParsing) {
   EXPECT_EQ(false, snapshot->getBoolean("blah.blah", false));
 
   // Fractional percent feature enablement
-  envoy::type::FractionalPercent fractional_percent;
+  envoy::type::v3alpha::FractionalPercent fractional_percent;
   fractional_percent.set_numerator(5);
-  fractional_percent.set_denominator(envoy::type::FractionalPercent::TEN_THOUSAND);
+  fractional_percent.set_denominator(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND);
 
   EXPECT_CALL(generator_, random()).WillOnce(Return(50));
   EXPECT_TRUE(loader_->snapshot().featureEnabled("file8", fractional_percent)); // valid data
@@ -820,7 +820,7 @@ class RtdsLoaderImplTest : public LoaderImplTest {
   void setup() override {
     LoaderImplTest::setup();
 
-    envoy::config::bootstrap::v2::LayeredRuntime config;
+    envoy::config::bootstrap::v3alpha::LayeredRuntime config;
     *config.add_layers()->mutable_static_layer() =
         TestUtility::parseYaml<ProtobufWkt::Struct>(R"EOF(
     foo: whatevs
@@ -839,7 +839,8 @@ class RtdsLoaderImplTest : public LoaderImplTest {
     }));
     ON_CALL(cm_.subscription_factory_, subscriptionFromConfigSource(_, _, _, _))
         .WillByDefault(testing::Invoke(
-            [this](const envoy::api::v2::core::ConfigSource&, absl::string_view, Stats::Scope&,
+            [this](const envoy::config::core::v3alpha::ConfigSource&, absl::string_view,
+                   Stats::Scope&,
                    Config::SubscriptionCallbacks& callbacks) -> Config::SubscriptionPtr {
               auto ret = std::make_unique<testing::NiceMock<Config::MockSubscription>>();
               rtds_subscriptions_.push_back(ret.get());
@@ -872,15 +873,16 @@ class RtdsLoaderImplTest : public LoaderImplTest {
 
   void addLayer(absl::string_view name) { layers_.emplace_back(name); }
 
-  void doOnConfigUpdateVerifyNoThrow(const envoy::service::discovery::v2::Runtime& runtime,
+  void doOnConfigUpdateVerifyNoThrow(const envoy::service::runtime::v3alpha::Runtime& runtime,
                                      uint32_t callback_index = 0) {
     Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
     resources.Add()->PackFrom(runtime);
     VERBOSE_EXPECT_NO_THROW(rtds_callbacks_[callback_index]->onConfigUpdate(resources, ""));
   }
 
-  void doDeltaOnConfigUpdateVerifyNoThrow(const envoy::service::discovery::v2::Runtime& runtime) {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> resources;
+  void
+  doDeltaOnConfigUpdateVerifyNoThrow(const envoy::service::runtime::v3alpha::Runtime& runtime) {
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> resources;
     auto* resource = resources.Add();
     resource->mutable_resource()->PackFrom(runtime);
     resource->set_version("");
@@ -947,7 +949,7 @@ TEST_F(RtdsLoaderImplTest, FailureSubscription) {
 TEST_F(RtdsLoaderImplTest, WrongResourceName) {
   setup();
 
-  auto runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  auto runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: other_resource
     layer:
       foo: bar
@@ -972,7 +974,7 @@ TEST_F(RtdsLoaderImplTest, WrongResourceName) {
 TEST_F(RtdsLoaderImplTest, OnConfigUpdateSuccess) {
   setup();
 
-  auto runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  auto runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_resource
     layer:
       foo: bar
@@ -990,7 +992,7 @@ TEST_F(RtdsLoaderImplTest, OnConfigUpdateSuccess) {
   EXPECT_EQ(3, store_.gauge("runtime.num_keys", Stats::Gauge::ImportMode::NeverImport).value());
   EXPECT_EQ(2, store_.gauge("runtime.num_layers", Stats::Gauge::ImportMode::NeverImport).value());
 
-  runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_resource
     layer:
       baz: saz
@@ -1011,7 +1013,7 @@ TEST_F(RtdsLoaderImplTest, OnConfigUpdateSuccess) {
 TEST_F(RtdsLoaderImplTest, DeltaOnConfigUpdateSuccess) {
   setup();
 
-  auto runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  auto runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_resource
     layer:
       foo: bar
@@ -1029,7 +1031,7 @@ TEST_F(RtdsLoaderImplTest, DeltaOnConfigUpdateSuccess) {
   EXPECT_EQ(3, store_.gauge("runtime.num_keys", Stats::Gauge::ImportMode::NeverImport).value());
   EXPECT_EQ(2, store_.gauge("runtime.num_layers", Stats::Gauge::ImportMode::NeverImport).value());
 
-  runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_resource
     layer:
       baz: saz
@@ -1055,7 +1057,7 @@ TEST_F(RtdsLoaderImplTest, MultipleRtdsLayers) {
   EXPECT_EQ("yar", loader_->snapshot().get("bar"));
   EXPECT_EQ("", loader_->snapshot().get("baz"));
 
-  auto runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  auto runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_resource
     layer:
       foo: bar
@@ -1073,7 +1075,7 @@ TEST_F(RtdsLoaderImplTest, MultipleRtdsLayers) {
   EXPECT_EQ(3, store_.gauge("runtime.num_keys", Stats::Gauge::ImportMode::NeverImport).value());
   EXPECT_EQ(3, store_.gauge("runtime.num_layers", Stats::Gauge::ImportMode::NeverImport).value());
 
-  runtime = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  runtime = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: another_resource
     layer:
       baz: saz
diff --git a/test/common/secret/BUILD b/test/common/secret/BUILD
index 10f506fd050f..3d502c36fbf4 100644
--- a/test/common/secret/BUILD
+++ b/test/common/secret/BUILD
@@ -24,10 +24,10 @@ envoy_cc_test(
         "//test/test_common:registry_lib",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/grpc_credential/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -49,9 +49,9 @@ envoy_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/secret/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/common/secret/sds_api_test.cc b/test/common/secret/sds_api_test.cc
index 329015ae8143..8fcba73a00d8 100644
--- a/test/common/secret/sds_api_test.cc
+++ b/test/common/secret/sds_api_test.cc
@@ -1,10 +1,10 @@
 #include <memory>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
 #include "envoy/common/exception.h"
-#include "envoy/service/discovery/v2/sds.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
+#include "envoy/service/secret/v3alpha/sds.pb.h"
 
 #include "common/secret/sds_api.h"
 #include "common/ssl/certificate_validation_context_config_impl.h"
@@ -50,10 +50,10 @@ class SdsApiTest : public testing::Test {
 // Validate that SdsApi object is created and initialized successfully.
 TEST_F(SdsApiTest, BasicTest) {
   ::testing::InSequence s;
-  const envoy::service::discovery::v2::SdsDummy dummy;
+  const envoy::service::secret::v3alpha::SdsDummy dummy;
   NiceMock<Server::MockInstance> server;
 
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TlsCertificateSdsApi sds_api(config_source, "abc.com", subscription_factory_, time_system_,
                                validation_visitor_, server.stats(), init_manager_, []() {});
   initialize();
@@ -63,7 +63,7 @@ TEST_F(SdsApiTest, BasicTest) {
 // is passed to onConfigUpdate().
 TEST_F(SdsApiTest, DynamicTlsCertificateUpdateSuccess) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TlsCertificateSdsApi sds_api(config_source, "abc.com", subscription_factory_, time_system_,
                                validation_visitor_, server.stats(), init_manager_, []() {});
   initialize();
@@ -80,7 +80,7 @@ TEST_F(SdsApiTest, DynamicTlsCertificateUpdateSuccess) {
     private_key:
       filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_key.pem"
     )EOF";
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> secret_resources;
   secret_resources.Add()->PackFrom(typed_secret);
@@ -105,20 +105,20 @@ TEST_F(SdsApiTest, DynamicTlsCertificateUpdateSuccess) {
 class PartialMockSds : public SdsApi {
 public:
   PartialMockSds(NiceMock<Server::MockInstance>& server, NiceMock<Init::MockManager>& init_manager,
-                 envoy::api::v2::core::ConfigSource& config_source,
+                 envoy::config::core::v3alpha::ConfigSource& config_source,
                  Config::SubscriptionFactory& subscription_factory, TimeSource& time_source)
       : SdsApi(config_source, "abc.com", subscription_factory, time_source, validation_visitor_,
                server.stats(), init_manager, []() {}) {}
 
   MOCK_METHOD2(onConfigUpdate,
                void(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>&, const std::string&));
-  void onConfigUpdate(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added,
-                      const Protobuf::RepeatedPtrField<std::string>& removed,
-                      const std::string& version) override {
+  void onConfigUpdate(
+      const Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource>& added,
+      const Protobuf::RepeatedPtrField<std::string>& removed, const std::string& version) override {
     SdsApi::onConfigUpdate(added, removed, version);
   }
-  void setSecret(const envoy::api::v2::auth::Secret&) override {}
-  void validateConfig(const envoy::api::v2::auth::Secret&) override {}
+  void setSecret(const envoy::extensions::transport_sockets::tls::v3alpha::Secret&) override {}
+  void validateConfig(const envoy::extensions::transport_sockets::tls::v3alpha::Secret&) override {}
 
   NiceMock<ProtobufMessage::MockValidationVisitor> validation_visitor_;
 };
@@ -126,8 +126,8 @@ class PartialMockSds : public SdsApi {
 // Basic test of delta's passthrough call to the state-of-the-world variant, to
 // increase coverage.
 TEST_F(SdsApiTest, Delta) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> resources;
-  envoy::api::v2::auth::Secret secret;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> resources;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret;
   secret.set_name("secret_1");
   auto* resource = resources.Add();
   resource->mutable_resource()->PackFrom(secret);
@@ -138,7 +138,7 @@ TEST_F(SdsApiTest, Delta) {
   for_matching.Add()->PackFrom(secret);
 
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   Event::GlobalTimeSystem time_system;
   PartialMockSds sds(server, init_manager_, config_source, subscription_factory_, time_system);
   initialize();
@@ -157,7 +157,7 @@ TEST_F(SdsApiTest, Delta) {
 // Tests SDS's use of the delta variant of onConfigUpdate().
 TEST_F(SdsApiTest, DeltaUpdateSuccess) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TlsCertificateSdsApi sds_api(config_source, "abc.com", subscription_factory_, time_system_,
                                validation_visitor_, server.stats(), init_manager_, []() {});
 
@@ -174,9 +174,9 @@ TEST_F(SdsApiTest, DeltaUpdateSuccess) {
     private_key:
       filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_key.pem"
     )EOF";
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> secret_resources;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> secret_resources;
   secret_resources.Add()->mutable_resource()->PackFrom(typed_secret);
 
   EXPECT_CALL(secret_callback, onAddOrUpdateSecret());
@@ -201,7 +201,7 @@ TEST_F(SdsApiTest, DeltaUpdateSuccess) {
 // a good secret is passed to onConfigUpdate().
 TEST_F(SdsApiTest, DynamicCertificateValidationContextUpdateSuccess) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   CertificateValidationContextSdsApi sds_api(config_source, "abc.com", subscription_factory_,
                                              time_system_, validation_visitor_, server.stats(),
                                              init_manager_, []() {});
@@ -218,7 +218,7 @@ TEST_F(SdsApiTest, DynamicCertificateValidationContextUpdateSuccess) {
     allow_expired_certificate: true
   )EOF";
 
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> secret_resources;
   secret_resources.Add()->PackFrom(typed_secret);
@@ -238,14 +238,18 @@ TEST_F(SdsApiTest, DynamicCertificateValidationContextUpdateSuccess) {
 class CvcValidationCallback {
 public:
   virtual ~CvcValidationCallback() = default;
-  virtual void validateCvc(const envoy::api::v2::auth::CertificateValidationContext&) PURE;
+  virtual void validateCvc(
+      const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&) PURE;
 };
 
 class MockCvcValidationCallback : public CvcValidationCallback {
 public:
   MockCvcValidationCallback() = default;
   ~MockCvcValidationCallback() override = default;
-  MOCK_METHOD1(validateCvc, void(const envoy::api::v2::auth::CertificateValidationContext&));
+  MOCK_METHOD1(
+      validateCvc,
+      void(
+          const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&));
 };
 
 // Validate that CertificateValidationContextSdsApi updates secrets successfully if
@@ -253,7 +257,7 @@ class MockCvcValidationCallback : public CvcValidationCallback {
 // provides correct information.
 TEST_F(SdsApiTest, DefaultCertificateValidationContextTest) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   CertificateValidationContextSdsApi sds_api(config_source, "abc.com", subscription_factory_,
                                              time_system_, validation_visitor_, server.stats(),
                                              init_manager_, []() {});
@@ -263,11 +267,11 @@ TEST_F(SdsApiTest, DefaultCertificateValidationContextTest) {
       sds_api.addUpdateCallback([&secret_callback]() { secret_callback.onAddOrUpdateSecret(); });
   NiceMock<MockCvcValidationCallback> validation_callback;
   auto validation_handle = sds_api.addValidationCallback(
-      [&validation_callback](const envoy::api::v2::auth::CertificateValidationContext& cvc) {
-        validation_callback.validateCvc(cvc);
-      });
+      [&validation_callback](
+          const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+              cvc) { validation_callback.validateCvc(cvc); });
 
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   typed_secret.set_name("abc.com");
   auto* dynamic_cvc = typed_secret.mutable_validation_context();
   dynamic_cvc->set_allow_expired_certificate(false);
@@ -287,12 +291,13 @@ TEST_F(SdsApiTest, DefaultCertificateValidationContextTest) {
 
   const std::string default_verify_certificate_hash =
       "0000000000000000000000000000000000000000000000000000000000000000";
-  envoy::api::v2::auth::CertificateValidationContext default_cvc;
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext default_cvc;
   default_cvc.set_allow_expired_certificate(true);
   default_cvc.mutable_trusted_ca()->set_inline_bytes("fake trusted ca");
   default_cvc.add_match_subject_alt_names()->set_exact("first san");
   default_cvc.add_verify_certificate_hash(default_verify_certificate_hash);
-  envoy::api::v2::auth::CertificateValidationContext merged_cvc = default_cvc;
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext merged_cvc =
+      default_cvc;
   merged_cvc.MergeFrom(*sds_api.secret());
   Ssl::CertificateValidationContextConfigImpl cvc_config(merged_cvc, *api_);
   // Verify that merging CertificateValidationContext applies logical OR to bool
@@ -323,7 +328,7 @@ TEST_F(SdsApiTest, DefaultCertificateValidationContextTest) {
 // Validate that SdsApi throws exception if an empty secret is passed to onConfigUpdate().
 TEST_F(SdsApiTest, EmptyResource) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TlsCertificateSdsApi sds_api(config_source, "abc.com", subscription_factory_, time_system_,
                                validation_visitor_, server.stats(), init_manager_, []() {});
 
@@ -338,7 +343,7 @@ TEST_F(SdsApiTest, EmptyResource) {
 // Validate that SdsApi throws exception if multiple secrets are passed to onConfigUpdate().
 TEST_F(SdsApiTest, SecretUpdateWrongSize) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TlsCertificateSdsApi sds_api(config_source, "abc.com", subscription_factory_, time_system_,
                                validation_visitor_, server.stats(), init_manager_, []() {});
 
@@ -352,7 +357,7 @@ TEST_F(SdsApiTest, SecretUpdateWrongSize) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_key.pem"
       )EOF";
 
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> secret_resources;
   secret_resources.Add()->PackFrom(typed_secret);
@@ -367,7 +372,7 @@ TEST_F(SdsApiTest, SecretUpdateWrongSize) {
 // does not match configured name.
 TEST_F(SdsApiTest, SecretUpdateWrongSecretName) {
   NiceMock<Server::MockInstance> server;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TlsCertificateSdsApi sds_api(config_source, "abc.com", subscription_factory_, time_system_,
                                validation_visitor_, server.stats(), init_manager_, []() {});
 
@@ -381,7 +386,7 @@ TEST_F(SdsApiTest, SecretUpdateWrongSecretName) {
           filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_key.pem"
         )EOF";
 
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> secret_resources;
   secret_resources.Add()->PackFrom(typed_secret);
diff --git a/test/common/secret/secret_manager_impl_test.cc b/test/common/secret/secret_manager_impl_test.cc
index d8095ef8c3c1..551f6f944f75 100644
--- a/test/common/secret/secret_manager_impl_test.cc
+++ b/test/common/secret/secret_manager_impl_test.cc
@@ -1,10 +1,10 @@
 #include <memory>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
 #include "envoy/common/exception.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/config/grpc_credential/v2alpha/file_based_metadata.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/common/base64.h"
 #include "common/common/logger.h"
@@ -37,8 +37,8 @@ class SecretManagerImplTest : public testing::Test, public Logger::Loggable<Logg
   void checkConfigDump(const std::string& expected_dump_yaml) {
     auto message_ptr = config_tracker_.config_tracker_callbacks_["secrets"]();
     const auto& secrets_config_dump =
-        dynamic_cast<const envoy::admin::v2alpha::SecretsConfigDump&>(*message_ptr);
-    envoy::admin::v2alpha::SecretsConfigDump expected_secrets_config_dump;
+        dynamic_cast<const envoy::admin::v3alpha::SecretsConfigDump&>(*message_ptr);
+    envoy::admin::v3alpha::SecretsConfigDump expected_secrets_config_dump;
     TestUtility::loadFromYaml(expected_dump_yaml, expected_secrets_config_dump);
     EXPECT_EQ(expected_secrets_config_dump.DebugString(), secrets_config_dump.DebugString());
   }
@@ -52,7 +52,7 @@ class SecretManagerImplTest : public testing::Test, public Logger::Loggable<Logg
 
 // Validate that secret manager adds static TLS certificate secret successfully.
 TEST_F(SecretManagerImplTest, TlsCertificateSecretLoadSuccess) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
   const std::string yaml =
       R"EOF(
 name: "abc.com"
@@ -85,7 +85,7 @@ name: "abc.com"
 // Validate that secret manager throws an exception when adding duplicated static TLS certificate
 // secret.
 TEST_F(SecretManagerImplTest, DuplicateStaticTlsCertificateSecret) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
   const std::string yaml =
       R"EOF(
     name: "abc.com"
@@ -106,7 +106,7 @@ TEST_F(SecretManagerImplTest, DuplicateStaticTlsCertificateSecret) {
 
 // Validate that secret manager adds static certificate validation context secret successfully.
 TEST_F(SecretManagerImplTest, CertificateValidationContextSecretLoadSuccess) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
   const std::string yaml =
       R"EOF(
       name: "abc.com"
@@ -131,7 +131,7 @@ TEST_F(SecretManagerImplTest, CertificateValidationContextSecretLoadSuccess) {
 // Validate that secret manager throws an exception when adding duplicated static certificate
 // validation context secret.
 TEST_F(SecretManagerImplTest, DuplicateStaticCertificateValidationContextSecret) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
   const std::string yaml =
       R"EOF(
     name: "abc.com"
@@ -150,7 +150,7 @@ TEST_F(SecretManagerImplTest, DuplicateStaticCertificateValidationContextSecret)
 
 // Validate that secret manager adds static STKs secret successfully.
 TEST_F(SecretManagerImplTest, SessionTicketKeysLoadSuccess) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
 
   const std::string yaml =
       R"EOF(
@@ -169,8 +169,9 @@ name: "abc.com"
   ASSERT_EQ(secret_manager->findStaticTlsSessionTicketKeysContextProvider("undefined"), nullptr);
   ASSERT_NE(secret_manager->findStaticTlsSessionTicketKeysContextProvider("abc.com"), nullptr);
 
-  const ::envoy::api::v2::auth::TlsSessionTicketKeys session_ticket_keys(
-      *secret_manager->findStaticTlsSessionTicketKeysContextProvider("abc.com")->secret());
+  const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys
+      session_ticket_keys(
+          *secret_manager->findStaticTlsSessionTicketKeysContextProvider("abc.com")->secret());
   const std::string keys_path =
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/keys.bin";
   EXPECT_EQ(session_ticket_keys.keys_size(), 1);
@@ -179,7 +180,7 @@ name: "abc.com"
 
 // Validate that secret manager throws an exception when adding duplicated static STKs secret.
 TEST_F(SecretManagerImplTest, DuplicateSessionTicketKeysSecret) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
 
   const std::string yaml =
       R"EOF(
@@ -224,7 +225,7 @@ TEST_F(SecretManagerImplTest, DeduplicateDynamicTlsCertificateSecretProvider) {
   EXPECT_CALL(secret_context, dispatcher()).WillRepeatedly(ReturnRef(dispatcher));
   EXPECT_CALL(secret_context, localInfo()).WillRepeatedly(ReturnRef(local_info));
 
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   TestUtility::loadFromYaml(R"(
 api_config_source:
   api_type: GRPC
@@ -291,7 +292,7 @@ TEST_F(SecretManagerImplTest, SdsDynamicSecretUpdateSuccess) {
 
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
 
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -319,7 +320,7 @@ name: "abc.com"
   private_key:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_key.pem"
 )EOF";
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> secret_resources;
   secret_resources.Add()->PackFrom(typed_secret);
@@ -344,7 +345,7 @@ TEST_F(SecretManagerImplTest, ConfigDumpHandler) {
 
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
 
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -374,7 +375,7 @@ name: "abc.com"
   password:
     inline_string: "DUMMY_PASSWORD"
 )EOF";
-  envoy::api::v2::auth::Secret typed_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret typed_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), typed_secret);
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> secret_resources;
   secret_resources.Add()->PackFrom(typed_secret);
@@ -522,7 +523,7 @@ TEST_F(SecretManagerImplTest, ConfigDumpHandlerWarmingSecrets) {
 
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
 
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -611,7 +612,7 @@ TEST_F(SecretManagerImplTest, ConfigDumpHandlerStaticSecrets) {
 
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
 
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -639,7 +640,7 @@ name: "abc.com"
   password:
     inline_string: "DUMMY_PASSWORD"
 )EOF";
-  envoy::api::v2::auth::Secret tls_cert_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret tls_cert_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(tls_certificate), tls_cert_secret);
   secret_manager->addStaticSecret(tls_cert_secret);
   TestUtility::loadFromYaml(TestEnvironment::substitute(R"EOF(
@@ -681,7 +682,7 @@ TEST_F(SecretManagerImplTest, ConfigDumpNotRedactFilenamePrivateKey) {
   auto secret_manager = std::make_unique<SecretManagerImpl>(config_tracker_);
   time_system_.setSystemTime(std::chrono::milliseconds(1234567891234));
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -708,7 +709,7 @@ name: "abc.com"
   password:
     filename: "/etc/certs/password"
 )EOF";
-  envoy::api::v2::auth::Secret tls_cert_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret tls_cert_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(tls_certificate), tls_cert_secret);
   secret_manager->addStaticSecret(tls_cert_secret);
   const std::string expected_config_dump = R"EOF(
@@ -732,7 +733,7 @@ TEST_F(SecretManagerImplTest, ConfigDumpHandlerStaticValidationContext) {
   auto secret_manager = std::make_unique<SecretManagerImpl>(config_tracker_);
   time_system_.setSystemTime(std::chrono::milliseconds(1234567891234));
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -756,7 +757,7 @@ name: "abc.com.validation"
   trusted_ca:
     inline_string: "DUMMY_INLINE_STRING_TRUSTED_CA"
 )EOF";
-  envoy::api::v2::auth::Secret validation_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret validation_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(validation_context), validation_secret);
   secret_manager->addStaticSecret(validation_secret);
   const std::string expected_config_dump = R"EOF(
@@ -776,7 +777,7 @@ TEST_F(SecretManagerImplTest, ConfigDumpHandlerStaticSessionTicketsContext) {
   auto secret_manager = std::make_unique<SecretManagerImpl>(config_tracker_);
   time_system_.setSystemTime(std::chrono::milliseconds(1234567891234));
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> secret_context;
-  envoy::api::v2::core::ConfigSource config_source;
+  envoy::config::core::v3alpha::ConfigSource config_source;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   NiceMock<Event::MockDispatcher> dispatcher;
   NiceMock<Runtime::MockRandomGenerator> random;
@@ -802,7 +803,7 @@ name: "abc.com.stek"
     - inline_string: "DUMMY_INLINE_STRING"
     - inline_bytes: "RFVNTVlfSU5MSU5FX0JZVEVT"
 )EOF";
-  envoy::api::v2::auth::Secret stek_secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret stek_secret;
   TestUtility::loadFromYaml(TestEnvironment::substitute(stek_context), stek_secret);
   secret_manager->addStaticSecret(stek_secret);
   const std::string expected_config_dump = R"EOF(
diff --git a/test/common/stats/BUILD b/test/common/stats/BUILD
index 0c8e4d868b1c..c983da12e1e1 100644
--- a/test/common/stats/BUILD
+++ b/test/common/stats/BUILD
@@ -97,8 +97,8 @@ envoy_cc_test(
         "//source/common/memory:stats_lib",
         "//source/common/stats:stats_matcher_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -162,7 +162,7 @@ envoy_cc_test(
         "//source/common/stats:tag_extractor_lib",
         "//source/common/stats:tag_producer_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -172,7 +172,7 @@ envoy_cc_test(
     deps = [
         "//source/common/stats:tag_producer_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -191,7 +191,7 @@ envoy_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/test_common:logging_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -211,6 +211,6 @@ envoy_cc_test_binary(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/common/stats/stats_matcher_impl_test.cc b/test/common/stats/stats_matcher_impl_test.cc
index 427a56db06dd..45b69168e59e 100644
--- a/test/common/stats/stats_matcher_impl_test.cc
+++ b/test/common/stats/stats_matcher_impl_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/metrics/v2/stats.pb.h"
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/stats/stats_matcher_impl.h"
 
@@ -12,10 +12,10 @@ namespace Stats {
 
 class StatsMatcherTest : public testing::Test {
 protected:
-  envoy::type::matcher::StringMatcher* inclusionList() {
+  envoy::type::matcher::v3alpha::StringMatcher* inclusionList() {
     return stats_config_.mutable_stats_matcher()->mutable_inclusion_list()->add_patterns();
   }
-  envoy::type::matcher::StringMatcher* exclusionList() {
+  envoy::type::matcher::v3alpha::StringMatcher* exclusionList() {
     return stats_config_.mutable_stats_matcher()->mutable_exclusion_list()->add_patterns();
   }
   void rejectAll(const bool should_reject) {
@@ -36,7 +36,7 @@ class StatsMatcherTest : public testing::Test {
   std::unique_ptr<StatsMatcherImpl> stats_matcher_impl_;
 
 private:
-  envoy::config::metrics::v2::StatsConfig stats_config_;
+  envoy::config::metrics::v3alpha::StatsConfig stats_config_;
 };
 
 TEST_F(StatsMatcherTest, CheckDefault) {
@@ -68,7 +68,7 @@ TEST_F(StatsMatcherTest, CheckNotRejectAll) {
 }
 
 TEST_F(StatsMatcherTest, CheckIncludeAll) {
-  inclusionList()->set_regex(".*");
+  inclusionList()->set_hidden_envoy_deprecated_regex(".*");
   initMatcher();
   expectAccepted({"foo", "bar", "foo.bar", "foo.bar.baz"});
   // It really does accept all, but the impl doesn't know it.
@@ -77,7 +77,7 @@ TEST_F(StatsMatcherTest, CheckIncludeAll) {
 }
 
 TEST_F(StatsMatcherTest, CheckExcludeAll) {
-  exclusionList()->set_regex(".*");
+  exclusionList()->set_hidden_envoy_deprecated_regex(".*");
   initMatcher();
   expectDenied({"foo", "bar", "foo.bar", "foo.bar.baz"});
   EXPECT_FALSE(stats_matcher_impl_->acceptsAll());
@@ -149,7 +149,7 @@ TEST_F(StatsMatcherTest, CheckExcludeSuffix) {
 // Single regex matchers.
 
 TEST_F(StatsMatcherTest, CheckIncludeRegex) {
-  inclusionList()->set_regex(".*envoy.*");
+  inclusionList()->set_hidden_envoy_deprecated_regex(".*envoy.*");
   initMatcher();
   expectAccepted({"envoy.matchers.requests", "stats.envoy.2xx", "regex.envoy.matchers"});
   expectDenied({"foo", "Envoy", "EnvoyProxy"});
@@ -158,7 +158,7 @@ TEST_F(StatsMatcherTest, CheckIncludeRegex) {
 }
 
 TEST_F(StatsMatcherTest, CheckExcludeRegex) {
-  exclusionList()->set_regex(".*envoy.*");
+  exclusionList()->set_hidden_envoy_deprecated_regex(".*envoy.*");
   initMatcher();
   expectAccepted({"foo", "Envoy", "EnvoyProxy"});
   expectDenied({"envoy.matchers.requests", "stats.envoy.2xx", "regex.envoy.matchers"});
@@ -237,8 +237,8 @@ TEST_F(StatsMatcherTest, CheckMultipleExcludeSuffix) {
 // Multiple regex matchers.
 
 TEST_F(StatsMatcherTest, CheckMultipleIncludeRegex) {
-  inclusionList()->set_regex(".*envoy.*");
-  inclusionList()->set_regex(".*absl.*");
+  inclusionList()->set_hidden_envoy_deprecated_regex(".*envoy.*");
+  inclusionList()->set_hidden_envoy_deprecated_regex(".*absl.*");
   initMatcher();
   expectAccepted({"envoy.matchers.requests", "stats.absl.2xx", "absl.envoy.matchers"});
   expectDenied({"Abseil", "EnvoyProxy"});
@@ -247,8 +247,8 @@ TEST_F(StatsMatcherTest, CheckMultipleIncludeRegex) {
 }
 
 TEST_F(StatsMatcherTest, CheckMultipleExcludeRegex) {
-  exclusionList()->set_regex(".*envoy.*");
-  exclusionList()->set_regex(".*absl.*");
+  exclusionList()->set_hidden_envoy_deprecated_regex(".*envoy.*");
+  exclusionList()->set_hidden_envoy_deprecated_regex(".*absl.*");
   initMatcher();
   expectAccepted({"Abseil", "EnvoyProxy"});
   expectDenied({"envoy.matchers.requests", "stats.absl.2xx", "absl.envoy.matchers"});
@@ -262,7 +262,7 @@ TEST_F(StatsMatcherTest, CheckMultipleExcludeRegex) {
 // whichever the case may be.
 
 TEST_F(StatsMatcherTest, CheckMultipleAssortedInclusionMatchers) {
-  inclusionList()->set_regex(".*envoy.*");
+  inclusionList()->set_hidden_envoy_deprecated_regex(".*envoy.*");
   inclusionList()->set_suffix("requests");
   inclusionList()->set_exact("regex");
   initMatcher();
@@ -273,7 +273,7 @@ TEST_F(StatsMatcherTest, CheckMultipleAssortedInclusionMatchers) {
 }
 
 TEST_F(StatsMatcherTest, CheckMultipleAssortedExclusionMatchers) {
-  exclusionList()->set_regex(".*envoy.*");
+  exclusionList()->set_hidden_envoy_deprecated_regex(".*envoy.*");
   exclusionList()->set_suffix("requests");
   exclusionList()->set_exact("regex");
   initMatcher();
diff --git a/test/common/stats/tag_extractor_impl_test.cc b/test/common/stats/tag_extractor_impl_test.cc
index b789ae0aa01a..1a48bbad819b 100644
--- a/test/common/stats/tag_extractor_impl_test.cc
+++ b/test/common/stats/tag_extractor_impl_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
 #include "envoy/common/exception.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/config/well_known_names.h"
 #include "common/stats/tag_extractor_impl.h"
@@ -65,7 +65,7 @@ TEST(TagExtractorTest, BadRegex) {
 
 class DefaultTagRegexTester {
 public:
-  DefaultTagRegexTester() : tag_extractors_(envoy::config::metrics::v2::StatsConfig()) {}
+  DefaultTagRegexTester() : tag_extractors_(envoy::config::metrics::v3alpha::StatsConfig()) {}
 
   void testRegex(const std::string& stat_name, const std::string& expected_tag_extracted_name,
                  const std::vector<Tag>& expected_tags) {
diff --git a/test/common/stats/tag_producer_impl_test.cc b/test/common/stats/tag_producer_impl_test.cc
index 7dd44f8cbcec..8e7065d57e7f 100644
--- a/test/common/stats/tag_producer_impl_test.cc
+++ b/test/common/stats/tag_producer_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/config/well_known_names.h"
 #include "common/stats/tag_producer_impl.h"
@@ -11,7 +11,7 @@ namespace Envoy {
 namespace Stats {
 
 TEST(TagProducerTest, CheckConstructor) {
-  envoy::config::metrics::v2::StatsConfig stats_config;
+  envoy::config::metrics::v3alpha::StatsConfig stats_config;
 
   // Should pass there were no tag name conflict.
   auto& tag_specifier1 = *stats_config.mutable_stats_tags()->Add();
diff --git a/test/common/stats/thread_local_store_speed_test.cc b/test/common/stats/thread_local_store_speed_test.cc
index e2f061044c6a..d1b2386e2de8 100644
--- a/test/common/stats/thread_local_store_speed_test.cc
+++ b/test/common/stats/thread_local_store_speed_test.cc
@@ -1,7 +1,7 @@
 // Note: this should be run with --compilation_mode=opt, and would benefit from a
 // quiescent system with disabled cstate power management.
 
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/common/logger.h"
 #include "common/common/thread.h"
@@ -63,7 +63,7 @@ class ThreadLocalStorePerf {
   Api::ApiPtr api_;
   Event::DispatcherPtr dispatcher_;
   std::unique_ptr<ThreadLocal::InstanceImpl> tls_;
-  envoy::config::metrics::v2::StatsConfig stats_config_;
+  envoy::config::metrics::v3alpha::StatsConfig stats_config_;
   std::vector<std::unique_ptr<Stats::StatNameStorage>> stat_names_;
 };
 
diff --git a/test/common/stats/thread_local_store_test.cc b/test/common/stats/thread_local_store_test.cc
index 68b5e48efac6..d866b37c175e 100644
--- a/test/common/stats/thread_local_store_test.cc
+++ b/test/common/stats/thread_local_store_test.cc
@@ -3,7 +3,7 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/common/c_smart_ptr.h"
 #include "common/event/dispatcher_impl.h"
@@ -522,7 +522,7 @@ TEST_F(LookupWithStatNameTest, NotFound) {
 
 class StatsMatcherTLSTest : public StatsThreadLocalStoreTest {
 public:
-  envoy::config::metrics::v2::StatsConfig stats_config_;
+  envoy::config::metrics::v3alpha::StatsConfig stats_config_;
 };
 
 TEST_F(StatsMatcherTLSTest, TestNoOpStatImpls) {
@@ -591,8 +591,10 @@ TEST_F(StatsMatcherTLSTest, TestExclusionRegex) {
   // Expected to alloc lowercase_counter, lowercase_gauge, valid_counter, valid_gauge
 
   // Will block all stats containing any capital alphanumeric letter.
-  stats_config_.mutable_stats_matcher()->mutable_exclusion_list()->add_patterns()->set_regex(
-      ".*[A-Z].*");
+  stats_config_.mutable_stats_matcher()
+      ->mutable_exclusion_list()
+      ->add_patterns()
+      ->set_hidden_envoy_deprecated_regex(".*[A-Z].*");
   store_->setStatsMatcher(std::make_unique<StatsMatcherImpl>(stats_config_));
 
   // The creation of counters/gauges/histograms which have no uppercase letters should succeed.
@@ -829,7 +831,7 @@ TEST_F(StatsThreadLocalStoreTest, RemoveRejectedStats) {
   EXPECT_EQ("h1", store_->histograms()[0]->name());
 
   // Will effectively block all stats, and remove all the non-matching stats.
-  envoy::config::metrics::v2::StatsConfig stats_config;
+  envoy::config::metrics::v3alpha::StatsConfig stats_config;
   stats_config.mutable_stats_matcher()->mutable_inclusion_list()->add_patterns()->set_exact(
       "no-such-stat");
   store_->setStatsMatcher(std::make_unique<StatsMatcherImpl>(stats_config));
@@ -884,7 +886,7 @@ class StatsThreadLocalStoreTestNoFixture : public testing::Test {
     store_->addSink(sink_);
 
     // Use a tag producer that will produce tags.
-    envoy::config::metrics::v2::StatsConfig stats_config;
+    envoy::config::metrics::v3alpha::StatsConfig stats_config;
     store_->setTagProducer(std::make_unique<TagProducerImpl>(stats_config));
   }
 
diff --git a/test/common/stream_info/BUILD b/test/common/stream_info/BUILD
index dee9a0b39c3c..1f9e9eec2ea7 100644
--- a/test/common/stream_info/BUILD
+++ b/test/common/stream_info/BUILD
@@ -47,7 +47,7 @@ envoy_cc_test_library(
         "//source/common/common:assert_lib",
         "//source/common/stream_info:filter_state_lib",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/common/stream_info/test_util.h b/test/common/stream_info/test_util.h
index 5f4b8572d473..2fbed1f3ad32 100644
--- a/test/common/stream_info/test_util.h
+++ b/test/common/stream_info/test_util.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/stream_info/stream_info.h"
 
 #include "common/common/assert.h"
@@ -167,8 +167,10 @@ class TestStreamInfo : public StreamInfo::StreamInfo {
     return duration(end_time_);
   }
 
-  envoy::api::v2::core::Metadata& dynamicMetadata() override { return metadata_; };
-  const envoy::api::v2::core::Metadata& dynamicMetadata() const override { return metadata_; };
+  envoy::config::core::v3alpha::Metadata& dynamicMetadata() override { return metadata_; };
+  const envoy::config::core::v3alpha::Metadata& dynamicMetadata() const override {
+    return metadata_;
+  };
 
   void setDynamicMetadata(const std::string& name, const ProtobufWkt::Struct& value) override {
     (*metadata_.mutable_filter_metadata())[name].MergeFrom(value);
@@ -223,7 +225,7 @@ class TestStreamInfo : public StreamInfo::StreamInfo {
   Ssl::ConnectionInfoConstSharedPtr downstream_connection_info_;
   Ssl::ConnectionInfoConstSharedPtr upstream_connection_info_;
   const Router::RouteEntry* route_entry_{};
-  envoy::api::v2::core::Metadata metadata_{};
+  envoy::config::core::v3alpha::Metadata metadata_{};
   Envoy::StreamInfo::FilterStateImpl filter_state_;
   Envoy::StreamInfo::UpstreamTiming upstream_timing_;
   std::string requested_server_name_;
diff --git a/test/common/tcp_proxy/BUILD b/test/common/tcp_proxy/BUILD
index d86e305f0993..293a5d350917 100644
--- a/test/common/tcp_proxy/BUILD
+++ b/test/common/tcp_proxy/BUILD
@@ -33,8 +33,8 @@ envoy_cc_test(
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/mocks/upstream:host_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/common/tcp_proxy/tcp_proxy_test.cc b/test/common/tcp_proxy/tcp_proxy_test.cc
index a999124dbde4..26fd920ab5e0 100644
--- a/test/common/tcp_proxy/tcp_proxy_test.cc
+++ b/test/common/tcp_proxy/tcp_proxy_test.cc
@@ -5,10 +5,10 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/config/accesslog/v2/file.pb.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.validate.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/file.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.validate.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/network/address_impl.h"
@@ -55,14 +55,14 @@ using ::Envoy::Network::UpstreamServerName;
 namespace {
 Config constructConfigFromYaml(const std::string& yaml,
                                Server::Configuration::FactoryContext& context) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy;
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy tcp_proxy;
   TestUtility::loadFromYamlAndValidate(yaml, tcp_proxy);
   return Config(tcp_proxy, context);
 }
 
 Config constructConfigFromV2Yaml(const std::string& yaml,
                                  Server::Configuration::FactoryContext& context) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy;
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy tcp_proxy;
   TestUtility::loadFromYamlAndValidate(yaml, tcp_proxy);
   return Config(tcp_proxy, context);
 }
@@ -798,23 +798,23 @@ TEST(ConfigTest, HashWithSourceIpDefaultConfig) {
 }
 
 TEST(ConfigTest, AccessLogConfig) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config;
-  envoy::config::filter::accesslog::v2::AccessLog* log = config.mutable_access_log()->Add();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config;
+  envoy::config::filter::accesslog::v3alpha::AccessLog* log = config.mutable_access_log()->Add();
   log->set_name(Extensions::AccessLoggers::AccessLogNames::get().File);
   {
-    envoy::config::accesslog::v2::FileAccessLog file_access_log;
+    envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog file_access_log;
     file_access_log.set_path("some_path");
     file_access_log.set_format("the format specifier");
-    ProtobufWkt::Struct* custom_config = log->mutable_config();
+    ProtobufWkt::Struct* custom_config = log->mutable_hidden_envoy_deprecated_config();
     TestUtility::jsonConvert(file_access_log, *custom_config);
   }
 
   log = config.mutable_access_log()->Add();
   log->set_name(Extensions::AccessLoggers::AccessLogNames::get().File);
   {
-    envoy::config::accesslog::v2::FileAccessLog file_access_log;
+    envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog file_access_log;
     file_access_log.set_path("another path");
-    ProtobufWkt::Struct* custom_config = log->mutable_config();
+    ProtobufWkt::Struct* custom_config = log->mutable_hidden_envoy_deprecated_config();
     TestUtility::jsonConvert(file_access_log, *custom_config);
   }
 
@@ -837,36 +837,37 @@ class TcpProxyTest : public testing::Test {
     }
   }
 
-  void configure(const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& config) {
+  void configure(const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& config) {
     config_.reset(new Config(config, factory_context_));
   }
 
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy defaultConfig() {
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy config;
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy defaultConfig() {
+    envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config;
     config.set_stat_prefix("name");
-    auto* route = config.mutable_deprecated_v1()->mutable_routes()->Add();
+    auto* route = config.mutable_hidden_envoy_deprecated_deprecated_v1()->mutable_routes()->Add();
     route->set_cluster("fake_cluster");
 
     return config;
   }
 
   // Return the default config, plus one file access log with the specified format
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy
   accessLogConfig(const std::string& access_log_format) {
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
-    envoy::config::filter::accesslog::v2::AccessLog* access_log =
+    envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
+    envoy::config::filter::accesslog::v3alpha::AccessLog* access_log =
         config.mutable_access_log()->Add();
     access_log->set_name(Extensions::AccessLoggers::AccessLogNames::get().File);
-    envoy::config::accesslog::v2::FileAccessLog file_access_log;
+    envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog file_access_log;
     file_access_log.set_path("unused");
     file_access_log.set_format(access_log_format);
-    TestUtility::jsonConvert(file_access_log, *access_log->mutable_config());
+    TestUtility::jsonConvert(file_access_log,
+                             *access_log->mutable_hidden_envoy_deprecated_config());
 
     return config;
   }
 
   void setup(uint32_t connections,
-             const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& config) {
+             const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& config) {
     configure(config);
     upstream_local_address_ = Network::Utility::resolveUrl("tcp://2.2.2.2:50000");
     upstream_remote_address_ = Network::Utility::resolveUrl("tcp://127.0.0.1:80");
@@ -964,9 +965,9 @@ class TcpProxyTest : public testing::Test {
 };
 
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(DefaultRoutes)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
 
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy::WeightedCluster::ClusterWeight*
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy::WeightedCluster::ClusterWeight*
       ignored_cluster = config.mutable_weighted_clusters()->mutable_clusters()->Add();
   ignored_cluster->set_name("ignored_cluster");
   ignored_cluster->set_weight(10);
@@ -1036,7 +1037,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(UpstreamRemoteDisconnect)) {
 
 // Test that reconnect is attempted after a local connect failure
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsUpstreamLocalFail)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_max_connect_attempts()->set_value(2);
 
   setup(2, config);
@@ -1052,7 +1053,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsUpstreamLocalFail))
 
 // Test that reconnect is attempted after a remote connect failure
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsUpstreamRemoteFail)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_max_connect_attempts()->set_value(2);
   setup(2, config);
 
@@ -1067,7 +1068,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsUpstreamRemoteFail))
 
 // Test that reconnect is attempted after a connect timeout
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsUpstreamTimeout)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_max_connect_attempts()->set_value(2);
   setup(2, config);
 
@@ -1081,7 +1082,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsUpstreamTimeout)) {
 
 // Test that only the configured number of connect attempts occur
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsLimit)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config =
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config =
       accessLogConfig("%RESPONSE_FLAGS%");
   config.mutable_max_connect_attempts()->set_value(3);
   setup(3, config);
@@ -1108,7 +1109,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(ConnectAttemptsLimit)) {
 
 // Test that the tcp proxy sends the correct notifications to the outlier detector
 TEST_F(TcpProxyTest, OutlierDetection) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_max_connect_attempts()->set_value(3);
   setup(3, config);
 
@@ -1216,7 +1217,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(RouteWithMetadataMatch)) {
     mutable_fields->insert({criterion.name(), criterion.value().value()});
   }
 
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_metadata_match()->mutable_filter_metadata()->insert(
       {Envoy::Config::MetadataFilters::get().ENVOY_LB, metadata_struct});
 
@@ -1375,7 +1376,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(UpstreamConnectionLimit)) {
 // Tests that the idle timer closes both connections, and gets updated when either
 // connection has activity.
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimeout)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_idle_timeout()->set_seconds(1);
   setup(1, config);
 
@@ -1405,7 +1406,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimeout)) {
 
 // Tests that the idle timer is disabled when the downstream connection is closed.
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimerDisabledDownstreamClose)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_idle_timeout()->set_seconds(1);
   setup(1, config);
 
@@ -1419,7 +1420,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimerDisabledDownstreamClose))
 
 // Tests that the idle timer is disabled when the upstream connection is closed.
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimerDisabledUpstreamClose)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_idle_timeout()->set_seconds(1);
   setup(1, config);
 
@@ -1433,7 +1434,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimerDisabledUpstreamClose)) {
 
 // Tests that flushing data during an idle timeout doesn't cause problems.
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(IdleTimeoutWithOutstandingDataFlushed)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_idle_timeout()->set_seconds(1);
   setup(1, config);
 
@@ -1618,7 +1619,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(UpstreamFlushNoTimeout)) {
 // Tests that upstream flush works with an idle timeout configured, but the connection
 // finishes draining before the timer expires.
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(UpstreamFlushTimeoutConfigured)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_idle_timeout()->set_seconds(1);
   setup(1, config);
 
@@ -1650,7 +1651,7 @@ TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(UpstreamFlushTimeoutConfigured)) {
 
 // Tests that upstream flush closes the connection when the idle timeout fires.
 TEST_F(TcpProxyTest, DEPRECATED_FEATURE_TEST(UpstreamFlushTimeoutExpired)) {
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config = defaultConfig();
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config = defaultConfig();
   config.mutable_idle_timeout()->set_seconds(1);
   setup(1, config);
 
diff --git a/test/common/tracing/BUILD b/test/common/tracing/BUILD
index f08ec699acc6..83548e304190 100644
--- a/test/common/tracing/BUILD
+++ b/test/common/tracing/BUILD
@@ -31,7 +31,7 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/type/tracing/v2:pkg_cc_proto",
     ],
 )
diff --git a/test/common/tracing/http_tracer_impl_test.cc b/test/common/tracing/http_tracer_impl_test.cc
index 7a04da9a6667..d6e752228ea7 100644
--- a/test/common/tracing/http_tracer_impl_test.cc
+++ b/test/common/tracing/http_tracer_impl_test.cc
@@ -2,7 +2,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/type/tracing/v2/custom_tag.pb.h"
 
 #include "common/common/base64.h"
@@ -353,8 +353,8 @@ TEST_F(HttpConnManFinalizerImplTest, SpanCustomTags) {
   NiceMock<Router::MockRouteEntry> route_entry;
   EXPECT_CALL(stream_info, routeEntry()).WillRepeatedly(Return(&route_entry));
   (*route_entry.metadata_.mutable_filter_metadata())["m.rot"].MergeFrom(fake_struct);
-  std::shared_ptr<envoy::api::v2::core::Metadata> host_metadata =
-      std::make_shared<envoy::api::v2::core::Metadata>();
+  std::shared_ptr<envoy::config::core::v3alpha::Metadata> host_metadata =
+      std::make_shared<envoy::config::core::v3alpha::Metadata>();
   (*host_metadata->mutable_filter_metadata())["m.host"].MergeFrom(fake_struct);
   (*stream_info.host_->cluster_.metadata_.mutable_filter_metadata())["m.cluster"].MergeFrom(
       fake_struct);
diff --git a/test/common/upstream/BUILD b/test/common/upstream/BUILD
index 27b6c33194d6..5100d146ec1d 100644
--- a/test/common/upstream/BUILD
+++ b/test/common/upstream/BUILD
@@ -21,8 +21,9 @@ envoy_cc_test(
         "//test/mocks/protobuf:protobuf_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -34,10 +35,10 @@ envoy_cc_test(
     ],
     deps = [
         ":test_cluster_manager",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -77,9 +78,10 @@ envoy_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -105,9 +107,9 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/data/core/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -143,7 +145,7 @@ envoy_cc_test(
         "//source/common/upstream:upstream_lib",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -159,9 +161,9 @@ envoy_cc_test(
         "//source/common/upstream:upstream_lib",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -177,8 +179,8 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/service/load_stats/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/load_stats/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -198,8 +200,9 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/health/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -224,8 +227,8 @@ envoy_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -248,7 +251,7 @@ envoy_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -269,7 +272,7 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/cluster:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/data/cluster/v2alpha:pkg_cc_proto",
     ],
 )
@@ -311,7 +314,7 @@ envoy_cc_test(
         "//source/common/upstream:upstream_lib",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -322,7 +325,7 @@ envoy_cc_test(
         ":utility_lib",
         "//source/common/upstream:maglev_lb_lib",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -340,7 +343,7 @@ envoy_cc_test_binary(
         "//test/common/upstream:utility_lib",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -359,8 +362,8 @@ envoy_cc_test(
         "//test/mocks/filesystem:filesystem_mocks",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -378,8 +381,8 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -388,9 +391,9 @@ envoy_cc_test(
     srcs = ["upstream_impl_test.cc"],
     deps = [
         ":utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
         "//include/envoy/api:api_interface",
         "//include/envoy/http:codec_interface",
         "//include/envoy/upstream:cluster_manager_interface",
@@ -426,10 +429,10 @@ envoy_cc_test_library(
         "//source/common/upstream:upstream_includes",
         "//source/common/upstream:upstream_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -470,9 +473,9 @@ envoy_cc_test_library(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -505,6 +508,6 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/common/upstream/cds_api_impl_test.cc b/test/common/upstream/cds_api_impl_test.cc
index 1b4d729eac1f..8a3bc8bdbaeb 100644
--- a/test/common/upstream/cds_api_impl_test.cc
+++ b/test/common/upstream/cds_api_impl_test.cc
@@ -3,9 +3,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/utility.h"
 #include "common/protobuf/utility.h"
@@ -35,7 +35,7 @@ MATCHER_P(WithName, expectedName, "") { return arg.name() == expectedName; }
 class CdsApiImplTest : public testing::Test {
 protected:
   void setup() {
-    envoy::api::v2::core::ConfigSource cds_config;
+    envoy::config::core::v3alpha::ConfigSource cds_config;
     cds_ = CdsApiImpl::create(cds_config, cm_, store_, validation_visitor_);
     cds_->setInitializedCb([this]() -> void { initialized_.ready(); });
 
@@ -78,7 +78,7 @@ TEST_F(CdsApiImplTest, ValidateFail) {
   setup();
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> clusters;
-  envoy::api::v2::Cluster cluster;
+  envoy::config::cluster::v3alpha::Cluster cluster;
   clusters.Add()->PackFrom(cluster);
 
   EXPECT_CALL(cm_, clusters()).WillRepeatedly(Return(cluster_map_));
@@ -103,7 +103,8 @@ version_info: '0'
     eds_config:
       path: eds path
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_yaml);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_yaml);
 
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(ClusterManager::ClusterInfoMap{}));
   expectAdd("cluster1", "0");
@@ -117,7 +118,8 @@ version_info: '0'
 version_info: '1'
 resources:
 )EOF";
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_yaml);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_yaml);
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(makeClusterMap({"cluster1"})));
   EXPECT_CALL(cm_, removeCluster("cluster1")).WillOnce(Return(true));
   cds_callbacks_->onConfigUpdate(response2.resources(), response2.version_info());
@@ -131,7 +133,7 @@ TEST_F(CdsApiImplTest, ValidateDuplicateClusters) {
   setup();
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> clusters;
-  envoy::api::v2::Cluster cluster_1;
+  envoy::config::cluster::v3alpha::Cluster cluster_1;
   cluster_1.set_name("duplicate_cluster");
   clusters.Add()->PackFrom(cluster_1);
   clusters.Add()->PackFrom(cluster_1);
@@ -166,12 +168,12 @@ TEST_F(CdsApiImplTest, ConfigUpdateWith2ValidClusters) {
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> clusters;
 
-  envoy::api::v2::Cluster cluster_1;
+  envoy::config::cluster::v3alpha::Cluster cluster_1;
   cluster_1.set_name("cluster_1");
   clusters.Add()->PackFrom(cluster_1);
   expectAdd("cluster_1");
 
-  envoy::api::v2::Cluster cluster_2;
+  envoy::config::cluster::v3alpha::Cluster cluster_2;
   cluster_2.set_name("cluster_2");
   clusters.Add()->PackFrom(cluster_2);
   expectAdd("cluster_2");
@@ -187,9 +189,9 @@ TEST_F(CdsApiImplTest, DeltaConfigUpdate) {
   EXPECT_CALL(initialized_, ready());
 
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> resources;
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> resources;
     {
-      envoy::api::v2::Cluster cluster;
+      envoy::config::cluster::v3alpha::Cluster cluster;
       cluster.set_name("cluster_1");
       expectAdd("cluster_1", "v1");
       auto* resource = resources.Add();
@@ -198,7 +200,7 @@ TEST_F(CdsApiImplTest, DeltaConfigUpdate) {
       resource->set_version("v1");
     }
     {
-      envoy::api::v2::Cluster cluster;
+      envoy::config::cluster::v3alpha::Cluster cluster;
       cluster.set_name("cluster_2");
       expectAdd("cluster_2", "v1");
       auto* resource = resources.Add();
@@ -210,9 +212,9 @@ TEST_F(CdsApiImplTest, DeltaConfigUpdate) {
   }
 
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Resource> resources;
+    Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> resources;
     {
-      envoy::api::v2::Cluster cluster;
+      envoy::config::cluster::v3alpha::Cluster cluster;
       cluster.set_name("cluster_3");
       expectAdd("cluster_3", "v2");
       auto* resource = resources.Add();
@@ -238,17 +240,17 @@ TEST_F(CdsApiImplTest, ConfigUpdateAddsSecondClusterEvenIfFirstThrows) {
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> clusters;
 
-  envoy::api::v2::Cluster cluster_1;
+  envoy::config::cluster::v3alpha::Cluster cluster_1;
   cluster_1.set_name("cluster_1");
   clusters.Add()->PackFrom(cluster_1);
   expectAddToThrow("cluster_1", "An exception");
 
-  envoy::api::v2::Cluster cluster_2;
+  envoy::config::cluster::v3alpha::Cluster cluster_2;
   cluster_2.set_name("cluster_2");
   clusters.Add()->PackFrom(cluster_2);
   expectAdd("cluster_2");
 
-  envoy::api::v2::Cluster cluster_3;
+  envoy::config::cluster::v3alpha::Cluster cluster_3;
   cluster_3.set_name("cluster_3");
   clusters.Add()->PackFrom(cluster_3);
   expectAddToThrow("cluster_3", "Another exception");
@@ -279,7 +281,8 @@ version_info: '0'
     eds_config:
       path: eds path
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_yaml);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_yaml);
 
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(ClusterManager::ClusterInfoMap{}));
   expectAdd("cluster1", "0");
@@ -305,7 +308,8 @@ version_info: '1'
     eds_config:
       path: eds path
 )EOF";
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_yaml);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_yaml);
 
   EXPECT_CALL(cm_, clusters()).WillOnce(Return(makeClusterMap({"cluster1", "cluster2"})));
   expectAdd("cluster1", "1");
@@ -338,7 +342,8 @@ version_info: '0'
     eds_config:
       path: eds path
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_yaml);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_yaml);
 
   EXPECT_CALL(cm_, clusters()).WillRepeatedly(Return(cluster_map_));
   EXPECT_CALL(initialized_, ready());
diff --git a/test/common/upstream/cluster_factory_impl_test.cc b/test/common/upstream/cluster_factory_impl_test.cc
index d1820575822c..3da95f45e6e7 100644
--- a/test/common/upstream/cluster_factory_impl_test.cc
+++ b/test/common/upstream/cluster_factory_impl_test.cc
@@ -5,7 +5,7 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/http/codec.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -37,7 +37,8 @@ class TestStaticClusterFactory : public ClusterFactoryImplBase {
   TestStaticClusterFactory() : ClusterFactoryImplBase("envoy.clusters.test_static") {}
 
   std::pair<ClusterImplBaseSharedPtr, ThreadAwareLoadBalancerPtr>
-  createClusterImpl(const envoy::api::v2::Cluster& cluster, ClusterFactoryContext& context,
+  createClusterImpl(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                    ClusterFactoryContext& context,
                     Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
                     Stats::ScopePtr&& stats_scope) override {
     return std::make_pair(std::make_shared<CustomStaticCluster>(
@@ -89,7 +90,7 @@ TEST_F(TestStaticClusterImplTest, CreateWithoutConfig) {
   TestStaticClusterFactory factory;
   Registry::InjectFactory<ClusterFactory> registered_factory(factory);
 
-  const envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  const envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   auto create_result = ClusterFactoryImplBase::create(
       cluster_config, cm_, stats_, tls_, dns_resolver_, ssl_context_manager_, runtime_, random_,
       dispatcher_, log_manager_, local_info_, admin_, singleton_manager_,
@@ -130,7 +131,7 @@ TEST_F(TestStaticClusterImplTest, CreateWithStructConfig) {
               port_value: 80
     )EOF";
 
-  const envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  const envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   auto create_result = ClusterFactoryImplBase::create(
       cluster_config, cm_, stats_, tls_, dns_resolver_, ssl_context_manager_, runtime_, random_,
       dispatcher_, log_manager_, local_info_, admin_, singleton_manager_,
@@ -169,7 +170,7 @@ TEST_F(TestStaticClusterImplTest, CreateWithTypedConfig) {
             port_value: 80
     )EOF";
 
-  const envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  const envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   auto create_result = ClusterFactoryImplBase::create(
       cluster_config, cm_, stats_, tls_, dns_resolver_, ssl_context_manager_, runtime_, random_,
       dispatcher_, log_manager_, local_info_, admin_, singleton_manager_,
@@ -208,7 +209,8 @@ TEST_F(TestStaticClusterImplTest, UnsupportedClusterType) {
   // the factory is not registered, expect to throw
   EXPECT_THROW_WITH_MESSAGE(
       {
-        const envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+        const envoy::config::cluster::v3alpha::Cluster cluster_config =
+            parseClusterFromV2Yaml(yaml);
         ClusterFactoryImplBase::create(
             cluster_config, cm_, stats_, tls_, dns_resolver_, ssl_context_manager_, runtime_,
             random_, dispatcher_, log_manager_, local_info_, admin_, singleton_manager_,
diff --git a/test/common/upstream/cluster_manager_impl_test.cc b/test/common/upstream/cluster_manager_impl_test.cc
index fd647957227a..08033201e142 100644
--- a/test/common/upstream/cluster_manager_impl_test.cc
+++ b/test/common/upstream/cluster_manager_impl_test.cc
@@ -1,7 +1,8 @@
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.validate.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "test/common/upstream/test_cluster_manager.h"
 
@@ -19,8 +20,8 @@ namespace Envoy {
 namespace Upstream {
 namespace {
 
-envoy::config::bootstrap::v2::Bootstrap parseBootstrapFromV2Yaml(const std::string& yaml) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+envoy::config::bootstrap::v3alpha::Bootstrap parseBootstrapFromV2Yaml(const std::string& yaml) {
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   TestUtility::loadFromYaml(yaml, bootstrap);
   return bootstrap;
 }
@@ -34,7 +35,7 @@ class ClusterManagerImplTest : public testing::Test {
   ClusterManagerImplTest()
       : api_(Api::createApiForTest()), http_context_(factory_.stats_.symbolTable()) {}
 
-  void create(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  void create(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     cluster_manager_ = std::make_unique<TestClusterManagerImpl>(
         bootstrap, factory_, factory_.stats_, factory_.tls_, factory_.runtime_, factory_.random_,
         factory_.local_info_, log_manager_, factory_.dispatcher_, admin_, validation_context_,
@@ -94,15 +95,15 @@ class ClusterManagerImplTest : public testing::Test {
   void checkConfigDump(const std::string& expected_dump_yaml) {
     auto message_ptr = admin_.config_tracker_.config_tracker_callbacks_["clusters"]();
     const auto& clusters_config_dump =
-        dynamic_cast<const envoy::admin::v2alpha::ClustersConfigDump&>(*message_ptr);
+        dynamic_cast<const envoy::admin::v3alpha::ClustersConfigDump&>(*message_ptr);
 
-    envoy::admin::v2alpha::ClustersConfigDump expected_clusters_config_dump;
+    envoy::admin::v3alpha::ClustersConfigDump expected_clusters_config_dump;
     TestUtility::loadFromYaml(expected_dump_yaml, expected_clusters_config_dump);
     EXPECT_EQ(expected_clusters_config_dump.DebugString(), clusters_config_dump.DebugString());
   }
 
-  envoy::api::v2::core::Metadata buildMetadata(const std::string& version) const {
-    envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata buildMetadata(const std::string& version) const {
+    envoy::config::core::v3alpha::Metadata metadata;
 
     if (!version.empty()) {
       Envoy::Config::Metadata::mutableMetadataValue(
@@ -125,7 +126,7 @@ class ClusterManagerImplTest : public testing::Test {
   Http::ContextImpl http_context_;
 };
 
-envoy::config::bootstrap::v2::Bootstrap defaultConfig() {
+envoy::config::bootstrap::v3alpha::Bootstrap defaultConfig() {
   const std::string yaml = R"EOF(
 static_resources:
   clusters: []
@@ -380,28 +381,28 @@ TEST_F(ClusterManagerImplTest, OriginalDstLbRestriction2) {
                   port_value: 11001
   )EOF";
 
-  EXPECT_THROW_WITH_MESSAGE(
-      create(parseBootstrapFromV2Yaml(yaml)), EnvoyException,
-      "cluster: LB policy ORIGINAL_DST_LB is not valid for Cluster type STATIC. "
-      "'ORIGINAL_DST_LB' is allowed only with cluster type 'ORIGINAL_DST'");
+  EXPECT_THROW_WITH_MESSAGE(create(parseBootstrapFromV2Yaml(yaml)), EnvoyException,
+                            "cluster: LB policy hidden_envoy_deprecated_ORIGINAL_DST_LB is not "
+                            "valid for Cluster type STATIC. "
+                            "'ORIGINAL_DST_LB' is allowed only with cluster type 'ORIGINAL_DST'");
 }
 
 class ClusterManagerSubsetInitializationTest
     : public ClusterManagerImplTest,
-      public testing::WithParamInterface<envoy::api::v2::Cluster_LbPolicy> {
+      public testing::WithParamInterface<envoy::config::cluster::v3alpha::Cluster::LbPolicy> {
 public:
   ClusterManagerSubsetInitializationTest() = default;
 
-  static std::vector<envoy::api::v2::Cluster_LbPolicy> lbPolicies() {
-    int first = static_cast<int>(envoy::api::v2::Cluster::LbPolicy_MIN);
-    int last = static_cast<int>(envoy::api::v2::Cluster::LbPolicy_MAX);
+  static std::vector<envoy::config::cluster::v3alpha::Cluster::LbPolicy> lbPolicies() {
+    int first = static_cast<int>(envoy::config::cluster::v3alpha::Cluster::LbPolicy_MIN);
+    int last = static_cast<int>(envoy::config::cluster::v3alpha::Cluster::LbPolicy_MAX);
     ASSERT(first < last);
 
-    std::vector<envoy::api::v2::Cluster_LbPolicy> policies;
+    std::vector<envoy::config::cluster::v3alpha::Cluster::LbPolicy> policies;
     for (int i = first; i <= last; i++) {
-      if (envoy::api::v2::Cluster::LbPolicy_IsValid(i)) {
-        auto policy = static_cast<envoy::api::v2::Cluster_LbPolicy>(i);
-        if (policy != envoy::api::v2::Cluster::LOAD_BALANCING_POLICY_CONFIG) {
+      if (envoy::config::cluster::v3alpha::Cluster::LbPolicy_IsValid(i)) {
+        auto policy = static_cast<envoy::config::cluster::v3alpha::Cluster::LbPolicy>(i);
+        if (policy != envoy::config::cluster::v3alpha::Cluster::LOAD_BALANCING_POLICY_CONFIG) {
           policies.push_back(policy);
         }
       }
@@ -410,7 +411,7 @@ class ClusterManagerSubsetInitializationTest
   }
 
   static std::string paramName(const testing::TestParamInfo<ParamType>& info) {
-    const std::string& name = envoy::api::v2::Cluster::LbPolicy_Name(info.param);
+    const std::string& name = envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(info.param);
     return absl::StrReplaceAll(name, {{"_", ""}});
   }
 };
@@ -443,23 +444,26 @@ TEST_P(ClusterManagerSubsetInitializationTest, SubsetLoadBalancerInitialization)
                   port_value: 8001
   )EOF";
 
-  const std::string& policy_name = envoy::api::v2::Cluster::LbPolicy_Name(GetParam());
+  const std::string& policy_name =
+      envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(GetParam());
 
   std::string cluster_type = "type: STATIC";
-  if (GetParam() == envoy::api::v2::Cluster::ORIGINAL_DST_LB) {
+  if (GetParam() ==
+      envoy::config::cluster::v3alpha::Cluster::hidden_envoy_deprecated_ORIGINAL_DST_LB) {
     cluster_type = "type: ORIGINAL_DST";
-  } else if (GetParam() == envoy::api::v2::Cluster::CLUSTER_PROVIDED) {
+  } else if (GetParam() == envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED) {
     // This custom cluster type is registered by linking test/integration/custom/static_cluster.cc.
     cluster_type = "cluster_type: { name: envoy.clusters.custom_static_with_lb }";
   }
   const std::string yaml = fmt::format(yamlPattern, cluster_type, policy_name);
 
-  if (GetParam() == envoy::api::v2::Cluster::ORIGINAL_DST_LB ||
-      GetParam() == envoy::api::v2::Cluster::CLUSTER_PROVIDED) {
+  if (GetParam() ==
+          envoy::config::cluster::v3alpha::Cluster::hidden_envoy_deprecated_ORIGINAL_DST_LB ||
+      GetParam() == envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED) {
     EXPECT_THROW_WITH_MESSAGE(
         create(parseBootstrapFromV2Yaml(yaml)), EnvoyException,
         fmt::format("cluster: LB policy {} cannot be combined with lb_subset_config",
-                    envoy::api::v2::Cluster::LbPolicy_Name(GetParam())));
+                    envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(GetParam())));
 
   } else {
     create(parseBootstrapFromV2Yaml(yaml));
@@ -496,9 +500,9 @@ TEST_F(ClusterManagerImplTest, SubsetLoadBalancerOriginalDstRestriction) {
         - keys: [ "x" ]
   )EOF";
 
-  EXPECT_THROW_WITH_MESSAGE(
-      create(parseBootstrapFromV2Yaml(yaml)), EnvoyException,
-      "cluster: LB policy ORIGINAL_DST_LB cannot be combined with lb_subset_config");
+  EXPECT_THROW_WITH_MESSAGE(create(parseBootstrapFromV2Yaml(yaml)), EnvoyException,
+                            "cluster: LB policy hidden_envoy_deprecated_ORIGINAL_DST_LB cannot be "
+                            "combined with lb_subset_config");
 }
 
 TEST_F(ClusterManagerImplTest, SubsetLoadBalancerClusterProvidedLbRestriction) {
@@ -2983,10 +2987,10 @@ class SockoptsTest : public ClusterManagerImplTest {
           NiceMock<Network::MockConnectionSocket> socket;
           if (expect_success) {
             EXPECT_TRUE((Network::Socket::applyOptions(
-                options, socket, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                options, socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
           } else {
             EXPECT_FALSE((Network::Socket::applyOptions(
-                options, socket, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                options, socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
           }
           return connection_;
         }));
@@ -3221,7 +3225,7 @@ class TcpKeepaliveTest : public ClusterManagerImplTest {
                 EXPECT_EQ(1, options->size());
                 NiceMock<Network::MockConnectionSocket> socket;
                 EXPECT_FALSE((Network::Socket::applyOptions(
-                    options, socket, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                    options, socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
                 return connection_;
               }));
       cluster_manager_->tcpConnForCluster("TcpKeepaliveCluster", nullptr);
@@ -3238,7 +3242,7 @@ class TcpKeepaliveTest : public ClusterManagerImplTest {
               EXPECT_NE(nullptr, options.get());
               NiceMock<Network::MockConnectionSocket> socket;
               EXPECT_TRUE((Network::Socket::applyOptions(
-                  options, socket, envoy::api::v2::core::SocketOption::STATE_PREBIND)));
+                  options, socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)));
               return connection_;
             }));
     EXPECT_CALL(os_sys_calls, setsockopt_(_, ENVOY_SOCKET_SO_KEEPALIVE.level(),
diff --git a/test/common/upstream/eds_test.cc b/test/common/upstream/eds_test.cc
index 586b3a2eeb2e..3c8393548b25 100644
--- a/test/common/upstream/eds_test.cc
+++ b/test/common/upstream/eds_test.cc
@@ -1,10 +1,10 @@
 #include <memory>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/utility.h"
@@ -106,7 +106,7 @@ class EdsTest : public testing::Test {
   }
 
   void doOnConfigUpdateVerifyNoThrow(
-      const envoy::api::v2::ClusterLoadAssignment& cluster_load_assignment) {
+      const envoy::config::endpoint::v3alpha::ClusterLoadAssignment& cluster_load_assignment) {
     Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
     resources.Add()->PackFrom(cluster_load_assignment);
     VERBOSE_EXPECT_NO_THROW(eds_callbacks_->onConfigUpdate(resources, ""));
@@ -115,7 +115,7 @@ class EdsTest : public testing::Test {
   bool initialized_{};
   Stats::IsolatedStoreImpl stats_;
   Ssl::MockContextManager ssl_context_manager_;
-  envoy::api::v2::Cluster eds_cluster_;
+  envoy::config::cluster::v3alpha::Cluster eds_cluster_;
   NiceMock<MockClusterManager> cm_;
   NiceMock<Event::MockDispatcher> dispatcher_;
   std::shared_ptr<EdsClusterImpl> cluster_;
@@ -214,13 +214,13 @@ class EdsWithHealthCheckUpdateTest : public EdsTest {
     EXPECT_EQ(0UL, stats_.counter("cluster.name.update_no_rebuild").value());
   }
 
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment_;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment_;
 };
 
 // Negative test for protoc-gen-validate constraints.
 TEST_F(EdsTest, ValidateFail) {
   initialize();
-  envoy::api::v2::ClusterLoadAssignment resource;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment resource;
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
   resources.Add()->PackFrom(resource);
   EXPECT_THROW(eds_callbacks_->onConfigUpdate(resources, ""), ProtoValidationException);
@@ -229,7 +229,7 @@ TEST_F(EdsTest, ValidateFail) {
 
 // Validate that onConfigUpdate() with unexpected cluster names rejects config.
 TEST_F(EdsTest, OnConfigUpdateWrongName) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("wrong name");
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
   resources.Add()->PackFrom(cluster_load_assignment);
@@ -247,7 +247,7 @@ TEST_F(EdsTest, OnConfigUpdateWrongName) {
 TEST_F(EdsTest, OnConfigUpdateEmpty) {
   initialize();
   eds_callbacks_->onConfigUpdate({}, "");
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> resources;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> resources;
   Protobuf::RepeatedPtrField<std::string> removed_resources;
   eds_callbacks_->onConfigUpdate(resources, removed_resources, "");
   EXPECT_EQ(2UL, stats_.counter("cluster.name.update_empty").value());
@@ -257,7 +257,7 @@ TEST_F(EdsTest, OnConfigUpdateEmpty) {
 // Validate that onConfigUpdate() with unexpected cluster vector size rejects config.
 TEST_F(EdsTest, OnConfigUpdateWrongSize) {
   initialize();
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> resources;
   resources.Add()->PackFrom(cluster_load_assignment);
@@ -273,7 +273,7 @@ TEST_F(EdsTest, OnConfigUpdateWrongSize) {
 
 // Validate that onConfigUpdate() with the expected cluster accepts config.
 TEST_F(EdsTest, OnConfigUpdateSuccess) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   initialize();
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
@@ -283,11 +283,11 @@ TEST_F(EdsTest, OnConfigUpdateSuccess) {
 
 // Validate that delta-style onConfigUpdate() with the expected cluster accepts config.
 TEST_F(EdsTest, DeltaOnConfigUpdateSuccess) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   initialize();
 
-  Protobuf::RepeatedPtrField<envoy::api::v2::Resource> resources;
+  Protobuf::RepeatedPtrField<envoy::service::discovery::v3alpha::Resource> resources;
   auto* resource = resources.Add();
   resource->mutable_resource()->PackFrom(cluster_load_assignment);
   resource->set_version("v1");
@@ -313,7 +313,7 @@ TEST_F(EdsTest, NoServiceNameOnSuccessConfigUpdate) {
             refresh_delay: 1s
     )EOF",
                Cluster::InitializePhase::Secondary);
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("name");
   initialize();
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
@@ -323,7 +323,7 @@ TEST_F(EdsTest, NoServiceNameOnSuccessConfigUpdate) {
 // Validate that EDS cluster loaded from file as primary cluster
 TEST_F(EdsTest, EdsClusterFromFileIsPrimaryCluster) {
   resetClusterLoadedFromFile();
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("name");
   initialize();
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
@@ -332,7 +332,7 @@ TEST_F(EdsTest, EdsClusterFromFileIsPrimaryCluster) {
 
 // Validate that onConfigUpdate() updates the endpoint metadata.
 TEST_F(EdsTest, EndpointMetadata) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   auto* endpoints = cluster_load_assignment.add_endpoints();
   auto* endpoint = endpoints->add_lb_endpoints();
@@ -408,20 +408,20 @@ TEST_F(EdsTest, EndpointMetadata) {
 
 // Validate that onConfigUpdate() updates endpoint health status.
 TEST_F(EdsTest, EndpointHealthStatus) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   auto* endpoints = cluster_load_assignment.add_endpoints();
 
   // First check that EDS is correctly mapping
   // envoy::api::v2::core::HealthStatus values to the expected health() status.
-  const std::vector<std::pair<envoy::api::v2::core::HealthStatus, Host::Health>>
+  const std::vector<std::pair<envoy::config::core::v3alpha::HealthStatus, Host::Health>>
       health_status_expected = {
-          {envoy::api::v2::core::HealthStatus::UNKNOWN, Host::Health::Healthy},
-          {envoy::api::v2::core::HealthStatus::HEALTHY, Host::Health::Healthy},
-          {envoy::api::v2::core::HealthStatus::UNHEALTHY, Host::Health::Unhealthy},
-          {envoy::api::v2::core::HealthStatus::DRAINING, Host::Health::Unhealthy},
-          {envoy::api::v2::core::HealthStatus::TIMEOUT, Host::Health::Unhealthy},
-          {envoy::api::v2::core::HealthStatus::DEGRADED, Host::Health::Degraded},
+          {envoy::config::core::v3alpha::UNKNOWN, Host::Health::Healthy},
+          {envoy::config::core::v3alpha::HEALTHY, Host::Health::Healthy},
+          {envoy::config::core::v3alpha::UNHEALTHY, Host::Health::Unhealthy},
+          {envoy::config::core::v3alpha::DRAINING, Host::Health::Unhealthy},
+          {envoy::config::core::v3alpha::TIMEOUT, Host::Health::Unhealthy},
+          {envoy::config::core::v3alpha::DEGRADED, Host::Health::Degraded},
       };
 
   int port = 80;
@@ -448,8 +448,7 @@ TEST_F(EdsTest, EndpointHealthStatus) {
 
   // Perform an update in which we don't change the host set, but flip some host
   // to unhealthy, check we have the expected change in status.
-  endpoints->mutable_lb_endpoints(0)->set_health_status(
-      envoy::api::v2::core::HealthStatus::UNHEALTHY);
+  endpoints->mutable_lb_endpoints(0)->set_health_status(envoy::config::core::v3alpha::UNHEALTHY);
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
   {
     auto& hosts = cluster_->prioritySet().hostSetsPerPriority()[0]->hosts();
@@ -464,7 +463,7 @@ TEST_F(EdsTest, EndpointHealthStatus) {
   // Perform an update in which we don't change the host set, but flip some host
   // to healthy, check we have the expected change in status.
   endpoints->mutable_lb_endpoints(health_status_expected.size() - 1)
-      ->set_health_status(envoy::api::v2::core::HealthStatus::HEALTHY);
+      ->set_health_status(envoy::config::core::v3alpha::HEALTHY);
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
   {
     auto& hosts = cluster_->prioritySet().hostSetsPerPriority()[0]->hosts();
@@ -490,8 +489,7 @@ TEST_F(EdsTest, EndpointHealthStatus) {
 
   // Now mark host 0 healthy via EDS, it should still be unhealthy due to the
   // active health check failure.
-  endpoints->mutable_lb_endpoints(0)->set_health_status(
-      envoy::api::v2::core::HealthStatus::HEALTHY);
+  endpoints->mutable_lb_endpoints(0)->set_health_status(envoy::config::core::v3alpha::HEALTHY);
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
   {
     auto& hosts = cluster_->prioritySet().hostSetsPerPriority()[0]->hosts();
@@ -508,8 +506,7 @@ TEST_F(EdsTest, EndpointHealthStatus) {
 
   const auto rebuild_container = stats_.counter("cluster.name.update_no_rebuild").value();
   // Now mark host 0 degraded via EDS, it should be degraded.
-  endpoints->mutable_lb_endpoints(0)->set_health_status(
-      envoy::api::v2::core::HealthStatus::DEGRADED);
+  endpoints->mutable_lb_endpoints(0)->set_health_status(envoy::config::core::v3alpha::DEGRADED);
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
   {
     auto& hosts = cluster_->prioritySet().hostSetsPerPriority()[0]->hosts();
@@ -524,8 +521,7 @@ TEST_F(EdsTest, EndpointHealthStatus) {
       Host::HealthFlag::DEGRADED_ACTIVE_HC);
 
   // Now mark host 0 healthy via EDS, it should still be degraded.
-  endpoints->mutable_lb_endpoints(0)->set_health_status(
-      envoy::api::v2::core::HealthStatus::HEALTHY);
+  endpoints->mutable_lb_endpoints(0)->set_health_status(envoy::config::core::v3alpha::HEALTHY);
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
   {
     auto& hosts = cluster_->prioritySet().hostSetsPerPriority()[0]->hosts();
@@ -539,7 +535,7 @@ TEST_F(EdsTest, EndpointHealthStatus) {
 // Verify that a host is removed if it is removed from discovery, stabilized, and then later
 // fails active HC.
 TEST_F(EdsTest, EndpointRemovalAfterHcFail) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
 
   auto health_checker = std::make_shared<MockHealthChecker>();
@@ -649,7 +645,7 @@ TEST_F(EdsTest, EndpointRemovalAfterHcFail) {
 // Verify that a host is removed when it is still passing active HC, but has been previously
 // told by the EDS server to fail health check.
 TEST_F(EdsTest, EndpointRemovalEdsFailButActiveHcSuccess) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   auto* endpoints = cluster_load_assignment.add_endpoints();
 
@@ -685,8 +681,7 @@ TEST_F(EdsTest, EndpointRemovalEdsFailButActiveHcSuccess) {
   }
 
   // Mark the first endpoint as unhealthy from EDS.
-  endpoints->mutable_lb_endpoints(0)->set_health_status(
-      envoy::api::v2::core::HealthStatus::UNHEALTHY);
+  endpoints->mutable_lb_endpoints(0)->set_health_status(envoy::config::core::v3alpha::UNHEALTHY);
   doOnConfigUpdateVerifyNoThrow(cluster_load_assignment);
 
   {
@@ -713,7 +708,7 @@ TEST_F(EdsTest, EndpointRemovalEdsFailButActiveHcSuccess) {
 // Validate that onConfigUpdate() removes endpoints that are marked as healthy
 // when configured to drain on host removal.
 TEST_F(EdsTest, EndpointRemovalClusterDrainOnHostRemoval) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   resetClusterDrainOnHostRemoval();
 
@@ -766,7 +761,7 @@ TEST_F(EdsTest, EndpointRemovalClusterDrainOnHostRemoval) {
 
 // Verifies that if an endpoint is moved to a new priority, the active hc status is preserved.
 TEST_F(EdsTest, EndpointMovedToNewPriority) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   resetClusterDrainOnHostRemoval();
 
@@ -867,7 +862,7 @@ TEST_F(EdsTest, EndpointMovedToNewPriority) {
 // Verifies that if an endpoint is moved between priorities, the health check value
 // of the host is preserved
 TEST_F(EdsTest, EndpointMoved) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   resetClusterDrainOnHostRemoval();
 
@@ -954,7 +949,7 @@ TEST_F(EdsTest, EndpointMoved) {
 
 // Validates that we correctly update the host list when a new overprovisioning factor is set.
 TEST_F(EdsTest, EndpointAddedWithNewOverprovisioningFactor) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   cluster_load_assignment.mutable_policy()->mutable_overprovisioning_factor()->set_value(1000);
 
@@ -985,7 +980,7 @@ TEST_F(EdsTest, EndpointAddedWithNewOverprovisioningFactor) {
 
 // Validate that onConfigUpdate() updates the endpoint locality.
 TEST_F(EdsTest, EndpointLocality) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   auto* endpoints = cluster_load_assignment.add_endpoints();
   auto* locality = endpoints->mutable_locality();
@@ -1029,7 +1024,7 @@ TEST_F(EdsTest, EndpointLocality) {
 // Validate that onConfigUpdate() does not propagate locality weights to the host set when
 // locality weighted balancing isn't configured.
 TEST_F(EdsTest, EndpointLocalityWeightsIgnored) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
 
   {
@@ -1058,7 +1053,7 @@ TEST_F(EdsTest, EndpointLocalityWeightsIgnored) {
 // Validate that onConfigUpdate() propagates locality weights to the host set when locality
 // weighted balancing is configured.
 TEST_F(EdsTest, EndpointLocalityWeights) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   resetCluster(R"EOF(
       name: name
@@ -1140,7 +1135,7 @@ TEST_F(EdsTest, EndpointLocalityWeights) {
 // Validate that onConfigUpdate() removes any locality not referenced in the
 // config update in each priority.
 TEST_F(EdsTest, RemoveUnreferencedLocalities) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   uint32_t port = 1000;
   auto add_hosts_to_locality = [&cluster_load_assignment,
@@ -1224,7 +1219,7 @@ TEST_F(EdsTest, RemoveUnreferencedLocalities) {
 
 // Validate that onConfigUpdate() updates bins hosts per locality as expected.
 TEST_F(EdsTest, EndpointHostsPerLocality) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   uint32_t port = 1000;
   auto add_hosts_to_locality = [&cluster_load_assignment,
@@ -1290,7 +1285,7 @@ TEST_F(EdsTest, EndpointHostsPerLocality) {
 
 // Validate that onConfigUpdate() updates all priorities in the prioritySet
 TEST_F(EdsTest, EndpointHostPerPriority) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   uint32_t port = 1000;
   auto add_hosts_to_locality = [&cluster_load_assignment,
@@ -1348,7 +1343,7 @@ TEST_F(EdsTest, EndpointHostPerPriority) {
 
 // Validate that onConfigUpdate() updates bins hosts per priority as expected.
 TEST_F(EdsTest, EndpointHostsPerPriority) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   uint32_t port = 1000;
   auto add_hosts_to_priority = [&cluster_load_assignment, &port](uint32_t priority, uint32_t n) {
@@ -1407,7 +1402,7 @@ TEST_F(EdsTest, NoPriorityForLocalCluster) {
   cm_.local_cluster_name_ = "name";
   resetCluster();
 
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   uint32_t port = 1000;
   auto add_hosts_to_priority = [&cluster_load_assignment, &port](uint32_t priority, uint32_t n) {
@@ -1443,7 +1438,7 @@ TEST_F(EdsTest, NoPriorityForLocalCluster) {
 // Set up an EDS config with multiple priorities and localities and make sure
 // they are loaded and reloaded as expected.
 TEST_F(EdsTest, PriorityAndLocality) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   uint32_t port = 1000;
   auto add_hosts_to_locality_and_priority =
@@ -1534,7 +1529,7 @@ TEST_F(EdsTest, PriorityAndLocality) {
 // Set up an EDS config with multiple priorities, localities, weights and make sure
 // they are loaded and reloaded as expected.
 TEST_F(EdsTest, PriorityAndLocalityWeighted) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   resetCluster(R"EOF(
       name: name
@@ -1708,7 +1703,7 @@ TEST_F(EdsWithHealthCheckUpdateTest, EndpointUpdateHealthCheckConfigWithDrainCon
 
 // Throw on adding a new resource with an invalid endpoint (since the given address is invalid).
 TEST_F(EdsTest, MalformedIP) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   auto* endpoints = cluster_load_assignment.add_endpoints();
 
@@ -1746,7 +1741,7 @@ class EdsAssignmentTimeoutTest : public EdsTest {
 
 // Test that assignment timeout is enabled and disabled correctly.
 TEST_F(EdsAssignmentTimeoutTest, AssignmentTimeoutEnableDisable) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   auto* endpoints = cluster_load_assignment.add_endpoints();
 
@@ -1762,7 +1757,8 @@ TEST_F(EdsAssignmentTimeoutTest, AssignmentTimeoutEnableDisable) {
   socket_address->set_address("1.2.3.4");
   socket_address->set_port_value(80);
 
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment_lease = cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment_lease =
+      cluster_load_assignment;
   cluster_load_assignment_lease.mutable_policy()->mutable_endpoint_stale_after()->MergeFrom(
       Protobuf::util::TimeUtil::SecondsToDuration(1));
 
@@ -1782,7 +1778,7 @@ TEST_F(EdsAssignmentTimeoutTest, AssignmentTimeoutEnableDisable) {
 
 // Test that assignment timeout is called and removes all the endpoints.
 TEST_F(EdsAssignmentTimeoutTest, AssignmentLeaseExpired) {
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("fare");
   cluster_load_assignment.mutable_policy()->mutable_endpoint_stale_after()->MergeFrom(
       Protobuf::util::TimeUtil::SecondsToDuration(1));
diff --git a/test/common/upstream/hds_test.cc b/test/common/upstream/hds_test.cc
index 46419d2fd31e..d73c0bd023bf 100644
--- a/test/common/upstream/hds_test.cc
+++ b/test/common/upstream/hds_test.cc
@@ -1,8 +1,9 @@
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/service/discovery/v2/hds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/service/health/v3alpha/hds.pb.h"
+#include "envoy/type/v3alpha/http.pb.h"
 
 #include "common/singleton/manager_impl.h"
 #include "common/upstream/health_discovery_service.h"
@@ -40,7 +41,7 @@ class HdsDelegateFriend {
   // Allows access to private function processMessage
   void processPrivateMessage(
       HdsDelegate& hd,
-      std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier>&& message) {
+      std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier>&& message) {
     hd.processMessage(std::move(message));
   };
 };
@@ -75,9 +76,9 @@ class HdsTest : public testing::Test {
 
   // Creates a HealthCheckSpecifier message that contains one endpoint and one
   // healthcheck
-  envoy::service::discovery::v2::HealthCheckSpecifier* createSimpleMessage() {
-    envoy::service::discovery::v2::HealthCheckSpecifier* msg =
-        new envoy::service::discovery::v2::HealthCheckSpecifier;
+  envoy::service::health::v3alpha::HealthCheckSpecifier* createSimpleMessage() {
+    envoy::service::health::v3alpha::HealthCheckSpecifier* msg =
+        new envoy::service::health::v3alpha::HealthCheckSpecifier;
     msg->mutable_interval()->set_seconds(1);
 
     auto* health_check = msg->add_cluster_health_checks();
@@ -88,7 +89,7 @@ class HdsTest : public testing::Test {
     health_check->mutable_health_checks(0)->mutable_healthy_threshold()->set_value(2);
     health_check->mutable_health_checks(0)->mutable_grpc_health_check();
     health_check->mutable_health_checks(0)->mutable_http_health_check()->set_codec_client_type(
-        envoy::type::HTTP1);
+        envoy::type::v3alpha::HTTP1);
     health_check->mutable_health_checks(0)->mutable_http_health_check()->set_path("/healthcheck");
 
     auto* socket_address = health_check->add_locality_endpoints()
@@ -102,7 +103,7 @@ class HdsTest : public testing::Test {
   }
 
   Event::SimulatedTimeSystem time_system_;
-  envoy::api::v2::core::Node node_;
+  envoy::config::core::v3alpha::Node node_;
   Event::MockDispatcher dispatcher_;
   Stats::IsolatedStoreImpl stats_store_;
   MockClusterInfoFactory test_factory_;
@@ -117,7 +118,7 @@ class HdsTest : public testing::Test {
 
   std::shared_ptr<Upstream::MockClusterInfo> cluster_info_{
       new NiceMock<Upstream::MockClusterInfo>()};
-  std::unique_ptr<envoy::service::discovery::v2::HealthCheckSpecifier> message;
+  std::unique_ptr<envoy::service::health::v3alpha::HealthCheckSpecifier> message;
   Grpc::MockAsyncStream async_stream_;
   Grpc::MockAsyncClient* async_client_;
   Runtime::MockLoader runtime_;
@@ -135,12 +136,12 @@ class HdsTest : public testing::Test {
 
 // Test that HdsDelegate builds and sends initial message correctly
 TEST_F(HdsTest, HealthCheckRequest) {
-  envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse request;
+  envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse request;
   request.mutable_health_check_request()->mutable_node()->set_id("hds-node");
   request.mutable_health_check_request()->mutable_capability()->add_health_check_protocols(
-      envoy::service::discovery::v2::Capability::HTTP);
+      envoy::service::health::v3alpha::Capability::HTTP);
   request.mutable_health_check_request()->mutable_capability()->add_health_check_protocols(
-      envoy::service::discovery::v2::Capability::TCP);
+      envoy::service::health::v3alpha::Capability::TCP);
 
   EXPECT_CALL(local_info_, node()).WillOnce(ReturnRef(node_));
   EXPECT_CALL(*async_client_, startRaw(_, _, _, _)).WillOnce(Return(&async_stream_));
@@ -158,7 +159,7 @@ TEST_F(HdsTest, TestProcessMessageEndpoints) {
   // Create Message
   // - Cluster "anna0" with 3 endpoints
   // - Cluster "anna1" with 3 endpoints
-  message = std::make_unique<envoy::service::discovery::v2::HealthCheckSpecifier>();
+  message = std::make_unique<envoy::service::health::v3alpha::HealthCheckSpecifier>();
   message->mutable_interval()->set_seconds(1);
 
   for (int i = 0; i < 2; i++) {
@@ -196,7 +197,7 @@ TEST_F(HdsTest, TestProcessMessageHealthChecks) {
   // Create Message
   // - Cluster "minkowski0" with 2 health_checks
   // - Cluster "minkowski1" with 3 health_checks
-  message = std::make_unique<envoy::service::discovery::v2::HealthCheckSpecifier>();
+  message = std::make_unique<envoy::service::health::v3alpha::HealthCheckSpecifier>();
   message->mutable_interval()->set_seconds(1);
 
   for (int i = 0; i < 2; i++) {
@@ -209,7 +210,7 @@ TEST_F(HdsTest, TestProcessMessageHealthChecks) {
       hc->mutable_unhealthy_threshold()->set_value(j + 1);
       hc->mutable_healthy_threshold()->set_value(j + 1);
       hc->mutable_grpc_health_check();
-      hc->mutable_http_health_check()->set_codec_client_type(envoy::type::HTTP1);
+      hc->mutable_http_health_check()->set_codec_client_type(envoy::type::v3alpha::HTTP1);
       hc->mutable_http_health_check()->set_path("/healthcheck");
     }
   }
@@ -231,7 +232,7 @@ TEST_F(HdsTest, TestMinimalOnReceiveMessage) {
   createHdsDelegate();
 
   // Create Message
-  message = std::make_unique<envoy::service::discovery::v2::HealthCheckSpecifier>();
+  message = std::make_unique<envoy::service::health::v3alpha::HealthCheckSpecifier>();
   message->mutable_interval()->set_seconds(1);
 
   // Process message
@@ -246,7 +247,7 @@ TEST_F(HdsTest, TestDefaultIntervalOnReceiveMessage) {
   createHdsDelegate();
 
   // Create Message
-  message = std::make_unique<envoy::service::discovery::v2::HealthCheckSpecifier>();
+  message = std::make_unique<envoy::service::health::v3alpha::HealthCheckSpecifier>();
   // notice that interval field is intentionally left undefined
 
   // Process message
@@ -263,7 +264,7 @@ TEST_F(HdsTest, TestMinimalSendResponse) {
   createHdsDelegate();
 
   // Create Message
-  message = std::make_unique<envoy::service::discovery::v2::HealthCheckSpecifier>();
+  message = std::make_unique<envoy::service::health::v3alpha::HealthCheckSpecifier>();
   message->mutable_interval()->set_seconds(1);
 
   // Process message and send 2 responses
@@ -330,7 +331,7 @@ TEST_F(HdsTest, TestSendResponseOneEndpointTimeout) {
 
   // Correctness
   EXPECT_EQ(msg.endpoint_health_response().endpoints_health(0).health_status(),
-            envoy::api::v2::core::HealthStatus::UNHEALTHY);
+            envoy::config::core::v3alpha::UNHEALTHY);
   EXPECT_EQ(msg.endpoint_health_response()
                 .endpoints_health(0)
                 .endpoint()
diff --git a/test/common/upstream/health_checker_impl_test.cc b/test/common/upstream/health_checker_impl_test.cc
index 32692f90cf18..c140480fd032 100644
--- a/test/common/upstream/health_checker_impl_test.cc
+++ b/test/common/upstream/health_checker_impl_test.cc
@@ -3,11 +3,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/core/health_check.pb.validate.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.validate.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/buffer/zero_copy_input_stream_impl.h"
@@ -48,8 +48,8 @@ namespace Envoy {
 namespace Upstream {
 namespace {
 
-envoy::api::v2::core::HealthCheck createGrpcHealthCheckConfig() {
-  envoy::api::v2::core::HealthCheck health_check;
+envoy::config::core::v3alpha::HealthCheck createGrpcHealthCheckConfig() {
+  envoy::config::core::v3alpha::HealthCheck health_check;
   health_check.mutable_timeout()->set_seconds(1);
   health_check.mutable_interval()->set_seconds(1);
   health_check.mutable_unhealthy_threshold()->set_value(2);
@@ -123,7 +123,8 @@ class HttpHealthCheckerImplTest : public testing::Test {
 
   using TestSessionPtr = std::unique_ptr<TestSession>;
   using HostWithHealthCheckMap =
-      std::unordered_map<std::string, const envoy::api::v2::endpoint::Endpoint::HealthCheckConfig>;
+      std::unordered_map<std::string,
+                         const envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig>;
 
   HttpHealthCheckerImplTest()
       : cluster_(new NiceMock<MockClusterMockPrioritySet>()),
@@ -354,9 +355,9 @@ class HttpHealthCheckerImplTest : public testing::Test {
         });
   }
 
-  const envoy::api::v2::endpoint::Endpoint::HealthCheckConfig
+  const envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig
   makeHealthCheckConfig(const uint32_t port_value) {
-    envoy::api::v2::endpoint::Endpoint::HealthCheckConfig config;
+    envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig config;
     config.set_port_value(port_value);
     return config;
   }
@@ -1060,7 +1061,7 @@ TEST_F(HttpHealthCheckerImplTest, SuccessServiceCheckWithAdditionalHeaders) {
       .WillOnce(Return(true));
 
   EXPECT_CALL(*this, onHostStatus(_, HealthTransition::Unchanged)).Times(1);
-  auto metadata = TestUtility::parseYaml<envoy::api::v2::core::Metadata>(
+  auto metadata = TestUtility::parseYaml<envoy::config::core::v3alpha::Metadata>(
       R"EOF(
         filter_metadata:
           namespace:
@@ -1120,7 +1121,7 @@ TEST_F(HttpHealthCheckerImplTest, SuccessServiceCheckWithoutUserAgent) {
       .WillOnce(Return(true));
 
   EXPECT_CALL(*this, onHostStatus(_, HealthTransition::Unchanged)).Times(1);
-  auto metadata = TestUtility::parseYaml<envoy::api::v2::core::Metadata>(
+  auto metadata = TestUtility::parseYaml<envoy::config::core::v3alpha::Metadata>(
       R"EOF(
         filter_metadata:
           namespace:
@@ -2340,7 +2341,7 @@ TEST(HttpStatusChecker, InvalidRange2) {
 
 TEST(TcpHealthCheckMatcher, loadJsonBytes) {
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload> repeated_payload;
+    Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload> repeated_payload;
     repeated_payload.Add()->set_text("39000000");
     repeated_payload.Add()->set_text("EEEEEEEE");
 
@@ -2350,14 +2351,14 @@ TEST(TcpHealthCheckMatcher, loadJsonBytes) {
   }
 
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload> repeated_payload;
+    Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload> repeated_payload;
     repeated_payload.Add()->set_text("4");
 
     EXPECT_THROW(TcpHealthCheckMatcher::loadProtoBytes(repeated_payload), EnvoyException);
   }
 
   {
-    Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload> repeated_payload;
+    Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload> repeated_payload;
     repeated_payload.Add()->set_text("gg");
 
     EXPECT_THROW(TcpHealthCheckMatcher::loadProtoBytes(repeated_payload), EnvoyException);
@@ -2369,7 +2370,7 @@ static void add_uint8(Buffer::Instance& buffer, uint8_t addend) {
 }
 
 TEST(TcpHealthCheckMatcher, match) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::core::HealthCheck::Payload> repeated_payload;
+  Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HealthCheck::Payload> repeated_payload;
   repeated_payload.Add()->set_text("01");
   repeated_payload.Add()->set_text("02");
 
@@ -4102,8 +4103,8 @@ TEST(HealthCheckEventLoggerImplTest, All) {
                          "\"ipv4_compat\":false,\"port_value\":443}},\"cluster_name\":\"fake_"
                          "cluster\",\"eject_unhealthy_event\":{\"failure_type\":\"ACTIVE\"},"
                          "\"timestamp\":\"2009-02-13T23:31:31.234Z\"}\n"}));
-  event_logger.logEjectUnhealthy(envoy::data::core::v2alpha::HealthCheckerType::HTTP, host,
-                                 envoy::data::core::v2alpha::HealthCheckFailureType::ACTIVE);
+  event_logger.logEjectUnhealthy(envoy::data::core::v3alpha::HTTP, host,
+                                 envoy::data::core::v3alpha::ACTIVE);
 
   EXPECT_CALL(*file, write(absl::string_view{
                          "{\"health_checker_type\":\"HTTP\",\"host\":{\"socket_address\":{"
@@ -4111,7 +4112,7 @@ TEST(HealthCheckEventLoggerImplTest, All) {
                          "\"ipv4_compat\":false,\"port_value\":443}},\"cluster_name\":\"fake_"
                          "cluster\",\"add_healthy_event\":{\"first_check\":false},\"timestamp\":"
                          "\"2009-02-13T23:31:31.234Z\"}\n"}));
-  event_logger.logAddHealthy(envoy::data::core::v2alpha::HealthCheckerType::HTTP, host, false);
+  event_logger.logAddHealthy(envoy::data::core::v3alpha::HTTP, host, false);
 
   EXPECT_CALL(*file, write(absl::string_view{
                          "{\"health_checker_type\":\"HTTP\",\"host\":{\"socket_address\":{"
@@ -4120,8 +4121,8 @@ TEST(HealthCheckEventLoggerImplTest, All) {
                          "cluster\",\"health_check_failure_event\":{\"failure_type\":\"ACTIVE\","
                          "\"first_check\":false},"
                          "\"timestamp\":\"2009-02-13T23:31:31.234Z\"}\n"}));
-  event_logger.logUnhealthy(envoy::data::core::v2alpha::HealthCheckerType::HTTP, host,
-                            envoy::data::core::v2alpha::HealthCheckFailureType::ACTIVE, false);
+  event_logger.logUnhealthy(envoy::data::core::v3alpha::HTTP, host,
+                            envoy::data::core::v3alpha::ACTIVE, false);
 
   EXPECT_CALL(*file, write(absl::string_view{
                          "{\"health_checker_type\":\"HTTP\",\"host\":{\"socket_address\":{"
@@ -4129,7 +4130,7 @@ TEST(HealthCheckEventLoggerImplTest, All) {
                          "\"ipv4_compat\":false,\"port_value\":443}},\"cluster_name\":\"fake_"
                          "cluster\",\"degraded_healthy_host\":{},"
                          "\"timestamp\":\"2009-02-13T23:31:31.234Z\"}\n"}));
-  event_logger.logDegraded(envoy::data::core::v2alpha::HealthCheckerType::HTTP, host);
+  event_logger.logDegraded(envoy::data::core::v3alpha::HTTP, host);
 
   EXPECT_CALL(*file, write(absl::string_view{
                          "{\"health_checker_type\":\"HTTP\",\"host\":{\"socket_address\":{"
@@ -4137,7 +4138,7 @@ TEST(HealthCheckEventLoggerImplTest, All) {
                          "\"ipv4_compat\":false,\"port_value\":443}},\"cluster_name\":\"fake_"
                          "cluster\",\"no_longer_degraded_host\":{},"
                          "\"timestamp\":\"2009-02-13T23:31:31.234Z\"}\n"}));
-  event_logger.logNoLongerDegraded(envoy::data::core::v2alpha::HealthCheckerType::HTTP, host);
+  event_logger.logNoLongerDegraded(envoy::data::core::v3alpha::HTTP, host);
 }
 
 // Validate that the proto constraints don't allow zero length edge durations.
diff --git a/test/common/upstream/load_balancer_benchmark.cc b/test/common/upstream/load_balancer_benchmark.cc
index a11341b099d2..29a223eb352f 100644
--- a/test/common/upstream/load_balancer_benchmark.cc
+++ b/test/common/upstream/load_balancer_benchmark.cc
@@ -2,7 +2,7 @@
 
 #include <memory>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/memory/stats.h"
 #include "common/runtime/runtime_impl.h"
@@ -46,7 +46,7 @@ class BaseTester {
   ClusterStats stats_{ClusterInfoImpl::generateStats(stats_store_)};
   NiceMock<Runtime::MockLoader> runtime_;
   Runtime::RandomGeneratorImpl random_;
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   std::shared_ptr<MockClusterInfo> info_{new NiceMock<MockClusterInfo>()};
 };
 
@@ -66,7 +66,7 @@ class RoundRobinTester : public BaseTester {
 class LeastRequestTester : public BaseTester {
 public:
   LeastRequestTester(uint64_t num_hosts, uint32_t choice_count) : BaseTester(num_hosts) {
-    envoy::api::v2::Cluster::LeastRequestLbConfig lr_lb_config;
+    envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig lr_lb_config;
     lr_lb_config.mutable_choice_count()->set_value(choice_count);
     lb_ =
         std::make_unique<LeastRequestLoadBalancer>(priority_set_, &local_priority_set_, stats_,
@@ -121,13 +121,13 @@ BENCHMARK(BM_RoundRobinLoadBalancerBuild)
 class RingHashTester : public BaseTester {
 public:
   RingHashTester(uint64_t num_hosts, uint64_t min_ring_size) : BaseTester(num_hosts) {
-    config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+    config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
     config_.value().mutable_minimum_ring_size()->set_value(min_ring_size);
     ring_hash_lb_ = std::make_unique<RingHashLoadBalancer>(
         priority_set_, stats_, stats_store_, runtime_, random_, config_, common_config_);
   }
 
-  absl::optional<envoy::api::v2::Cluster::RingHashLbConfig> config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig> config_;
   std::unique_ptr<RingHashLoadBalancer> ring_hash_lb_;
 };
 
diff --git a/test/common/upstream/load_balancer_impl_test.cc b/test/common/upstream/load_balancer_impl_test.cc
index 1f200a636dd6..2963e61771ed 100644
--- a/test/common/upstream/load_balancer_impl_test.cc
+++ b/test/common/upstream/load_balancer_impl_test.cc
@@ -4,7 +4,7 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/network/utility.h"
 #include "common/upstream/load_balancer_impl.h"
@@ -44,15 +44,15 @@ class LoadBalancerTestBase : public testing::TestWithParam<bool> {
   MockHostSet& host_set_ = *priority_set_.getMockHostSet(0);
   MockHostSet& failover_host_set_ = *priority_set_.getMockHostSet(1);
   std::shared_ptr<MockClusterInfo> info_{new NiceMock<MockClusterInfo>()};
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
-  envoy::api::v2::Cluster::LeastRequestLbConfig least_request_lb_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig least_request_lb_config_;
 };
 
 class TestLb : public LoadBalancerBase {
 public:
   TestLb(const PrioritySet& priority_set, ClusterStats& stats, Runtime::Loader& runtime,
          Runtime::RandomGenerator& random,
-         const envoy::api::v2::Cluster::CommonLbConfig& common_config)
+         const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig& common_config)
       : LoadBalancerBase(priority_set, stats, runtime, random, common_config) {}
   using LoadBalancerBase::chooseHostSet;
   using LoadBalancerBase::isInPanic;
@@ -115,7 +115,7 @@ class LoadBalancerBaseTest : public LoadBalancerTestBase {
     return aggregatePrioritySetsValues<bool>(lb_, &TestLb::isInPanic);
   }
 
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   TestLb lb_{priority_set_, stats_, runtime_, random_, common_config_};
 };
 
@@ -1380,7 +1380,7 @@ TEST_P(LeastRequestLoadBalancerTest, PNC) {
   hostSet().healthy_hosts_[3]->stats().rq_active_.set(1);
 
   // Creating various load balancer objects with different choice configs.
-  envoy::api::v2::Cluster::LeastRequestLbConfig lr_lb_config;
+  envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig lr_lb_config;
   lr_lb_config.mutable_choice_count()->set_value(2);
   LeastRequestLoadBalancer lb_2{priority_set_, nullptr,        stats_,      runtime_,
                                 random_,       common_config_, lr_lb_config};
@@ -1523,11 +1523,12 @@ TEST_P(RandomLoadBalancerTest, FailClusterOnPanic) {
 INSTANTIATE_TEST_SUITE_P(PrimaryOrFailover, RandomLoadBalancerTest, ::testing::Values(true, false));
 
 TEST(LoadBalancerSubsetInfoImplTest, DefaultConfigIsDiabled) {
-  auto subset_info =
-      LoadBalancerSubsetInfoImpl(envoy::api::v2::Cluster::LbSubsetConfig::default_instance());
+  auto subset_info = LoadBalancerSubsetInfoImpl(
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance());
 
   EXPECT_FALSE(subset_info.isEnabled());
-  EXPECT_TRUE(subset_info.fallbackPolicy() == envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK);
+  EXPECT_TRUE(subset_info.fallbackPolicy() ==
+              envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK);
   EXPECT_EQ(subset_info.defaultSubset().fields_size(), 0);
   EXPECT_EQ(subset_info.subsetSelectors().size(), 0);
 }
@@ -1536,43 +1537,46 @@ TEST(LoadBalancerSubsetInfoImplTest, SubsetConfig) {
   auto subset_value = ProtobufWkt::Value();
   subset_value.set_string_value("the value");
 
-  auto subset_config = envoy::api::v2::Cluster::LbSubsetConfig::default_instance();
-  subset_config.set_fallback_policy(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET);
+  auto subset_config = envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance();
+  subset_config.set_fallback_policy(
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET);
   subset_config.mutable_default_subset()->mutable_fields()->insert({"key", subset_value});
   auto subset_selector1 = subset_config.mutable_subset_selectors()->Add();
   subset_selector1->add_keys("selector_key1");
   auto subset_selector2 = subset_config.mutable_subset_selectors()->Add();
   subset_selector2->add_keys("selector_key2");
   subset_selector2->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT);
 
   auto subset_info = LoadBalancerSubsetInfoImpl(subset_config);
 
   EXPECT_TRUE(subset_info.isEnabled());
   EXPECT_TRUE(subset_info.fallbackPolicy() ==
-              envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET);
+              envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET);
   EXPECT_EQ(subset_info.defaultSubset().fields_size(), 1);
   EXPECT_EQ(subset_info.defaultSubset().fields().at("key").string_value(),
             std::string("the value"));
   EXPECT_EQ(subset_info.subsetSelectors().size(), 2);
   EXPECT_EQ(subset_info.subsetSelectors()[0]->selectorKeys(),
             std::set<std::string>({"selector_key1"}));
-  EXPECT_EQ(subset_info.subsetSelectors()[0]->fallbackPolicy(),
-            envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED);
+  EXPECT_EQ(
+      subset_info.subsetSelectors()[0]->fallbackPolicy(),
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED);
   EXPECT_EQ(subset_info.subsetSelectors()[1]->selectorKeys(),
             std::set<std::string>({"selector_key2"}));
-  EXPECT_EQ(subset_info.subsetSelectors()[1]->fallbackPolicy(),
-            envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT);
+  EXPECT_EQ(
+      subset_info.subsetSelectors()[1]->fallbackPolicy(),
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT);
 }
 
 TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetFallbackValid) {
-  auto subset_config = envoy::api::v2::Cluster::LbSubsetConfig::default_instance();
+  auto subset_config = envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance();
   auto selector1 = subset_config.mutable_subset_selectors()->Add();
   selector1->add_keys("key1");
   selector1->add_keys("key2");
   selector1->add_keys("key3");
   selector1->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
   selector1->add_fallback_keys_subset("key1");
   selector1->add_fallback_keys_subset("key3");
 
@@ -1581,20 +1585,22 @@ TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetFallbackValid) {
   selector2->add_keys("key3");
   selector2->add_keys("key4");
   selector2->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
   selector2->add_fallback_keys_subset("key4");
 
   auto subset_info = LoadBalancerSubsetInfoImpl(subset_config);
 
-  EXPECT_EQ(subset_info.subsetSelectors()[0]->fallbackPolicy(),
-            envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+  EXPECT_EQ(
+      subset_info.subsetSelectors()[0]->fallbackPolicy(),
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
   EXPECT_EQ(subset_info.subsetSelectors()[0]->selectorKeys(),
             std::set<std::string>({"key1", "key2", "key3"}));
   EXPECT_EQ(subset_info.subsetSelectors()[0]->fallbackKeysSubset(),
             std::set<std::string>({"key1", "key3"}));
 
-  EXPECT_EQ(subset_info.subsetSelectors()[1]->fallbackPolicy(),
-            envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+  EXPECT_EQ(
+      subset_info.subsetSelectors()[1]->fallbackPolicy(),
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
   EXPECT_EQ(subset_info.subsetSelectors()[1]->selectorKeys(),
             std::set<std::string>({"key1", "key3", "key4"}));
   EXPECT_EQ(subset_info.subsetSelectors()[1]->fallbackKeysSubset(),
@@ -1602,13 +1608,13 @@ TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetFallbackValid) {
 }
 
 TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetForOtherPolicyInvalid) {
-  auto subset_config = envoy::api::v2::Cluster::LbSubsetConfig::default_instance();
+  auto subset_config = envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance();
   auto selector = subset_config.mutable_subset_selectors()->Add();
 
   selector->add_keys("key1");
   selector->add_keys("key2");
   selector->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT);
   selector->add_fallback_keys_subset("key1");
 
   EXPECT_THROW_WITH_MESSAGE(LoadBalancerSubsetInfoImpl{subset_config}, EnvoyException,
@@ -1616,13 +1622,13 @@ TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetForOtherPolicyInvalid) {
 }
 
 TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetNotASubsetInvalid) {
-  auto subset_config = envoy::api::v2::Cluster::LbSubsetConfig::default_instance();
+  auto subset_config = envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance();
   auto selector = subset_config.mutable_subset_selectors()->Add();
 
   selector->add_keys("key1");
   selector->add_keys("key2");
   selector->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
   selector->add_fallback_keys_subset("key3");
 
   EXPECT_THROW_WITH_MESSAGE(LoadBalancerSubsetInfoImpl{subset_config}, EnvoyException,
@@ -1630,26 +1636,26 @@ TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetNotASubsetInvalid) {
 }
 
 TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetEmptyInvalid) {
-  auto subset_config = envoy::api::v2::Cluster::LbSubsetConfig::default_instance();
+  auto subset_config = envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance();
   auto selector = subset_config.mutable_subset_selectors()->Add();
 
   selector->add_keys("key1");
   selector->add_keys("key2");
   selector->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
 
   EXPECT_THROW_WITH_MESSAGE(LoadBalancerSubsetInfoImpl{subset_config}, EnvoyException,
                             "fallback_keys_subset cannot be empty");
 }
 
 TEST(LoadBalancerSubsetInfoImplTest, KeysSubsetEqualKeysInvalid) {
-  auto subset_config = envoy::api::v2::Cluster::LbSubsetConfig::default_instance();
+  auto subset_config = envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::default_instance();
   auto selector = subset_config.mutable_subset_selectors()->Add();
 
   selector->add_keys("key1");
   selector->add_keys("key2");
   selector->set_fallback_policy(
-      envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET);
   selector->add_fallback_keys_subset("key2");
   selector->add_fallback_keys_subset("key1");
 
diff --git a/test/common/upstream/load_balancer_simulation_test.cc b/test/common/upstream/load_balancer_simulation_test.cc
index 4cca47733fba..cd1d3a7527d3 100644
--- a/test/common/upstream/load_balancer_simulation_test.cc
+++ b/test/common/upstream/load_balancer_simulation_test.cc
@@ -2,10 +2,10 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/network/utility.h"
@@ -30,13 +30,13 @@ namespace {
 static HostSharedPtr newTestHost(Upstream::ClusterInfoConstSharedPtr cluster,
                                  const std::string& url, uint32_t weight = 1,
                                  const std::string& zone = "") {
-  envoy::api::v2::core::Locality locality;
+  envoy::config::core::v3alpha::Locality locality;
   locality.set_zone(zone);
-  return HostSharedPtr{
-      new HostImpl(cluster, "", Network::Utility::resolveUrl(url),
-                   envoy::api::v2::core::Metadata::default_instance(), weight, locality,
-                   envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), 0,
-                   envoy::api::v2::core::HealthStatus::UNKNOWN)};
+  return HostSharedPtr{new HostImpl(
+      cluster, "", Network::Utility::resolveUrl(url),
+      envoy::config::core::v3alpha::Metadata::default_instance(), weight, locality,
+      envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(), 0,
+      envoy::config::core::v3alpha::UNKNOWN)};
 }
 
 // Simulate weighted LR load balancer.
@@ -71,8 +71,8 @@ TEST(DISABLED_LeastRequestLoadBalancerWeightTest, Weight) {
   stats.max_host_weight_.set(weight);
   NiceMock<Runtime::MockLoader> runtime;
   Runtime::RandomGeneratorImpl random;
-  envoy::api::v2::Cluster::LeastRequestLbConfig least_request_lb_config;
-  envoy::api::v2::Cluster::CommonLbConfig common_config;
+  envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig least_request_lb_config;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config;
   LeastRequestLoadBalancer lb_{
       priority_set, nullptr, stats, runtime, random, common_config, least_request_lb_config};
 
@@ -239,7 +239,7 @@ class DISABLED_SimulationTest : public testing::Test {
   Runtime::RandomGeneratorImpl random_;
   Stats::IsolatedStoreImpl stats_store_;
   ClusterStats stats_;
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
 };
 
 TEST_F(DISABLED_SimulationTest, strictlyEqualDistribution) {
diff --git a/test/common/upstream/load_stats_reporter_test.cc b/test/common/upstream/load_stats_reporter_test.cc
index 0e6a657827ef..590f5f444e2e 100644
--- a/test/common/upstream/load_stats_reporter_test.cc
+++ b/test/common/upstream/load_stats_reporter_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/api/v2/endpoint/load_report.pb.h"
-#include "envoy/service/load_stats/v2/lrs.pb.h"
+#include "envoy/config/endpoint/v3alpha/load_report.pb.h"
+#include "envoy/service/load_stats/v3alpha/lrs.pb.h"
 
 #include "common/upstream/load_stats_reporter.h"
 
@@ -48,8 +48,8 @@ class LoadStatsReporterTest : public testing::Test {
   }
 
   void expectSendMessage(
-      const std::vector<envoy::api::v2::endpoint::ClusterStats>& expected_cluster_stats) {
-    envoy::service::load_stats::v2::LoadStatsRequest expected_request;
+      const std::vector<envoy::config::endpoint::v3alpha::ClusterStats>& expected_cluster_stats) {
+    envoy::service::load_stats::v3alpha::LoadStatsRequest expected_request;
     expected_request.mutable_node()->MergeFrom(local_info_.node());
     std::copy(expected_cluster_stats.begin(), expected_cluster_stats.end(),
               Protobuf::RepeatedPtrFieldBackInserter(expected_request.mutable_cluster_stats()));
@@ -57,8 +57,8 @@ class LoadStatsReporterTest : public testing::Test {
   }
 
   void deliverLoadStatsResponse(const std::vector<std::string>& cluster_names) {
-    std::unique_ptr<envoy::service::load_stats::v2::LoadStatsResponse> response(
-        new envoy::service::load_stats::v2::LoadStatsResponse());
+    std::unique_ptr<envoy::service::load_stats::v3alpha::LoadStatsResponse> response(
+        new envoy::service::load_stats::v3alpha::LoadStatsResponse());
     response->mutable_load_reporting_interval()->set_seconds(42);
     std::copy(cluster_names.begin(), cluster_names.end(),
               Protobuf::RepeatedPtrFieldBackInserter(response->mutable_clusters()));
@@ -127,7 +127,7 @@ TEST_F(LoadStatsReporterTest, ExistingClusters) {
   foo_cluster.info_->load_report_stats_.upstream_rq_dropped_.add(5);
   time_system_.setMonotonicTime(std::chrono::microseconds(4));
   {
-    envoy::api::v2::endpoint::ClusterStats foo_cluster_stats;
+    envoy::config::endpoint::v3alpha::ClusterStats foo_cluster_stats;
     foo_cluster_stats.set_cluster_name("foo");
     foo_cluster_stats.set_cluster_service_name("bar");
     foo_cluster_stats.set_total_dropped_requests(5);
@@ -150,13 +150,13 @@ TEST_F(LoadStatsReporterTest, ExistingClusters) {
   bar_cluster.info_->load_report_stats_.upstream_rq_dropped_.add(1);
   time_system_.setMonotonicTime(std::chrono::microseconds(28));
   {
-    envoy::api::v2::endpoint::ClusterStats foo_cluster_stats;
+    envoy::config::endpoint::v3alpha::ClusterStats foo_cluster_stats;
     foo_cluster_stats.set_cluster_name("foo");
     foo_cluster_stats.set_cluster_service_name("bar");
     foo_cluster_stats.set_total_dropped_requests(2);
     foo_cluster_stats.mutable_load_report_interval()->MergeFrom(
         Protobuf::util::TimeUtil::MicrosecondsToDuration(24));
-    envoy::api::v2::endpoint::ClusterStats bar_cluster_stats;
+    envoy::config::endpoint::v3alpha::ClusterStats bar_cluster_stats;
     bar_cluster_stats.set_cluster_name("bar");
     bar_cluster_stats.set_total_dropped_requests(1);
     bar_cluster_stats.mutable_load_report_interval()->MergeFrom(
@@ -177,7 +177,7 @@ TEST_F(LoadStatsReporterTest, ExistingClusters) {
   bar_cluster.info_->load_report_stats_.upstream_rq_dropped_.add(5);
   time_system_.setMonotonicTime(std::chrono::microseconds(33));
   {
-    envoy::api::v2::endpoint::ClusterStats bar_cluster_stats;
+    envoy::config::endpoint::v3alpha::ClusterStats bar_cluster_stats;
     bar_cluster_stats.set_cluster_name("bar");
     bar_cluster_stats.set_total_dropped_requests(6);
     bar_cluster_stats.mutable_load_report_interval()->MergeFrom(
@@ -199,13 +199,13 @@ TEST_F(LoadStatsReporterTest, ExistingClusters) {
   bar_cluster.info_->load_report_stats_.upstream_rq_dropped_.add(1);
   time_system_.setMonotonicTime(std::chrono::microseconds(47));
   {
-    envoy::api::v2::endpoint::ClusterStats foo_cluster_stats;
+    envoy::config::endpoint::v3alpha::ClusterStats foo_cluster_stats;
     foo_cluster_stats.set_cluster_name("foo");
     foo_cluster_stats.set_cluster_service_name("bar");
     foo_cluster_stats.set_total_dropped_requests(1);
     foo_cluster_stats.mutable_load_report_interval()->MergeFrom(
         Protobuf::util::TimeUtil::MicrosecondsToDuration(4));
-    envoy::api::v2::endpoint::ClusterStats bar_cluster_stats;
+    envoy::config::endpoint::v3alpha::ClusterStats bar_cluster_stats;
     bar_cluster_stats.set_cluster_name("bar");
     bar_cluster_stats.set_total_dropped_requests(2);
     bar_cluster_stats.mutable_load_report_interval()->MergeFrom(
diff --git a/test/common/upstream/logical_dns_cluster_test.cc b/test/common/upstream/logical_dns_cluster_test.cc
index 77de14fe34c0..f2745f44b916 100644
--- a/test/common/upstream/logical_dns_cluster_test.cc
+++ b/test/common/upstream/logical_dns_cluster_test.cc
@@ -4,8 +4,8 @@
 #include <tuple>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/network/utility.h"
@@ -45,7 +45,7 @@ class LogicalDnsClusterTest : public testing::Test {
   void setupFromV2Yaml(const std::string& yaml) {
     resolve_timer_ = new Event::MockTimer(&dispatcher_);
     NiceMock<MockClusterManager> cm;
-    envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+    envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
     Envoy::Stats::ScopePtr scope = stats_store_.createScope(fmt::format(
         "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                               : cluster_config.alt_stat_name()));
@@ -130,7 +130,7 @@ class LogicalDnsClusterTest : public testing::Test {
     EXPECT_EQ("", data.host_description_->locality().zone());
     EXPECT_EQ("", data.host_description_->locality().sub_zone());
     EXPECT_EQ("foo.bar.com", data.host_description_->hostname());
-    EXPECT_TRUE(TestUtility::protoEqual(envoy::api::v2::core::Metadata::default_instance(),
+    EXPECT_TRUE(TestUtility::protoEqual(envoy::config::core::v3alpha::Metadata::default_instance(),
                                         *data.host_description_->metadata()));
     data.host_description_->outlierDetector().putHttpResponseCode(200);
     data.host_description_->healthChecker().setUnhealthy();
diff --git a/test/common/upstream/maglev_lb_test.cc b/test/common/upstream/maglev_lb_test.cc
index c4966c3b2229..e29b09161853 100644
--- a/test/common/upstream/maglev_lb_test.cc
+++ b/test/common/upstream/maglev_lb_test.cc
@@ -1,6 +1,6 @@
 #include <memory>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/upstream/maglev_lb.h"
 
@@ -38,7 +38,7 @@ class MaglevLoadBalancerTest : public testing::Test {
   std::shared_ptr<MockClusterInfo> info_{new NiceMock<MockClusterInfo>()};
   Stats::IsolatedStoreImpl stats_store_;
   ClusterStats stats_;
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   NiceMock<Runtime::MockLoader> runtime_;
   NiceMock<Runtime::MockRandomGenerator> random_;
   std::unique_ptr<MaglevLoadBalancer> lb_;
diff --git a/test/common/upstream/original_dst_cluster_test.cc b/test/common/upstream/original_dst_cluster_test.cc
index 81dd50fb9594..692a02ae2f2e 100644
--- a/test/common/upstream/original_dst_cluster_test.cc
+++ b/test/common/upstream/original_dst_cluster_test.cc
@@ -4,7 +4,7 @@
 #include <tuple>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/network/address_impl.h"
@@ -68,7 +68,7 @@ class OriginalDstClusterTest : public testing::Test {
 
   void setupFromYaml(const std::string& yaml) { setup(parseClusterFromV2Yaml(yaml)); }
 
-  void setup(const envoy::api::v2::Cluster& cluster_config) {
+  void setup(const envoy::config::cluster::v3alpha::Cluster& cluster_config) {
     NiceMock<MockClusterManager> cm;
     Envoy::Stats::ScopePtr scope = stats_store_.createScope(fmt::format(
         "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
diff --git a/test/common/upstream/outlier_detection_impl_test.cc b/test/common/upstream/outlier_detection_impl_test.cc
index c6ab6692665b..0c6ee0794d4d 100644
--- a/test/common/upstream/outlier_detection_impl_test.cc
+++ b/test/common/upstream/outlier_detection_impl_test.cc
@@ -4,8 +4,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cluster/outlier_detection.pb.h"
 #include "envoy/common/time.h"
+#include "envoy/config/cluster/v3alpha/outlier_detection.pb.h"
 #include "envoy/data/cluster/v2alpha/outlier_detection_event.pb.h"
 
 #include "common/network/utility.h"
@@ -115,8 +115,8 @@ class OutlierDetectorImplTest : public testing::Test {
   CallbackChecker checker_;
   Event::SimulatedTimeSystem time_system_;
   std::shared_ptr<MockEventLogger> event_logger_{new MockEventLogger()};
-  envoy::api::v2::cluster::OutlierDetection empty_outlier_detection_;
-  envoy::api::v2::cluster::OutlierDetection outlier_detection_split_;
+  envoy::config::cluster::v3alpha::OutlierDetection empty_outlier_detection_;
+  envoy::config::cluster::v3alpha::OutlierDetection outlier_detection_split_;
   Stats::Gauge& outlier_detection_ejections_active_;
 };
 
@@ -136,7 +136,7 @@ failure_percentage_request_volume: 25
 failure_percentage_threshold: 70
   )EOF";
 
-  envoy::api::v2::cluster::OutlierDetection outlier_detection;
+  envoy::config::cluster::v3alpha::OutlierDetection outlier_detection;
   TestUtility::loadFromYaml(yaml, outlier_detection);
   EXPECT_CALL(*interval_timer_, enableTimer(std::chrono::milliseconds(100), _));
   std::shared_ptr<DetectorImpl> detector(DetectorImpl::create(
@@ -174,9 +174,8 @@ TEST_F(OutlierDetectorImplTest, DestroyWithActive) {
   loadRq(hosts_[0], 4, 500);
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, 500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
   EXPECT_EQ(1UL, outlier_detection_ejections_active_.value());
@@ -186,7 +185,7 @@ TEST_F(OutlierDetectorImplTest, DestroyWithActive) {
   EXPECT_CALL(checker_, check(failover_hosts_[0]));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(failover_hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(failover_hosts_[0], 1, 500);
   EXPECT_TRUE(failover_hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
   EXPECT_EQ(2UL, outlier_detection_ejections_active_.value());
@@ -231,9 +230,8 @@ TEST_F(OutlierDetectorImplTest, BasicFlow5xxViaHttpCodes) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, 500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -261,9 +259,8 @@ TEST_F(OutlierDetectorImplTest, BasicFlow5xxViaHttpCodes) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(40000));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, 500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
   EXPECT_EQ(1UL, outlier_detection_ejections_active_.value());
@@ -325,9 +322,8 @@ TEST_F(OutlierDetectorImplTest, ExternalOriginEventsNonSplit) {
 
   // Now make sure that EXT_ORIGIN_REQUEST_FAILED ejects the host
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   for (auto i = 0; i < 100; i++) {
     hosts_[0]->outlierDetector().putResult(Result::ExtOriginRequestFailed);
   }
@@ -353,14 +349,11 @@ TEST_F(OutlierDetectorImplTest, BasicFlow5xxViaNonHttpCodes) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, Result::LocalOriginConnectFailed);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -388,14 +381,11 @@ TEST_F(OutlierDetectorImplTest, BasicFlow5xxViaNonHttpCodes) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(40000));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, Result::LocalOriginConnectFailed);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
   EXPECT_EQ(1UL, outlier_detection_ejections_active_.value());
@@ -440,18 +430,15 @@ TEST_F(OutlierDetectorImplTest, BasicFlowGatewayFailure) {
   loadRq(hosts_[0], 1, 500);
   hosts_[0]->outlierDetector().putResponseTime(std::chrono::milliseconds(5));
   loadRq(hosts_[0], 2, 503);
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false));
   loadRq(hosts_[0], 2, 503);
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               true));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, true));
   loadRq(hosts_[0], 1, 503);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -479,11 +466,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowGatewayFailure) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(40000));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               true));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, true));
   loadRq(hosts_[0], 1, 503);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
   EXPECT_EQ(1UL, outlier_detection_ejections_active_.value());
@@ -529,9 +514,8 @@ TEST_F(OutlierDetectorImplTest, TimeoutWithHttpCode) {
 
   // Report several LOCAL_ORIGIN_TIMEOUT with optional Http code 500. Host should be ejected.
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   // Get the configured number of failures and simulate than number of connect failures.
   uint32_t n = runtime_.snapshot_.getInteger("outlier_detection.consecutive_5xx",
                                              detector->config().consecutive5xx());
@@ -552,9 +536,8 @@ TEST_F(OutlierDetectorImplTest, TimeoutWithHttpCode) {
 
   // Report several LOCAL_ORIGIN_TIMEOUT with HTTP code other that 500. Node should not be ejected.
   EXPECT_CALL(checker_, check(hosts_[0])).Times(0);
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true))
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true))
       .Times(0);
   // Get the configured number of failures and simulate than number of connect failures.
   n = runtime_.snapshot_.getInteger("outlier_detection.consecutive_5xx",
@@ -568,14 +551,11 @@ TEST_F(OutlierDetectorImplTest, TimeoutWithHttpCode) {
   // Report LOCAL_ORIGIN_TIMEOUT without explicit HTTP code mapping. It should be implicitly mapped
   // to 5xx code and the node should be ejected.
   EXPECT_CALL(checker_, check(hosts_[0]));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false));
   // Get the configured number of failures and simulate than number of connect failures.
   n = runtime_.snapshot_.getInteger("outlier_detection.consecutive_gateway_failure",
                                     detector->config().consecutiveGatewayFailure());
@@ -602,11 +582,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowLocalOriginFailure) {
 
   // When connect failure is detected the following methods should be called.
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE,
-               true));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE, true));
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
 
   // Get the configured number of failures and simulate than number of connect failures.
@@ -696,11 +674,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowGatewayFailureAnd5xx) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               true));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, true));
   loadRq(hosts_[0], 1, 503);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -730,9 +706,8 @@ TEST_F(OutlierDetectorImplTest, BasicFlowGatewayFailureAnd5xx) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(40000));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, 500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
   EXPECT_EQ(1UL, outlier_detection_ejections_active_.value());
@@ -797,14 +772,11 @@ TEST_F(OutlierDetectorImplTest, BasicFlowNonHttpCodesExternalOrigin) {
   loadRq(hosts_[0], 3, Result::LocalOriginConnectFailed);
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false));
   EXPECT_CALL(checker_, check(hosts_[0]));
   loadRq(hosts_[0], 1, Result::LocalOriginConnectFailed);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
@@ -835,15 +807,12 @@ TEST_F(OutlierDetectorImplTest, BasicFlowSuccessRateExternalOrigin) {
       .WillByDefault(Return(false));
   // Expect non-enforcing logging to happen every time the consecutive_5xx_ counter
   // gets saturated (every 5 times).
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false))
+      .Times(40);
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false))
-      .Times(40);
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false))
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false))
       .Times(40);
 
   // Cause a SR error on one host. First have 4 of the hosts have perfect SR.
@@ -852,9 +821,8 @@ TEST_F(OutlierDetectorImplTest, BasicFlowSuccessRateExternalOrigin) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(10000));
   EXPECT_CALL(checker_, check(hosts_[4]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]),
+                                       _, envoy::data::cluster::v2alpha::SUCCESS_RATE, true));
   EXPECT_CALL(*interval_timer_, enableTimer(std::chrono::milliseconds(10000), _));
   ON_CALL(runtime_.snapshot_, getInteger("outlier_detection.success_rate_stdev_factor", 1900))
       .WillByDefault(Return(1900));
@@ -894,15 +862,12 @@ TEST_F(OutlierDetectorImplTest, BasicFlowSuccessRateExternalOrigin) {
 
   // Expect non-enforcing logging to happen every time the consecutive_5xx_ counter
   // gets saturated (every 5 times).
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false))
+      .Times(5);
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false))
-      .Times(5);
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false))
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false))
       .Times(5);
 
   // Give 4 hosts enough request volume but not to the 5th. Should not cause an ejection.
@@ -939,14 +904,11 @@ TEST_F(OutlierDetectorImplTest, ExternalOriginEventsWithSplit) {
   EXPECT_FALSE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
   // Now make sure that EXT_ORIGIN_REQUEST_FAILED ejects the host
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false));
   for (auto i = 0; i < 100; i++) {
     hosts_[0]->outlierDetector().putResult(Result::ExtOriginRequestFailed);
   }
@@ -974,11 +936,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowSuccessRateLocalOrigin) {
       .WillByDefault(Return(false));
   // Expect non-enforcing logging to happen every time the consecutive_ counter
   // gets saturated (every 5 times).
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE,
-               false))
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE, false))
       .Times(40);
   // Cause a SR error on one host. First have 4 of the hosts have perfect SR.
   loadRq(hosts_, 200, Result::LocalOriginConnectSuccess);
@@ -986,11 +946,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowSuccessRateLocalOrigin) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(10000));
   EXPECT_CALL(checker_, check(hosts_[4]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN,
-               true));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN, true));
   EXPECT_CALL(*interval_timer_, enableTimer(std::chrono::milliseconds(10000), _));
   ON_CALL(runtime_.snapshot_, getInteger("outlier_detection.success_rate_stdev_factor", 1900))
       .WillByDefault(Return(1900));
@@ -1030,11 +988,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowSuccessRateLocalOrigin) {
 
   // Expect non-enforcing logging to happen every time the consecutive_ counter
   // gets saturated (every 5 times).
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE,
-               false))
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE, false))
       .Times(5);
 
   // Give 4 hosts enough request volume but not to the 5th. Should not cause an ejection.
@@ -1098,25 +1054,19 @@ TEST_F(OutlierDetectorImplTest, BasicFlowFailurePercentageExternalOrigin) {
       .WillByDefault(Return(true));
   // Expect non-enforcing logging to happen every time the consecutive_5xx_ counter
   // gets saturated (every 5 times).
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[3]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false))
+      .Times(50);
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[3]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false))
-      .Times(50);
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[3]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false))
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false))
       .Times(50);
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false))
+      .Times(60);
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false))
-      .Times(60);
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false))
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false))
       .Times(60);
 
   // Cause a failure percentage error on one host. First 3 hosts have perfect failure percentage;
@@ -1128,10 +1078,8 @@ TEST_F(OutlierDetectorImplTest, BasicFlowFailurePercentageExternalOrigin) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(10000));
   EXPECT_CALL(checker_, check(hosts_[4]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE,
-                       true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]),
+                                       _, envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE, true));
   EXPECT_CALL(*interval_timer_, enableTimer(std::chrono::milliseconds(10000), _));
   ON_CALL(runtime_.snapshot_, getInteger("outlier_detection.success_rate_stdev_factor", 1900))
       .WillByDefault(Return(1900));
@@ -1172,15 +1120,12 @@ TEST_F(OutlierDetectorImplTest, BasicFlowFailurePercentageExternalOrigin) {
 
   // Expect non-enforcing logging to happen every time the consecutive_5xx_ counter
   // gets saturated (every 5 times).
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false))
+      .Times(5);
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false))
-      .Times(5);
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false))
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false))
       .Times(5);
 
   // Give 4 hosts enough request volume but not to the 5th. Should not cause an ejection.
@@ -1229,11 +1174,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowFailurePercentageLocalOrigin) {
       .WillByDefault(Return(true));
   // Expect non-enforcing logging to happen every time the consecutive_ counter
   // gets saturated (every 5 times).
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE,
-               false))
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE, false))
       .Times(40);
   // Cause a failure percentage error on one host. First 4 of the hosts have perfect failure
   // percentage.
@@ -1242,16 +1185,12 @@ TEST_F(OutlierDetectorImplTest, BasicFlowFailurePercentageLocalOrigin) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(10000));
   EXPECT_CALL(checker_, check(hosts_[4]));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE_LOCAL_ORIGIN,
-               true));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE_LOCAL_ORIGIN,
-               false));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE_LOCAL_ORIGIN, true));
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::SUCCESS_RATE_LOCAL_ORIGIN, false));
   EXPECT_CALL(*interval_timer_, enableTimer(std::chrono::milliseconds(10000), _));
   ON_CALL(runtime_.snapshot_, getInteger("outlier_detection.failure_percentage_threshold", 85))
       .WillByDefault(Return(40));
@@ -1291,11 +1230,9 @@ TEST_F(OutlierDetectorImplTest, BasicFlowFailurePercentageLocalOrigin) {
 
   // Expect non-enforcing logging to happen every time the consecutive_ counter
   // gets saturated (every 5 times).
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_LOCAL_ORIGIN_FAILURE,
-               false))
+  EXPECT_CALL(*event_logger_,
+              logEject(std::static_pointer_cast<const HostDescription>(hosts_[4]), _,
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_LOCAL_ORIGIN_FAILURE, false))
       .Times(5);
 
   // Give 4 hosts enough request volume but not to the 5th. Should not cause an ejection.
@@ -1328,9 +1265,8 @@ TEST_F(OutlierDetectorImplTest, RemoveWhileEjected) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, 500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -1361,9 +1297,8 @@ TEST_F(OutlierDetectorImplTest, Overflow) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   hosts_[0]->outlierDetector().putHttpResponseCode(500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -1387,14 +1322,11 @@ TEST_F(OutlierDetectorImplTest, NotEnforcing) {
 
   ON_CALL(runtime_.snapshot_, featureEnabled("outlier_detection.enforcing_consecutive_5xx", 100))
       .WillByDefault(Return(false));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, false));
   EXPECT_CALL(*event_logger_,
               logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, false));
-  EXPECT_CALL(
-      *event_logger_,
-      logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-               envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_GATEWAY_FAILURE,
-               false));
+                       envoy::data::cluster::v2alpha::CONSECUTIVE_GATEWAY_FAILURE, false));
   loadRq(hosts_[0], 1, 503);
   EXPECT_FALSE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -1481,9 +1413,8 @@ TEST_F(OutlierDetectorImplTest, CrossThreadFailRace) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
 
   // Fire the post callback twice. This should only result in a single ejection.
   post_cb();
@@ -1506,9 +1437,8 @@ TEST_F(OutlierDetectorImplTest, Consecutive_5xxAlreadyEjected) {
 
   time_system_.setMonotonicTime(std::chrono::milliseconds(0));
   EXPECT_CALL(checker_, check(hosts_[0]));
-  EXPECT_CALL(*event_logger_,
-              logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]), _,
-                       envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true));
+  EXPECT_CALL(*event_logger_, logEject(std::static_pointer_cast<const HostDescription>(hosts_[0]),
+                                       _, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true));
   loadRq(hosts_[0], 1, 500);
   EXPECT_TRUE(hosts_[0]->healthFlagGet(Host::HealthFlag::FAILED_OUTLIER_CHECK));
 
@@ -1550,8 +1480,7 @@ TEST(OutlierDetectionEventLoggerImplTest, All) {
                          ",\"timestamp\":\"2018-12-18T09:00:00Z\"}\n")))
       .WillOnce(SaveArg<0>(&log1));
 
-  event_logger.logEject(host, detector,
-                        envoy::data::cluster::v2alpha::OutlierEjectionType::CONSECUTIVE_5XX, true);
+  event_logger.logEject(host, detector, envoy::data::cluster::v2alpha::CONSECUTIVE_5XX, true);
   Json::Factory::loadFromString(log1);
 
   StringViewSaver log2;
@@ -1590,8 +1519,7 @@ TEST(OutlierDetectionEventLoggerImplTest, All) {
                   "\"cluster_success_rate_ejection_threshold\":0},"
                   "\"timestamp\":\"2018-12-18T09:00:00Z\",\"secs_since_last_action\":\"30\"}\n")))
       .WillOnce(SaveArg<0>(&log3));
-  event_logger.logEject(host, detector,
-                        envoy::data::cluster::v2alpha::OutlierEjectionType::SUCCESS_RATE, false);
+  event_logger.logEject(host, detector, envoy::data::cluster::v2alpha::SUCCESS_RATE, false);
   Json::Factory::loadFromString(log3);
 
   StringViewSaver log4;
@@ -1619,9 +1547,7 @@ TEST(OutlierDetectionEventLoggerImplTest, All) {
                   "\"host_success_rate\":0},\"timestamp\":\"2018-12-18T09:00:00Z\","
                   "\"secs_since_last_action\":\"30\"}\n")))
       .WillOnce(SaveArg<0>(&log5));
-  event_logger.logEject(host, detector,
-                        envoy::data::cluster::v2alpha::OutlierEjectionType::FAILURE_PERCENTAGE,
-                        false);
+  event_logger.logEject(host, detector, envoy::data::cluster::v2alpha::FAILURE_PERCENTAGE, false);
   Json::Factory::loadFromString(log5);
 
   StringViewSaver log6;
diff --git a/test/common/upstream/ring_hash_lb_test.cc b/test/common/upstream/ring_hash_lb_test.cc
index 012e6f745864..864c0ea8ba43 100644
--- a/test/common/upstream/ring_hash_lb_test.cc
+++ b/test/common/upstream/ring_hash_lb_test.cc
@@ -4,7 +4,7 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/router/router.h"
 
 #include "common/network/utility.h"
@@ -55,8 +55,8 @@ class RingHashLoadBalancerTest : public testing::TestWithParam<bool> {
   std::shared_ptr<MockClusterInfo> info_{new NiceMock<MockClusterInfo>()};
   Stats::IsolatedStoreImpl stats_store_;
   ClusterStats stats_;
-  absl::optional<envoy::api::v2::Cluster::RingHashLbConfig> config_;
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig> config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   NiceMock<Runtime::MockLoader> runtime_;
   NiceMock<Runtime::MockRandomGenerator> random_;
   std::unique_ptr<RingHashLoadBalancer> lb_;
@@ -77,7 +77,7 @@ TEST_P(RingHashLoadBalancerTest, NoHost) {
 
 // Given minimum_ring_size > maximum_ring_size, expect an exception.
 TEST_P(RingHashLoadBalancerTest, BadRingSizeBounds) {
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(20);
   config_.value().mutable_maximum_ring_size()->set_value(10);
   EXPECT_THROW_WITH_MESSAGE(init(), EnvoyException,
@@ -92,7 +92,7 @@ TEST_P(RingHashLoadBalancerTest, Basic) {
   hostSet().healthy_hosts_ = hostSet().hosts_;
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(12);
 
   init();
@@ -164,7 +164,7 @@ TEST_P(RingHashFailoverTest, BasicFailover) {
   failover_host_set_.healthy_hosts_ = {makeTestHost(info_, "tcp://127.0.0.1:82")};
   failover_host_set_.hosts_ = failover_host_set_.healthy_hosts_;
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(12);
   init();
   EXPECT_EQ(12, lb_->stats().size_.value());
@@ -207,8 +207,9 @@ TEST_P(RingHashLoadBalancerTest, BasicWithMurmur2) {
   hostSet().healthy_hosts_ = hostSet().hosts_;
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
-  config_.value().set_hash_function(envoy::api::v2::Cluster::RingHashLbConfig::MURMUR_HASH_2);
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
+  config_.value().set_hash_function(
+      envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig::MURMUR_HASH_2);
   config_.value().mutable_minimum_ring_size()->set_value(12);
   init();
   EXPECT_EQ(12, lb_->stats().size_.value());
@@ -259,7 +260,7 @@ TEST_P(RingHashLoadBalancerTest, UnevenHosts) {
   hostSet().healthy_hosts_ = hostSet().hosts_;
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(3);
   init();
   EXPECT_EQ(4, lb_->stats().size_.value());
@@ -310,7 +311,7 @@ TEST_P(RingHashLoadBalancerTest, HostWeightedTinyRing) {
   hostSet().runCallbacks({}, {});
 
   // enforce a ring size of exactly six entries
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(6);
   config_.value().mutable_maximum_ring_size()->set_value(6);
   init();
@@ -338,7 +339,7 @@ TEST_P(RingHashLoadBalancerTest, HostWeightedLargeRing) {
   hostSet().healthy_hosts_ = hostSet().hosts_;
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(6144);
   init();
   EXPECT_EQ(6144, lb_->stats().size_.value());
@@ -388,7 +389,7 @@ TEST_P(RingHashLoadBalancerTest, LocalityWeightedTinyRing) {
   hostSet().runCallbacks({}, {});
 
   // enforce a ring size of exactly six entries
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(6);
   config_.value().mutable_maximum_ring_size()->set_value(6);
   init();
@@ -421,7 +422,7 @@ TEST_P(RingHashLoadBalancerTest, LocalityWeightedLargeRing) {
   hostSet().locality_weights_ = makeLocalityWeights({1, 2, 3, 0});
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(6144);
   init();
   EXPECT_EQ(6144, lb_->stats().size_.value());
@@ -458,7 +459,7 @@ TEST_P(RingHashLoadBalancerTest, HostAndLocalityWeightedTinyRing) {
   hostSet().runCallbacks({}, {});
 
   // enforce a ring size of exactly 9 entries
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(9);
   config_.value().mutable_maximum_ring_size()->set_value(9);
   init();
@@ -494,7 +495,7 @@ TEST_P(RingHashLoadBalancerTest, HostAndLocalityWeightedLargeRing) {
   hostSet().locality_weights_ = makeLocalityWeights({1, 2});
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(9216);
   init();
   EXPECT_EQ(9216, lb_->stats().size_.value());
@@ -525,7 +526,7 @@ TEST_P(RingHashLoadBalancerTest, SmallFractionalScale) {
   hostSet().healthy_hosts_ = hostSet().hosts_;
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(2);
   config_.value().mutable_maximum_ring_size()->set_value(2);
   init();
@@ -565,7 +566,7 @@ TEST_P(RingHashLoadBalancerTest, LargeFractionalScale) {
   hostSet().healthy_hosts_ = hostSet().hosts_;
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(1023);
   config_.value().mutable_maximum_ring_size()->set_value(1023);
   init();
@@ -602,7 +603,7 @@ TEST_P(RingHashLoadBalancerTest, LopsidedWeightSmallScale) {
   hostSet().locality_weights_ = makeLocalityWeights({127, 1});
   hostSet().runCallbacks({}, {});
 
-  config_ = envoy::api::v2::Cluster::RingHashLbConfig();
+  config_ = envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig();
   config_.value().mutable_minimum_ring_size()->set_value(1024);
   config_.value().mutable_maximum_ring_size()->set_value(1024);
   init();
diff --git a/test/common/upstream/subset_lb_test.cc b/test/common/upstream/subset_lb_test.cc
index 3752f8266730..340e90963f7f 100644
--- a/test/common/upstream/subset_lb_test.cc
+++ b/test/common/upstream/subset_lb_test.cc
@@ -5,8 +5,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/logger.h"
 #include "common/config/metadata.h"
@@ -242,7 +242,7 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
   }
 
   HostSharedPtr makeHost(const std::string& url, const HostMetadata& metadata) {
-    envoy::api::v2::core::Metadata m;
+    envoy::config::core::v3alpha::Metadata m;
     for (const auto& m_it : metadata) {
       Config::Metadata::mutableMetadataValue(m, Config::MetadataFilters::get().ENVOY_LB, m_it.first)
           .set_string_value(m_it.second);
@@ -251,7 +251,7 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
     return makeTestHost(info_, url, m);
   }
   HostSharedPtr makeHost(const std::string& url, const HostListMetadata& metadata) {
-    envoy::api::v2::core::Metadata m;
+    envoy::config::core::v3alpha::Metadata m;
     for (const auto& m_it : metadata) {
       auto& metadata = Config::Metadata::mutableMetadataValue(
           m, Config::MetadataFilters::get().ENVOY_LB, m_it.first);
@@ -276,11 +276,11 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
     return default_subset;
   }
 
-  SubsetSelectorPtr makeSelector(
-      const std::set<std::string>& selector_keys,
-      envoy::api::v2::Cluster_LbSubsetConfig_LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-          fallback_policy,
-      const std::set<std::string>& fallback_keys_subset) {
+  SubsetSelectorPtr
+  makeSelector(const std::set<std::string>& selector_keys,
+               envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+                   LbSubsetSelectorFallbackPolicy fallback_policy,
+               const std::set<std::string>& fallback_keys_subset) {
 
     Protobuf::RepeatedPtrField<std::string> selector_keys_mapped;
     for (const auto& it : selector_keys) {
@@ -296,10 +296,10 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
                                                 fallback_keys_subset_mapped);
   }
 
-  SubsetSelectorPtr makeSelector(
-      const std::set<std::string>& selector_keys,
-      envoy::api::v2::Cluster_LbSubsetConfig_LbSubsetSelector::LbSubsetSelectorFallbackPolicy
-          fallback_policy) {
+  SubsetSelectorPtr
+  makeSelector(const std::set<std::string>& selector_keys,
+               envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::
+                   LbSubsetSelectorFallbackPolicy fallback_policy) {
     return makeSelector(selector_keys, fallback_policy, {});
   }
 
@@ -403,7 +403,8 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
 
   void doLbTypeTest(LoadBalancerType type) {
     EXPECT_CALL(subset_info_, fallbackPolicy())
-        .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+        .WillRepeatedly(
+            Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
     lb_type_ = type;
     init({{"tcp://127.0.0.1:80", {{"version", "1.0"}}}});
@@ -416,9 +417,9 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
     EXPECT_EQ(added_host, lb_->chooseHost(nullptr));
   }
 
-  envoy::api::v2::core::Metadata buildMetadata(const std::string& version,
-                                               bool is_default = false) const {
-    envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata buildMetadata(const std::string& version,
+                                                       bool is_default = false) const {
+    envoy::config::core::v3alpha::Metadata metadata;
 
     if (!version.empty()) {
       Envoy::Config::Metadata::mutableMetadataValue(
@@ -440,9 +441,9 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
   MockHostSet& host_set_ = *priority_set_.getMockHostSet(0);
   NiceMock<MockLoadBalancerSubsetInfo> subset_info_;
   std::shared_ptr<MockClusterInfo> info_{new NiceMock<MockClusterInfo>()};
-  envoy::api::v2::Cluster::RingHashLbConfig ring_hash_lb_config_;
-  envoy::api::v2::Cluster::LeastRequestLbConfig least_request_lb_config_;
-  envoy::api::v2::Cluster::CommonLbConfig common_config_;
+  envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig ring_hash_lb_config_;
+  envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig least_request_lb_config_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig common_config_;
   NiceMock<Runtime::MockLoader> runtime_;
   NiceMock<Runtime::MockRandomGenerator> random_;
   Stats::IsolatedStoreImpl stats_store_;
@@ -455,7 +456,8 @@ class SubsetLoadBalancerTest : public testing::TestWithParam<UpdateOrder> {
 
 TEST_F(SubsetLoadBalancerTest, NoFallback) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   init();
 
@@ -474,7 +476,8 @@ TEST_F(SubsetLoadBalancerTest, DeregisterCallbacks) {
 
 TEST_P(SubsetLoadBalancerTest, NoFallbackAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   init();
 
@@ -487,7 +490,8 @@ TEST_P(SubsetLoadBalancerTest, NoFallbackAfterUpdate) {
 
 TEST_F(SubsetLoadBalancerTest, FallbackAnyEndpoint) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   init();
 
@@ -498,7 +502,8 @@ TEST_F(SubsetLoadBalancerTest, FallbackAnyEndpoint) {
 
 TEST_P(SubsetLoadBalancerTest, FallbackAnyEndpointAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   init();
 
@@ -513,7 +518,8 @@ TEST_P(SubsetLoadBalancerTest, FallbackAnyEndpointAfterUpdate) {
 
 TEST_F(SubsetLoadBalancerTest, FallbackDefaultSubset) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   const ProtobufWkt::Struct default_subset = makeDefaultSubset({{"version", "default"}});
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
@@ -530,7 +536,8 @@ TEST_F(SubsetLoadBalancerTest, FallbackDefaultSubset) {
 
 TEST_F(SubsetLoadBalancerTest, FallbackPanicMode) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
   EXPECT_CALL(subset_info_, panicModeAny()).WillRepeatedly(Return(true));
 
   // The default subset will be empty.
@@ -550,7 +557,8 @@ TEST_F(SubsetLoadBalancerTest, FallbackPanicMode) {
 
 TEST_P(SubsetLoadBalancerTest, FallbackPanicModeWithUpdates) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
   EXPECT_CALL(subset_info_, panicModeAny()).WillRepeatedly(Return(true));
 
   // The default subset will be empty.
@@ -570,7 +578,8 @@ TEST_P(SubsetLoadBalancerTest, FallbackPanicModeWithUpdates) {
 
 TEST_P(SubsetLoadBalancerTest, FallbackDefaultSubsetAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   const ProtobufWkt::Struct default_subset = makeDefaultSubset({{"version", "default"}});
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
@@ -592,7 +601,8 @@ TEST_P(SubsetLoadBalancerTest, FallbackDefaultSubsetAfterUpdate) {
 
 TEST_F(SubsetLoadBalancerTest, FallbackEmptyDefaultSubsetConvertsToAnyEndpoint) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   EXPECT_CALL(subset_info_, defaultSubset())
       .WillRepeatedly(ReturnRef(ProtobufWkt::Struct::default_instance()));
@@ -607,7 +617,8 @@ TEST_F(SubsetLoadBalancerTest, FallbackEmptyDefaultSubsetConvertsToAnyEndpoint)
 
 TEST_F(SubsetLoadBalancerTest, FallbackOnUnknownMetadata) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   init();
 
@@ -620,10 +631,12 @@ TEST_F(SubsetLoadBalancerTest, FallbackOnUnknownMetadata) {
 
 TEST_F(SubsetLoadBalancerTest, BalancesSubset) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -647,10 +660,12 @@ TEST_F(SubsetLoadBalancerTest, BalancesSubset) {
 
 TEST_P(SubsetLoadBalancerTest, BalancesSubsetAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -686,10 +701,12 @@ TEST_P(SubsetLoadBalancerTest, BalancesSubsetAfterUpdate) {
 
 TEST_P(SubsetLoadBalancerTest, ListAsAnyEnabled) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
   EXPECT_CALL(subset_info_, listAsAny()).WillRepeatedly(Return(true));
 
@@ -713,10 +730,12 @@ TEST_P(SubsetLoadBalancerTest, ListAsAnyEnabled) {
 
 TEST_P(SubsetLoadBalancerTest, ListAsAnyEnabledMultipleLists) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
   EXPECT_CALL(subset_info_, listAsAny()).WillRepeatedly(Return(true));
 
@@ -752,11 +771,12 @@ TEST_P(SubsetLoadBalancerTest, ListAsAnyEnabledMultipleLists) {
 
 TEST_P(SubsetLoadBalancerTest, ListAsAnyEnabledMultipleListsForSingleHost) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
-  std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version", "hardware"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+  std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
+      {"version", "hardware"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
   EXPECT_CALL(subset_info_, listAsAny()).WillRepeatedly(Return(true));
 
@@ -792,10 +812,12 @@ TEST_P(SubsetLoadBalancerTest, ListAsAnyEnabledMultipleListsForSingleHost) {
 
 TEST_P(SubsetLoadBalancerTest, ListAsAnyDisable) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
   init({});
@@ -815,10 +837,12 @@ TEST_P(SubsetLoadBalancerTest, ListAsAnyDisable) {
 // Test that adding backends to a failover group causes no problems.
 TEST_P(SubsetLoadBalancerTest, UpdateFailover) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -849,10 +873,12 @@ TEST_P(SubsetLoadBalancerTest, OnlyMetadataChanged) {
   TestLoadBalancerContext context_default({{"default", "true"}});
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"default"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"default"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -860,7 +886,8 @@ TEST_P(SubsetLoadBalancerTest, OnlyMetadataChanged) {
 
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   // Add hosts initial hosts.
   init({{"tcp://127.0.0.1:8000", {{"version", "1.2"}}},
@@ -939,13 +966,16 @@ TEST_P(SubsetLoadBalancerTest, MetadataChangedHostsAddedRemoved) {
 
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"default"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"default"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
   // Add hosts initial hosts.
@@ -1022,10 +1052,12 @@ TEST_P(SubsetLoadBalancerTest, MetadataChangedHostsAddedRemoved) {
 
 TEST_P(SubsetLoadBalancerTest, UpdateRemovingLastSubsetHost) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
   init({
@@ -1056,13 +1088,16 @@ TEST_P(SubsetLoadBalancerTest, UpdateRemovingLastSubsetHost) {
 
 TEST_P(SubsetLoadBalancerTest, UpdateRemovingUnknownHost) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"stage", "version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"stage", "version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1083,13 +1118,16 @@ TEST_P(SubsetLoadBalancerTest, UpdateRemovingUnknownHost) {
 
 TEST_F(SubsetLoadBalancerTest, UpdateModifyingOnlyHostHealth) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"hardware"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"hardware"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1123,13 +1161,16 @@ TEST_F(SubsetLoadBalancerTest, UpdateModifyingOnlyHostHealth) {
 
 TEST_F(SubsetLoadBalancerTest, BalancesDisjointSubsets) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"hardware"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"hardware"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1151,13 +1192,16 @@ TEST_F(SubsetLoadBalancerTest, BalancesDisjointSubsets) {
 
 TEST_F(SubsetLoadBalancerTest, BalancesOverlappingSubsets) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"stage", "version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"stage", "version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1190,13 +1234,16 @@ TEST_F(SubsetLoadBalancerTest, BalancesOverlappingSubsets) {
 
 TEST_F(SubsetLoadBalancerTest, BalancesNestedSubsets) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"stage", "version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"stage"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector(
+          {"stage", "version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"stage"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1227,10 +1274,12 @@ TEST_F(SubsetLoadBalancerTest, BalancesNestedSubsets) {
 
 TEST_F(SubsetLoadBalancerTest, IgnoresUnselectedMetadata) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1252,10 +1301,12 @@ TEST_F(SubsetLoadBalancerTest, IgnoresUnselectedMetadata) {
 TEST_F(SubsetLoadBalancerTest, IgnoresHostsWithoutMetadata) {
   EXPECT_CALL(subset_info_, isEnabled()).WillRepeatedly(Return(true));
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1300,10 +1351,12 @@ TEST_P(SubsetLoadBalancerTest, LoadBalancerTypesMaglev) { doLbTypeTest(LoadBalan
 
 TEST_F(SubsetLoadBalancerTest, ZoneAwareFallback) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
-  std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"x"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+  std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
+      {"x"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1346,10 +1399,12 @@ TEST_F(SubsetLoadBalancerTest, ZoneAwareFallback) {
 
 TEST_P(SubsetLoadBalancerTest, ZoneAwareFallbackAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
-  std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"x"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+  std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
+      {"x"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1404,13 +1459,15 @@ TEST_P(SubsetLoadBalancerTest, ZoneAwareFallbackAfterUpdate) {
 
 TEST_F(SubsetLoadBalancerTest, ZoneAwareFallbackDefaultSubset) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   const ProtobufWkt::Struct default_subset = makeDefaultSubset({{"version", "default"}});
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1460,13 +1517,15 @@ TEST_F(SubsetLoadBalancerTest, ZoneAwareFallbackDefaultSubset) {
 
 TEST_P(SubsetLoadBalancerTest, ZoneAwareFallbackDefaultSubsetAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   const ProtobufWkt::Struct default_subset = makeDefaultSubset({{"version", "default"}});
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1529,10 +1588,12 @@ TEST_P(SubsetLoadBalancerTest, ZoneAwareFallbackDefaultSubsetAfterUpdate) {
 
 TEST_F(SubsetLoadBalancerTest, ZoneAwareBalancesSubsets) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("upstream.healthy_panic_threshold", 50))
@@ -1583,10 +1644,12 @@ TEST_F(SubsetLoadBalancerTest, ZoneAwareBalancesSubsets) {
 
 TEST_P(SubsetLoadBalancerTest, ZoneAwareBalancesSubsetsAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("upstream.healthy_panic_threshold", 50))
@@ -1650,7 +1713,8 @@ TEST_P(SubsetLoadBalancerTest, ZoneAwareBalancesSubsetsAfterUpdate) {
 
 TEST_F(SubsetLoadBalancerTest, DescribeMetadata) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
   init();
 
   ProtobufWkt::Value str_value;
@@ -1744,7 +1808,8 @@ TEST_F(SubsetLoadBalancerTest, EnabledLocalityWeightAwareness) {
 TEST_F(SubsetLoadBalancerTest, EnabledScaleLocalityWeights) {
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
   EXPECT_CALL(subset_info_, isEnabled()).WillRepeatedly(Return(true));
   EXPECT_CALL(subset_info_, localityWeightAware()).WillRepeatedly(Return(true));
@@ -1787,7 +1852,8 @@ TEST_F(SubsetLoadBalancerTest, EnabledScaleLocalityWeights) {
 TEST_F(SubsetLoadBalancerTest, EnabledScaleLocalityWeightsRounding) {
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
   EXPECT_CALL(subset_info_, isEnabled()).WillRepeatedly(Return(true));
   EXPECT_CALL(subset_info_, localityWeightAware()).WillRepeatedly(Return(true));
@@ -1826,7 +1892,8 @@ TEST_F(SubsetLoadBalancerTest, EnabledScaleLocalityWeightsRounding) {
 // Regression for bug where missing locality weights crashed scaling and locality aware subset LBs.
 TEST_F(SubsetLoadBalancerTest, ScaleLocalityWeightsWithNoLocalityWeights) {
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
   EXPECT_CALL(subset_info_, isEnabled()).WillRepeatedly(Return(true));
   EXPECT_CALL(subset_info_, localityWeightAware()).WillRepeatedly(Return(true));
@@ -1846,10 +1913,12 @@ TEST_F(SubsetLoadBalancerTest, ScaleLocalityWeightsWithNoLocalityWeights) {
 
 TEST_P(SubsetLoadBalancerTest, GaugesUpdatedOnDestroy) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
   init({
@@ -1867,10 +1936,12 @@ TEST_P(SubsetLoadBalancerTest, GaugesUpdatedOnDestroy) {
 
 TEST_P(SubsetLoadBalancerTest, SubsetSelectorNoFallbackPerSelector) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1896,13 +1967,15 @@ TEST_P(SubsetLoadBalancerTest, SubsetSelectorNoFallbackPerSelector) {
 
 TEST_P(SubsetLoadBalancerTest, FallbackNotDefinedForIntermediateSelector) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"stage"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"stage", "version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT)};
+      makeSelector(
+          {"stage"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector({"stage", "version"}, envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                             LbSubsetSelector::ANY_ENDPOINT)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1920,10 +1993,12 @@ TEST_P(SubsetLoadBalancerTest, FallbackNotDefinedForIntermediateSelector) {
 
 TEST_P(SubsetLoadBalancerTest, SubsetSelectorFallbackOverridesTopLevelOne) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1938,10 +2013,12 @@ TEST_P(SubsetLoadBalancerTest, SubsetSelectorFallbackOverridesTopLevelOne) {
 
 TEST_P(SubsetLoadBalancerTest, SubsetSelectorNoFallbackMatchesTopLevelOne) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1957,15 +2034,18 @@ TEST_P(SubsetLoadBalancerTest, SubsetSelectorNoFallbackMatchesTopLevelOne) {
 
 TEST_P(SubsetLoadBalancerTest, SubsetSelectorDefaultAnyFallbackPerSelector) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET),
-      makeSelector({"app"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT),
-      makeSelector({"foo"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
+      makeSelector({"version"}, envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::
+                                    LbSubsetSelector::DEFAULT_SUBSET),
+      makeSelector(
+          {"app"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT),
+      makeSelector(
+          {"foo"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -1993,13 +2073,15 @@ TEST_P(SubsetLoadBalancerTest, SubsetSelectorDefaultAnyFallbackPerSelector) {
 
 TEST_P(SubsetLoadBalancerTest, SubsetSelectorDefaultAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::DEFAULT_SUBSET));
 
   const ProtobufWkt::Struct default_subset = makeDefaultSubset({{"version", "default"}});
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -2022,10 +2104,12 @@ TEST_P(SubsetLoadBalancerTest, SubsetSelectorDefaultAfterUpdate) {
 
 TEST_P(SubsetLoadBalancerTest, SubsetSelectorAnyAfterUpdate) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT)};
+      {"version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::ANY_ENDPOINT)};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -2047,20 +2131,24 @@ TEST_P(SubsetLoadBalancerTest, SubsetSelectorAnyAfterUpdate) {
 
 TEST_P(SubsetLoadBalancerTest, FallbackForCompoundSelector) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
   const ProtobufWkt::Struct default_subset = makeDefaultSubset({{"foo", "bar"}});
   EXPECT_CALL(subset_info_, defaultSubset()).WillRepeatedly(ReturnRef(default_subset));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
-      makeSelector({"version", "hardware", "stage"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK),
-      makeSelector({"version", "hardware"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET),
-      makeSelector({"version", "stage"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
-                   {"version"})};
+      makeSelector(
+          {"version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NOT_DEFINED),
+      makeSelector(
+          {"version", "hardware", "stage"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK),
+      makeSelector({"version", "hardware"}, envoy::config::cluster::v3alpha::Cluster::
+                                                LbSubsetConfig::LbSubsetSelector::DEFAULT_SUBSET),
+      makeSelector(
+          {"version", "stage"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
+          {"version"})};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -2097,17 +2185,21 @@ TEST_P(SubsetLoadBalancerTest, FallbackForCompoundSelector) {
 
 TEST_P(SubsetLoadBalancerTest, KeysSubsetFallbackChained) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {
-      makeSelector({"stage"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK),
-      makeSelector({"stage", "version"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
-                   {"stage"}),
-      makeSelector({"stage", "version", "hardware"},
-                   envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
-                   {"version", "stage"})};
+      makeSelector(
+          {"stage"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::NO_FALLBACK),
+      makeSelector(
+          {"stage", "version"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
+          {"stage"}),
+      makeSelector(
+          {"stage", "version", "hardware"},
+          envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
+          {"version", "stage"})};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
 
@@ -2132,10 +2224,12 @@ TEST_P(SubsetLoadBalancerTest, KeysSubsetFallbackChained) {
 
 TEST_P(SubsetLoadBalancerTest, KeysSubsetFallbackToNotExistingSelector) {
   EXPECT_CALL(subset_info_, fallbackPolicy())
-      .WillRepeatedly(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillRepeatedly(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
 
   std::vector<SubsetSelectorPtr> subset_selectors = {makeSelector(
-      {"stage", "version"}, envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
+      {"stage", "version"},
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetSelector::KEYS_SUBSET,
       {"stage"})};
 
   EXPECT_CALL(subset_info_, subsetSelectors()).WillRepeatedly(ReturnRef(subset_selectors));
diff --git a/test/common/upstream/test_cluster_manager.h b/test/common/upstream/test_cluster_manager.h
index cb6c93383e73..317d951bf446 100644
--- a/test/common/upstream/test_cluster_manager.h
+++ b/test/common/upstream/test_cluster_manager.h
@@ -3,9 +3,9 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 #include "envoy/network/listen_socket.h"
 #include "envoy/upstream/upstream.h"
 
@@ -63,7 +63,7 @@ class TestClusterManagerFactory : public ClusterManagerFactory {
   TestClusterManagerFactory() : api_(Api::createApiForTest(stats_)) {
     ON_CALL(*this, clusterFromProto_(_, _, _, _))
         .WillByDefault(Invoke(
-            [&](const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+            [&](const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
                 Outlier::EventLoggerSharedPtr outlier_event_logger,
                 bool added_via_api) -> std::pair<ClusterSharedPtr, ThreadAwareLoadBalancer*> {
               auto result = ClusterFactoryImplBase::create(
@@ -91,26 +91,26 @@ class TestClusterManagerFactory : public ClusterManagerFactory {
   }
 
   std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>
-  clusterFromProto(const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+  clusterFromProto(const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
                    Outlier::EventLoggerSharedPtr outlier_event_logger,
                    bool added_via_api) override {
     auto result = clusterFromProto_(cluster, cm, outlier_event_logger, added_via_api);
     return std::make_pair(result.first, ThreadAwareLoadBalancerPtr(result.second));
   }
 
-  CdsApiPtr createCds(const envoy::api::v2::core::ConfigSource&, ClusterManager&) override {
+  CdsApiPtr createCds(const envoy::config::core::v3alpha::ConfigSource&, ClusterManager&) override {
     return CdsApiPtr{createCds_()};
   }
 
   ClusterManagerPtr
-  clusterManagerFromProto(const envoy::config::bootstrap::v2::Bootstrap& bootstrap) override {
+  clusterManagerFromProto(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) override {
     return ClusterManagerPtr{clusterManagerFromProto_(bootstrap)};
   }
 
   Secret::SecretManager& secretManager() override { return secret_manager_; }
 
   MOCK_METHOD1(clusterManagerFromProto_,
-               ClusterManager*(const envoy::config::bootstrap::v2::Bootstrap& bootstrap));
+               ClusterManager*(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap));
   MOCK_METHOD3(allocateConnPool_,
                Http::ConnectionPool::Instance*(HostConstSharedPtr host,
                                                Network::ConnectionSocket::OptionsSharedPtr,
@@ -118,7 +118,7 @@ class TestClusterManagerFactory : public ClusterManagerFactory {
   MOCK_METHOD1(allocateTcpConnPool_, Tcp::ConnectionPool::Instance*(HostConstSharedPtr host));
   MOCK_METHOD4(clusterFromProto_,
                std::pair<ClusterSharedPtr, ThreadAwareLoadBalancer*>(
-                   const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+                   const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
                    Outlier::EventLoggerSharedPtr outlier_event_logger, bool added_via_api));
   MOCK_METHOD0(createCds_, CdsApi*());
 
@@ -158,7 +158,7 @@ class TestClusterManagerImpl : public ClusterManagerImpl {
 public:
   using ClusterManagerImpl::ClusterManagerImpl;
 
-  TestClusterManagerImpl(const envoy::config::bootstrap::v2::Bootstrap& bootstrap,
+  TestClusterManagerImpl(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap,
                          ClusterManagerFactory& factory, Stats::Store& stats,
                          ThreadLocal::Instance& tls, Runtime::Loader& runtime,
                          Runtime::RandomGenerator& random, const LocalInfo::LocalInfo& local_info,
@@ -183,7 +183,7 @@ class TestClusterManagerImpl : public ClusterManagerImpl {
 class MockedUpdatedClusterManagerImpl : public TestClusterManagerImpl {
 public:
   MockedUpdatedClusterManagerImpl(
-      const envoy::config::bootstrap::v2::Bootstrap& bootstrap, ClusterManagerFactory& factory,
+      const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap, ClusterManagerFactory& factory,
       Stats::Store& stats, ThreadLocal::Instance& tls, Runtime::Loader& runtime,
       Runtime::RandomGenerator& random, const LocalInfo::LocalInfo& local_info,
       AccessLog::AccessLogManager& log_manager, Event::Dispatcher& main_thread_dispatcher,
diff --git a/test/common/upstream/transport_socket_matcher_test.cc b/test/common/upstream/transport_socket_matcher_test.cc
index 661a19e2d46b..10dc8cbffd25 100644
--- a/test/common/upstream/transport_socket_matcher_test.cc
+++ b/test/common/upstream/transport_socket_matcher_test.cc
@@ -2,9 +2,9 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/base.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.validate.h"
 #include "envoy/network/transport_socket.h"
 #include "envoy/stats/scope.h"
 
@@ -52,7 +52,7 @@ class FooTransportSocketFactory
   Network::TransportSocketFactoryPtr
   createTransportSocketFactory(const Protobuf::Message& proto,
                                Server::Configuration::TransportSocketFactoryContext&) override {
-    const auto& node = dynamic_cast<const envoy::api::v2::core::Node&>(proto);
+    const auto& node = dynamic_cast<const envoy::config::core::v3alpha::Node&>(proto);
     std::string id = "default-foo";
     if (!node.id().empty()) {
       id = node.id();
@@ -61,7 +61,7 @@ class FooTransportSocketFactory
   }
 
   ProtobufTypes::MessagePtr createEmptyConfigProto() override {
-    return std::make_unique<envoy::api::v2::core::Node>();
+    return std::make_unique<envoy::config::core::v3alpha::Node>();
   }
 
   std::string name() const override { return "foo"; }
@@ -74,7 +74,8 @@ class TransportSocketMatcherTest : public testing::Test {
         stats_scope_(stats_store_.createScope("transport_socket_match.test")) {}
 
   void init(const std::vector<std::string>& match_yaml) {
-    Protobuf::RepeatedPtrField<envoy::api::v2::Cluster_TransportSocketMatch> matches;
+    Protobuf::RepeatedPtrField<envoy::config::cluster::v3alpha::Cluster::TransportSocketMatch>
+        matches;
     for (const auto& yaml : match_yaml) {
       auto transport_socket_match = matches.Add();
       TestUtility::loadFromYaml(yaml, *transport_socket_match);
@@ -83,7 +84,8 @@ class TransportSocketMatcherTest : public testing::Test {
                                                             mock_default_factory_, *stats_scope_);
   }
 
-  void validate(const envoy::api::v2::core::Metadata& metadata, const std::string& expected) {
+  void validate(const envoy::config::core::v3alpha::Metadata& metadata,
+                const std::string& expected) {
     auto& factory = matcher_->resolve(metadata).factory_;
     const auto& config_factory = dynamic_cast<const FakeTransportSocketFactory&>(factory);
     EXPECT_EQ(expected, config_factory.id());
@@ -108,7 +110,7 @@ name: "enableFooSocket"
     id: "abc"
  )EOF"});
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   validate(metadata, "default");
 }
 
@@ -131,7 +133,7 @@ name: "http_socket"
     id: "http"
  )EOF"});
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   TestUtility::loadFromYaml(R"EOF(
 filter_metadata:
   envoy.transport_socket_match: { sidecar: "true" } 
@@ -167,7 +169,7 @@ name: "sidecar_socket"
   config:
     id: "sidecar"
  )EOF"});
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   TestUtility::loadFromYaml(R"EOF(
 filter_metadata:
   envoy.transport_socket_match: { sidecar: "true", protocol: "http" }
@@ -185,7 +187,7 @@ match: {}
   config:
     id: "match_all"
  )EOF"});
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   validate(metadata, "match_all");
   TestUtility::loadFromYaml(R"EOF(
 filter_metadata:
diff --git a/test/common/upstream/upstream_impl_test.cc b/test/common/upstream/upstream_impl_test.cc
index b30b929d80a4..cbd286df1efb 100644
--- a/test/common/upstream/upstream_impl_test.cc
+++ b/test/common/upstream/upstream_impl_test.cc
@@ -6,10 +6,10 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/http/codec.h"
 #include "envoy/stats/scope.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -171,7 +171,7 @@ TEST_P(StrictDnsParamTest, ImmediateResolve) {
         cb(TestUtility::makeDnsResponse(std::get<2>(GetParam())));
         return nullptr;
       }));
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -205,7 +205,7 @@ TEST_F(StrictDnsClusterImplTest, ZeroHostsHealthChecker) {
   )EOF";
 
   ResolverData resolver(*dns_resolver_, dispatcher_);
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -266,7 +266,7 @@ TEST_F(StrictDnsClusterImplTest, Basic) {
     - { socket_address: { address: localhost2, port_value: 11002 }}
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -404,7 +404,7 @@ TEST_F(StrictDnsClusterImplTest, HostRemovalActiveHealthSkipped) {
   )EOF";
 
   ResolverData resolver(*dns_resolver_, dispatcher_);
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -456,7 +456,7 @@ TEST_F(StrictDnsClusterImplTest, HostRemovalAfterHcFail) {
   )EOF";
 
   ResolverData resolver(*dns_resolver_, dispatcher_);
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -581,7 +581,7 @@ TEST_F(StrictDnsClusterImplTest, LoadAssignmentBasic) {
               port_value: 8000
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -807,7 +807,7 @@ TEST_F(StrictDnsClusterImplTest, LoadAssignmentBasicMultiplePriorities) {
               port_value: 8000
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -906,7 +906,7 @@ TEST_F(StrictDnsClusterImplTest, CustomResolverFails) {
     hosts: [{ socket_address: { address: foo.bar.com, port_value: 443, resolver_name: customresolver }}]
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope =
       stats_.createScope(fmt::format("cluster.{}.", cluster_config.name()));
   Envoy::Server::Configuration::TransportSocketFactoryContextImpl factory_context(
@@ -932,7 +932,7 @@ TEST_F(StrictDnsClusterImplTest, RecordTtlAsDnsRefreshRate) {
     hosts: [{ socket_address: { address: localhost1, port_value: 11001 }}]
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -967,7 +967,7 @@ TEST_F(StrictDnsClusterImplTest, DefaultTtlAsDnsRefreshRateWhenResponseEmpty) {
     hosts: [{ socket_address: { address: localhost1, port_value: 11001 }}]
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1012,18 +1012,18 @@ TEST(HostImplTest, Weight) {
 
 TEST(HostImplTest, HostnameCanaryAndLocality) {
   MockClusterMockPrioritySet cluster;
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   Config::Metadata::mutableMetadataValue(metadata, Config::MetadataFilters::get().ENVOY_LB,
                                          Config::MetadataEnvoyLbKeys::get().CANARY)
       .set_bool_value(true);
-  envoy::api::v2::core::Locality locality;
+  envoy::config::core::v3alpha::Locality locality;
   locality.set_region("oceania");
   locality.set_zone("hello");
   locality.set_sub_zone("world");
   HostImpl host(cluster.info_, "lyft.com", Network::Utility::resolveUrl("tcp://10.0.0.1:1234"),
                 metadata, 1, locality,
-                envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), 1,
-                envoy::api::v2::core::HealthStatus::UNKNOWN);
+                envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(),
+                1, envoy::config::core::v3alpha::UNKNOWN);
   EXPECT_EQ(cluster.info_.get(), &host.cluster());
   EXPECT_EQ("lyft.com", host.hostname());
   EXPECT_TRUE(host.canary());
@@ -1073,11 +1073,12 @@ TEST(HostImplTest, HealthPipeAddress) {
   EXPECT_THROW_WITH_MESSAGE(
       {
         std::shared_ptr<MockClusterInfo> info{new NiceMock<MockClusterInfo>()};
-        envoy::api::v2::endpoint::Endpoint::HealthCheckConfig config;
+        envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig config;
         config.set_port_value(8000);
         HostDescriptionImpl descr(info, "", Network::Utility::resolveUrl("unix://foo"),
-                                  envoy::api::v2::core::Metadata::default_instance(),
-                                  envoy::api::v2::core::Locality().default_instance(), config, 1);
+                                  envoy::config::core::v3alpha::Metadata::default_instance(),
+                                  envoy::config::core::v3alpha::Locality().default_instance(),
+                                  config, 1);
       },
       EnvoyException, "Invalid host configuration: non-zero port for non-IP address");
 }
@@ -1096,7 +1097,7 @@ TEST_F(StaticClusterImplTest, InitialHosts) {
         port_value: 443
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1131,7 +1132,7 @@ TEST_F(StaticClusterImplTest, LoadAssignmentEmptyHostname) {
               port_value: 8000
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1183,7 +1184,7 @@ TEST_F(StaticClusterImplTest, LoadAssignmentMultiplePriorities) {
               port_value: 8000
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1228,7 +1229,7 @@ TEST_F(StaticClusterImplTest, LoadAssignmentLocality) {
               port_value: 8000
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1273,7 +1274,7 @@ TEST_F(StaticClusterImplTest, LoadAssignmentEdsHealth) {
   )EOF";
 
   NiceMock<MockClusterManager> cm;
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1298,7 +1299,7 @@ TEST_F(StaticClusterImplTest, AltStatName) {
     hosts: [{ socket_address: { address: 10.0.0.1, port_value: 443 }}]
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1321,7 +1322,7 @@ TEST_F(StaticClusterImplTest, RingHash) {
     hosts: [{ socket_address: { address: 10.0.0.1, port_value: 11001 }}]
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1347,7 +1348,7 @@ TEST_F(StaticClusterImplTest, OutlierDetector) {
     - { socket_address: { address: 10.0.0.1, port_value: 11002 }}
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1395,7 +1396,7 @@ TEST_F(StaticClusterImplTest, HealthyStat) {
     - { socket_address: { address: 10.0.0.1, port_value: 11002 }}
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1526,7 +1527,7 @@ TEST_F(StaticClusterImplTest, UrlConfig) {
     - { socket_address: { address: 10.0.0.2, port_value: 11002 }}
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1572,7 +1573,7 @@ TEST_F(StaticClusterImplTest, UnsupportedLBType) {
 
   EXPECT_THROW_WITH_MESSAGE(
       {
-        envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+        envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
         Envoy::Stats::ScopePtr scope =
             stats_.createScope(fmt::format("cluster.{}.", cluster_config.alt_stat_name().empty()
                                                               ? cluster_config.name()
@@ -1584,7 +1585,8 @@ TEST_F(StaticClusterImplTest, UnsupportedLBType) {
                                   false);
       },
       EnvoyException,
-      "Protobuf message (type envoy.api.v2.Cluster reason INVALID_ARGUMENT:(lb_policy): invalid "
+      "Protobuf message (type envoy.config.cluster.v3alpha.Cluster reason "
+      "INVALID_ARGUMENT:(lb_policy): invalid "
       "value \"fakelbtype\" for type TYPE_ENUM) has unknown fields");
 }
 
@@ -1597,7 +1599,7 @@ TEST_F(StaticClusterImplTest, MalformedHostIP) {
     hosts: [{ socket_address: { address: foo.bar.com }}]
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1625,7 +1627,7 @@ TEST_F(StaticClusterImplTest, NoHostsTest) {
       - priority: 1
   )EOF";
 
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope =
       stats_.createScope(fmt::format("cluster.{}.", cluster_config.name()));
   Envoy::Server::Configuration::TransportSocketFactoryContextImpl factory_context(
@@ -1638,7 +1640,7 @@ TEST_F(StaticClusterImplTest, NoHostsTest) {
 }
 
 TEST_F(StaticClusterImplTest, SourceAddressPriority) {
-  envoy::api::v2::Cluster config;
+  envoy::config::cluster::v3alpha::Cluster config;
   config.set_name("staticcluster");
   config.mutable_connect_timeout();
 
@@ -1696,7 +1698,7 @@ TEST_F(ClusterImplTest, CloseConnectionsOnHostHealthFailure) {
     close_connections_on_host_health_failure: true
     hosts: [{ socket_address: { address: foo.bar.com, port_value: 443 }}]
   )EOF";
-  envoy::api::v2::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
+  envoy::config::cluster::v3alpha::Cluster cluster_config = parseClusterFromV2Yaml(yaml);
   Envoy::Stats::ScopePtr scope = stats_.createScope(fmt::format(
       "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                             : cluster_config.alt_stat_name()));
@@ -1851,7 +1853,7 @@ class ClusterInfoImplTest : public testing::Test {
   Singleton::ManagerImpl singleton_manager_{Thread::threadFactoryForTest()};
   NiceMock<ThreadLocal::MockInstance> tls_;
   ReadyWatcher initialized_;
-  envoy::api::v2::Cluster cluster_config_;
+  envoy::config::cluster::v3alpha::Cluster cluster_config_;
   Envoy::Stats::ScopePtr scope_;
   std::unique_ptr<Server::Configuration::TransportSocketFactoryContextImpl> factory_context_;
   NiceMock<ProtobufMessage::MockValidationVisitor> validation_visitor_;
diff --git a/test/common/upstream/utility.h b/test/common/upstream/utility.h
index b8f64ee01472..6feeb1e37d48 100644
--- a/test/common/upstream/utility.h
+++ b/test/common/upstream/utility.h
@@ -1,10 +1,10 @@
 #pragma once
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/upstream/upstream.h"
 
 #include "common/common/utility.h"
@@ -42,26 +42,27 @@ inline std::string defaultStaticClusterJson(const std::string& name) {
 })EOF");
 }
 
-inline envoy::config::bootstrap::v2::Bootstrap
+inline envoy::config::bootstrap::v3alpha::Bootstrap
 parseBootstrapFromV2Json(const std::string& json_string) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   TestUtility::loadFromJson(json_string, bootstrap);
   return bootstrap;
 }
 
-inline envoy::api::v2::Cluster parseClusterFromV2Json(const std::string& json_string) {
-  envoy::api::v2::Cluster cluster;
+inline envoy::config::cluster::v3alpha::Cluster
+parseClusterFromV2Json(const std::string& json_string) {
+  envoy::config::cluster::v3alpha::Cluster cluster;
   TestUtility::loadFromJson(json_string, cluster);
   return cluster;
 }
 
-inline envoy::api::v2::Cluster parseClusterFromV2Yaml(const std::string& yaml) {
-  envoy::api::v2::Cluster cluster;
+inline envoy::config::cluster::v3alpha::Cluster parseClusterFromV2Yaml(const std::string& yaml) {
+  envoy::config::cluster::v3alpha::Cluster cluster;
   TestUtility::loadFromYaml(yaml, cluster);
   return cluster;
 }
 
-inline envoy::api::v2::Cluster defaultStaticCluster(const std::string& name) {
+inline envoy::config::cluster::v3alpha::Cluster defaultStaticCluster(const std::string& name) {
   return parseClusterFromV2Json(defaultStaticClusterJson(name));
 }
 
@@ -69,38 +70,39 @@ inline HostSharedPtr makeTestHost(ClusterInfoConstSharedPtr cluster, const std::
                                   uint32_t weight = 1) {
   return HostSharedPtr{new HostImpl(
       cluster, "", Network::Utility::resolveUrl(url),
-      envoy::api::v2::core::Metadata::default_instance(), weight, envoy::api::v2::core::Locality(),
-      envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), 0,
-      envoy::api::v2::core::HealthStatus::UNKNOWN)};
+      envoy::config::core::v3alpha::Metadata::default_instance(), weight,
+      envoy::config::core::v3alpha::Locality(),
+      envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(), 0,
+      envoy::config::core::v3alpha::UNKNOWN)};
 }
 
 inline HostSharedPtr makeTestHost(ClusterInfoConstSharedPtr cluster, const std::string& url,
-                                  const envoy::api::v2::core::Metadata& metadata,
+                                  const envoy::config::core::v3alpha::Metadata& metadata,
                                   uint32_t weight = 1) {
-  return HostSharedPtr{
-      new HostImpl(cluster, "", Network::Utility::resolveUrl(url), metadata, weight,
-                   envoy::api::v2::core::Locality(),
-                   envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), 0,
-                   envoy::api::v2::core::HealthStatus::UNKNOWN)};
+  return HostSharedPtr{new HostImpl(
+      cluster, "", Network::Utility::resolveUrl(url), metadata, weight,
+      envoy::config::core::v3alpha::Locality(),
+      envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(), 0,
+      envoy::config::core::v3alpha::UNKNOWN)};
 }
 
-inline HostSharedPtr
-makeTestHost(ClusterInfoConstSharedPtr cluster, const std::string& url,
-             const envoy::api::v2::endpoint::Endpoint::HealthCheckConfig& health_check_config,
-             uint32_t weight = 1) {
+inline HostSharedPtr makeTestHost(
+    ClusterInfoConstSharedPtr cluster, const std::string& url,
+    const envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig& health_check_config,
+    uint32_t weight = 1) {
   return HostSharedPtr{new HostImpl(cluster, "", Network::Utility::resolveUrl(url),
-                                    envoy::api::v2::core::Metadata::default_instance(), weight,
-                                    envoy::api::v2::core::Locality(), health_check_config, 0,
-                                    envoy::api::v2::core::HealthStatus::UNKNOWN)};
+                                    envoy::config::core::v3alpha::Metadata::default_instance(),
+                                    weight, envoy::config::core::v3alpha::Locality(),
+                                    health_check_config, 0, envoy::config::core::v3alpha::UNKNOWN)};
 }
 
 inline HostDescriptionConstSharedPtr makeTestHostDescription(ClusterInfoConstSharedPtr cluster,
                                                              const std::string& url) {
   return HostDescriptionConstSharedPtr{new HostDescriptionImpl(
       cluster, "", Network::Utility::resolveUrl(url),
-      envoy::api::v2::core::Metadata::default_instance(),
-      envoy::api::v2::core::Locality().default_instance(),
-      envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), 0)};
+      envoy::config::core::v3alpha::Metadata::default_instance(),
+      envoy::config::core::v3alpha::Locality().default_instance(),
+      envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(), 0)};
 }
 
 inline HostsPerLocalitySharedPtr makeHostsPerLocality(std::vector<HostVector>&& locality_hosts,
@@ -114,9 +116,9 @@ makeLocalityWeights(std::initializer_list<uint32_t> locality_weights) {
   return std::make_shared<LocalityWeights>(locality_weights);
 }
 
-inline envoy::api::v2::core::HealthCheck
+inline envoy::config::core::v3alpha::HealthCheck
 parseHealthCheckFromV2Yaml(const std::string& yaml_string) {
-  envoy::api::v2::core::HealthCheck health_check;
+  envoy::config::core::v3alpha::HealthCheck health_check;
   TestUtility::loadFromYaml(yaml_string, health_check);
   return health_check;
 }
diff --git a/test/config/BUILD b/test/config/BUILD
index 286e06521a6c..c524f6f19ed0 100644
--- a/test/config/BUILD
+++ b/test/config/BUILD
@@ -26,15 +26,17 @@ envoy_cc_test_library(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/transport_socket/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/config/utility.cc b/test/config/utility.cc
index 564182786299..ac0ca09122af 100644
--- a/test/config/utility.cc
+++ b/test/config/utility.cc
@@ -1,18 +1,18 @@
 #include "test/config/utility.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/accesslog/v2/file.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/config/transport_socket/tap/v2alpha/tap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/file.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tap/v3alpha/tap.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/http/codec.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/common/assert.h"
 #include "common/config/resources.h"
@@ -302,9 +302,10 @@ std::string ConfigHelper::adsBootstrap(const std::string& api_type) {
       api_type);
 }
 
-envoy::api::v2::Cluster ConfigHelper::buildCluster(const std::string& name, int port,
-                                                   const std::string& ip_version) {
-  return TestUtility::parseYaml<envoy::api::v2::Cluster>(fmt::format(R"EOF(
+envoy::config::cluster::v3alpha::Cluster
+ConfigHelper::buildCluster(const std::string& name, int port, const std::string& ip_version) {
+  return TestUtility::parseYaml<envoy::config::cluster::v3alpha::Cluster>(
+      fmt::format(R"EOF(
       name: {}
       connect_timeout: 5s
       type: STATIC
@@ -320,7 +321,7 @@ envoy::api::v2::Cluster ConfigHelper::buildCluster(const std::string& name, int
       lb_policy: ROUND_ROBIN
       http2_protocol_options: {{}}
     )EOF",
-                                                                     name, name, ip_version, port));
+                  name, name, ip_version, port));
 }
 
 ConfigHelper::ConfigHelper(const Network::Address::IpVersion version, Api::Api& api,
@@ -396,12 +397,13 @@ void ConfigHelper::finalize(const std::vector<uint32_t>& ports) {
     for (int j = 0; j < listener->filter_chains_size(); ++j) {
       if (tap_path) {
         auto* filter_chain = listener->mutable_filter_chains(j);
-        const bool has_tls = filter_chain->has_tls_context();
+        const bool has_tls = filter_chain->has_hidden_envoy_deprecated_tls_context();
         absl::optional<ProtobufWkt::Struct> tls_config;
         if (has_tls) {
           tls_config = ProtobufWkt::Struct();
-          TestUtility::jsonConvert(filter_chain->tls_context(), tls_config.value());
-          filter_chain->clear_tls_context();
+          TestUtility::jsonConvert(filter_chain->hidden_envoy_deprecated_tls_context(),
+                                   tls_config.value());
+          filter_chain->clear_hidden_envoy_deprecated_tls_context();
         }
         setTapTransportSocket(tap_path.value(), fmt::format("listener_{}_{}", i, j),
                               *filter_chain->mutable_transport_socket(), tls_config);
@@ -410,9 +412,9 @@ void ConfigHelper::finalize(const std::vector<uint32_t>& ports) {
   }
   for (int i = 0; i < bootstrap_.mutable_static_resources()->clusters_size(); ++i) {
     auto* cluster = static_resources->mutable_clusters(i);
-    if (cluster->type() == envoy::api::v2::Cluster::EDS) {
+    if (cluster->type() == envoy::config::cluster::v3alpha::Cluster::EDS) {
       eds_hosts = true;
-    } else if (cluster->type() == envoy::api::v2::Cluster::ORIGINAL_DST) {
+    } else if (cluster->type() == envoy::config::cluster::v3alpha::Cluster::ORIGINAL_DST) {
       original_dst_cluster = true;
     } else if (cluster->has_cluster_type()) {
       custom_cluster = true;
@@ -442,12 +444,13 @@ void ConfigHelper::finalize(const std::vector<uint32_t>& ports) {
     }
 
     if (tap_path) {
-      const bool has_tls = cluster->has_tls_context();
+      const bool has_tls = cluster->has_hidden_envoy_deprecated_tls_context();
       absl::optional<ProtobufWkt::Struct> tls_config;
       if (has_tls) {
         tls_config = ProtobufWkt::Struct();
-        TestUtility::jsonConvert(cluster->tls_context(), tls_config.value());
-        cluster->clear_tls_context();
+        TestUtility::jsonConvert(cluster->hidden_envoy_deprecated_tls_context(),
+                                 tls_config.value());
+        cluster->clear_hidden_envoy_deprecated_tls_context();
       }
       setTapTransportSocket(tap_path.value(), fmt::format("cluster_{}", i),
                             *cluster->mutable_transport_socket(), tls_config);
@@ -470,23 +473,24 @@ void ConfigHelper::finalize(const std::vector<uint32_t>& ports) {
   finalized_ = true;
 }
 
-void ConfigHelper::setTapTransportSocket(const std::string& tap_path, const std::string& type,
-                                         envoy::api::v2::core::TransportSocket& transport_socket,
-                                         const absl::optional<ProtobufWkt::Struct>& tls_config) {
+void ConfigHelper::setTapTransportSocket(
+    const std::string& tap_path, const std::string& type,
+    envoy::config::core::v3alpha::TransportSocket& transport_socket,
+    const absl::optional<ProtobufWkt::Struct>& tls_config) {
   // Determine inner transport socket.
-  envoy::api::v2::core::TransportSocket inner_transport_socket;
+  envoy::config::core::v3alpha::TransportSocket inner_transport_socket;
   if (!transport_socket.name().empty()) {
     RELEASE_ASSERT(!tls_config, "");
     inner_transport_socket.MergeFrom(transport_socket);
   } else if (tls_config.has_value()) {
     inner_transport_socket.set_name("envoy.transport_sockets.tls");
-    inner_transport_socket.mutable_config()->MergeFrom(tls_config.value());
+    inner_transport_socket.mutable_hidden_envoy_deprecated_config()->MergeFrom(tls_config.value());
   } else {
     inner_transport_socket.set_name("envoy.transport_sockets.raw_buffer");
   }
   // Configure outer tap transport socket.
   transport_socket.set_name("envoy.transport_sockets.tap");
-  envoy::config::transport_socket::tap::v2alpha::Tap tap_config;
+  envoy::extensions::transport_sockets::tap::v3alpha::Tap tap_config;
   tap_config.mutable_common_config()
       ->mutable_static_config()
       ->mutable_match_config()
@@ -496,7 +500,7 @@ void ConfigHelper::setTapTransportSocket(const std::string& tap_path, const std:
                           ->mutable_output_config()
                           ->mutable_sinks()
                           ->Add();
-  output_sink->set_format(envoy::service::tap::v2alpha::OutputSink::PROTO_TEXT);
+  output_sink->set_format(envoy::config::tap::v3alpha::OutputSink::PROTO_TEXT);
   const ::testing::TestInfo* const test_info =
       ::testing::UnitTest::GetInstance()->current_test_info();
   const std::string test_id =
@@ -522,7 +526,8 @@ void ConfigHelper::setSourceAddress(const std::string& address_string) {
 
 void ConfigHelper::setDefaultHostAndRoute(const std::string& domains, const std::string& prefix) {
   RELEASE_ASSERT(!finalized_, "");
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+      hcm_config;
   loadHttpConnectionManager(hcm_config);
 
   auto* virtual_host = hcm_config.mutable_route_config()->mutable_virtual_hosts(0);
@@ -547,10 +552,11 @@ void ConfigHelper::setBufferLimits(uint32_t upstream_buffer_limit,
 
   auto filter = getFilterFromListener("envoy.http_connection_manager");
   if (filter) {
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+        hcm_config;
     loadHttpConnectionManager(hcm_config);
-    if (hcm_config.codec_type() ==
-        envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::HTTP2) {
+    if (hcm_config.codec_type() == envoy::extensions::filters::network::http_connection_manager::
+                                       v3alpha::HttpConnectionManager::HTTP2) {
       const uint32_t size =
           std::max(downstream_buffer_limit, Http::Http2Settings::MIN_INITIAL_STREAM_WINDOW_SIZE);
       auto* options = hcm_config.mutable_http2_protocol_options();
@@ -561,21 +567,19 @@ void ConfigHelper::setBufferLimits(uint32_t upstream_buffer_limit,
 }
 
 void ConfigHelper::setDownstreamHttpIdleTimeout(std::chrono::milliseconds timeout) {
-  addConfigModifier(
-      [timeout](
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_common_http_protocol_options()->mutable_idle_timeout()->MergeFrom(
-            ProtobufUtil::TimeUtil::MillisecondsToDuration(timeout.count()));
-      });
+  addConfigModifier([timeout](envoy::extensions::filters::network::http_connection_manager::
+                                  v3alpha::HttpConnectionManager& hcm) {
+    hcm.mutable_common_http_protocol_options()->mutable_idle_timeout()->MergeFrom(
+        ProtobufUtil::TimeUtil::MillisecondsToDuration(timeout.count()));
+  });
 }
 
 void ConfigHelper::setDownstreamMaxConnectionDuration(std::chrono::milliseconds timeout) {
-  addConfigModifier(
-      [timeout](
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_common_http_protocol_options()->mutable_max_connection_duration()->MergeFrom(
-            ProtobufUtil::TimeUtil::MillisecondsToDuration(timeout.count()));
-      });
+  addConfigModifier([timeout](envoy::extensions::filters::network::http_connection_manager::
+                                  v3alpha::HttpConnectionManager& hcm) {
+    hcm.mutable_common_http_protocol_options()->mutable_max_connection_duration()->MergeFrom(
+        ProtobufUtil::TimeUtil::MillisecondsToDuration(timeout.count()));
+  });
 }
 
 void ConfigHelper::setConnectTimeout(std::chrono::milliseconds timeout) {
@@ -590,9 +594,9 @@ void ConfigHelper::setConnectTimeout(std::chrono::milliseconds timeout) {
   connect_timeout_set_ = true;
 }
 
-envoy::api::v2::route::VirtualHost
+envoy::config::route::v3alpha::VirtualHost
 ConfigHelper::createVirtualHost(const char* domain, const char* prefix, const char* cluster) {
-  envoy::api::v2::route::VirtualHost virtual_host;
+  envoy::config::route::v3alpha::VirtualHost virtual_host;
   virtual_host.set_name(domain);
   virtual_host.add_domains(domain);
   virtual_host.add_routes()->mutable_match()->set_prefix(prefix);
@@ -601,9 +605,10 @@ ConfigHelper::createVirtualHost(const char* domain, const char* prefix, const ch
   return virtual_host;
 }
 
-void ConfigHelper::addVirtualHost(const envoy::api::v2::route::VirtualHost& vhost) {
+void ConfigHelper::addVirtualHost(const envoy::config::route::v3alpha::VirtualHost& vhost) {
   RELEASE_ASSERT(!finalized_, "");
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+      hcm_config;
   loadHttpConnectionManager(hcm_config);
   auto route_config = hcm_config.mutable_route_config();
   auto* virtual_host = route_config->add_virtual_hosts();
@@ -613,7 +618,8 @@ void ConfigHelper::addVirtualHost(const envoy::api::v2::route::VirtualHost& vhos
 
 void ConfigHelper::addFilter(const std::string& config) {
   RELEASE_ASSERT(!finalized_, "");
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+      hcm_config;
   loadHttpConnectionManager(hcm_config);
 
   auto* filter_list_back = hcm_config.add_http_filters();
@@ -626,11 +632,11 @@ void ConfigHelper::addFilter(const std::string& config) {
   storeHttpConnectionManager(hcm_config);
 }
 
-void ConfigHelper::setClientCodec(
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::CodecType
-        type) {
+void ConfigHelper::setClientCodec(envoy::extensions::filters::network::http_connection_manager::
+                                      v3alpha::HttpConnectionManager::CodecType type) {
   RELEASE_ASSERT(!finalized_, "");
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+      hcm_config;
   if (loadHttpConnectionManager(hcm_config)) {
     hcm_config.set_codec_type(type);
     storeHttpConnectionManager(hcm_config);
@@ -642,7 +648,7 @@ void ConfigHelper::addSslConfig(const ServerSslOptions& options) {
 
   auto* filter_chain =
       bootstrap_.mutable_static_resources()->mutable_listeners(0)->mutable_filter_chains(0);
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   initializeTls(options, *tls_context.mutable_common_tls_context());
   filter_chain->mutable_transport_socket()->set_name("envoy.transport_sockets.tls");
   filter_chain->mutable_transport_socket()->mutable_typed_config()->PackFrom(tls_context);
@@ -653,9 +659,10 @@ bool ConfigHelper::setAccessLog(const std::string& filename, absl::string_view f
     return false;
   }
   // Replace /dev/null with a real path for the file access log.
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+      hcm_config;
   loadHttpConnectionManager(hcm_config);
-  envoy::config::accesslog::v2::FileAccessLog access_log_config;
+  envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog access_log_config;
   if (!format.empty()) {
     access_log_config.set_format(std::string(format));
   }
@@ -665,8 +672,9 @@ bool ConfigHelper::setAccessLog(const std::string& filename, absl::string_view f
   return true;
 }
 
-void ConfigHelper::initializeTls(const ServerSslOptions& options,
-                                 envoy::api::v2::auth::CommonTlsContext& common_tls_context) {
+void ConfigHelper::initializeTls(
+    const ServerSslOptions& options,
+    envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext& common_tls_context) {
   common_tls_context.add_alpn_protocols("h2");
   common_tls_context.add_alpn_protocols("http/1.1");
 
@@ -679,8 +687,9 @@ void ConfigHelper::initializeTls(const ServerSslOptions& options,
   // We'll negotiate up to TLSv1.3 for the tests that care, but it really
   // depends on what the client sets.
   common_tls_context.mutable_tls_params()->set_tls_maximum_protocol_version(
-      options.tlsv1_3_ ? envoy::api::v2::auth::TlsParameters::TLSv1_3
-                       : envoy::api::v2::auth::TlsParameters::TLSv1_2);
+      options.tlsv1_3_
+          ? envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3
+          : envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2);
   if (options.rsa_cert_) {
     auto* tls_certificate = common_tls_context.add_tls_certificates();
     tls_certificate->mutable_certificate_chain()->set_filename(
@@ -704,7 +713,8 @@ void ConfigHelper::renameListener(const std::string& name) {
   }
 }
 
-envoy::api::v2::listener::Filter* ConfigHelper::getFilterFromListener(const std::string& name) {
+envoy::config::listener::v3alpha::Filter*
+ConfigHelper::getFilterFromListener(const std::string& name) {
   RELEASE_ASSERT(!finalized_, "");
   if (bootstrap_.mutable_static_resources()->listeners_size() == 0) {
     return nullptr;
@@ -736,21 +746,22 @@ void ConfigHelper::addNetworkFilter(const std::string& filter_yaml) {
 }
 
 bool ConfigHelper::loadHttpConnectionManager(
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager&
+        hcm) {
   RELEASE_ASSERT(!finalized_, "");
   auto* hcm_filter = getFilterFromListener("envoy.http_connection_manager");
   if (hcm_filter) {
     auto* config = hcm_filter->mutable_typed_config();
-    hcm = MessageUtil::anyConvert<
-        envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager>(
-        *config);
+    hcm = MessageUtil::anyConvert<envoy::extensions::filters::network::http_connection_manager::
+                                      v3alpha::HttpConnectionManager>(*config);
     return true;
   }
   return false;
 }
 
 void ConfigHelper::storeHttpConnectionManager(
-    const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
+    const envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager& hcm) {
   RELEASE_ASSERT(!finalized_, "");
   auto* hcm_config_any =
       getFilterFromListener("envoy.http_connection_manager")->mutable_typed_config();
@@ -764,8 +775,9 @@ void ConfigHelper::addConfigModifier(ConfigModifierFunction function) {
 }
 
 void ConfigHelper::addConfigModifier(HttpModifierFunction function) {
-  addConfigModifier([function, this](envoy::config::bootstrap::v2::Bootstrap&) -> void {
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+  addConfigModifier([function, this](envoy::config::bootstrap::v3alpha::Bootstrap&) -> void {
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+        hcm_config;
     loadHttpConnectionManager(hcm_config);
     function(hcm_config);
     storeHttpConnectionManager(hcm_config);
@@ -775,7 +787,7 @@ void ConfigHelper::addConfigModifier(HttpModifierFunction function) {
 void ConfigHelper::setLds(absl::string_view version_info) {
   applyConfigModifiers();
 
-  envoy::api::v2::DiscoveryResponse lds;
+  envoy::service::discovery::v3alpha::DiscoveryResponse lds;
   lds.set_version_info(std::string(version_info));
   for (auto& listener : bootstrap_.static_resources().listeners()) {
     ProtobufWkt::Any* resource = lds.add_resources();
@@ -791,10 +803,11 @@ void ConfigHelper::setLds(absl::string_view version_info) {
 void ConfigHelper::setOutboundFramesLimits(uint32_t max_all_frames, uint32_t max_control_frames) {
   auto filter = getFilterFromListener("envoy.http_connection_manager");
   if (filter) {
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager hcm_config;
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
+        hcm_config;
     loadHttpConnectionManager(hcm_config);
-    if (hcm_config.codec_type() ==
-        envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::HTTP2) {
+    if (hcm_config.codec_type() == envoy::extensions::filters::network::http_connection_manager::
+                                       v3alpha::HttpConnectionManager::HTTP2) {
       auto* options = hcm_config.mutable_http2_protocol_options();
       options->mutable_max_outbound_frames()->set_value(max_all_frames);
       options->mutable_max_outbound_control_frames()->set_value(max_control_frames);
@@ -805,9 +818,9 @@ void ConfigHelper::setOutboundFramesLimits(uint32_t max_all_frames, uint32_t max
 
 CdsHelper::CdsHelper() : cds_path_(TestEnvironment::writeStringToFileForTest("cds.pb_text", "")) {}
 
-void CdsHelper::setCds(const std::vector<envoy::api::v2::Cluster>& clusters) {
+void CdsHelper::setCds(const std::vector<envoy::config::cluster::v3alpha::Cluster>& clusters) {
   // Write to file the DiscoveryResponse and trigger inotify watch.
-  envoy::api::v2::DiscoveryResponse cds_response;
+  envoy::service::discovery::v3alpha::DiscoveryResponse cds_response;
   cds_response.set_version_info(std::to_string(cds_version_++));
   cds_response.set_type_url(Config::TypeUrl::get().Cluster);
   for (const auto& cluster : clusters) {
@@ -826,10 +839,10 @@ EdsHelper::EdsHelper() : eds_path_(TestEnvironment::writeStringToFileForTest("ed
   ++update_successes_;
 }
 
-void EdsHelper::setEds(
-    const std::vector<envoy::api::v2::ClusterLoadAssignment>& cluster_load_assignments) {
+void EdsHelper::setEds(const std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>&
+                           cluster_load_assignments) {
   // Write to file the DiscoveryResponse and trigger inotify watch.
-  envoy::api::v2::DiscoveryResponse eds_response;
+  envoy::service::discovery::v3alpha::DiscoveryResponse eds_response;
   eds_response.set_version_info(std::to_string(eds_version_++));
   eds_response.set_type_url(Config::TypeUrl::get().ClusterLoadAssignment);
   for (const auto& cluster_load_assignment : cluster_load_assignments) {
@@ -843,7 +856,8 @@ void EdsHelper::setEds(
 }
 
 void EdsHelper::setEdsAndWait(
-    const std::vector<envoy::api::v2::ClusterLoadAssignment>& cluster_load_assignments,
+    const std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>&
+        cluster_load_assignments,
     IntegrationTestServerStats& server_stats) {
   setEds(cluster_load_assignments);
   // Make sure Envoy has consumed the update now that it is running.
diff --git a/test/config/utility.h b/test/config/utility.h
index 7e6f1c63a93d..83677d490ba0 100644
--- a/test/config/utility.h
+++ b/test/config/utility.h
@@ -6,14 +6,14 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/http/codes.h"
 
 #include "common/network/address_impl.h"
@@ -62,12 +62,14 @@ class ConfigHelper {
   ConfigHelper(const Network::Address::IpVersion version, Api::Api& api,
                const std::string& config = HTTP_PROXY_CONFIG);
 
-  static void initializeTls(const ServerSslOptions& options,
-                            envoy::api::v2::auth::CommonTlsContext& common_context);
+  static void initializeTls(
+      const ServerSslOptions& options,
+      envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext& common_context);
 
-  using ConfigModifierFunction = std::function<void(envoy::config::bootstrap::v2::Bootstrap&)>;
-  using HttpModifierFunction = std::function<void(
-      envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&)>;
+  using ConfigModifierFunction = std::function<void(envoy::config::bootstrap::v3alpha::Bootstrap&)>;
+  using HttpModifierFunction =
+      std::function<void(envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                             HttpConnectionManager&)>;
 
   // A basic configuration (admin port, cluster_0, one listener) with no network filters.
   static const std::string BASE_CONFIG;
@@ -95,8 +97,8 @@ class ConfigHelper {
   static std::string discoveredClustersBootstrap(const std::string& api_type);
   static std::string adsBootstrap(const std::string& api_type);
   // Builds a standard Cluster config fragment, with a single endpoint (at loopback:port).
-  static envoy::api::v2::Cluster buildCluster(const std::string& name, int port,
-                                              const std::string& ip_version);
+  static envoy::config::cluster::v3alpha::Cluster buildCluster(const std::string& name, int port,
+                                                               const std::string& ip_version);
 
   // Run the final config modifiers, and then set the upstream ports based on upstream connections.
   // This is the last operation run on |bootstrap_| before it is handed to Envoy.
@@ -122,10 +124,10 @@ class ConfigHelper {
   // Set the connect timeout on upstream connections.
   void setConnectTimeout(std::chrono::milliseconds timeout);
 
-  envoy::api::v2::route::VirtualHost createVirtualHost(const char* host, const char* route = "/",
-                                                       const char* cluster = "cluster_0");
+  envoy::config::route::v3alpha::VirtualHost
+  createVirtualHost(const char* host, const char* route = "/", const char* cluster = "cluster_0");
 
-  void addVirtualHost(const envoy::api::v2::route::VirtualHost& vhost);
+  void addVirtualHost(const envoy::config::route::v3alpha::VirtualHost& vhost);
 
   // Add an HTTP filter prior to existing filters.
   void addFilter(const std::string& filter_yaml);
@@ -134,9 +136,8 @@ class ConfigHelper {
   void addNetworkFilter(const std::string& filter_yaml);
 
   // Sets the client codec to the specified type.
-  void setClientCodec(
-      envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::CodecType
-          type);
+  void setClientCodec(envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                          HttpConnectionManager::CodecType type);
 
   // Add the default SSL configuration.
   void addSslConfig(const ServerSslOptions& options);
@@ -165,7 +166,7 @@ class ConfigHelper {
   void setOutboundFramesLimits(uint32_t max_all_frames, uint32_t max_control_frames);
 
   // Return the bootstrap configuration for hand-off to Envoy.
-  const envoy::config::bootstrap::v2::Bootstrap& bootstrap() { return bootstrap_; }
+  const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap() { return bootstrap_; }
 
   // Allow a finalized configuration to be edited for generating xDS responses
   void applyConfigModifiers();
@@ -177,23 +178,23 @@ class ConfigHelper {
 private:
   // Load the first HCM struct from the first listener into a parsed proto.
   bool loadHttpConnectionManager(
-      envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm);
+      envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager&
+          hcm);
   // Take the contents of the provided HCM proto and stuff them into the first HCM
   // struct of the first listener.
-  void storeHttpConnectionManager(
-      const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-          hcm);
+  void storeHttpConnectionManager(const envoy::extensions::filters::network::
+                                      http_connection_manager::v3alpha::HttpConnectionManager& hcm);
 
   // Finds the filter named 'name' from the first filter chain from the first listener.
-  envoy::api::v2::listener::Filter* getFilterFromListener(const std::string& name);
+  envoy::config::listener::v3alpha::Filter* getFilterFromListener(const std::string& name);
 
   // Configure a tap transport socket for a cluster/filter chain.
   void setTapTransportSocket(const std::string& tap_path, const std::string& type,
-                             envoy::api::v2::core::TransportSocket& transport_socket,
+                             envoy::config::core::v3alpha::TransportSocket& transport_socket,
                              const absl::optional<ProtobufWkt::Struct>& tls_config);
 
   // The bootstrap proto Envoy will start up with.
-  envoy::config::bootstrap::v2::Bootstrap bootstrap_;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap_;
 
   // The config modifiers added via addConfigModifier() which will be applied in finalize()
   std::vector<ConfigModifierFunction> config_modifiers_;
@@ -216,7 +217,7 @@ class CdsHelper {
   CdsHelper();
 
   // Set CDS contents on filesystem.
-  void setCds(const std::vector<envoy::api::v2::Cluster>& cluster);
+  void setCds(const std::vector<envoy::config::cluster::v3alpha::Cluster>& cluster);
   const std::string& cds_path() const { return cds_path_; }
 
 private:
@@ -230,10 +231,11 @@ class EdsHelper {
   EdsHelper();
 
   // Set EDS contents on filesystem and wait for Envoy to pick this up.
-  void setEds(const std::vector<envoy::api::v2::ClusterLoadAssignment>& cluster_load_assignments);
-  void
-  setEdsAndWait(const std::vector<envoy::api::v2::ClusterLoadAssignment>& cluster_load_assignments,
-                IntegrationTestServerStats& server_stats);
+  void setEds(const std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>&
+                  cluster_load_assignments);
+  void setEdsAndWait(const std::vector<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>&
+                         cluster_load_assignments,
+                     IntegrationTestServerStats& server_stats);
   const std::string& eds_path() const { return eds_path_; }
 
 private:
diff --git a/test/config_test/config_test.cc b/test/config_test/config_test.cc
index 626c8482c270..b5dc04b55a3c 100644
--- a/test/config_test/config_test.cc
+++ b/test/config_test/config_test.cc
@@ -2,9 +2,9 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/listener/listener.pb.h"
 #include "envoy/common/platform.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/protobuf/utility.h"
@@ -83,7 +83,7 @@ class ConfigTest {
           }
         }));
 
-    envoy::config::bootstrap::v2::Bootstrap bootstrap;
+    envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
     Server::InstanceUtil::loadBootstrapConfig(
         bootstrap, options_, server_.messageValidationContext().staticValidationVisitor(), *api_);
     Server::Configuration::InitialImpl initial_config(bootstrap);
@@ -101,16 +101,17 @@ class ConfigTest {
     }));
     ON_CALL(server_, listenerManager()).WillByDefault(ReturnRef(listener_manager_));
     ON_CALL(component_factory_, createNetworkFilterFactoryList(_, _))
-        .WillByDefault(
-            Invoke([&](const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
-                       Server::Configuration::FactoryContext& context)
-                       -> std::vector<Network::FilterFactoryCb> {
+        .WillByDefault(Invoke(
+            [&](const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
+                Server::Configuration::FactoryContext& context)
+                -> std::vector<Network::FilterFactoryCb> {
               return Server::ProdListenerComponentFactory::createNetworkFilterFactoryList_(filters,
                                                                                            context);
             }));
     ON_CALL(component_factory_, createListenerFilterFactoryList(_, _))
         .WillByDefault(Invoke(
-            [&](const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+            [&](const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>&
+                    filters,
                 Server::Configuration::ListenerFactoryContext& context)
                 -> std::vector<Network::ListenerFilterFactoryCb> {
               return Server::ProdListenerComponentFactory::createListenerFilterFactoryList_(
@@ -118,7 +119,8 @@ class ConfigTest {
             }));
     ON_CALL(component_factory_, createUdpListenerFilterFactoryList(_, _))
         .WillByDefault(Invoke(
-            [&](const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+            [&](const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>&
+                    filters,
                 Server::Configuration::ListenerFactoryContext& context)
                 -> std::vector<Network::UdpListenerFilterFactoryCb> {
               return Server::ProdListenerComponentFactory::createUdpListenerFilterFactoryList_(
@@ -157,7 +159,7 @@ void testMerge() {
   const std::string overlay = "static_resources: { clusters: [{name: 'foo'}]}";
   OptionsImpl options(Server::createTestOptionsImpl("google_com_proxy.v2.yaml", overlay,
                                                     Network::Address::IpVersion::v6));
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   Server::InstanceUtil::loadBootstrapConfig(bootstrap, options,
                                             ProtobufMessage::getStrictValidationVisitor(), *api);
   EXPECT_EQ(2, bootstrap.static_resources().clusters_size());
@@ -171,7 +173,7 @@ uint32_t run(const std::string& directory) {
     OptionsImpl options(
         Envoy::Server::createTestOptionsImpl(filename, "", Network::Address::IpVersion::v6));
     ConfigTest test1(options);
-    envoy::config::bootstrap::v2::Bootstrap bootstrap;
+    envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
     if (Server::InstanceUtil::loadBootstrapConfig(
             bootstrap, options, ProtobufMessage::getStrictValidationVisitor(), *api) ==
         Server::InstanceUtil::BootstrapVersion::V2) {
diff --git a/test/extensions/access_loggers/file/BUILD b/test/extensions/access_loggers/file/BUILD
index 64a55c5dc10a..fde1fd7cb472 100644
--- a/test/extensions/access_loggers/file/BUILD
+++ b/test/extensions/access_loggers/file/BUILD
@@ -19,7 +19,7 @@ envoy_extension_cc_test(
         "//source/extensions/access_loggers/file:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/access_loggers/file/config_test.cc b/test/extensions/access_loggers/file/config_test.cc
index 0b58cfd30c0f..ea5bc65eae59 100644
--- a/test/extensions/access_loggers/file/config_test.cc
+++ b/test/extensions/access_loggers/file/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/accesslog/v2/file.pb.h"
-#include "envoy/config/filter/accesslog/v2/accesslog.pb.h"
+#include "envoy/config/filter/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/file.pb.h"
 #include "envoy/registry/registry.h"
 
 #include "common/access_log/access_log_impl.h"
@@ -23,18 +23,19 @@ namespace {
 TEST(FileAccessLogConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
-  EXPECT_THROW(FileAccessLogFactory().createAccessLogInstance(
-                   envoy::config::accesslog::v2::FileAccessLog(), nullptr, context),
-               ProtoValidationException);
+  EXPECT_THROW(
+      FileAccessLogFactory().createAccessLogInstance(
+          envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog(), nullptr, context),
+      ProtoValidationException);
 }
 
 TEST(FileAccessLogConfigTest, ConfigureFromProto) {
-  envoy::config::filter::accesslog::v2::AccessLog config;
+  envoy::config::filter::accesslog::v3alpha::AccessLog config;
 
-  envoy::config::accesslog::v2::FileAccessLog fal_config;
+  envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog fal_config;
   fal_config.set_path("/dev/null");
 
-  TestUtility::jsonConvert(fal_config, *config.mutable_config());
+  TestUtility::jsonConvert(fal_config, *config.mutable_hidden_envoy_deprecated_config());
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW_WITH_MESSAGE(AccessLog::AccessLogFactory::fromProto(config, context), EnvoyException,
@@ -62,7 +63,7 @@ TEST(FileAccessLogConfigTest, FileAccessLogTest) {
   ProtobufTypes::MessagePtr message = factory->createEmptyConfigProto();
   ASSERT_NE(nullptr, message);
 
-  envoy::config::accesslog::v2::FileAccessLog file_access_log;
+  envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog file_access_log;
   file_access_log.set_path("/dev/null");
   file_access_log.set_format("%START_TIME%");
   TestUtility::jsonConvert(file_access_log, *message);
@@ -77,9 +78,9 @@ TEST(FileAccessLogConfigTest, FileAccessLogTest) {
 }
 
 TEST(FileAccessLogConfigTest, FileAccessLogJsonTest) {
-  envoy::config::filter::accesslog::v2::AccessLog config;
+  envoy::config::filter::accesslog::v3alpha::AccessLog config;
 
-  envoy::config::accesslog::v2::FileAccessLog fal_config;
+  envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog fal_config;
   fal_config.set_path("/dev/null");
 
   ProtobufWkt::Value string_value;
@@ -89,8 +90,9 @@ TEST(FileAccessLogConfigTest, FileAccessLogJsonTest) {
   (*json_format->mutable_fields())["protocol"] = string_value;
 
   EXPECT_EQ(fal_config.access_log_format_case(),
-            envoy::config::accesslog::v2::FileAccessLog::kJsonFormat);
-  TestUtility::jsonConvert(fal_config, *config.mutable_config());
+            envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog::AccessLogFormatCase::
+                kJsonFormat);
+  TestUtility::jsonConvert(fal_config, *config.mutable_hidden_envoy_deprecated_config());
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW_WITH_MESSAGE(AccessLog::AccessLogFactory::fromProto(config, context), EnvoyException,
@@ -110,9 +112,9 @@ TEST(FileAccessLogConfigTest, FileAccessLogJsonTest) {
 }
 
 TEST(FileAccessLogConfigTest, FileAccessLogTypedJsonTest) {
-  envoy::config::filter::accesslog::v2::AccessLog config;
+  envoy::config::filter::accesslog::v3alpha::AccessLog config;
 
-  envoy::config::accesslog::v2::FileAccessLog fal_config;
+  envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog fal_config;
   fal_config.set_path("/dev/null");
 
   ProtobufWkt::Value string_value;
@@ -122,8 +124,9 @@ TEST(FileAccessLogConfigTest, FileAccessLogTypedJsonTest) {
   (*json_format->mutable_fields())["protocol"] = string_value;
 
   EXPECT_EQ(fal_config.access_log_format_case(),
-            envoy::config::accesslog::v2::FileAccessLog::kTypedJsonFormat);
-  TestUtility::jsonConvert(fal_config, *config.mutable_config());
+            envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog::AccessLogFormatCase::
+                kTypedJsonFormat);
+  TestUtility::jsonConvert(fal_config, *config.mutable_hidden_envoy_deprecated_config());
 
   config.set_name(AccessLogNames::get().File);
 
@@ -137,9 +140,9 @@ TEST(FileAccessLogConfigTest, FileAccessLogTypedJsonTest) {
 TEST(FileAccessLogConfigTest, FileAccessLogJsonWithBoolValueTest) {
   {
     // Make sure we fail if you set a bool value in the format dictionary
-    envoy::config::filter::accesslog::v2::AccessLog config;
+    envoy::config::filter::accesslog::v3alpha::AccessLog config;
     config.set_name(AccessLogNames::get().File);
-    envoy::config::accesslog::v2::FileAccessLog fal_config;
+    envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog fal_config;
     fal_config.set_path("/dev/null");
 
     ProtobufWkt::Value bool_value;
@@ -147,7 +150,7 @@ TEST(FileAccessLogConfigTest, FileAccessLogJsonWithBoolValueTest) {
     auto json_format = fal_config.mutable_json_format();
     (*json_format->mutable_fields())["protocol"] = bool_value;
 
-    TestUtility::jsonConvert(fal_config, *config.mutable_config());
+    TestUtility::jsonConvert(fal_config, *config.mutable_hidden_envoy_deprecated_config());
     NiceMock<Server::Configuration::MockFactoryContext> context;
 
     EXPECT_THROW_WITH_MESSAGE(AccessLog::AccessLogFactory::fromProto(config, context),
@@ -159,9 +162,9 @@ TEST(FileAccessLogConfigTest, FileAccessLogJsonWithBoolValueTest) {
 TEST(FileAccessLogConfigTest, FileAccessLogJsonWithNestedKeyTest) {
   {
     // Make sure we fail if you set a nested Struct value in the format dictionary
-    envoy::config::filter::accesslog::v2::AccessLog config;
+    envoy::config::filter::accesslog::v3alpha::AccessLog config;
     config.set_name(AccessLogNames::get().File);
-    envoy::config::accesslog::v2::FileAccessLog fal_config;
+    envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog fal_config;
     fal_config.set_path("/dev/null");
 
     ProtobufWkt::Value string_value;
@@ -173,7 +176,7 @@ TEST(FileAccessLogConfigTest, FileAccessLogJsonWithNestedKeyTest) {
     auto json_format = fal_config.mutable_json_format();
     (*json_format->mutable_fields())["top_level_key"] = struct_value;
 
-    TestUtility::jsonConvert(fal_config, *config.mutable_config());
+    TestUtility::jsonConvert(fal_config, *config.mutable_hidden_envoy_deprecated_config());
     NiceMock<Server::Configuration::MockFactoryContext> context;
 
     EXPECT_THROW_WITH_MESSAGE(AccessLog::AccessLogFactory::fromProto(config, context),
diff --git a/test/extensions/access_loggers/grpc/BUILD b/test/extensions/access_loggers/grpc/BUILD
index 4e3c14d2fdaa..edf9957e8682 100644
--- a/test/extensions/access_loggers/grpc/BUILD
+++ b/test/extensions/access_loggers/grpc/BUILD
@@ -23,10 +23,10 @@ envoy_extension_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/mocks/thread_local:thread_local_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/accesslog/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,7 +39,7 @@ envoy_extension_cc_test(
         "//test/mocks/local_info:local_info_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/stream_info:stream_info_mocks",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -56,8 +56,8 @@ envoy_extension_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/mocks/thread_local:thread_local_mocks",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/data/accesslog/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -68,8 +68,8 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/access_loggers/grpc:http_config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -85,10 +85,10 @@ envoy_extension_cc_test(
         "//test/common/grpc:grpc_client_integration_lib",
         "//test/integration:http_integration_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/accesslog/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -106,10 +106,10 @@ envoy_extension_cc_test(
         "//test/common/grpc:grpc_client_integration_lib",
         "//test/integration:http_integration_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/accesslog/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/accesslog/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/access_loggers/grpc/grpc_access_log_impl_test.cc b/test/extensions/access_loggers/grpc/grpc_access_log_impl_test.cc
index cf458f360b1c..b49017dca931 100644
--- a/test/extensions/access_loggers/grpc/grpc_access_log_impl_test.cc
+++ b/test/extensions/access_loggers/grpc/grpc_access_log_impl_test.cc
@@ -1,9 +1,9 @@
 #include <memory>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
-#include "envoy/service/accesslog/v2/als.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
+#include "envoy/service/accesslog/v3alpha/als.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/network/address_impl.h"
@@ -34,7 +34,7 @@ class GrpcAccessLoggerImplTest : public testing::Test {
 public:
   using MockAccessLogStream = Grpc::MockAsyncStream;
   using AccessLogCallbacks =
-      Grpc::AsyncStreamCallbacks<envoy::service::accesslog::v2::StreamAccessLogsResponse>;
+      Grpc::AsyncStreamCallbacks<envoy::service::accesslog::v3alpha::StreamAccessLogsResponse>;
 
   void initLogger(std::chrono::milliseconds buffer_flush_interval_msec, size_t buffer_size_bytes) {
     timer_ = new Event::MockTimer(&dispatcher_);
@@ -55,11 +55,11 @@ class GrpcAccessLoggerImplTest : public testing::Test {
   }
 
   void expectStreamMessage(MockAccessLogStream& stream, const std::string& expected_message_yaml) {
-    envoy::service::accesslog::v2::StreamAccessLogsMessage expected_message;
+    envoy::service::accesslog::v3alpha::StreamAccessLogsMessage expected_message;
     TestUtility::loadFromYaml(expected_message_yaml, expected_message);
     EXPECT_CALL(stream, sendMessageRaw_(_, false))
         .WillOnce(Invoke([expected_message](Buffer::InstancePtr& request, bool) {
-          envoy::service::accesslog::v2::StreamAccessLogsMessage message;
+          envoy::service::accesslog::v3alpha::StreamAccessLogsMessage message;
           Buffer::ZeroCopyInputStreamImpl request_stream(std::move(request));
           EXPECT_TRUE(message.ParseFromZeroCopyStream(&request_stream));
           EXPECT_EQ(message.DebugString(), expected_message.DebugString());
@@ -97,9 +97,9 @@ TEST_F(GrpcAccessLoggerImplTest, BasicFlow) {
     request:
       path: /test/path1
 )EOF");
-  envoy::data::accesslog::v2::HTTPAccessLogEntry entry;
+  envoy::data::accesslog::v3alpha::HTTPAccessLogEntry entry;
   entry.mutable_request()->set_path("/test/path1");
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 
   expectStreamMessage(stream, R"EOF(
 http_logs:
@@ -108,11 +108,11 @@ TEST_F(GrpcAccessLoggerImplTest, BasicFlow) {
       path: /test/path2
 )EOF");
   entry.mutable_request()->set_path("/test/path2");
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 
   // Verify that sending an empty response message doesn't do anything bad.
   callbacks->onReceiveMessage(
-      std::make_unique<envoy::service::accesslog::v2::StreamAccessLogsResponse>());
+      std::make_unique<envoy::service::accesslog::v3alpha::StreamAccessLogsResponse>());
 
   // Close the stream and make sure we make a new one.
   callbacks->onRemoteClose(Grpc::Status::Internal, "bad");
@@ -132,7 +132,7 @@ TEST_F(GrpcAccessLoggerImplTest, BasicFlow) {
       path: /test/path3
 )EOF");
   entry.mutable_request()->set_path("/test/path3");
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 }
 
 // Test that stream failure is handled correctly.
@@ -148,8 +148,8 @@ TEST_F(GrpcAccessLoggerImplTest, StreamFailure) {
             return nullptr;
           }));
   EXPECT_CALL(local_info_, node());
-  envoy::data::accesslog::v2::HTTPAccessLogEntry entry;
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  envoy::data::accesslog::v3alpha::HTTPAccessLogEntry entry;
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 }
 
 // Test that log entries are batched.
@@ -182,13 +182,13 @@ TEST_F(GrpcAccessLoggerImplTest, Batching) {
       path: "{}"
 )EOF",
                                           path1, path2, path3));
-  envoy::data::accesslog::v2::HTTPAccessLogEntry entry;
+  envoy::data::accesslog::v3alpha::HTTPAccessLogEntry entry;
   entry.mutable_request()->set_path(path1);
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
   entry.mutable_request()->set_path(path2);
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
   entry.mutable_request()->set_path(path3);
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 
   const std::string path4(120, '4');
   expectStreamMessage(stream, fmt::format(R"EOF(
@@ -199,7 +199,7 @@ TEST_F(GrpcAccessLoggerImplTest, Batching) {
 )EOF",
                                           path4));
   entry.mutable_request()->set_path(path4);
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 }
 
 // Test that log entries are flushed periodically.
@@ -211,10 +211,10 @@ TEST_F(GrpcAccessLoggerImplTest, Flushing) {
   EXPECT_CALL(*timer_, enableTimer(FlushInterval, _));
   timer_->invokeCallback();
 
-  envoy::data::accesslog::v2::HTTPAccessLogEntry entry;
+  envoy::data::accesslog::v3alpha::HTTPAccessLogEntry entry;
   // Not enough data yet to trigger flush on batch size.
   entry.mutable_request()->set_path("/test/path1");
-  logger_->log(envoy::data::accesslog::v2::HTTPAccessLogEntry(entry));
+  logger_->log(envoy::data::accesslog::v3alpha::HTTPAccessLogEntry(entry));
 
   MockAccessLogStream stream;
   AccessLogCallbacks* callbacks;
@@ -252,12 +252,13 @@ class GrpcAccessLoggerCacheImplTest : public testing::Test {
     factory_ = new Grpc::MockAsyncClientFactory;
     async_client_ = new Grpc::MockAsyncClient;
     EXPECT_CALL(async_client_manager_, factoryForGrpcService(_, _, false))
-        .WillOnce(Invoke([this](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
-          EXPECT_CALL(*factory_, create()).WillOnce(Invoke([this] {
-            return Grpc::RawAsyncClientPtr{async_client_};
-          }));
-          return Grpc::AsyncClientFactoryPtr{factory_};
-        }));
+        .WillOnce(
+            Invoke([this](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
+              EXPECT_CALL(*factory_, create()).WillOnce(Invoke([this] {
+                return Grpc::RawAsyncClientPtr{async_client_};
+              }));
+              return Grpc::AsyncClientFactoryPtr{factory_};
+            }));
   }
 
   LocalInfo::MockLocalInfo local_info_;
@@ -272,7 +273,7 @@ class GrpcAccessLoggerCacheImplTest : public testing::Test {
 TEST_F(GrpcAccessLoggerCacheImplTest, Deduplication) {
   InSequence s;
 
-  ::envoy::config::accesslog::v2::CommonGrpcAccessLogConfig config;
+  envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig config;
   config.set_log_name("log-1");
   config.mutable_grpc_service()->mutable_envoy_grpc()->set_cluster_name("cluster-1");
 
diff --git a/test/extensions/access_loggers/grpc/grpc_access_log_utils_test.cc b/test/extensions/access_loggers/grpc/grpc_access_log_utils_test.cc
index 81881de67713..c5342de458ed 100644
--- a/test/extensions/access_loggers/grpc/grpc_access_log_utils_test.cc
+++ b/test/extensions/access_loggers/grpc/grpc_access_log_utils_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
 
 #include "extensions/access_loggers/grpc/grpc_access_log_utils.h"
 
@@ -16,10 +16,10 @@ using testing::Return;
 TEST(UtilityResponseFlagsToAccessLogResponseFlagsTest, All) {
   NiceMock<StreamInfo::MockStreamInfo> stream_info;
   ON_CALL(stream_info, hasResponseFlag(_)).WillByDefault(Return(true));
-  envoy::data::accesslog::v2::AccessLogCommon common_access_log;
+  envoy::data::accesslog::v3alpha::AccessLogCommon common_access_log;
   Utility::responseFlagsToAccessLogResponseFlags(common_access_log, stream_info);
 
-  envoy::data::accesslog::v2::AccessLogCommon common_access_log_expected;
+  envoy::data::accesslog::v3alpha::AccessLogCommon common_access_log_expected;
   common_access_log_expected.mutable_response_flags()->set_failed_local_healthcheck(true);
   common_access_log_expected.mutable_response_flags()->set_no_healthy_upstream(true);
   common_access_log_expected.mutable_response_flags()->set_upstream_request_timeout(true);
@@ -33,7 +33,7 @@ TEST(UtilityResponseFlagsToAccessLogResponseFlagsTest, All) {
   common_access_log_expected.mutable_response_flags()->set_fault_injected(true);
   common_access_log_expected.mutable_response_flags()->set_rate_limited(true);
   common_access_log_expected.mutable_response_flags()->mutable_unauthorized_details()->set_reason(
-      envoy::data::accesslog::v2::ResponseFlags::Unauthorized::EXTERNAL_SERVICE);
+      envoy::data::accesslog::v3alpha::ResponseFlags::Unauthorized::EXTERNAL_SERVICE);
   common_access_log_expected.mutable_response_flags()->set_rate_limit_service_error(true);
   common_access_log_expected.mutable_response_flags()->set_downstream_connection_termination(true);
   common_access_log_expected.mutable_response_flags()->set_upstream_retry_limit_exceeded(true);
diff --git a/test/extensions/access_loggers/grpc/http_config_test.cc b/test/extensions/access_loggers/grpc/http_config_test.cc
index 73abc22a66b7..3453298af140 100644
--- a/test/extensions/access_loggers/grpc/http_config_test.cc
+++ b/test/extensions/access_loggers/grpc/http_config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/accesslog/v2/als.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/access_log_config.h"
 #include "envoy/stats/scope.h"
@@ -33,7 +33,7 @@ class HttpGrpcAccessLogConfigTest : public testing::Test {
     ASSERT_NE(nullptr, message_);
 
     EXPECT_CALL(context_.cluster_manager_.async_client_manager_, factoryForGrpcService(_, _, _))
-        .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+        .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
           return std::make_unique<NiceMock<Grpc::MockAsyncClientFactory>>();
         }));
 
@@ -45,7 +45,7 @@ class HttpGrpcAccessLogConfigTest : public testing::Test {
 
   AccessLog::FilterPtr filter_;
   NiceMock<Server::Configuration::MockFactoryContext> context_;
-  envoy::config::accesslog::v2::HttpGrpcAccessLogConfig http_grpc_access_log_;
+  envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig http_grpc_access_log_;
   ProtobufTypes::MessagePtr message_;
   Server::Configuration::AccessLogInstanceFactory* factory_{};
 };
diff --git a/test/extensions/access_loggers/grpc/http_grpc_access_log_impl_test.cc b/test/extensions/access_loggers/grpc/http_grpc_access_log_impl_test.cc
index 9e5633c6c2fc..400bb4914ef7 100644
--- a/test/extensions/access_loggers/grpc/http_grpc_access_log_impl_test.cc
+++ b/test/extensions/access_loggers/grpc/http_grpc_access_log_impl_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/data/accesslog/v2/accesslog.pb.h"
+#include "envoy/data/accesslog/v3alpha/accesslog.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/network/address_impl.h"
@@ -31,22 +31,23 @@ namespace AccessLoggers {
 namespace HttpGrpc {
 namespace {
 
-using envoy::data::accesslog::v2::HTTPAccessLogEntry;
+using envoy::data::accesslog::v3alpha::HTTPAccessLogEntry;
 
 class MockGrpcAccessLogger : public GrpcCommon::GrpcAccessLogger {
 public:
   // GrpcAccessLogger
   MOCK_METHOD1(log, void(HTTPAccessLogEntry&& entry));
-  MOCK_METHOD1(log, void(envoy::data::accesslog::v2::TCPAccessLogEntry&& entry));
+  MOCK_METHOD1(log, void(envoy::data::accesslog::v3alpha::TCPAccessLogEntry&& entry));
 };
 
 class MockGrpcAccessLoggerCache : public GrpcCommon::GrpcAccessLoggerCache {
 public:
   // GrpcAccessLoggerCache
-  MOCK_METHOD2(getOrCreateLogger,
-               GrpcCommon::GrpcAccessLoggerSharedPtr(
-                   const ::envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& config,
-                   GrpcCommon::GrpcAccessLoggerType logger_type));
+  MOCK_METHOD2(
+      getOrCreateLogger,
+      GrpcCommon::GrpcAccessLoggerSharedPtr(
+          const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig& config,
+          GrpcCommon::GrpcAccessLoggerType logger_type));
 };
 
 class HttpGrpcAccessLogTest : public testing::Test {
@@ -57,12 +58,15 @@ class HttpGrpcAccessLogTest : public testing::Test {
     config_.mutable_common_config()->add_filter_state_objects_to_log("string_accessor");
     config_.mutable_common_config()->add_filter_state_objects_to_log("serialized");
     EXPECT_CALL(*logger_cache_, getOrCreateLogger(_, _))
-        .WillOnce([this](const ::envoy::config::accesslog::v2::CommonGrpcAccessLogConfig& config,
-                         GrpcCommon::GrpcAccessLoggerType logger_type) {
-          EXPECT_EQ(config.DebugString(), config_.common_config().DebugString());
-          EXPECT_EQ(GrpcCommon::GrpcAccessLoggerType::HTTP, logger_type);
-          return logger_;
-        });
+        .WillOnce(
+            [this](
+                const envoy::extensions::access_loggers::grpc::v3alpha::CommonGrpcAccessLogConfig&
+                    config,
+                GrpcCommon::GrpcAccessLoggerType logger_type) {
+              EXPECT_EQ(config.DebugString(), config_.common_config().DebugString());
+              EXPECT_EQ(GrpcCommon::GrpcAccessLoggerType::HTTP, logger_type);
+              return logger_;
+            });
     access_log_ = std::make_unique<HttpGrpcAccessLog>(AccessLog::FilterPtr{filter_}, config_, tls_,
                                                       logger_cache_);
   }
@@ -75,8 +79,8 @@ class HttpGrpcAccessLogTest : public testing::Test {
     HTTPAccessLogEntry expected_log_entry;
     TestUtility::loadFromYaml(expected_log_entry_yaml, expected_log_entry);
     EXPECT_CALL(*logger_, log(An<HTTPAccessLogEntry&&>()))
-        .WillOnce(
-            Invoke([expected_log_entry](envoy::data::accesslog::v2::HTTPAccessLogEntry&& entry) {
+        .WillOnce(Invoke(
+            [expected_log_entry](envoy::data::accesslog::v3alpha::HTTPAccessLogEntry&& entry) {
               EXPECT_EQ(entry.DebugString(), expected_log_entry.DebugString());
             }));
   }
@@ -115,7 +119,7 @@ response: {{}}
 
   AccessLog::MockFilter* filter_{new NiceMock<AccessLog::MockFilter>()};
   NiceMock<ThreadLocal::MockInstance> tls_;
-  envoy::config::accesslog::v2::HttpGrpcAccessLogConfig config_;
+  envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig config_;
   std::shared_ptr<MockGrpcAccessLogger> logger_{new MockGrpcAccessLogger()};
   std::shared_ptr<MockGrpcAccessLoggerCache> logger_cache_{new MockGrpcAccessLoggerCache()};
   std::unique_ptr<HttpGrpcAccessLog> access_log_;
diff --git a/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc b/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc
index eaf17a673eb8..1b9c58f0d8c3 100644
--- a/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc
+++ b/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/service/accesslog/v2/als.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/service/accesslog/v3alpha/als.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/common/version.h"
@@ -31,7 +31,7 @@ class AccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* accesslog_cluster = bootstrap.mutable_static_resources()->add_clusters();
       accesslog_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
       accesslog_cluster->set_name("accesslog");
@@ -39,12 +39,12 @@ class AccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
     });
 
     config_helper_.addConfigModifier(
-        [this](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                   hcm) {
+        [this](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                   HttpConnectionManager& hcm) {
           auto* access_log = hcm.add_access_log();
           access_log->set_name("envoy.http_grpc_access_log");
 
-          envoy::config::accesslog::v2::HttpGrpcAccessLogConfig config;
+          envoy::extensions::access_loggers::grpc::v3alpha::HttpGrpcAccessLogConfig config;
           auto* common_config = config.mutable_common_config();
           common_config->set_log_name("foo");
           setGrpcService(*common_config->mutable_grpc_service(), "accesslog",
@@ -67,7 +67,7 @@ class AccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
 
   ABSL_MUST_USE_RESULT
   AssertionResult waitForAccessLogRequest(const std::string& expected_request_msg_yaml) {
-    envoy::service::accesslog::v2::StreamAccessLogsMessage request_msg;
+    envoy::service::accesslog::v3alpha::StreamAccessLogsMessage request_msg;
     VERIFY_ASSERTION(access_log_request_->waitForGrpcMessage(*dispatcher_, request_msg));
     EXPECT_EQ("POST", access_log_request_->headers().Method()->value().getStringView());
     EXPECT_EQ("/envoy.service.accesslog.v2.AccessLogService/StreamAccessLogs",
@@ -75,7 +75,7 @@ class AccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
     EXPECT_EQ("application/grpc",
               access_log_request_->headers().ContentType()->value().getStringView());
 
-    envoy::service::accesslog::v2::StreamAccessLogsMessage expected_request_msg;
+    envoy::service::accesslog::v3alpha::StreamAccessLogsMessage expected_request_msg;
     TestUtility::loadFromYaml(expected_request_msg_yaml, expected_request_msg);
 
     // Clear fields which are not deterministic.
@@ -168,7 +168,7 @@ TEST_P(AccessLogIntegrationTest, BasicAccessLogFlow) {
   // Send an empty response and end the stream. This should never happen but make sure nothing
   // breaks and we make a new stream on a follow up request.
   access_log_request_->startGrpcStream();
-  envoy::service::accesslog::v2::StreamAccessLogsResponse response_msg;
+  envoy::service::accesslog::v3alpha::StreamAccessLogsResponse response_msg;
   access_log_request_->sendGrpcMessage(response_msg);
   access_log_request_->finishGrpcStream(Grpc::Status::Ok);
   switch (clientType()) {
diff --git a/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc b/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
index df2c645c65be..e11862dd3642 100644
--- a/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
+++ b/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
@@ -1,8 +1,8 @@
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/config/accesslog/v2/als.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
-#include "envoy/service/accesslog/v2/als.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/als.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
+#include "envoy/service/accesslog/v3alpha/als.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/common/version.h"
@@ -20,7 +20,7 @@ using testing::AssertionResult;
 namespace Envoy {
 namespace {
 
-void clearPort(envoy::api::v2::core::Address& address) {
+void clearPort(envoy::config::core::v3alpha::Address& address) {
   address.mutable_socket_address()->clear_port_specifier();
 }
 
@@ -45,23 +45,23 @@ class TcpGrpcAccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamT
 
   void initialize() override {
     config_helper_.renameListener("tcp_proxy");
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* accesslog_cluster = bootstrap.mutable_static_resources()->add_clusters();
       accesslog_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
       accesslog_cluster->set_name("accesslog");
       accesslog_cluster->mutable_http2_protocol_options();
     });
 
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
       auto* filter_chain = listener->mutable_filter_chains(0);
       auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
-      auto tcp_proxy_config =
-          MessageUtil::anyConvert<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>(
-              *config_blob);
+      auto tcp_proxy_config = MessageUtil::anyConvert<
+          envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy>(*config_blob);
       auto* access_log = tcp_proxy_config.add_access_log();
       access_log->set_name("envoy.tcp_grpc_access_log");
-      envoy::config::accesslog::v2::TcpGrpcAccessLogConfig access_log_config;
+      envoy::extensions::access_loggers::grpc::v3alpha::TcpGrpcAccessLogConfig access_log_config;
       auto* common_config = access_log_config.mutable_common_config();
       common_config->set_log_name("foo");
       setGrpcService(*common_config->mutable_grpc_service(), "accesslog",
@@ -84,7 +84,7 @@ class TcpGrpcAccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamT
 
   ABSL_MUST_USE_RESULT
   AssertionResult waitForAccessLogRequest(const std::string& expected_request_msg_yaml) {
-    envoy::service::accesslog::v2::StreamAccessLogsMessage request_msg;
+    envoy::service::accesslog::v3alpha::StreamAccessLogsMessage request_msg;
     VERIFY_ASSERTION(access_log_request_->waitForGrpcMessage(*dispatcher_, request_msg));
     EXPECT_EQ("POST", access_log_request_->headers().Method()->value().getStringView());
     EXPECT_EQ("/envoy.service.accesslog.v2.AccessLogService/StreamAccessLogs",
@@ -92,7 +92,7 @@ class TcpGrpcAccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamT
     EXPECT_EQ("application/grpc",
               access_log_request_->headers().ContentType()->value().getStringView());
 
-    envoy::service::accesslog::v2::StreamAccessLogsMessage expected_request_msg;
+    envoy::service::accesslog::v3alpha::StreamAccessLogsMessage expected_request_msg;
     TestUtility::loadFromYaml(expected_request_msg_yaml, expected_request_msg);
 
     // Clear fields which are not deterministic.
diff --git a/test/extensions/clusters/aggregate/BUILD b/test/extensions/clusters/aggregate/BUILD
index 699ded2ea0e5..8941da41636e 100644
--- a/test/extensions/clusters/aggregate/BUILD
+++ b/test/extensions/clusters/aggregate/BUILD
@@ -23,8 +23,8 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/cluster/aggregate/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/clusters/aggregate/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,8 +44,8 @@ envoy_extension_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:simulated_time_system_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/cluster/aggregate/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/clusters/aggregate/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -66,6 +66,6 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/clusters/aggregate/cluster_integration_test.cc b/test/extensions/clusters/aggregate/cluster_integration_test.cc
index 529fc0911a3c..49377004908d 100644
--- a/test/extensions/clusters/aggregate/cluster_integration_test.cc
+++ b/test/extensions/clusters/aggregate/cluster_integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/grpc/status.h"
 #include "envoy/stats/scope.h"
 
@@ -140,8 +140,8 @@ class AggregateIntegrationTest : public testing::TestWithParam<Network::Address:
 
     // Do the initial compareDiscoveryRequest / sendDiscoveryResponse for cluster_1.
     EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-    sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster1_},
-                                                   {cluster1_}, {}, "55");
+    sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+        Config::TypeUrl::get().Cluster, {cluster1_}, {cluster1_}, {}, "55");
 
     test_server_->waitForGaugeGe("cluster_manager.active_clusters", 3);
 
@@ -161,8 +161,8 @@ class AggregateIntegrationTest : public testing::TestWithParam<Network::Address:
     fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
   }
 
-  envoy::api::v2::Cluster cluster1_;
-  envoy::api::v2::Cluster cluster2_;
+  envoy::config::cluster::v3alpha::Cluster cluster1_;
+  envoy::config::cluster::v3alpha::Cluster cluster2_;
 };
 
 INSTANTIATE_TEST_SUITE_P(IpVersions, AggregateIntegrationTest,
@@ -174,8 +174,8 @@ TEST_P(AggregateIntegrationTest, ClusterUpDownUp) {
 
   // Tell Envoy that cluster_1 is gone.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "55", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {}, {},
-                                                 {FirstClusterName}, "42");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(Config::TypeUrl::get().Cluster,
+                                                                  {}, {}, {FirstClusterName}, "42");
   // We can continue the test once we're sure that Envoy's ClusterManager has made use of
   // the DiscoveryResponse that says cluster_1 is gone.
   test_server_->waitForCounterGe("cluster_manager.cluster_removed", 1);
@@ -192,8 +192,8 @@ TEST_P(AggregateIntegrationTest, ClusterUpDownUp) {
 
   // Tell Envoy that cluster_1 is back.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "42", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster1_},
-                                                 {cluster1_}, {}, "413");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster1_}, {cluster1_}, {}, "413");
 
   test_server_->waitForGaugeGe("cluster_manager.active_clusters", 3);
   testRouterHeaderOnlyRequestAndResponse(nullptr, FirstUpstreamIndex, "/aggregatecluster");
@@ -211,8 +211,8 @@ TEST_P(AggregateIntegrationTest, TwoClusters) {
 
   // Tell Envoy that cluster_2 is here.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "55", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {cluster1_, cluster2_}, {cluster2_}, {}, "42");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster1_, cluster2_}, {cluster2_}, {}, "42");
   // The '4' includes the fake CDS server and aggregate cluster.
   test_server_->waitForGaugeGe("cluster_manager.active_clusters", 4);
 
@@ -223,8 +223,8 @@ TEST_P(AggregateIntegrationTest, TwoClusters) {
 
   // Tell Envoy that cluster_1 is gone.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "42", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster2_}, {},
-                                                 {FirstClusterName}, "42");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster2_}, {}, {FirstClusterName}, "42");
   // We can continue the test once we're sure that Envoy's ClusterManager has made use of
   // the DiscoveryResponse that says cluster_1 is gone.
   test_server_->waitForCounterGe("cluster_manager.cluster_removed", 1);
@@ -235,8 +235,8 @@ TEST_P(AggregateIntegrationTest, TwoClusters) {
 
   // Tell Envoy that cluster_1 is back.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "42", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {cluster1_, cluster2_}, {cluster1_}, {}, "413");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster1_, cluster2_}, {cluster1_}, {}, "413");
 
   test_server_->waitForGaugeGe("cluster_manager.active_clusters", 4);
   testRouterHeaderOnlyRequestAndResponse(nullptr, FirstUpstreamIndex, "/aggregatecluster");
diff --git a/test/extensions/clusters/aggregate/cluster_test.cc b/test/extensions/clusters/aggregate/cluster_test.cc
index af33b6d0a221..933db1f0abf8 100644
--- a/test/extensions/clusters/aggregate/cluster_test.cc
+++ b/test/extensions/clusters/aggregate/cluster_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.validate.h"
 
 #include "common/singleton/manager_impl.h"
 
@@ -74,8 +74,9 @@ class AggregateClusterTest : public testing::Test {
   }
 
   void initialize(const std::string& yaml_config) {
-    envoy::api::v2::Cluster cluster_config = Upstream::parseClusterFromV2Yaml(yaml_config);
-    envoy::config::cluster::aggregate::v2alpha::ClusterConfig config;
+    envoy::config::cluster::v3alpha::Cluster cluster_config =
+        Upstream::parseClusterFromV2Yaml(yaml_config);
+    envoy::extensions::clusters::aggregate::v3alpha::ClusterConfig config;
     Config::Utility::translateOpaqueConfig(cluster_config.cluster_type().typed_config(),
                                            ProtobufWkt::Struct::default_instance(),
                                            ProtobufMessage::getStrictValidationVisitor(), config);
diff --git a/test/extensions/clusters/aggregate/cluster_update_test.cc b/test/extensions/clusters/aggregate/cluster_update_test.cc
index d29e263dda19..2da2ba158b91 100644
--- a/test/extensions/clusters/aggregate/cluster_update_test.cc
+++ b/test/extensions/clusters/aggregate/cluster_update_test.cc
@@ -1,5 +1,6 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/cluster/aggregate/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/aggregate/v3alpha/cluster.pb.validate.h"
 
 #include "common/singleton/manager_impl.h"
 #include "common/upstream/cluster_factory_impl.h"
@@ -22,8 +23,8 @@ namespace Extensions {
 namespace Clusters {
 namespace Aggregate {
 
-envoy::config::bootstrap::v2::Bootstrap parseBootstrapFromV2Yaml(const std::string& yaml) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+envoy::config::bootstrap::v3alpha::Bootstrap parseBootstrapFromV2Yaml(const std::string& yaml) {
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   TestUtility::loadFromYaml(yaml, bootstrap);
   return bootstrap;
 }
diff --git a/test/extensions/clusters/dynamic_forward_proxy/BUILD b/test/extensions/clusters/dynamic_forward_proxy/BUILD
index be03b0cb6a2e..8e42c9d7df83 100644
--- a/test/extensions/clusters/dynamic_forward_proxy/BUILD
+++ b/test/extensions/clusters/dynamic_forward_proxy/BUILD
@@ -26,7 +26,7 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/cluster/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/clusters/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/clusters/dynamic_forward_proxy/cluster_test.cc b/test/extensions/clusters/dynamic_forward_proxy/cluster_test.cc
index 5e8a3aa8277d..7fcb7e4a2f08 100644
--- a/test/extensions/clusters/dynamic_forward_proxy/cluster_test.cc
+++ b/test/extensions/clusters/dynamic_forward_proxy/cluster_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.pb.h"
-#include "envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/dynamic_forward_proxy/v3alpha/cluster.pb.h"
+#include "envoy/extensions/clusters/dynamic_forward_proxy/v3alpha/cluster.pb.validate.h"
 
 #include "common/singleton/manager_impl.h"
 
@@ -28,8 +28,9 @@ class ClusterTest : public testing::Test,
                     public Extensions::Common::DynamicForwardProxy::DnsCacheManagerFactory {
 public:
   void initialize(const std::string& yaml_config, bool uses_tls) {
-    envoy::api::v2::Cluster cluster_config = Upstream::parseClusterFromV2Yaml(yaml_config);
-    envoy::config::cluster::dynamic_forward_proxy::v2alpha::ClusterConfig config;
+    envoy::config::cluster::v3alpha::Cluster cluster_config =
+        Upstream::parseClusterFromV2Yaml(yaml_config);
+    envoy::extensions::clusters::dynamic_forward_proxy::v3alpha::ClusterConfig config;
     Config::Utility::translateOpaqueConfig(cluster_config.cluster_type().typed_config(),
                                            ProtobufWkt::Struct::default_instance(),
                                            ProtobufMessage::getStrictValidationVisitor(), config);
diff --git a/test/extensions/clusters/redis/BUILD b/test/extensions/clusters/redis/BUILD
index c105e66412ca..346e93da8e49 100644
--- a/test/extensions/clusters/redis/BUILD
+++ b/test/extensions/clusters/redis/BUILD
@@ -41,9 +41,9 @@ envoy_extension_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
         "@envoy_api//envoy/config/cluster/redis:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -93,7 +93,7 @@ envoy_extension_cc_test(
         "//source/extensions/clusters/redis:redis_cluster_lb",
         "//source/extensions/filters/network/redis_proxy:config",
         "//test/integration:integration_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -108,7 +108,7 @@ envoy_cc_mock(
         "//source/extensions/clusters/redis:redis_cluster",
         "//test/mocks/upstream:upstream_mocks",
         "@envoy_api//envoy/config/cluster/redis:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/clusters/redis/mocks.cc b/test/extensions/clusters/redis/mocks.cc
index c89bb13ac312..b30a8a621be5 100644
--- a/test/extensions/clusters/redis/mocks.cc
+++ b/test/extensions/clusters/redis/mocks.cc
@@ -1,7 +1,9 @@
 #include "test/extensions/clusters/redis/mocks.h"
 
+#include "envoy/config/cluster/redis/redis_cluster.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.validate.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 using testing::_;
 using testing::Return;
diff --git a/test/extensions/clusters/redis/mocks.h b/test/extensions/clusters/redis/mocks.h
index 1bf68caa1f9a..a8eebeabd6d0 100644
--- a/test/extensions/clusters/redis/mocks.h
+++ b/test/extensions/clusters/redis/mocks.h
@@ -1,5 +1,7 @@
+#include "envoy/config/cluster/redis/redis_cluster.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.validate.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 #include "envoy/upstream/upstream.h"
 
 #include "source/extensions/clusters/redis/redis_cluster.h"
diff --git a/test/extensions/clusters/redis/redis_cluster_integration_test.cc b/test/extensions/clusters/redis/redis_cluster_integration_test.cc
index 4f68b96a75e4..46e3b96e75dd 100644
--- a/test/extensions/clusters/redis/redis_cluster_integration_test.cc
+++ b/test/extensions/clusters/redis/redis_cluster_integration_test.cc
@@ -1,7 +1,7 @@
 #include <sstream>
 #include <vector>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/common/macros.h"
 
@@ -144,21 +144,22 @@ class RedisClusterIntegrationTest : public testing::TestWithParam<Network::Addre
     config_helper_.renameListener("redis_proxy");
 
     // Change the port for each of the discovery host in cluster_0.
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      uint32_t upstream_idx = 0;
-      auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
-
-      for (int j = 0; j < cluster_0->hosts_size(); ++j) {
-        if (cluster_0->mutable_hosts(j)->has_socket_address()) {
-          auto* host_socket_addr = cluster_0->mutable_hosts(j)->mutable_socket_address();
-          RELEASE_ASSERT(fake_upstreams_.size() > upstream_idx, "");
-          host_socket_addr->set_address(
-              fake_upstreams_[upstream_idx]->localAddress()->ip()->addressAsString());
-          host_socket_addr->set_port_value(
-              fake_upstreams_[upstream_idx++]->localAddress()->ip()->port());
-        }
-      }
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          uint32_t upstream_idx = 0;
+          auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
+
+          for (int j = 0; j < cluster_0->hosts_size(); ++j) {
+            if (cluster_0->mutable_hosts(j)->has_socket_address()) {
+              auto* host_socket_addr = cluster_0->mutable_hosts(j)->mutable_socket_address();
+              RELEASE_ASSERT(fake_upstreams_.size() > upstream_idx, "");
+              host_socket_addr->set_address(
+                  fake_upstreams_[upstream_idx]->localAddress()->ip()->addressAsString());
+              host_socket_addr->set_port_value(
+                  fake_upstreams_[upstream_idx++]->localAddress()->ip()->port());
+            }
+          }
+        });
 
     on_server_ready_function_ = [this](Envoy::IntegrationTestServer& test_server) {
       mock_rng_ = dynamic_cast<Runtime::MockRandomGenerator*>(&(test_server.server().random()));
diff --git a/test/extensions/clusters/redis/redis_cluster_test.cc b/test/extensions/clusters/redis/redis_cluster_test.cc
index ecc47b258352..16f54ade95b8 100644
--- a/test/extensions/clusters/redis/redis_cluster_test.cc
+++ b/test/extensions/clusters/redis/redis_cluster_test.cc
@@ -3,10 +3,11 @@
 #include <memory>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.validate.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 #include "envoy/stats/scope.h"
 
 #include "common/network/utility.h"
@@ -87,7 +88,8 @@ class RedisClusterTest : public testing::Test,
   void setupFromV2Yaml(const std::string& yaml) {
     expectRedisSessionCreated();
     NiceMock<Upstream::MockClusterManager> cm;
-    envoy::api::v2::Cluster cluster_config = Upstream::parseClusterFromV2Yaml(yaml);
+    envoy::config::cluster::v3alpha::Cluster cluster_config =
+        Upstream::parseClusterFromV2Yaml(yaml);
     Envoy::Stats::ScopePtr scope = stats_store_.createScope(fmt::format(
         "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                               : cluster_config.alt_stat_name()));
@@ -117,7 +119,8 @@ class RedisClusterTest : public testing::Test,
 
   void setupFactoryFromV2Yaml(const std::string& yaml) {
     NiceMock<Upstream::MockClusterManager> cm;
-    envoy::api::v2::Cluster cluster_config = Upstream::parseClusterFromV2Yaml(yaml);
+    envoy::config::cluster::v3alpha::Cluster cluster_config =
+        Upstream::parseClusterFromV2Yaml(yaml);
     Envoy::Stats::ScopePtr scope = stats_store_.createScope(fmt::format(
         "cluster.{}.", cluster_config.alt_stat_name().empty() ? cluster_config.name()
                                                               : cluster_config.alt_stat_name()));
diff --git a/test/extensions/common/dynamic_forward_proxy/BUILD b/test/extensions/common/dynamic_forward_proxy/BUILD
index 8b8964e1baa0..1e8c311155a3 100644
--- a/test/extensions/common/dynamic_forward_proxy/BUILD
+++ b/test/extensions/common/dynamic_forward_proxy/BUILD
@@ -19,8 +19,8 @@ envoy_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/test_common:simulated_time_system_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -30,6 +30,6 @@ envoy_cc_mock(
     hdrs = ["mocks.h"],
     deps = [
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_interface",
-        "@envoy_api//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/common/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/common/dynamic_forward_proxy/dns_cache_impl_test.cc b/test/extensions/common/dynamic_forward_proxy/dns_cache_impl_test.cc
index a1ded3f9476a..40df271d065b 100644
--- a/test/extensions/common/dynamic_forward_proxy/dns_cache_impl_test.cc
+++ b/test/extensions/common/dynamic_forward_proxy/dns_cache_impl_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 
 #include "extensions/common/dynamic_forward_proxy/dns_cache_impl.h"
 #include "extensions/common/dynamic_forward_proxy/dns_cache_manager_impl.h"
@@ -24,7 +24,7 @@ class DnsCacheImplTest : public testing::Test, public Event::TestUsingSimulatedT
 public:
   void initialize() {
     config_.set_name("foo");
-    config_.set_dns_lookup_family(envoy::api::v2::Cluster::V4_ONLY);
+    config_.set_dns_lookup_family(envoy::config::cluster::v3alpha::Cluster::V4_ONLY);
 
     EXPECT_CALL(dispatcher_, createDnsResolver(_, _)).WillOnce(Return(resolver_));
     dns_cache_ = std::make_unique<DnsCacheImpl>(dispatcher_, tls_, store_, config_);
@@ -51,7 +51,7 @@ class DnsCacheImplTest : public testing::Test, public Event::TestUsingSimulatedT
     EXPECT_EQ(num_hosts, TestUtility::findGauge(store_, "dns_cache.foo.num_hosts")->value());
   }
 
-  envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig config_;
+  envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig config_;
   NiceMock<Event::MockDispatcher> dispatcher_;
   std::shared_ptr<Network::MockDnsResolver> resolver_{std::make_shared<Network::MockDnsResolver>()};
   NiceMock<ThreadLocal::MockInstance> tls_;
@@ -533,25 +533,25 @@ TEST(DnsCacheManagerImplTest, LoadViaConfig) {
   Stats::IsolatedStoreImpl store;
   DnsCacheManagerImpl cache_manager(dispatcher, tls, store);
 
-  envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig config1;
+  envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig config1;
   config1.set_name("foo");
 
   auto cache1 = cache_manager.getCache(config1);
   EXPECT_NE(cache1, nullptr);
 
-  envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig config2;
+  envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig config2;
   config2.set_name("foo");
   EXPECT_EQ(cache1, cache_manager.getCache(config2));
 
-  envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig config3;
+  envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig config3;
   config3.set_name("bar");
   auto cache2 = cache_manager.getCache(config3);
   EXPECT_NE(cache2, nullptr);
   EXPECT_NE(cache1, cache2);
 
-  envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig config4;
+  envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig config4;
   config4.set_name("foo");
-  config4.set_dns_lookup_family(envoy::api::v2::Cluster::V6_ONLY);
+  config4.set_dns_lookup_family(envoy::config::cluster::v3alpha::Cluster::V6_ONLY);
   EXPECT_THROW_WITH_MESSAGE(cache_manager.getCache(config4), EnvoyException,
                             "config specified DNS cache 'foo' with different settings");
 }
diff --git a/test/extensions/common/dynamic_forward_proxy/mocks.h b/test/extensions/common/dynamic_forward_proxy/mocks.h
index 1a48aae801de..e51cc381c317 100644
--- a/test/extensions/common/dynamic_forward_proxy/mocks.h
+++ b/test/extensions/common/dynamic_forward_proxy/mocks.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.pb.h"
+#include "envoy/extensions/common/dynamic_forward_proxy/v3alpha/dns_cache.pb.h"
 
 #include "extensions/common/dynamic_forward_proxy/dns_cache.h"
 
@@ -55,7 +55,7 @@ class MockDnsCacheManager : public DnsCacheManager {
   MOCK_METHOD1(
       getCache,
       DnsCacheSharedPtr(
-          const envoy::config::common::dynamic_forward_proxy::v2alpha::DnsCacheConfig& config));
+          const envoy::extensions::common::dynamic_forward_proxy::v3alpha::DnsCacheConfig& config));
 
   std::shared_ptr<MockDnsCache> dns_cache_{new MockDnsCache()};
 };
diff --git a/test/extensions/common/tap/BUILD b/test/extensions/common/tap/BUILD
index df76b7e88aab..7c375d8f24cf 100644
--- a/test/extensions/common/tap/BUILD
+++ b/test/extensions/common/tap/BUILD
@@ -16,7 +16,7 @@ envoy_cc_test_library(
     deps = [
         "//source/extensions/common/tap:tap_interface",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -26,7 +26,7 @@ envoy_cc_test(
     deps = [
         "//source/extensions/common/tap:admin",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -36,7 +36,7 @@ envoy_cc_test(
     deps = [
         "//source/extensions/common/tap:tap_matcher",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -46,7 +46,7 @@ envoy_cc_test(
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/common/tap:tap_config_base",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/common/tap/admin_test.cc b/test/extensions/common/tap/admin_test.cc
index d73119b23387..83a00ac162e2 100644
--- a/test/extensions/common/tap/admin_test.cc
+++ b/test/extensions/common/tap/admin_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
 
 #include "extensions/common/tap/admin.h"
 
@@ -21,7 +21,7 @@ class MockExtensionConfig : public ExtensionConfig {
   MOCK_METHOD0(adminId, const absl::string_view());
   MOCK_METHOD0(clearTapConfig, void());
   MOCK_METHOD2(newTapConfig,
-               void(envoy::service::tap::v2alpha::TapConfig&& proto_config, Sink* admin_streamer));
+               void(envoy::config::tap::v3alpha::TapConfig&& proto_config, Sink* admin_streamer));
 };
 
 class AdminHandlerTest : public testing::Test {
diff --git a/test/extensions/common/tap/common.cc b/test/extensions/common/tap/common.cc
index 9aeec4649803..45b00c8e65ae 100644
--- a/test/extensions/common/tap/common.cc
+++ b/test/extensions/common/tap/common.cc
@@ -1,17 +1,17 @@
 #include "test/extensions/common/tap/common.h"
 
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 namespace envoy {
 namespace data {
 namespace tap {
-namespace v2alpha {
+namespace v3alpha {
 
 std::ostream& operator<<(std::ostream& os, const TraceWrapper& trace) {
   return os << Envoy::MessageUtil::getJsonStringFromMessage(trace, true, false);
 }
 
-} // namespace v2alpha
+} // namespace v3alpha
 } // namespace tap
 } // namespace data
 } // namespace envoy
diff --git a/test/extensions/common/tap/common.h b/test/extensions/common/tap/common.h
index 9d005b461d36..d67bfbd4b9f6 100644
--- a/test/extensions/common/tap/common.h
+++ b/test/extensions/common/tap/common.h
@@ -1,4 +1,4 @@
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -11,13 +11,13 @@
 namespace envoy {
 namespace data {
 namespace tap {
-namespace v2alpha {
+namespace v3alpha {
 
 // TODO(mattklein123): AFAICT gtest has built in printing for proto messages but it doesn't seem
 // to work unless this is here.
 std::ostream& operator<<(std::ostream& os, const TraceWrapper& trace);
 
-} // namespace v2alpha
+} // namespace v3alpha
 } // namespace tap
 } // namespace data
 } // namespace envoy
@@ -28,7 +28,7 @@ namespace Extensions {
 // TODO(mattklein123): Make this a common matcher called ProtoYamlEq and figure out how to
 // correctly templatize it.
 MATCHER_P(TraceEqual, rhs, "") {
-  envoy::data::tap::v2alpha::TraceWrapper expected_trace;
+  envoy::data::tap::v3alpha::TraceWrapper expected_trace;
   TestUtility::loadFromYaml(rhs, expected_trace);
   return TestUtility::protoEqual(expected_trace, arg);
 }
@@ -43,7 +43,7 @@ class MockPerTapSinkHandleManager : public PerTapSinkHandleManager {
 
   void submitTrace(TraceWrapperPtr&& trace) override { submitTrace_(*trace); }
 
-  MOCK_METHOD1(submitTrace_, void(const envoy::data::tap::v2alpha::TraceWrapper& trace));
+  MOCK_METHOD1(submitTrace_, void(const envoy::data::tap::v3alpha::TraceWrapper& trace));
 };
 
 class MockMatcher : public Matcher {
diff --git a/test/extensions/common/tap/tap_config_base_test.cc b/test/extensions/common/tap/tap_config_base_test.cc
index a381f7858894..3f423c64f76b 100644
--- a/test/extensions/common/tap/tap_config_base_test.cc
+++ b/test/extensions/common/tap/tap_config_base_test.cc
@@ -1,8 +1,8 @@
 #include <vector>
 
-#include "envoy/data/tap/v2alpha/common.pb.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -18,52 +18,48 @@ namespace {
 
 TEST(BodyBytesToString, All) {
   {
-    envoy::data::tap::v2alpha::TraceWrapper trace;
+    envoy::data::tap::v3alpha::TraceWrapper trace;
     trace.mutable_http_streamed_trace_segment()->mutable_request_body_chunk()->set_as_bytes(
         "hello");
-    Utility::bodyBytesToString(trace, envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_BYTES);
+    Utility::bodyBytesToString(trace, envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_BYTES);
     EXPECT_EQ("hello", trace.http_streamed_trace_segment().request_body_chunk().as_bytes());
   }
 
   {
-    envoy::data::tap::v2alpha::TraceWrapper trace;
+    envoy::data::tap::v3alpha::TraceWrapper trace;
     trace.mutable_http_streamed_trace_segment()->mutable_request_body_chunk()->set_as_bytes(
         "hello");
-    Utility::bodyBytesToString(trace,
-                               envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING);
+    Utility::bodyBytesToString(trace, envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING);
     EXPECT_EQ("hello", trace.http_streamed_trace_segment().request_body_chunk().as_string());
   }
 
   {
-    envoy::data::tap::v2alpha::TraceWrapper trace;
+    envoy::data::tap::v3alpha::TraceWrapper trace;
     trace.mutable_http_streamed_trace_segment()->mutable_response_body_chunk()->set_as_bytes(
         "hello");
-    Utility::bodyBytesToString(trace,
-                               envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING);
+    Utility::bodyBytesToString(trace, envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING);
     EXPECT_EQ("hello", trace.http_streamed_trace_segment().response_body_chunk().as_string());
   }
 
   {
-    envoy::data::tap::v2alpha::TraceWrapper trace;
+    envoy::data::tap::v3alpha::TraceWrapper trace;
     trace.mutable_socket_streamed_trace_segment()
         ->mutable_event()
         ->mutable_read()
         ->mutable_data()
         ->set_as_bytes("hello");
-    Utility::bodyBytesToString(trace,
-                               envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING);
+    Utility::bodyBytesToString(trace, envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING);
     EXPECT_EQ("hello", trace.socket_streamed_trace_segment().event().read().data().as_string());
   }
 
   {
-    envoy::data::tap::v2alpha::TraceWrapper trace;
+    envoy::data::tap::v3alpha::TraceWrapper trace;
     trace.mutable_socket_streamed_trace_segment()
         ->mutable_event()
         ->mutable_write()
         ->mutable_data()
         ->set_as_bytes("hello");
-    Utility::bodyBytesToString(trace,
-                               envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING);
+    Utility::bodyBytesToString(trace, envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING);
     EXPECT_EQ("hello", trace.socket_streamed_trace_segment().event().write().data().as_string());
   }
 }
@@ -71,7 +67,7 @@ TEST(BodyBytesToString, All) {
 TEST(AddBufferToProtoBytes, All) {
   {
     Buffer::OwnedImpl data("hello");
-    envoy::data::tap::v2alpha::Body body;
+    envoy::data::tap::v3alpha::Body body;
     Utility::addBufferToProtoBytes(body, 5, data, 4, 1);
     EXPECT_EQ("o", body.as_bytes());
     EXPECT_FALSE(body.truncated());
@@ -79,7 +75,7 @@ TEST(AddBufferToProtoBytes, All) {
 
   {
     Buffer::OwnedImpl data("hello");
-    envoy::data::tap::v2alpha::Body body;
+    envoy::data::tap::v3alpha::Body body;
     Utility::addBufferToProtoBytes(body, 3, data, 0, 5);
     EXPECT_EQ("hel", body.as_bytes());
     EXPECT_TRUE(body.truncated());
@@ -87,7 +83,7 @@ TEST(AddBufferToProtoBytes, All) {
 
   {
     Buffer::OwnedImpl data("hello");
-    envoy::data::tap::v2alpha::Body body;
+    envoy::data::tap::v3alpha::Body body;
     Utility::addBufferToProtoBytes(body, 100, data, 0, 5);
     EXPECT_EQ("hello", body.as_bytes());
     EXPECT_FALSE(body.truncated());
diff --git a/test/extensions/common/tap/tap_matcher_test.cc b/test/extensions/common/tap/tap_matcher_test.cc
index 65702ba952b0..e118c497f46a 100644
--- a/test/extensions/common/tap/tap_matcher_test.cc
+++ b/test/extensions/common/tap/tap_matcher_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -18,7 +18,7 @@ class TapMatcherTest : public testing::Test {
 public:
   std::vector<MatcherPtr> matchers_;
   Matcher::MatchStatusVector statuses_;
-  envoy::service::tap::v2alpha::MatchPredicate config_;
+  envoy::config::tap::v3alpha::MatchPredicate config_;
   Http::TestHeaderMapImpl headers_;
 };
 
diff --git a/test/extensions/filters/common/ext_authz/BUILD b/test/extensions/filters/common/ext_authz/BUILD
index 36317dc8b2f3..620e1e6cc2a9 100644
--- a/test/extensions/filters/common/ext_authz/BUILD
+++ b/test/extensions/filters/common/ext_authz/BUILD
@@ -21,8 +21,8 @@ envoy_cc_test(
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -32,9 +32,9 @@ envoy_cc_test(
     deps = [
         "//source/extensions/filters/common/ext_authz:ext_authz_grpc_lib",
         "//test/extensions/filters/common/ext_authz:ext_authz_test_common",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
         "@envoy_api//envoy/service/auth/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,8 +44,8 @@ envoy_cc_test(
     deps = [
         "//source/extensions/filters/common/ext_authz:ext_authz_http_lib",
         "//test/extensions/filters/common/ext_authz:ext_authz_test_common",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -55,7 +55,7 @@ envoy_cc_mock(
     hdrs = ["mocks.h"],
     deps = [
         "//source/extensions/filters/common/ext_authz:ext_authz_interface",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -70,8 +70,8 @@ envoy_cc_mock(
         "//test/extensions/filters/common/ext_authz:ext_authz_mocks",
         "//test/mocks/grpc:grpc_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/common/ext_authz/check_request_utils_test.cc b/test/extensions/filters/common/ext_authz/check_request_utils_test.cc
index b5dc3cc681ae..2467aa6113f6 100644
--- a/test/extensions/filters/common/ext_authz/check_request_utils_test.cc
+++ b/test/extensions/filters/common/ext_authz/check_request_utils_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/protobuf/protobuf.h"
@@ -48,11 +48,11 @@ class CheckRequestUtilsTest : public testing::Test {
   void callHttpCheckAndValidateRequestAttributes(bool include_peer_certificate) {
     Http::TestHeaderMapImpl request_headers{{"x-envoy-downstream-service-cluster", "foo"},
                                             {":path", "/bar"}};
-    envoy::service::auth::v2::CheckRequest request;
+    envoy::service::auth::v3alpha::CheckRequest request;
     Protobuf::Map<std::string, std::string> context_extensions;
     context_extensions["key"] = "value";
 
-    envoy::api::v2::core::Metadata metadata_context;
+    envoy::config::core::v3alpha::Metadata metadata_context;
     auto metadata_val = MessageUtil::keyValueStruct("foo", "bar");
     (*metadata_context.mutable_filter_metadata())["meta.key"] = metadata_val;
 
@@ -104,7 +104,7 @@ class CheckRequestUtilsTest : public testing::Test {
 // Verify that createTcpCheck's dependencies are invoked when it's called.
 // Verify that the source certificate is not set by default.
 TEST_F(CheckRequestUtilsTest, BasicTcp) {
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   EXPECT_CALL(net_callbacks_, connection()).Times(2).WillRepeatedly(ReturnRef(connection_));
   EXPECT_CALL(connection_, remoteAddress()).WillOnce(ReturnRef(addr_));
   EXPECT_CALL(connection_, localAddress()).WillOnce(ReturnRef(addr_));
@@ -121,7 +121,7 @@ TEST_F(CheckRequestUtilsTest, BasicTcp) {
 // Verify that createTcpCheck's dependencies are invoked when it's called.
 // Verify that createTcpCheck populates the source certificate correctly.
 TEST_F(CheckRequestUtilsTest, TcpPeerCertificate) {
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   EXPECT_CALL(net_callbacks_, connection()).Times(2).WillRepeatedly(ReturnRef(connection_));
   EXPECT_CALL(connection_, remoteAddress()).WillOnce(ReturnRef(addr_));
   EXPECT_CALL(connection_, localAddress()).WillOnce(ReturnRef(addr_));
@@ -142,7 +142,7 @@ TEST_F(CheckRequestUtilsTest, TcpPeerCertificate) {
 // CheckRequest call.
 TEST_F(CheckRequestUtilsTest, BasicHttp) {
   const uint64_t size = 0;
-  envoy::service::auth::v2::CheckRequest request_;
+  envoy::service::auth::v3alpha::CheckRequest request_;
 
   // A client supplied EnvoyAuthPartialBody header should be ignored.
   Http::TestHeaderMapImpl request_headers{{Http::Headers::get().EnvoyAuthPartialBody.get(), "1"}};
@@ -151,9 +151,9 @@ TEST_F(CheckRequestUtilsTest, BasicHttp) {
   EXPECT_CALL(*ssl_, uriSanLocalCertificate())
       .WillOnce(Return(std::vector<std::string>{"destination"}));
   expectBasicHttp();
-  CheckRequestUtils::createHttpCheck(&callbacks_, request_headers,
-                                     Protobuf::Map<std::string, std::string>(),
-                                     envoy::api::v2::core::Metadata(), request_, size, false);
+  CheckRequestUtils::createHttpCheck(
+      &callbacks_, request_headers, Protobuf::Map<std::string, std::string>(),
+      envoy::config::core::v3alpha::Metadata(), request_, size, false);
   ASSERT_EQ(size, request_.attributes().request().http().body().size());
   EXPECT_EQ(buffer_->toString().substr(0, size), request_.attributes().request().http().body());
   EXPECT_EQ(request_.attributes().request().http().headers().end(),
@@ -165,15 +165,15 @@ TEST_F(CheckRequestUtilsTest, BasicHttp) {
 TEST_F(CheckRequestUtilsTest, BasicHttpWithPartialBody) {
   const uint64_t size = 4049;
   Http::HeaderMapImpl headers_;
-  envoy::service::auth::v2::CheckRequest request_;
+  envoy::service::auth::v3alpha::CheckRequest request_;
 
   EXPECT_CALL(*ssl_, uriSanPeerCertificate()).WillOnce(Return(std::vector<std::string>{"source"}));
   EXPECT_CALL(*ssl_, uriSanLocalCertificate())
       .WillOnce(Return(std::vector<std::string>{"destination"}));
   expectBasicHttp();
-  CheckRequestUtils::createHttpCheck(&callbacks_, headers_,
-                                     Protobuf::Map<std::string, std::string>(),
-                                     envoy::api::v2::core::Metadata(), request_, size, false);
+  CheckRequestUtils::createHttpCheck(
+      &callbacks_, headers_, Protobuf::Map<std::string, std::string>(),
+      envoy::config::core::v3alpha::Metadata(), request_, size, false);
   ASSERT_EQ(size, request_.attributes().request().http().body().size());
   EXPECT_EQ(buffer_->toString().substr(0, size), request_.attributes().request().http().body());
   EXPECT_EQ("true", request_.attributes().request().http().headers().at(
@@ -183,7 +183,7 @@ TEST_F(CheckRequestUtilsTest, BasicHttpWithPartialBody) {
 // Verify that check request object has all the request data.
 TEST_F(CheckRequestUtilsTest, BasicHttpWithFullBody) {
   Http::HeaderMapImpl headers_;
-  envoy::service::auth::v2::CheckRequest request_;
+  envoy::service::auth::v3alpha::CheckRequest request_;
 
   EXPECT_CALL(*ssl_, uriSanPeerCertificate()).WillOnce(Return(std::vector<std::string>{"source"}));
   EXPECT_CALL(*ssl_, uriSanLocalCertificate())
@@ -191,7 +191,7 @@ TEST_F(CheckRequestUtilsTest, BasicHttpWithFullBody) {
   expectBasicHttp();
   CheckRequestUtils::createHttpCheck(
       &callbacks_, headers_, Protobuf::Map<std::string, std::string>(),
-      envoy::api::v2::core::Metadata(), request_, buffer_->length(), false);
+      envoy::config::core::v3alpha::Metadata(), request_, buffer_->length(), false);
   ASSERT_EQ(buffer_->length(), request_.attributes().request().http().body().size());
   EXPECT_EQ(buffer_->toString().substr(0, buffer_->length()),
             request_.attributes().request().http().body());
@@ -205,7 +205,7 @@ TEST_F(CheckRequestUtilsTest, BasicHttpWithFullBody) {
 TEST_F(CheckRequestUtilsTest, CheckAttrContextPeer) {
   Http::TestHeaderMapImpl request_headers{{"x-envoy-downstream-service-cluster", "foo"},
                                           {":path", "/bar"}};
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   EXPECT_CALL(callbacks_, connection()).WillRepeatedly(Return(&connection_));
   EXPECT_CALL(connection_, remoteAddress()).WillRepeatedly(ReturnRef(addr_));
   EXPECT_CALL(connection_, localAddress()).WillRepeatedly(ReturnRef(addr_));
diff --git a/test/extensions/filters/common/ext_authz/ext_authz_grpc_impl_test.cc b/test/extensions/filters/common/ext_authz/ext_authz_grpc_impl_test.cc
index e780537a9760..8052ac171a5b 100644
--- a/test/extensions/filters/common/ext_authz/ext_authz_grpc_impl_test.cc
+++ b/test/extensions/filters/common/ext_authz/ext_authz_grpc_impl_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/service/auth/v2/external_auth.pb.h"
 #include "envoy/service/auth/v2alpha/external_auth.pb.h" // for proto link
-#include "envoy/type/http_status.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
+#include "envoy/type/v3alpha/http_status.pb.h"
 
 #include "common/grpc/common.h"
 #include "common/http/headers.h"
@@ -43,7 +43,7 @@ class ExtAuthzGrpcClientTest : public testing::TestWithParam<bool> {
                                                use_alpha_);
   }
 
-  void expectCallSend(envoy::service::auth::v2::CheckRequest& request) {
+  void expectCallSend(envoy::service::auth::v3alpha::CheckRequest& request) {
     EXPECT_CALL(*async_client_,
                 sendRaw(_, _, Grpc::ProtoBufferEq(request), Ref(*(client_.get())), _, _))
         .WillOnce(
@@ -72,13 +72,13 @@ INSTANTIATE_TEST_SUITE_P(Parameterized, ExtAuthzGrpcClientTest, Values(true, fal
 TEST_P(ExtAuthzGrpcClientTest, AuthorizationOk) {
   initialize(GetParam());
 
-  auto check_response = std::make_unique<envoy::service::auth::v2::CheckResponse>();
+  auto check_response = std::make_unique<envoy::service::auth::v3alpha::CheckResponse>();
   auto status = check_response->mutable_status();
   status->set_code(Grpc::Status::WellKnownGrpcStatus::Ok);
   auto authz_response = Response{};
   authz_response.status = CheckStatus::OK;
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -98,12 +98,12 @@ TEST_P(ExtAuthzGrpcClientTest, AuthorizationOkWithAllAtributes) {
   const std::string empty_body{};
   const auto expected_headers = TestCommon::makeHeaderValueOption({{"foo", "bar", false}});
   auto check_response =
-      TestCommon::makeCheckResponse(Grpc::Status::WellKnownGrpcStatus::Ok,
-                                    envoy::type::StatusCode::OK, empty_body, expected_headers);
+      TestCommon::makeCheckResponse(Grpc::Status::WellKnownGrpcStatus::Ok, envoy::type::v3alpha::OK,
+                                    empty_body, expected_headers);
   auto authz_response =
       TestCommon::makeAuthzResponse(CheckStatus::OK, Http::Code::OK, empty_body, expected_headers);
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -120,13 +120,13 @@ TEST_P(ExtAuthzGrpcClientTest, AuthorizationOkWithAllAtributes) {
 TEST_P(ExtAuthzGrpcClientTest, AuthorizationDenied) {
   initialize(GetParam());
 
-  auto check_response = std::make_unique<envoy::service::auth::v2::CheckResponse>();
+  auto check_response = std::make_unique<envoy::service::auth::v3alpha::CheckResponse>();
   auto status = check_response->mutable_status();
   status->set_code(Grpc::Status::WellKnownGrpcStatus::PermissionDenied);
   auto authz_response = Response{};
   authz_response.status = CheckStatus::Denied;
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -144,13 +144,13 @@ TEST_P(ExtAuthzGrpcClientTest, AuthorizationDenied) {
 TEST_P(ExtAuthzGrpcClientTest, AuthorizationDeniedGrpcUnknownStatus) {
   initialize(GetParam());
 
-  auto check_response = std::make_unique<envoy::service::auth::v2::CheckResponse>();
+  auto check_response = std::make_unique<envoy::service::auth::v3alpha::CheckResponse>();
   auto status = check_response->mutable_status();
   status->set_code(Grpc::Status::WellKnownGrpcStatus::Unknown);
   auto authz_response = Response{};
   authz_response.status = CheckStatus::Denied;
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -172,12 +172,12 @@ TEST_P(ExtAuthzGrpcClientTest, AuthorizationDeniedWithAllAttributes) {
   const auto expected_headers =
       TestCommon::makeHeaderValueOption({{"foo", "bar", false}, {"foobar", "bar", true}});
   auto check_response = TestCommon::makeCheckResponse(
-      Grpc::Status::WellKnownGrpcStatus::PermissionDenied, envoy::type::StatusCode::Unauthorized,
+      Grpc::Status::WellKnownGrpcStatus::PermissionDenied, envoy::type::v3alpha::Unauthorized,
       expected_body, expected_headers);
   auto authz_response = TestCommon::makeAuthzResponse(CheckStatus::Denied, Http::Code::Unauthorized,
                                                       expected_body, expected_headers);
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -195,7 +195,7 @@ TEST_P(ExtAuthzGrpcClientTest, AuthorizationDeniedWithAllAttributes) {
 TEST_P(ExtAuthzGrpcClientTest, UnknownError) {
   initialize(GetParam());
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -208,7 +208,7 @@ TEST_P(ExtAuthzGrpcClientTest, UnknownError) {
 TEST_P(ExtAuthzGrpcClientTest, CancelledAuthorizationRequest) {
   initialize(GetParam());
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   EXPECT_CALL(*async_client_, sendRaw(_, _, _, _, _, _)).WillOnce(Return(&async_request_));
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
@@ -220,7 +220,7 @@ TEST_P(ExtAuthzGrpcClientTest, CancelledAuthorizationRequest) {
 TEST_P(ExtAuthzGrpcClientTest, AuthorizationRequestTimeout) {
   initialize(GetParam());
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   expectCallSend(request);
   client_->check(request_callbacks_, request, Tracing::NullSpan::instance());
 
diff --git a/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc b/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc
index b896e731fb8c..e6fb9b1b0c9d 100644
--- a/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc
+++ b/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 
 #include "common/http/headers.h"
 #include "common/http/message_impl.h"
@@ -42,7 +42,7 @@ class ExtAuthzHttpClientTest : public testing::Test {
 
   static ClientConfigSharedPtr createConfig(std::string yaml = "", uint32_t timeout = 250,
                                             std::string path_prefix = "/bar") {
-    envoy::config::filter::http::ext_authz::v2::ExtAuthz proto_config{};
+    envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz proto_config{};
     if (yaml.empty()) {
       std::string default_yaml = R"EOF(
         http_service:
@@ -81,7 +81,7 @@ class ExtAuthzHttpClientTest : public testing::Test {
   }
 
   Http::MessagePtr sendRequest(std::unordered_map<std::string, std::string>&& headers) {
-    envoy::service::auth::v2::CheckRequest request{};
+    envoy::service::auth::v3alpha::CheckRequest request{};
     auto mutable_headers =
         request.mutable_attributes()->mutable_request()->mutable_http()->mutable_headers();
     for (const auto& header : headers) {
@@ -228,7 +228,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationOk) {
   const auto expected_headers = TestCommon::makeHeaderValueOption({{":status", "200", false}});
   const auto authz_response = TestCommon::makeAuthzResponse(CheckStatus::OK);
   auto check_response = TestCommon::makeMessageResponse(expected_headers);
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
 
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
   EXPECT_CALL(*child_span,
@@ -251,7 +251,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationOkWithAddedAuthzHeaders) {
   const auto expected_headers = TestCommon::makeHeaderValueOption({{":status", "200", false}});
   const auto authz_response = TestCommon::makeAuthzResponse(CheckStatus::OK);
   auto check_response = TestCommon::makeMessageResponse(expected_headers);
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   auto mutable_headers =
       request.mutable_attributes()->mutable_request()->mutable_http()->mutable_headers();
   (*mutable_headers)[std::string{":x-authz-header2"}] = std::string{"forged-value"};
@@ -283,7 +283,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationOkWithAllowHeader) {
   const auto authz_response =
       TestCommon::makeAuthzResponse(CheckStatus::OK, Http::Code::OK, empty_body, expected_headers);
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   EXPECT_CALL(request_callbacks_,
               onComplete_(WhenDynamicCastTo<ResponsePtr&>(AuthzOkResponse(authz_response))));
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
@@ -315,7 +315,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationDenied) {
   const auto authz_response = TestCommon::makeAuthzResponse(
       CheckStatus::Denied, Http::Code::Forbidden, "", expected_headers);
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
   EXPECT_CALL(*child_span,
               setTag(Eq(Tracing::Tags::get().UpstreamCluster), Eq(config_->cluster())));
@@ -344,7 +344,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationDeniedWithAllAttributes) {
               setTag(Eq(Tracing::Tags::get().UpstreamCluster), Eq(config_->cluster())));
   EXPECT_CALL(*child_span, injectContext(_));
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   client_.check(request_callbacks_, request, active_span_);
 
   EXPECT_CALL(*child_span, setTag(Eq("ext_authz_status"), Eq("ext_authz_unauthorized")));
@@ -370,7 +370,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationDeniedAndAllowedClientHeaders) {
               setTag(Eq(Tracing::Tags::get().UpstreamCluster), Eq(config_->cluster())));
   EXPECT_CALL(*child_span, injectContext(_));
 
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
   client_.check(request_callbacks_, request, active_span_);
   EXPECT_CALL(request_callbacks_,
               onComplete_(WhenDynamicCastTo<ResponsePtr&>(AuthzDeniedResponse(authz_response))));
@@ -387,7 +387,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationDeniedAndAllowedClientHeaders) {
 // Test the client when an unknown error occurs.
 TEST_F(ExtAuthzHttpClientTest, AuthorizationRequestError) {
   Tracing::MockSpan* child_span{new Tracing::MockSpan()};
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
 
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
   EXPECT_CALL(*child_span,
@@ -408,7 +408,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationRequest5xxError) {
   Http::MessagePtr check_response(new Http::ResponseMessageImpl(
       Http::HeaderMapPtr{new Http::TestHeaderMapImpl{{":status", "503"}}}));
   Tracing::MockSpan* child_span{new Tracing::MockSpan()};
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
 
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
   EXPECT_CALL(*child_span,
@@ -430,7 +430,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationRequestErrorParsingStatusCode) {
   Http::MessagePtr check_response(new Http::ResponseMessageImpl(
       Http::HeaderMapPtr{new Http::TestHeaderMapImpl{{":status", "foo"}}}));
   Tracing::MockSpan* child_span{new Tracing::MockSpan()};
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
 
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
   EXPECT_CALL(*child_span,
@@ -449,7 +449,7 @@ TEST_F(ExtAuthzHttpClientTest, AuthorizationRequestErrorParsingStatusCode) {
 // Test the client when the request is canceled.
 TEST_F(ExtAuthzHttpClientTest, CancelledAuthorizationRequest) {
   Tracing::MockSpan* child_span{new Tracing::MockSpan()};
-  envoy::service::auth::v2::CheckRequest request;
+  envoy::service::auth::v3alpha::CheckRequest request;
 
   EXPECT_CALL(active_span_, spawnChild_(_, config_->tracingName(), _)).WillOnce(Return(child_span));
   EXPECT_CALL(*child_span,
@@ -479,7 +479,7 @@ TEST_F(ExtAuthzHttpClientTest, NoCluster) {
               onComplete_(WhenDynamicCastTo<ResponsePtr&>(AuthzErrorResponse(CheckStatus::Error))));
   EXPECT_CALL(*child_span, setTag(Eq(Tracing::Tags::get().Error), Eq(Tracing::Tags::get().True)));
   EXPECT_CALL(*child_span, finishSpan());
-  client_.check(request_callbacks_, envoy::service::auth::v2::CheckRequest{}, active_span_);
+  client_.check(request_callbacks_, envoy::service::auth::v3alpha::CheckRequest{}, active_span_);
 }
 
 } // namespace
diff --git a/test/extensions/filters/common/ext_authz/mocks.h b/test/extensions/filters/common/ext_authz/mocks.h
index f4401d7c46df..98d980e7a0fd 100644
--- a/test/extensions/filters/common/ext_authz/mocks.h
+++ b/test/extensions/filters/common/ext_authz/mocks.h
@@ -3,7 +3,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 
 #include "extensions/filters/common/ext_authz/ext_authz.h"
 
@@ -23,7 +23,7 @@ class MockClient : public Client {
   // ExtAuthz::Client
   MOCK_METHOD0(cancel, void());
   MOCK_METHOD3(check, void(RequestCallbacks& callbacks,
-                           const envoy::service::auth::v2::CheckRequest& request,
+                           const envoy::service::auth::v3alpha::CheckRequest& request,
                            Tracing::Span& parent_span));
 };
 
diff --git a/test/extensions/filters/common/ext_authz/test_common.cc b/test/extensions/filters/common/ext_authz/test_common.cc
index 4f322e01da30..fe79ae63ba7b 100644
--- a/test/extensions/filters/common/ext_authz/test_common.cc
+++ b/test/extensions/filters/common/ext_authz/test_common.cc
@@ -2,9 +2,9 @@
 
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
-#include "envoy/type/http_status.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
+#include "envoy/type/v3alpha/http_status.pb.h"
 
 #include "test/mocks/upstream/mocks.h"
 
@@ -15,10 +15,10 @@ namespace Common {
 namespace ExtAuthz {
 
 CheckResponsePtr TestCommon::makeCheckResponse(Grpc::Status::GrpcStatus response_status,
-                                               envoy::type::StatusCode http_status_code,
+                                               envoy::type::v3alpha::StatusCode http_status_code,
                                                const std::string& body,
                                                const HeaderValueOptionVector& headers) {
-  auto response = std::make_unique<envoy::service::auth::v2::CheckResponse>();
+  auto response = std::make_unique<envoy::service::auth::v3alpha::CheckResponse>();
   auto status = response->mutable_status();
   status->set_code(response_status);
 
@@ -76,7 +76,7 @@ Response TestCommon::makeAuthzResponse(CheckStatus status, Http::Code status_cod
 HeaderValueOptionVector TestCommon::makeHeaderValueOption(KeyValueOptionVector&& headers) {
   HeaderValueOptionVector header_option_vector{};
   for (const auto& header : headers) {
-    envoy::api::v2::core::HeaderValueOption header_value_option;
+    envoy::config::core::v3alpha::HeaderValueOption header_value_option;
     auto* mutable_header = header_value_option.mutable_header();
     mutable_header->set_key(header.key);
     mutable_header->set_value(header.value);
diff --git a/test/extensions/filters/common/ext_authz/test_common.h b/test/extensions/filters/common/ext_authz/test_common.h
index e784aaa2f274..596d31788c4b 100644
--- a/test/extensions/filters/common/ext_authz/test_common.h
+++ b/test/extensions/filters/common/ext_authz/test_common.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
-#include "envoy/type/http_status.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
+#include "envoy/type/v3alpha/http_status.pb.h"
 
 #include "common/http/headers.h"
 
@@ -23,8 +23,8 @@ struct KeyValueOption {
 };
 
 using KeyValueOptionVector = std::vector<KeyValueOption>;
-using HeaderValueOptionVector = std::vector<envoy::api::v2::core::HeaderValueOption>;
-using CheckResponsePtr = std::unique_ptr<envoy::service::auth::v2::CheckResponse>;
+using HeaderValueOptionVector = std::vector<envoy::config::core::v3alpha::HeaderValueOption>;
+using CheckResponsePtr = std::unique_ptr<envoy::service::auth::v3alpha::CheckResponse>;
 
 class TestCommon {
 public:
@@ -33,7 +33,7 @@ class TestCommon {
 
   static CheckResponsePtr makeCheckResponse(
       Grpc::Status::GrpcStatus response_status = Grpc::Status::WellKnownGrpcStatus::Ok,
-      envoy::type::StatusCode http_status_code = envoy::type::StatusCode::OK,
+      envoy::type::v3alpha::StatusCode http_status_code = envoy::type::v3alpha::OK,
       const std::string& body = std::string{},
       const HeaderValueOptionVector& headers = HeaderValueOptionVector{});
 
diff --git a/test/extensions/filters/common/fault/BUILD b/test/extensions/filters/common/fault/BUILD
index db3d74fd3406..03707cb998f4 100644
--- a/test/extensions/filters/common/fault/BUILD
+++ b/test/extensions/filters/common/fault/BUILD
@@ -14,6 +14,6 @@ envoy_cc_test(
     deps = [
         "//source/extensions/filters/common/fault:fault_config_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/fault/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/common/fault/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/common/fault/fault_config_test.cc b/test/extensions/filters/common/fault/fault_config_test.cc
index e8cbf9d8083a..e30fec3d9ff7 100644
--- a/test/extensions/filters/common/fault/fault_config_test.cc
+++ b/test/extensions/filters/common/fault/fault_config_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/fault/v2/fault.pb.h"
+#include "envoy/extensions/filters/common/fault/v3alpha/fault.pb.h"
 
 #include "extensions/filters/common/fault/fault_config.h"
 
@@ -14,7 +14,7 @@ namespace Fault {
 namespace {
 
 TEST(FaultConfigTest, FaultDelayHeaderConfig) {
-  envoy::config::filter::fault::v2::FaultDelay proto_config;
+  envoy::extensions::filters::common::fault::v3alpha::FaultDelay proto_config;
   proto_config.mutable_header_delay();
   FaultDelayConfig config(proto_config);
 
@@ -32,7 +32,7 @@ TEST(FaultConfigTest, FaultDelayHeaderConfig) {
 }
 
 TEST(FaultConfigTest, FaultRateLimitHeaderConfig) {
-  envoy::config::filter::fault::v2::FaultRateLimit proto_config;
+  envoy::extensions::filters::common::fault::v3alpha::FaultRateLimit proto_config;
   proto_config.mutable_header_limit();
   FaultRateLimitConfig config(proto_config);
 
diff --git a/test/extensions/filters/common/lua/BUILD b/test/extensions/filters/common/lua/BUILD
index 2a4ea815b577..4eede8b73288 100644
--- a/test/extensions/filters/common/lua/BUILD
+++ b/test/extensions/filters/common/lua/BUILD
@@ -30,7 +30,7 @@ envoy_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/common/lua/wrappers_test.cc b/test/extensions/filters/common/lua/wrappers_test.cc
index a64ee7c6f25d..bef9d5eec488 100644
--- a/test/extensions/filters/common/lua/wrappers_test.cc
+++ b/test/extensions/filters/common/lua/wrappers_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -25,8 +25,8 @@ class LuaMetadataMapWrapperTest : public LuaWrappersTestBase<MetadataMapWrapper>
     state_->registerType<MetadataMapIterator>();
   }
 
-  envoy::api::v2::core::Metadata parseMetadataFromYaml(const std::string& yaml_string) {
-    envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata parseMetadataFromYaml(const std::string& yaml_string) {
+    envoy::config::core::v3alpha::Metadata metadata;
     TestUtility::loadFromYaml(yaml_string, metadata);
     return metadata;
   }
@@ -165,7 +165,7 @@ TEST_F(LuaMetadataMapWrapperTest, Methods) {
           value: ~
     )EOF";
 
-  envoy::api::v2::core::Metadata metadata = parseMetadataFromYaml(yaml);
+  envoy::config::core::v3alpha::Metadata metadata = parseMetadataFromYaml(yaml);
   const auto filter_metadata = metadata.filter_metadata().at("envoy.lua");
   MetadataMapWrapper::create(coroutine_->luaState(), filter_metadata);
 
@@ -221,7 +221,7 @@ TEST_F(LuaMetadataMapWrapperTest, Iterators) {
   // The underlying map is unordered.
   setup(SCRIPT);
 
-  envoy::api::v2::core::Metadata metadata = parseMetadataFromYaml(yaml);
+  envoy::config::core::v3alpha::Metadata metadata = parseMetadataFromYaml(yaml);
   const auto filter_metadata = metadata.filter_metadata().at("envoy.lua");
   MetadataMapWrapper::create(coroutine_->luaState(), filter_metadata);
 
@@ -258,7 +258,7 @@ TEST_F(LuaMetadataMapWrapperTest, DontFinishIteration) {
           name: nothing
     )EOF";
 
-  envoy::api::v2::core::Metadata metadata = parseMetadataFromYaml(yaml);
+  envoy::config::core::v3alpha::Metadata metadata = parseMetadataFromYaml(yaml);
   const auto filter_metadata = metadata.filter_metadata().at("envoy.lua");
   MetadataMapWrapper::create(coroutine_->luaState(), filter_metadata);
   EXPECT_THROW_WITH_MESSAGE(
diff --git a/test/extensions/filters/common/original_src/BUILD b/test/extensions/filters/common/original_src/BUILD
index f42ad5108618..1157184b4586 100644
--- a/test/extensions/filters/common/original_src/BUILD
+++ b/test/extensions/filters/common/original_src/BUILD
@@ -17,6 +17,6 @@ envoy_cc_test(
         "//test/mocks:common_lib",
         "//test/mocks/network:network_mocks",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/common/original_src/original_src_socket_option_test.cc b/test/extensions/filters/common/original_src/original_src_socket_option_test.cc
index a410f682ff8a..b8f70efb8767 100644
--- a/test/extensions/filters/common/original_src/original_src_socket_option_test.cc
+++ b/test/extensions/filters/common/original_src/original_src_socket_option_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/address.h"
 
 #include "common/network/utility.h"
@@ -37,21 +37,24 @@ TEST_F(OriginalSrcSocketOptionTest, TestSetOptionPreBindSetsAddress) {
   const auto address = Network::Utility::parseInternetAddress("127.0.0.2");
   auto option = makeOptionByAddress(address);
   EXPECT_CALL(socket_, setLocalAddress(PointeesEq(address)));
-  EXPECT_EQ(option->setOption(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND), true);
+  EXPECT_EQ(option->setOption(socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND),
+            true);
 }
 
 TEST_F(OriginalSrcSocketOptionTest, TestSetOptionPreBindSetsAddressSecond) {
   const auto address = Network::Utility::parseInternetAddress("1.2.3.4");
   auto option = makeOptionByAddress(address);
   EXPECT_CALL(socket_, setLocalAddress(PointeesEq(address)));
-  EXPECT_EQ(option->setOption(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND), true);
+  EXPECT_EQ(option->setOption(socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND),
+            true);
 }
 
 TEST_F(OriginalSrcSocketOptionTest, TestSetOptionNotPrebindDoesNotSetAddress) {
   const auto address = Network::Utility::parseInternetAddress("1.2.3.4");
   auto option = makeOptionByAddress(address);
   EXPECT_CALL(socket_, setLocalAddress(_)).Times(0);
-  EXPECT_EQ(option->setOption(socket_, envoy::api::v2::core::SocketOption::STATE_LISTENING), true);
+  EXPECT_EQ(option->setOption(socket_, envoy::config::core::v3alpha::SocketOption::STATE_LISTENING),
+            true);
 }
 
 TEST_F(OriginalSrcSocketOptionTest, TestIpv4HashKey) {
@@ -99,7 +102,7 @@ TEST_F(OriginalSrcSocketOptionTest, TestOptionDetailsNotSupported) {
   auto option = makeOptionByAddress(address);
 
   auto details =
-      option->getOptionDetails(socket_, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+      option->getOptionDetails(socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   EXPECT_FALSE(details.has_value());
 }
diff --git a/test/extensions/filters/common/ratelimit/BUILD b/test/extensions/filters/common/ratelimit/BUILD
index 740798ba309b..8f144a4d5b17 100644
--- a/test/extensions/filters/common/ratelimit/BUILD
+++ b/test/extensions/filters/common/ratelimit/BUILD
@@ -19,7 +19,7 @@ envoy_cc_test(
         "//test/mocks/grpc:grpc_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/service/ratelimit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/common/ratelimit/ratelimit_impl_test.cc b/test/extensions/filters/common/ratelimit/ratelimit_impl_test.cc
index cf7c22e851d4..454421e1a65d 100644
--- a/test/extensions/filters/common/ratelimit/ratelimit_impl_test.cc
+++ b/test/extensions/filters/common/ratelimit/ratelimit_impl_test.cc
@@ -3,7 +3,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/service/ratelimit/v2/rls.pb.h"
+#include "envoy/service/ratelimit/v3alpha/rls.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/http/header_map_impl.h"
@@ -59,10 +59,10 @@ class RateLimitGrpcClientTest : public testing::Test {
 };
 
 TEST_F(RateLimitGrpcClientTest, Basic) {
-  std::unique_ptr<envoy::service::ratelimit::v2::RateLimitResponse> response;
+  std::unique_ptr<envoy::service::ratelimit::v3alpha::RateLimitResponse> response;
 
   {
-    envoy::service::ratelimit::v2::RateLimitRequest request;
+    envoy::service::ratelimit::v3alpha::RateLimitRequest request;
     Http::HeaderMapImpl headers;
     GrpcClientImpl::createRequest(request, "foo", {{{{"foo", "bar"}}}});
     EXPECT_CALL(*async_client_, sendRaw(_, _, Grpc::ProtoBufferEq(request), Ref(client_), _, _))
@@ -81,15 +81,15 @@ TEST_F(RateLimitGrpcClientTest, Basic) {
     client_.onCreateInitialMetadata(headers);
     EXPECT_EQ(nullptr, headers.RequestId());
 
-    response = std::make_unique<envoy::service::ratelimit::v2::RateLimitResponse>();
-    response->set_overall_code(envoy::service::ratelimit::v2::RateLimitResponse::OVER_LIMIT);
+    response = std::make_unique<envoy::service::ratelimit::v3alpha::RateLimitResponse>();
+    response->set_overall_code(envoy::service::ratelimit::v3alpha::RateLimitResponse::OVER_LIMIT);
     EXPECT_CALL(span_, setTag(Eq("ratelimit_status"), Eq("over_limit")));
     EXPECT_CALL(request_callbacks_, complete_(LimitStatus::OverLimit, _, _));
     client_.onSuccess(std::move(response), span_);
   }
 
   {
-    envoy::service::ratelimit::v2::RateLimitRequest request;
+    envoy::service::ratelimit::v3alpha::RateLimitRequest request;
     Http::HeaderMapImpl headers;
     GrpcClientImpl::createRequest(request, "foo", {{{{"foo", "bar"}, {"bar", "baz"}}}});
     EXPECT_CALL(*async_client_, sendRaw(_, _, Grpc::ProtoBufferEq(request), _, _, _))
@@ -100,15 +100,15 @@ TEST_F(RateLimitGrpcClientTest, Basic) {
 
     client_.onCreateInitialMetadata(headers);
 
-    response = std::make_unique<envoy::service::ratelimit::v2::RateLimitResponse>();
-    response->set_overall_code(envoy::service::ratelimit::v2::RateLimitResponse::OK);
+    response = std::make_unique<envoy::service::ratelimit::v3alpha::RateLimitResponse>();
+    response->set_overall_code(envoy::service::ratelimit::v3alpha::RateLimitResponse::OK);
     EXPECT_CALL(span_, setTag(Eq("ratelimit_status"), Eq("ok")));
     EXPECT_CALL(request_callbacks_, complete_(LimitStatus::OK, _, _));
     client_.onSuccess(std::move(response), span_);
   }
 
   {
-    envoy::service::ratelimit::v2::RateLimitRequest request;
+    envoy::service::ratelimit::v3alpha::RateLimitRequest request;
     GrpcClientImpl::createRequest(
         request, "foo",
         {{{{"foo", "bar"}, {"bar", "baz"}}}, {{{"foo2", "bar2"}, {"bar2", "baz2"}}}});
@@ -119,14 +119,14 @@ TEST_F(RateLimitGrpcClientTest, Basic) {
                   {{{{"foo", "bar"}, {"bar", "baz"}}}, {{{"foo2", "bar2"}, {"bar2", "baz2"}}}},
                   Tracing::NullSpan::instance());
 
-    response = std::make_unique<envoy::service::ratelimit::v2::RateLimitResponse>();
+    response = std::make_unique<envoy::service::ratelimit::v3alpha::RateLimitResponse>();
     EXPECT_CALL(request_callbacks_, complete_(LimitStatus::Error, _, _));
     client_.onFailure(Grpc::Status::Unknown, "", span_);
   }
 }
 
 TEST_F(RateLimitGrpcClientTest, Cancel) {
-  std::unique_ptr<envoy::service::ratelimit::v2::RateLimitResponse> response;
+  std::unique_ptr<envoy::service::ratelimit::v3alpha::RateLimitResponse> response;
 
   EXPECT_CALL(*async_client_, sendRaw(_, _, _, _, _, _)).WillOnce(Return(&async_request_));
 
diff --git a/test/extensions/filters/common/rbac/BUILD b/test/extensions/filters/common/rbac/BUILD
index e4abc56ebda1..7ba2cd125a8d 100644
--- a/test/extensions/filters/common/rbac/BUILD
+++ b/test/extensions/filters/common/rbac/BUILD
@@ -21,10 +21,10 @@ envoy_extension_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -38,8 +38,8 @@ envoy_extension_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -49,6 +49,6 @@ envoy_extension_cc_mock(
     extension_name = "envoy.filters.http.rbac",
     deps = [
         "//source/extensions/filters/common/rbac:engine_lib",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/common/rbac/engine_impl_test.cc b/test/extensions/filters/common/rbac/engine_impl_test.cc
index d0aa6dc1303b..7efcae58032f 100644
--- a/test/extensions/filters/common/rbac/engine_impl_test.cc
+++ b/test/extensions/filters/common/rbac/engine_impl_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
-#include "envoy/config/rbac/v2/rbac.pb.validate.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.validate.h"
 
 #include "common/network/utility.h"
 
@@ -27,7 +27,8 @@ namespace {
 void checkEngine(const RBAC::RoleBasedAccessControlEngineImpl& engine, bool expected,
                  const Envoy::Network::Connection& connection = Envoy::Network::MockConnection(),
                  const Envoy::Http::HeaderMap& headers = Envoy::Http::HeaderMapImpl(),
-                 const envoy::api::v2::core::Metadata& metadata = envoy::api::v2::core::Metadata(),
+                 const envoy::config::core::v3alpha::Metadata& metadata =
+                     envoy::config::core::v3alpha::Metadata(),
                  std::string* policy_id = nullptr) {
   NiceMock<StreamInfo::MockStreamInfo> info;
   EXPECT_CALL(Const(info), dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
@@ -35,11 +36,11 @@ void checkEngine(const RBAC::RoleBasedAccessControlEngineImpl& engine, bool expe
 }
 
 TEST(RoleBasedAccessControlEngineImpl, Disabled) {
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   checkEngine(RBAC::RoleBasedAccessControlEngineImpl(rbac), false);
 
-  rbac.set_action(envoy::config::rbac::v2::RBAC::DENY);
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::DENY);
   checkEngine(RBAC::RoleBasedAccessControlEngineImpl(rbac), true);
 }
 
@@ -47,9 +48,9 @@ TEST(RoleBasedAccessControlEngineImpl, Disabled) {
 // https://github.com/envoyproxy/envoy/issues/8715.
 TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
   {
-    envoy::config::rbac::v2::RBAC rbac;
-    rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::RBAC rbac;
+    rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
+    envoy::config::rbac::v3alpha::Policy policy;
     (*rbac.mutable_policies())["foo"] = policy;
 
     EXPECT_THROW_WITH_REGEX(TestUtility::validate(rbac), EnvoyException,
@@ -58,9 +59,9 @@ TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
   }
 
   {
-    envoy::config::rbac::v2::RBAC rbac;
-    rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::RBAC rbac;
+    rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
+    envoy::config::rbac::v3alpha::Policy policy;
     policy.add_permissions();
     (*rbac.mutable_policies())["foo"] = policy;
 
@@ -70,9 +71,9 @@ TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
   }
 
   {
-    envoy::config::rbac::v2::RBAC rbac;
-    rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::RBAC rbac;
+    rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
+    envoy::config::rbac::v3alpha::Policy policy;
     auto* permission = policy.add_permissions();
     auto* and_rules = permission->mutable_and_rules();
     and_rules->add_rules();
@@ -85,9 +86,9 @@ TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
   }
 
   {
-    envoy::config::rbac::v2::RBAC rbac;
-    rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::RBAC rbac;
+    rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
+    envoy::config::rbac::v3alpha::Policy policy;
     auto* permission = policy.add_permissions();
     permission->set_any(true);
     (*rbac.mutable_policies())["foo"] = policy;
@@ -98,9 +99,9 @@ TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
   }
 
   {
-    envoy::config::rbac::v2::RBAC rbac;
-    rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::RBAC rbac;
+    rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
+    envoy::config::rbac::v3alpha::Policy policy;
     auto* permission = policy.add_permissions();
     permission->set_any(true);
     policy.add_principals();
@@ -112,9 +113,9 @@ TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
   }
 
   {
-    envoy::config::rbac::v2::RBAC rbac;
-    rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::RBAC rbac;
+    rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
+    envoy::config::rbac::v3alpha::Policy policy;
     auto* permission = policy.add_permissions();
     permission->set_any(true);
     auto* principal = policy.add_principals();
@@ -130,12 +131,12 @@ TEST(RoleBasedAccessControlEngineImpl, InvalidConfig) {
 }
 
 TEST(RoleBasedAccessControlEngineImpl, AllowedWhitelist) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_destination_port(123);
   policy.add_principals()->set_any(true);
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
 
@@ -151,12 +152,12 @@ TEST(RoleBasedAccessControlEngineImpl, AllowedWhitelist) {
 }
 
 TEST(RoleBasedAccessControlEngineImpl, DeniedBlacklist) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_destination_port(123);
   policy.add_principals()->set_any(true);
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::DENY);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::DENY);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
 
@@ -172,7 +173,7 @@ TEST(RoleBasedAccessControlEngineImpl, DeniedBlacklist) {
 }
 
 TEST(RoleBasedAccessControlEngineImpl, BasicCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -181,15 +182,15 @@ TEST(RoleBasedAccessControlEngineImpl, BasicCondition) {
       bool_value: false
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
   checkEngine(engine, false);
 }
 
 TEST(RoleBasedAccessControlEngineImpl, MalformedCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -201,8 +202,8 @@ TEST(RoleBasedAccessControlEngineImpl, MalformedCondition) {
           bool_value: false
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
 
   EXPECT_THROW_WITH_REGEX(RBAC::RoleBasedAccessControlEngineImpl engine(rbac), EnvoyException,
@@ -210,7 +211,7 @@ TEST(RoleBasedAccessControlEngineImpl, MalformedCondition) {
 }
 
 TEST(RoleBasedAccessControlEngineImpl, MistypedCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -219,15 +220,15 @@ TEST(RoleBasedAccessControlEngineImpl, MistypedCondition) {
       int64_value: 13
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
   checkEngine(engine, false);
 }
 
 TEST(RoleBasedAccessControlEngineImpl, ErrorCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -244,15 +245,15 @@ TEST(RoleBasedAccessControlEngineImpl, ErrorCondition) {
           string_value: foo
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
   checkEngine(engine, false, Envoy::Network::MockConnection());
 }
 
 TEST(RoleBasedAccessControlEngineImpl, HeaderCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -274,8 +275,8 @@ TEST(RoleBasedAccessControlEngineImpl, HeaderCondition) {
           string_value: bar
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
 
@@ -288,7 +289,7 @@ TEST(RoleBasedAccessControlEngineImpl, HeaderCondition) {
 }
 
 TEST(RoleBasedAccessControlEngineImpl, MetadataCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -315,15 +316,15 @@ TEST(RoleBasedAccessControlEngineImpl, MetadataCondition) {
           string_value: prod
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
 
   Envoy::Http::HeaderMapImpl headers;
 
   auto label = MessageUtil::keyValueStruct("label", "prod");
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   metadata.mutable_filter_metadata()->insert(
       Protobuf::MapPair<std::string, ProtobufWkt::Struct>("other", label));
 
@@ -331,7 +332,7 @@ TEST(RoleBasedAccessControlEngineImpl, MetadataCondition) {
 }
 
 TEST(RoleBasedAccessControlEngineImpl, ConjunctiveCondition) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_destination_port(123);
   policy.add_principals()->set_any(true);
   policy.mutable_condition()->MergeFrom(
@@ -340,8 +341,8 @@ TEST(RoleBasedAccessControlEngineImpl, ConjunctiveCondition) {
       bool_value: false
   )EOF"));
 
-  envoy::config::rbac::v2::RBAC rbac;
-  rbac.set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+  envoy::config::rbac::v3alpha::RBAC rbac;
+  rbac.set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
   (*rbac.mutable_policies())["foo"] = policy;
   RBAC::RoleBasedAccessControlEngineImpl engine(rbac);
 
diff --git a/test/extensions/filters/common/rbac/matchers_test.cc b/test/extensions/filters/common/rbac/matchers_test.cc
index 848f7bcc4a3d..a447776f28cd 100644
--- a/test/extensions/filters/common/rbac/matchers_test.cc
+++ b/test/extensions/filters/common/rbac/matchers_test.cc
@@ -1,8 +1,8 @@
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
-#include "envoy/type/matcher/metadata.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/type/matcher/v3alpha/metadata.pb.h"
 
 #include "common/network/utility.h"
 
@@ -25,11 +25,11 @@ namespace Common {
 namespace RBAC {
 namespace {
 
-void checkMatcher(
-    const RBAC::Matcher& matcher, bool expected,
-    const Envoy::Network::Connection& connection = Envoy::Network::MockConnection(),
-    const Envoy::Http::HeaderMap& headers = Envoy::Http::HeaderMapImpl(),
-    const envoy::api::v2::core::Metadata& metadata = envoy::api::v2::core::Metadata()) {
+void checkMatcher(const RBAC::Matcher& matcher, bool expected,
+                  const Envoy::Network::Connection& connection = Envoy::Network::MockConnection(),
+                  const Envoy::Http::HeaderMap& headers = Envoy::Http::HeaderMapImpl(),
+                  const envoy::config::core::v3alpha::Metadata& metadata =
+                      envoy::config::core::v3alpha::Metadata()) {
   NiceMock<StreamInfo::MockStreamInfo> info;
   EXPECT_CALL(Const(info), dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
   EXPECT_EQ(expected, matcher.matches(connection, headers, info));
@@ -38,8 +38,8 @@ void checkMatcher(
 TEST(AlwaysMatcher, AlwaysMatches) { checkMatcher(RBAC::AlwaysMatcher(), true); }
 
 TEST(AndMatcher, Permission_Set) {
-  envoy::config::rbac::v2::Permission_Set set;
-  envoy::config::rbac::v2::Permission* perm = set.add_rules();
+  envoy::config::rbac::v3alpha::Permission::Set set;
+  envoy::config::rbac::v3alpha::Permission* perm = set.add_rules();
   perm->set_any(true);
 
   checkMatcher(RBAC::AndMatcher(set), true);
@@ -61,8 +61,8 @@ TEST(AndMatcher, Permission_Set) {
 }
 
 TEST(AndMatcher, Principal_Set) {
-  envoy::config::rbac::v2::Principal_Set set;
-  envoy::config::rbac::v2::Principal* principal = set.add_ids();
+  envoy::config::rbac::v3alpha::Principal::Set set;
+  envoy::config::rbac::v3alpha::Principal* principal = set.add_ids();
   principal->set_any(true);
 
   checkMatcher(RBAC::AndMatcher(set), true);
@@ -86,8 +86,8 @@ TEST(AndMatcher, Principal_Set) {
 }
 
 TEST(OrMatcher, Permission_Set) {
-  envoy::config::rbac::v2::Permission_Set set;
-  envoy::config::rbac::v2::Permission* perm = set.add_rules();
+  envoy::config::rbac::v3alpha::Permission::Set set;
+  envoy::config::rbac::v3alpha::Permission* perm = set.add_rules();
   perm->set_destination_port(123);
 
   Envoy::Network::MockConnection conn;
@@ -104,8 +104,8 @@ TEST(OrMatcher, Permission_Set) {
 }
 
 TEST(OrMatcher, Principal_Set) {
-  envoy::config::rbac::v2::Principal_Set set;
-  envoy::config::rbac::v2::Principal* id = set.add_ids();
+  envoy::config::rbac::v3alpha::Principal::Set set;
+  envoy::config::rbac::v3alpha::Principal* id = set.add_ids();
   auto* cidr = id->mutable_source_ip();
   cidr->set_address_prefix("1.2.3.0");
   cidr->mutable_prefix_len()->set_value(24);
@@ -124,21 +124,21 @@ TEST(OrMatcher, Principal_Set) {
 }
 
 TEST(NotMatcher, Permission) {
-  envoy::config::rbac::v2::Permission perm;
+  envoy::config::rbac::v3alpha::Permission perm;
   perm.set_any(true);
 
   checkMatcher(RBAC::NotMatcher(perm), false, Envoy::Network::MockConnection());
 }
 
 TEST(NotMatcher, Principal) {
-  envoy::config::rbac::v2::Principal principal;
+  envoy::config::rbac::v3alpha::Principal principal;
   principal.set_any(true);
 
   checkMatcher(RBAC::NotMatcher(principal), false, Envoy::Network::MockConnection());
 }
 
 TEST(HeaderMatcher, HeaderMatcher) {
-  envoy::api::v2::route::HeaderMatcher config;
+  envoy::config::route::v3alpha::HeaderMatcher config;
   config.set_name("foo");
   config.set_exact_match("bar");
 
@@ -167,11 +167,11 @@ TEST(IPMatcher, IPMatcher) {
   EXPECT_CALL(conn, localAddress()).Times(2).WillRepeatedly(ReturnRef(local));
   EXPECT_CALL(conn, remoteAddress()).Times(2).WillRepeatedly(ReturnRef(remote));
 
-  envoy::api::v2::core::CidrRange local_cidr;
+  envoy::config::core::v3alpha::CidrRange local_cidr;
   local_cidr.set_address_prefix("1.2.3.0");
   local_cidr.mutable_prefix_len()->set_value(24);
 
-  envoy::api::v2::core::CidrRange remote_cidr;
+  envoy::config::core::v3alpha::CidrRange remote_cidr;
   remote_cidr.set_address_prefix("4.5.6.7");
   remote_cidr.mutable_prefix_len()->set_value(32);
 
@@ -208,7 +208,7 @@ TEST(AuthenticatedMatcher, uriSanPeerCertificate) {
   EXPECT_CALL(Const(conn), ssl()).WillRepeatedly(Return(ssl));
 
   // We should check if any URI SAN matches.
-  envoy::config::rbac::v2::Principal_Authenticated auth;
+  envoy::config::rbac::v3alpha::Principal::Authenticated auth;
   auth.mutable_principal_name()->set_exact("foo");
   checkMatcher(AuthenticatedMatcher(auth), true, conn);
 
@@ -235,7 +235,7 @@ TEST(AuthenticatedMatcher, dnsSanPeerCertificate) {
   EXPECT_CALL(*ssl, subjectPeerCertificate()).WillRepeatedly(ReturnRef("subject"));
 
   // We should get check if any DNS SAN matches as URI SAN is not available.
-  envoy::config::rbac::v2::Principal_Authenticated auth;
+  envoy::config::rbac::v3alpha::Principal::Authenticated auth;
   auth.mutable_principal_name()->set_exact("foo");
   checkMatcher(AuthenticatedMatcher(auth), true, conn);
 
@@ -257,7 +257,7 @@ TEST(AuthenticatedMatcher, subjectPeerCertificate) {
   EXPECT_CALL(*ssl, subjectPeerCertificate()).WillRepeatedly(ReturnRef(peer_subject));
   EXPECT_CALL(Const(conn), ssl()).WillRepeatedly(Return(ssl));
 
-  envoy::config::rbac::v2::Principal_Authenticated auth;
+  envoy::config::rbac::v3alpha::Principal::Authenticated auth;
   auth.mutable_principal_name()->set_exact("bar");
   checkMatcher(AuthenticatedMatcher(auth), true, conn);
 
@@ -272,10 +272,10 @@ TEST(AuthenticatedMatcher, AnySSLSubject) {
   EXPECT_CALL(*ssl, uriSanPeerCertificate()).WillRepeatedly(Return(sans));
   EXPECT_CALL(Const(conn), ssl()).WillRepeatedly(Return(ssl));
 
-  envoy::config::rbac::v2::Principal_Authenticated auth;
+  envoy::config::rbac::v3alpha::Principal::Authenticated auth;
   checkMatcher(AuthenticatedMatcher(auth), true, conn);
 
-  auth.mutable_principal_name()->set_regex(".*");
+  auth.mutable_principal_name()->set_hidden_envoy_deprecated_regex(".*");
   checkMatcher(AuthenticatedMatcher(auth), true, conn);
 }
 
@@ -290,13 +290,13 @@ TEST(MetadataMatcher, MetadataMatcher) {
   Envoy::Http::HeaderMapImpl header;
 
   auto label = MessageUtil::keyValueStruct("label", "prod");
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   metadata.mutable_filter_metadata()->insert(
       Protobuf::MapPair<std::string, ProtobufWkt::Struct>("other", label));
   metadata.mutable_filter_metadata()->insert(
       Protobuf::MapPair<std::string, ProtobufWkt::Struct>("rbac", label));
 
-  envoy::type::matcher::MetadataMatcher matcher;
+  envoy::type::matcher::v3alpha::MetadataMatcher matcher;
   matcher.set_filter("rbac");
   matcher.add_path()->set_key("label");
 
@@ -307,7 +307,7 @@ TEST(MetadataMatcher, MetadataMatcher) {
 }
 
 TEST(PolicyMatcher, PolicyMatcher) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_destination_port(123);
   policy.add_permissions()->set_destination_port(456);
   policy.add_principals()->mutable_authenticated()->mutable_principal_name()->set_exact("foo");
diff --git a/test/extensions/filters/common/rbac/mocks.h b/test/extensions/filters/common/rbac/mocks.h
index 78bafc4a3e18..b6769180dd69 100644
--- a/test/extensions/filters/common/rbac/mocks.h
+++ b/test/extensions/filters/common/rbac/mocks.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
 
 #include "extensions/filters/common/rbac/engine_impl.h"
 
@@ -14,7 +14,7 @@ namespace RBAC {
 
 class MockEngine : public RoleBasedAccessControlEngineImpl {
 public:
-  MockEngine(const envoy::config::rbac::v2::RBAC& rules)
+  MockEngine(const envoy::config::rbac::v3alpha::RBAC& rules)
       : RoleBasedAccessControlEngineImpl(rules){};
 
   MOCK_CONST_METHOD4(allowed,
diff --git a/test/extensions/filters/http/adaptive_concurrency/BUILD b/test/extensions/filters/http/adaptive_concurrency/BUILD
index 97a4bdebc5e3..f94bf2b905a6 100644
--- a/test/extensions/filters/http/adaptive_concurrency/BUILD
+++ b/test/extensions/filters/http/adaptive_concurrency/BUILD
@@ -23,7 +23,7 @@ envoy_extension_cc_test(
         "//test/mocks/http:http_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/adaptive_concurrency/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/adaptive_concurrency/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc b/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc
index 3ed4b4fb30a1..655e1ff77b3a 100644
--- a/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc
+++ b/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc
@@ -1,7 +1,7 @@
 #include <chrono>
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.validate.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.validate.h"
 
 #include "extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h"
 #include "extensions/filters/http/adaptive_concurrency/concurrency_controller/concurrency_controller.h"
@@ -39,7 +39,8 @@ class AdaptiveConcurrencyFilterTest : public testing::Test {
   AdaptiveConcurrencyFilterTest() = default;
 
   void SetUp() override {
-    const envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency config;
+    const envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency
+        config;
     auto config_ptr = std::make_shared<AdaptiveConcurrencyFilterConfig>(
         config, runtime_, "testprefix.", stats_, time_system_);
 
@@ -50,9 +51,9 @@ class AdaptiveConcurrencyFilterTest : public testing::Test {
 
   void TearDown() override { filter_.reset(); }
 
-  envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency
+  envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency
   makeConfig(const std::string& yaml_config) {
-    envoy::config::filter::http::adaptive_concurrency::v2alpha::AdaptiveConcurrency proto;
+    envoy::extensions::filters::http::adaptive_concurrency::v3alpha::AdaptiveConcurrency proto;
     TestUtility::loadFromYamlAndValidate(yaml_config, proto);
     return proto;
   }
diff --git a/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD b/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD
index 2b87f392b5b6..30882ddf26c6 100644
--- a/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD
+++ b/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/BUILD
@@ -23,6 +23,6 @@ envoy_extension_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/adaptive_concurrency/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/adaptive_concurrency/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller_test.cc b/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller_test.cc
index f7b7fd11fc44..ce52f330b101 100644
--- a/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller_test.cc
+++ b/test/extensions/filters/http/adaptive_concurrency/concurrency_controller/gradient_controller_test.cc
@@ -1,8 +1,8 @@
 #include <chrono>
 #include <iostream>
 
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.h"
-#include "envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.pb.validate.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.h"
+#include "envoy/extensions/filters/http/adaptive_concurrency/v3alpha/adaptive_concurrency.pb.validate.h"
 
 #include "common/stats/isolated_store_impl.h"
 
@@ -33,7 +33,7 @@ namespace {
 
 GradientControllerConfig makeConfig(const std::string& yaml_config,
                                     NiceMock<Runtime::MockLoader>& runtime) {
-  envoy::config::filter::http::adaptive_concurrency::v2alpha::GradientControllerConfig proto;
+  envoy::extensions::filters::http::adaptive_concurrency::v3alpha::GradientControllerConfig proto;
   TestUtility::loadFromYamlAndValidate(yaml_config, proto);
   return GradientControllerConfig{proto, runtime};
 }
diff --git a/test/extensions/filters/http/buffer/BUILD b/test/extensions/filters/http/buffer/BUILD
index 546b15b392eb..07fbbb27d3c0 100644
--- a/test/extensions/filters/http/buffer/BUILD
+++ b/test/extensions/filters/http/buffer/BUILD
@@ -28,7 +28,7 @@ envoy_extension_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:test_runtime_lib",
-        "@envoy_api//envoy/config/filter/http/buffer/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/buffer/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -40,8 +40,8 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/buffer:config",
         "//test/config:utility_lib",
         "//test/integration:http_protocol_integration_lib",
-        "@envoy_api//envoy/config/filter/http/buffer/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/buffer/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -53,6 +53,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/buffer:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/buffer/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/buffer/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc b/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc
index bf6720bc3649..fbb0eaf84962 100644
--- a/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc
+++ b/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -116,19 +116,18 @@ TEST_P(BufferIntegrationTest, RouterRequestBufferLimitExceeded) {
 }
 
 ConfigHelper::HttpModifierFunction overrideConfig(const std::string& json_config) {
-  envoy::config::filter::http::buffer::v2::BufferPerRoute buffer_per_route;
+  envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute buffer_per_route;
   TestUtility::loadFromJson(json_config, buffer_per_route);
 
-  return
-      [buffer_per_route](
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& cfg) {
-        auto* config = cfg.mutable_route_config()
-                           ->mutable_virtual_hosts()
-                           ->Mutable(0)
-                           ->mutable_typed_per_filter_config();
+  return [buffer_per_route](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                                HttpConnectionManager& cfg) {
+    auto* config = cfg.mutable_route_config()
+                       ->mutable_virtual_hosts()
+                       ->Mutable(0)
+                       ->mutable_typed_per_filter_config();
 
-        (*config)["envoy.buffer"].PackFrom(buffer_per_route);
-      };
+    (*config)["envoy.buffer"].PackFrom(buffer_per_route);
+  };
 }
 
 TEST_P(BufferIntegrationTest, RouteDisabled) {
diff --git a/test/extensions/filters/http/buffer/buffer_filter_test.cc b/test/extensions/filters/http/buffer/buffer_filter_test.cc
index 37cd45324700..969eb01a8285 100644
--- a/test/extensions/filters/http/buffer/buffer_filter_test.cc
+++ b/test/extensions/filters/http/buffer/buffer_filter_test.cc
@@ -1,8 +1,8 @@
 #include <chrono>
 #include <memory>
 
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
 
 #include "common/http/header_map_impl.h"
 #include "common/runtime/runtime_impl.h"
@@ -30,7 +30,7 @@ namespace BufferFilter {
 class BufferFilterTest : public testing::Test {
 public:
   BufferFilterConfigSharedPtr setupConfig() {
-    envoy::config::filter::http::buffer::v2::Buffer proto_config;
+    envoy::extensions::filters::http::buffer::v3alpha::Buffer proto_config;
     proto_config.mutable_max_request_bytes()->set_value(1024 * 1024);
     return std::make_shared<BufferFilterConfig>(proto_config);
   }
@@ -152,10 +152,10 @@ TEST_F(BufferFilterTest, ContentLengthPopulationRuntimeGuard) {
 }
 
 TEST_F(BufferFilterTest, RouteConfigOverride) {
-  envoy::config::filter::http::buffer::v2::BufferPerRoute route_cfg;
+  envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute route_cfg;
   auto* buf = route_cfg.mutable_buffer();
   buf->mutable_max_request_bytes()->set_value(123);
-  envoy::config::filter::http::buffer::v2::BufferPerRoute vhost_cfg;
+  envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute vhost_cfg;
   vhost_cfg.set_disabled(true);
   BufferFilterSettings route_settings(route_cfg);
   BufferFilterSettings vhost_settings(vhost_cfg);
@@ -170,7 +170,7 @@ TEST_F(BufferFilterTest, RouteConfigOverride) {
 }
 
 TEST_F(BufferFilterTest, VHostConfigOverride) {
-  envoy::config::filter::http::buffer::v2::BufferPerRoute vhost_cfg;
+  envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute vhost_cfg;
   auto* buf = vhost_cfg.mutable_buffer();
   buf->mutable_max_request_bytes()->set_value(789);
   BufferFilterSettings vhost_settings(vhost_cfg);
@@ -184,7 +184,7 @@ TEST_F(BufferFilterTest, VHostConfigOverride) {
 }
 
 TEST_F(BufferFilterTest, RouteDisabledConfigOverride) {
-  envoy::config::filter::http::buffer::v2::BufferPerRoute vhost_cfg;
+  envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute vhost_cfg;
   vhost_cfg.set_disabled(true);
   BufferFilterSettings vhost_settings(vhost_cfg);
   routeLocalConfig(nullptr, &vhost_settings);
diff --git a/test/extensions/filters/http/buffer/config_test.cc b/test/extensions/filters/http/buffer/config_test.cc
index 64ee63ca54dc..5837cc7f4e54 100644
--- a/test/extensions/filters/http/buffer/config_test.cc
+++ b/test/extensions/filters/http/buffer/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
-#include "envoy/config/filter/http/buffer/v2/buffer.pb.validate.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.h"
+#include "envoy/extensions/filters/http/buffer/v3alpha/buffer.pb.validate.h"
 
 #include "extensions/filters/http/buffer/buffer_filter.h"
 #include "extensions/filters/http/buffer/config.h"
@@ -23,7 +23,7 @@ TEST(BufferFilterFactoryTest, BufferFilterCorrectYaml) {
   max_request_bytes: 1028
   )EOF";
 
-  envoy::config::filter::http::buffer::v2::Buffer proto_config;
+  envoy::extensions::filters::http::buffer::v3alpha::Buffer proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   BufferFilterFactory factory;
@@ -34,7 +34,7 @@ TEST(BufferFilterFactoryTest, BufferFilterCorrectYaml) {
 }
 
 TEST(BufferFilterFactoryTest, BufferFilterCorrectProto) {
-  envoy::config::filter::http::buffer::v2::Buffer config;
+  envoy::extensions::filters::http::buffer::v3alpha::Buffer config;
   config.mutable_max_request_bytes()->set_value(1028);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -47,8 +47,8 @@ TEST(BufferFilterFactoryTest, BufferFilterCorrectProto) {
 
 TEST(BufferFilterFactoryTest, BufferFilterEmptyProto) {
   BufferFilterFactory factory;
-  envoy::config::filter::http::buffer::v2::Buffer config =
-      *dynamic_cast<envoy::config::filter::http::buffer::v2::Buffer*>(
+  envoy::extensions::filters::http::buffer::v3alpha::Buffer config =
+      *dynamic_cast<envoy::extensions::filters::http::buffer::v3alpha::Buffer*>(
           factory.createEmptyConfigProto().get());
 
   config.mutable_max_request_bytes()->set_value(1028);
@@ -62,8 +62,8 @@ TEST(BufferFilterFactoryTest, BufferFilterEmptyProto) {
 
 TEST(BufferFilterFactoryTest, BufferFilterNoMaxRequestBytes) {
   BufferFilterFactory factory;
-  envoy::config::filter::http::buffer::v2::Buffer config =
-      *dynamic_cast<envoy::config::filter::http::buffer::v2::Buffer*>(
+  envoy::extensions::filters::http::buffer::v3alpha::Buffer config =
+      *dynamic_cast<envoy::extensions::filters::http::buffer::v3alpha::Buffer*>(
           factory.createEmptyConfigProto().get());
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -74,8 +74,8 @@ TEST(BufferFilterFactoryTest, BufferFilterNoMaxRequestBytes) {
 TEST(BufferFilterFactoryTest, BufferFilterEmptyRouteProto) {
   BufferFilterFactory factory;
   EXPECT_NO_THROW({
-    envoy::config::filter::http::buffer::v2::BufferPerRoute* config =
-        dynamic_cast<envoy::config::filter::http::buffer::v2::BufferPerRoute*>(
+    envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute* config =
+        dynamic_cast<envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute*>(
             factory.createEmptyRouteConfigProto().get());
     EXPECT_NE(nullptr, config);
   });
@@ -88,8 +88,8 @@ TEST(BufferFilterFactoryTest, BufferFilterRouteSpecificConfig) {
   ProtobufTypes::MessagePtr proto_config = factory.createEmptyRouteConfigProto();
   EXPECT_TRUE(proto_config.get());
 
-  auto& cfg =
-      dynamic_cast<envoy::config::filter::http::buffer::v2::BufferPerRoute&>(*proto_config.get());
+  auto& cfg = dynamic_cast<envoy::extensions::filters::http::buffer::v3alpha::BufferPerRoute&>(
+      *proto_config.get());
   cfg.set_disabled(true);
 
   Router::RouteSpecificFilterConfigConstSharedPtr route_config =
diff --git a/test/extensions/filters/http/common/BUILD b/test/extensions/filters/http/common/BUILD
index cd1ac2368823..78005434e5f8 100644
--- a/test/extensions/filters/http/common/BUILD
+++ b/test/extensions/filters/http/common/BUILD
@@ -23,7 +23,7 @@ envoy_cc_test_library(
     deps = [
         "//source/extensions/filters/http/common:jwks_fetcher_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -38,6 +38,6 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/common:mock_lib",
         "//test/mocks/http:http_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/common/jwks_fetcher_test.cc b/test/extensions/filters/http/common/jwks_fetcher_test.cc
index e449604325d6..15cf659d8130 100644
--- a/test/extensions/filters/http/common/jwks_fetcher_test.cc
+++ b/test/extensions/filters/http/common/jwks_fetcher_test.cc
@@ -1,7 +1,7 @@
 #include <chrono>
 #include <thread>
 
-#include "envoy/api/v2/core/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
 
 #include "common/http/message_impl.h"
 #include "common/protobuf/utility.h"
@@ -12,7 +12,7 @@
 #include "test/mocks/http/mocks.h"
 #include "test/test_common/utility.h"
 
-using ::envoy::api::v2::core::HttpUri;
+using envoy::config::core::v3alpha::HttpUri;
 
 namespace Envoy {
 namespace Extensions {
diff --git a/test/extensions/filters/http/common/mock.h b/test/extensions/filters/http/common/mock.h
index 57a01a919262..51882033b46d 100644
--- a/test/extensions/filters/http/common/mock.h
+++ b/test/extensions/filters/http/common/mock.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/http_uri.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
 
 #include "extensions/filters/http/common/jwks_fetcher.h"
 
@@ -16,8 +16,8 @@ namespace Common {
 class MockJwksFetcher : public JwksFetcher {
 public:
   MOCK_METHOD0(cancel, void());
-  MOCK_METHOD3(fetch, void(const ::envoy::api::v2::core::HttpUri& uri, Tracing::Span& parent_span,
-                           JwksReceiver& receiver));
+  MOCK_METHOD3(fetch, void(const envoy::config::core::v3alpha::HttpUri& uri,
+                           Tracing::Span& parent_span, JwksReceiver& receiver));
 };
 
 // A mock HTTP upstream.
diff --git a/test/extensions/filters/http/cors/BUILD b/test/extensions/filters/http/cors/BUILD
index af89b52cca87..a767bb73c431 100644
--- a/test/extensions/filters/http/cors/BUILD
+++ b/test/extensions/filters/http/cors/BUILD
@@ -21,7 +21,7 @@ envoy_extension_cc_test(
         "//test/mocks/buffer:buffer_mocks",
         "//test/mocks/http:http_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -37,6 +37,6 @@ envoy_extension_cc_test(
         "//test/mocks/http:http_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/cors/cors_filter_integration_test.cc b/test/extensions/filters/http/cors/cors_filter_integration_test.cc
index a1132270586e..e7b1c7f96e20 100644
--- a/test/extensions/filters/http/cors/cors_filter_integration_test.cc
+++ b/test/extensions/filters/http/cors/cors_filter_integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/http_integration.h"
 #include "test/mocks/http/mocks.h"
@@ -16,13 +16,13 @@ class CorsFilterIntegrationTest : public testing::TestWithParam<Network::Address
   void initialize() override {
     config_helper_.addFilter("name: envoy.cors");
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-            -> void {
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) -> void {
           auto* route_config = hcm.mutable_route_config();
           auto* virtual_host = route_config->mutable_virtual_hosts(0);
           {
             auto* cors = virtual_host->mutable_cors();
-            cors->add_allow_origin("*");
+            cors->add_hidden_envoy_deprecated_allow_origin("*");
             cors->set_allow_headers("content-type,x-grpc-web");
             cors->set_allow_methods("GET,POST");
           }
@@ -48,8 +48,8 @@ class CorsFilterIntegrationTest : public testing::TestWithParam<Network::Address
             route->mutable_match()->set_prefix("/cors-route-config");
             route->mutable_route()->set_cluster("cluster_0");
             auto* cors = route->mutable_route()->mutable_cors();
-            cors->add_allow_origin("test-origin-1");
-            cors->add_allow_origin("test-host-2");
+            cors->add_hidden_envoy_deprecated_allow_origin("test-origin-1");
+            cors->add_hidden_envoy_deprecated_allow_origin("test-host-2");
             cors->set_allow_headers("content-type");
             cors->set_allow_methods("POST");
             cors->set_max_age("100");
@@ -62,7 +62,7 @@ class CorsFilterIntegrationTest : public testing::TestWithParam<Network::Address
             route->mutable_match()->set_prefix("/cors-credentials-allowed");
             route->mutable_route()->set_cluster("cluster_0");
             auto* cors = route->mutable_route()->mutable_cors();
-            cors->add_allow_origin("test-origin-1");
+            cors->add_hidden_envoy_deprecated_allow_origin("test-origin-1");
             cors->mutable_allow_credentials()->set_value(true);
           }
 
@@ -82,7 +82,7 @@ class CorsFilterIntegrationTest : public testing::TestWithParam<Network::Address
             route->mutable_match()->set_prefix("/cors-expose-headers");
             route->mutable_route()->set_cluster("cluster_0");
             auto* cors = route->mutable_route()->mutable_cors();
-            cors->add_allow_origin("test-origin-1");
+            cors->add_hidden_envoy_deprecated_allow_origin("test-origin-1");
             cors->set_expose_headers("custom-header-1,custom-header-2");
           }
         });
@@ -198,16 +198,17 @@ TEST_P(CorsFilterIntegrationTest, DEPRECATED_FEATURE_TEST(TestCorsDisabled)) {
 }
 
 TEST_P(CorsFilterIntegrationTest, DEPRECATED_FEATURE_TEST(TestLegacyCorsDisabled)) {
-  config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
-        auto* route_config = hcm.mutable_route_config();
-        auto* virtual_host = route_config->mutable_virtual_hosts(0);
-        auto* route = virtual_host->add_routes();
-        route->mutable_match()->set_prefix("/legacy-no-cors");
-        route->mutable_route()->set_cluster("cluster_0");
-        route->mutable_route()->mutable_cors()->mutable_enabled()->set_value(false);
-      });
+  config_helper_.addConfigModifier([&](envoy::extensions::filters::network::
+                                           http_connection_manager::v3alpha::HttpConnectionManager&
+                                               hcm) -> void {
+    auto* route_config = hcm.mutable_route_config();
+    auto* virtual_host = route_config->mutable_virtual_hosts(0);
+    auto* route = virtual_host->add_routes();
+    route->mutable_match()->set_prefix("/legacy-no-cors");
+    route->mutable_route()->set_cluster("cluster_0");
+    route->mutable_route()->mutable_cors()->mutable_hidden_envoy_deprecated_enabled()->set_value(
+        false);
+  });
   testNormalRequest(
       Http::TestHeaderMapImpl{
           {":method", "OPTIONS"},
diff --git a/test/extensions/filters/http/cors/cors_filter_test.cc b/test/extensions/filters/http/cors/cors_filter_test.cc
index a5663b72a23f..8fb64bbb344e 100644
--- a/test/extensions/filters/http/cors/cors_filter_test.cc
+++ b/test/extensions/filters/http/cors/cors_filter_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/type/matcher/string.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/common/matchers.h"
 #include "common/http/header_map_impl.h"
@@ -24,14 +24,14 @@ namespace Cors {
 namespace {
 
 Matchers::StringMatcherPtr makeExactStringMatcher(const std::string& exact_match) {
-  envoy::type::matcher::StringMatcher config;
+  envoy::type::matcher::v3alpha::StringMatcher config;
   config.set_exact(exact_match);
   return std::make_unique<Matchers::StringMatcherImpl>(config);
 }
 
 Matchers::StringMatcherPtr makeStdRegexStringMatcher(const std::string& regex) {
-  envoy::type::matcher::StringMatcher config;
-  config.set_regex(regex);
+  envoy::type::matcher::v3alpha::StringMatcher config;
+  config.set_hidden_envoy_deprecated_regex(regex);
   return std::make_unique<Matchers::StringMatcherImpl>(config);
 }
 
diff --git a/test/extensions/filters/http/csrf/BUILD b/test/extensions/filters/http/csrf/BUILD
index b58f0443c0d6..210ad5af73c1 100644
--- a/test/extensions/filters/http/csrf/BUILD
+++ b/test/extensions/filters/http/csrf/BUILD
@@ -21,8 +21,8 @@ envoy_extension_cc_test(
         "//test/mocks/buffer:buffer_mocks",
         "//test/mocks/http:http_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/filter/http/csrf/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/csrf/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/http/csrf/csrf_filter_test.cc b/test/extensions/filters/http/csrf/csrf_filter_test.cc
index b5e988291359..3ef9ae0ab1f2 100644
--- a/test/extensions/filters/http/csrf/csrf_filter_test.cc
+++ b/test/extensions/filters/http/csrf/csrf_filter_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/csrf/v2/csrf.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/http/csrf/v3alpha/csrf.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/http/header_map_impl.h"
 
@@ -25,24 +25,24 @@ namespace Csrf {
 class CsrfFilterTest : public testing::Test {
 public:
   CsrfFilterConfigSharedPtr setupConfig() {
-    envoy::config::filter::http::csrf::v2::CsrfPolicy policy;
+    envoy::extensions::filters::http::csrf::v3alpha::CsrfPolicy policy;
     const auto& filter_enabled = policy.mutable_filter_enabled();
     filter_enabled->mutable_default_value()->set_numerator(100);
     filter_enabled->mutable_default_value()->set_denominator(
-        envoy::type::FractionalPercent::HUNDRED);
+        envoy::type::v3alpha::FractionalPercent::HUNDRED);
     filter_enabled->set_runtime_key("csrf.enabled");
 
     const auto& shadow_enabled = policy.mutable_shadow_enabled();
     shadow_enabled->mutable_default_value()->set_numerator(0);
     shadow_enabled->mutable_default_value()->set_denominator(
-        envoy::type::FractionalPercent::HUNDRED);
+        envoy::type::v3alpha::FractionalPercent::HUNDRED);
     shadow_enabled->set_runtime_key("csrf.shadow_enabled");
 
     const auto& add_exact_origin = policy.mutable_additional_origins()->Add();
     add_exact_origin->set_exact("additionalhost");
 
     const auto& add_regex_origin = policy.mutable_additional_origins()->Add();
-    add_regex_origin->set_regex(R"(www\-[0-9]\.allow\.com)");
+    add_regex_origin->set_hidden_envoy_deprecated_regex(R"(www\-[0-9]\.allow\.com)");
 
     return std::make_shared<CsrfFilterConfig>(policy, "test", stats_, runtime_);
   }
@@ -70,16 +70,16 @@ class CsrfFilterTest : public testing::Test {
   }
 
   void setFilterEnabled(bool enabled) {
-    ON_CALL(
-        runtime_.snapshot_,
-        featureEnabled("csrf.enabled", testing::Matcher<const envoy::type::FractionalPercent&>(_)))
+    ON_CALL(runtime_.snapshot_,
+            featureEnabled("csrf.enabled",
+                           testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
         .WillByDefault(Return(enabled));
   }
 
   void setShadowEnabled(bool enabled) {
     ON_CALL(runtime_.snapshot_,
             featureEnabled("csrf.shadow_enabled",
-                           testing::Matcher<const envoy::type::FractionalPercent&>(_)))
+                           testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
         .WillByDefault(Return(enabled));
   }
 
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/BUILD b/test/extensions/filters/http/dynamic_forward_proxy/BUILD
index 6c205015c4f7..c168e2063148 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/BUILD
+++ b/test/extensions/filters/http/dynamic_forward_proxy/BUILD
@@ -21,7 +21,7 @@ envoy_extension_cc_test(
         "//test/extensions/common/dynamic_forward_proxy:mocks",
         "//test/mocks/http:http_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/filter/http/dynamic_forward_proxy/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -36,9 +36,9 @@ envoy_extension_cc_test(
         "//source/extensions/clusters/dynamic_forward_proxy:cluster",
         "//source/extensions/filters/http/dynamic_forward_proxy:config",
         "//test/integration:http_integration_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc
index 9c26c95168bd..3a2db9274472 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc
+++ b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "extensions/transport_sockets/tls/context_config_impl.h"
 #include "extensions/transport_sockets/tls/ssl_socket.h"
@@ -44,7 +44,8 @@ name: envoy.filters.http.dynamic_forward_proxy
                                            ipVersionToDnsFamily(GetParam()), max_hosts);
     config_helper_.addFilter(filter);
 
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       // Switch predefined cluster_0 to CDS filesystem sourcing.
       bootstrap.mutable_dynamic_resources()->mutable_cds_config()->set_path(cds_helper_.cds_path());
       bootstrap.mutable_static_resources()->clear_clusters();
@@ -52,17 +53,19 @@ name: envoy.filters.http.dynamic_forward_proxy
 
     // Set validate_clusters to false to allow us to reference a CDS cluster.
     config_helper_.addConfigModifier(
-        [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-               hcm) { hcm.mutable_route_config()->mutable_validate_clusters()->set_value(false); });
+        [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+               HttpConnectionManager& hcm) {
+          hcm.mutable_route_config()->mutable_validate_clusters()->set_value(false);
+        });
 
     // Setup the initial CDS cluster.
     cluster_.mutable_connect_timeout()->CopyFrom(
         Protobuf::util::TimeUtil::MillisecondsToDuration(100));
     cluster_.set_name("cluster_0");
-    cluster_.set_lb_policy(envoy::api::v2::Cluster::CLUSTER_PROVIDED);
+    cluster_.set_lb_policy(envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED);
 
     if (upstream_tls_) {
-      envoy::api::v2::auth::UpstreamTlsContext tls_context;
+      envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
       auto* validation_context =
           tls_context.mutable_common_tls_context()->mutable_validation_context();
       validation_context->mutable_trusted_ca()->set_filename(
@@ -103,7 +106,7 @@ name: envoy.clusters.dynamic_forward_proxy
 
   // TODO(mattklein123): This logic is duplicated in various places. Cleanup in a follow up.
   Network::TransportSocketFactoryPtr createUpstreamSslContext() {
-    envoy::api::v2::auth::DownstreamTlsContext tls_context;
+    envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
     auto* common_tls_context = tls_context.mutable_common_tls_context();
     auto* tls_cert = common_tls_context->add_tls_certificates();
     tls_cert->mutable_certificate_chain()->set_filename(TestEnvironment::runfilesPath(
@@ -122,7 +125,7 @@ name: envoy.clusters.dynamic_forward_proxy
   bool upstream_tls_{};
   std::string upstream_cert_name_{"upstreamlocalhost"};
   CdsHelper cds_helper_;
-  envoy::api::v2::Cluster cluster_;
+  envoy::config::cluster::v3alpha::Cluster cluster_;
 };
 
 INSTANTIATE_TEST_SUITE_P(IpVersions, ProxyFilterIntegrationTest,
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
index 06d72300802a..86481ae63025 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
+++ b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.pb.h"
+#include "envoy/extensions/filters/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.pb.h"
 
 #include "extensions/filters/http/dynamic_forward_proxy/proxy_filter.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -32,7 +32,7 @@ class ProxyFilterTest : public testing::Test,
     cm_.thread_local_cluster_.cluster_.info_->transport_socket_matcher_.reset(
         transport_socket_match_);
 
-    envoy::config::filter::http::dynamic_forward_proxy::v2alpha::FilterConfig proto_config;
+    envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::FilterConfig proto_config;
     EXPECT_CALL(*dns_cache_manager_, getCache(_));
     filter_config_ = std::make_shared<ProxyFilterConfig>(proto_config, *this, cm_);
     filter_ = std::make_unique<ProxyFilter>(filter_config_);
@@ -176,8 +176,8 @@ TEST_F(ProxyFilterTest, NoCluster) {
 TEST_F(ProxyFilterTest, HostRewrite) {
   InSequence s;
 
-  envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig proto_config;
-  proto_config.set_host_rewrite("bar");
+  envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig proto_config;
+  proto_config.set_host_rewrite_literal("bar");
   ProxyPerRouteConfig config(proto_config);
 
   EXPECT_CALL(callbacks_, route());
@@ -200,8 +200,8 @@ TEST_F(ProxyFilterTest, HostRewrite) {
 TEST_F(ProxyFilterTest, HostRewriteViaHeader) {
   InSequence s;
 
-  envoy::config::filter::http::dynamic_forward_proxy::v2alpha::PerRouteConfig proto_config;
-  proto_config.set_auto_host_rewrite_header("x-set-header");
+  envoy::extensions::filters::http::dynamic_forward_proxy::v3alpha::PerRouteConfig proto_config;
+  proto_config.set_host_rewrite_header("x-set-header");
   ProxyPerRouteConfig config(proto_config);
 
   EXPECT_CALL(callbacks_, route());
diff --git a/test/extensions/filters/http/ext_authz/BUILD b/test/extensions/filters/http/ext_authz/BUILD
index b1cb8993f0b4..3e38acb69a5f 100644
--- a/test/extensions/filters/http/ext_authz/BUILD
+++ b/test/extensions/filters/http/ext_authz/BUILD
@@ -34,10 +34,10 @@ envoy_extension_cc_test(
         "//test/mocks/tracing:tracing_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -48,8 +48,8 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/http/ext_authz:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -61,9 +61,9 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/ext_authz:config",
         "//test/integration:http_integration_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/ext_authz/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ext_authz/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/auth/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/ext_authz/config_test.cc b/test/extensions/filters/http/ext_authz/config_test.cc
index be228d0cf968..bcbbf84f1814 100644
--- a/test/extensions/filters/http/ext_authz/config_test.cc
+++ b/test/extensions/filters/http/ext_authz/config_test.cc
@@ -1,5 +1,6 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.validate.h"
 #include "envoy/stats/scope.h"
 
 #include "extensions/filters/http/ext_authz/config.h"
@@ -38,7 +39,7 @@ TEST(HttpExtAuthzConfigTest, CorrectProtoGrpc) {
   EXPECT_CALL(context, runtime()).Times(1);
   EXPECT_CALL(context, scope()).Times(2);
   EXPECT_CALL(context.cluster_manager_.async_client_manager_, factoryForGrpcService(_, _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         return std::make_unique<NiceMock<Grpc::MockAsyncClientFactory>>();
       }));
   Http::FilterFactoryCb cb = factory.createFilterFactoryFromProto(*proto_config, "stats", context);
diff --git a/test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc b/test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc
index 24fdd6594974..ab891c7a3c45 100644
--- a/test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc
+++ b/test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/api/v2/listener/listener.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
 
 #include "extensions/filters/http/well_known_names.h"
 
@@ -30,7 +30,8 @@ class ExtAuthzGrpcIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
   }
 
   void initializeWithDownstreamProtocol(Http::CodecClient::Type downstream_protocol) {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* ext_authz_cluster = bootstrap.mutable_static_resources()->add_clusters();
       ext_authz_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
       ext_authz_cluster->set_name("ext_authz");
@@ -40,7 +41,7 @@ class ExtAuthzGrpcIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
       setGrpcService(*proto_config_.mutable_grpc_service(), "ext_authz",
                      fake_upstreams_.back()->localAddress());
 
-      envoy::api::v2::listener::Filter ext_authz_filter;
+      envoy::config::listener::v3alpha::Filter ext_authz_filter;
       ext_authz_filter.set_name(Extensions::HttpFilters::HttpFilterNames::get().ExtAuthorization);
       ext_authz_filter.mutable_typed_config()->PackFrom(proto_config_);
       config_helper_.addFilter(MessageUtil::getJsonStringFromMessage(ext_authz_filter));
@@ -67,7 +68,7 @@ class ExtAuthzGrpcIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
     RELEASE_ASSERT(result, result.message());
 
     // Check for the validity of the received CheckRequest.
-    envoy::service::auth::v2::CheckRequest check_request;
+    envoy::service::auth::v3alpha::CheckRequest check_request;
     result = ext_authz_request_->waitForGrpcMessage(*dispatcher_, check_request);
     RELEASE_ASSERT(result, result.message());
 
@@ -77,7 +78,7 @@ class ExtAuthzGrpcIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
     EXPECT_EQ("application/grpc",
               ext_authz_request_->headers().ContentType()->value().getStringView());
 
-    envoy::service::auth::v2::CheckRequest expected_check_request;
+    envoy::service::auth::v3alpha::CheckRequest expected_check_request;
     TestUtility::loadFromYaml(expected_check_request_yaml, expected_check_request);
 
     auto* attributes = check_request.mutable_attributes();
@@ -120,7 +121,7 @@ class ExtAuthzGrpcIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
 
   void sendExtAuthzResponse() {
     ext_authz_request_->startGrpcStream();
-    envoy::service::auth::v2::CheckResponse check_response;
+    envoy::service::auth::v3alpha::CheckResponse check_response;
     check_response.mutable_status()->set_code(Grpc::Status::WellKnownGrpcStatus::Ok);
     ext_authz_request_->sendGrpcMessage(check_response);
     ext_authz_request_->finishGrpcStream(Grpc::Status::Ok);
@@ -182,7 +183,7 @@ class ExtAuthzGrpcIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
   Buffer::OwnedImpl request_body_;
   const uint64_t response_size_ = 512;
   const uint64_t max_request_bytes_ = 1024;
-  envoy::config::filter::http::ext_authz::v2::ExtAuthz proto_config_{};
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz proto_config_{};
   const std::string base_filter_config_ = R"EOF(
     with_request_body:
       max_request_bytes: 1024
diff --git a/test/extensions/filters/http/ext_authz/ext_authz_test.cc b/test/extensions/filters/http/ext_authz/ext_authz_test.cc
index fe8f9500bd46..0d6587ceb475 100644
--- a/test/extensions/filters/http/ext_authz/ext_authz_test.cc
+++ b/test/extensions/filters/http/ext_authz/ext_authz_test.cc
@@ -2,12 +2,12 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/http/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.pb.validate.h"
 #include "envoy/http/codes.h"
-#include "envoy/service/auth/v2/external_auth.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/service/auth/v3alpha/external_auth.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/empty_string.h"
@@ -55,7 +55,7 @@ template <class T> class HttpFilterTestBase : public T {
   HttpFilterTestBase() : http_context_(stats_store_.symbolTable()) {}
 
   void initialize(std::string&& yaml) {
-    envoy::config::filter::http::ext_authz::v2::ExtAuthz proto_config{};
+    envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz proto_config{};
     if (!yaml.empty()) {
       TestUtility::loadFromYaml(yaml, proto_config);
     }
@@ -94,7 +94,7 @@ class HttpFilterTest : public HttpFilterTestBase<testing::Test> {
   HttpFilterTest() = default;
 };
 
-using CreateFilterConfigFunc = envoy::config::filter::http::ext_authz::v2::ExtAuthz();
+using CreateFilterConfigFunc = envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz();
 
 class HttpFilterTestParam
     : public HttpFilterTestBase<testing::TestWithParam<CreateFilterConfigFunc*>> {
@@ -103,7 +103,7 @@ class HttpFilterTestParam
 };
 
 template <bool failure_mode_allow_value, bool http_client>
-envoy::config::filter::http::ext_authz::v2::ExtAuthz GetFilterConfig() {
+envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz GetFilterConfig() {
   const std::string http_config = R"EOF(
   http_service:
     server_uri:
@@ -118,7 +118,7 @@ envoy::config::filter::http::ext_authz::v2::ExtAuthz GetFilterConfig() {
       cluster_name: "ext_authz_server"
   )EOF";
 
-  envoy::config::filter::http::ext_authz::v2::ExtAuthz proto_config{};
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz proto_config{};
   TestUtility::loadFromYaml(http_client ? http_config : grpc_config, proto_config);
   proto_config.set_failure_mode_allow(failure_mode_allow_value);
   return proto_config;
@@ -130,7 +130,7 @@ INSTANTIATE_TEST_SUITE_P(ParameterizedFilterConfig, HttpFilterTestParam,
 
 // Test that the per route config is properly merged: more specific keys override previous keys.
 TEST_F(HttpFilterTest, MergeConfig) {
-  envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute settings;
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute settings;
   auto&& extensions = settings.mutable_check_settings()->mutable_context_extensions();
 
   // First config base config with one base value, and one value to be overridden.
@@ -312,11 +312,11 @@ TEST_F(HttpFilterTest, BadConfig) {
     envoy_grpc: {}
   failure_mode_allow: true
   )EOF";
-  envoy::config::filter::http::ext_authz::v2::ExtAuthz proto_config{};
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz proto_config{};
   TestUtility::loadFromYaml(filter_config, proto_config);
   EXPECT_THROW(
-      TestUtility::downcastAndValidate<const envoy::config::filter::http::ext_authz::v2::ExtAuthz&>(
-          proto_config),
+      TestUtility::downcastAndValidate<
+          const envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthz&>(proto_config),
       ProtoValidationException);
 }
 
@@ -808,16 +808,18 @@ TEST_F(HttpFilterTest, MetadataContext) {
       richards: keith
   )EOF";
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   TestUtility::loadFromYaml(yaml, metadata);
   ON_CALL(filter_callbacks_.stream_info_, dynamicMetadata()).WillByDefault(ReturnRef(metadata));
 
   prepareCheck();
 
-  envoy::service::auth::v2::CheckRequest check_request;
+  envoy::service::auth::v3alpha::CheckRequest check_request;
   EXPECT_CALL(*client_, check(_, _, _))
-      .WillOnce(WithArgs<1>(Invoke([&](const envoy::service::auth::v2::CheckRequest& check_param)
-                                       -> void { check_request = check_param; })));
+      .WillOnce(WithArgs<1>(
+          Invoke([&](const envoy::service::auth::v3alpha::CheckRequest& check_param) -> void {
+            check_request = check_param;
+          })));
 
   filter_->decodeHeaders(request_headers_, false);
   Http::MetadataMap metadata_map{{"metadata", "metadata"}};
@@ -858,9 +860,10 @@ TEST_F(HttpFilterTest, FilterDisabled) {
       denominator: HUNDRED
   )EOF");
 
-  ON_CALL(runtime_.snapshot_,
-          featureEnabled("http.ext_authz.enabled",
-                         testing::Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+  ON_CALL(
+      runtime_.snapshot_,
+      featureEnabled("http.ext_authz.enabled",
+                     testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillByDefault(Return(false));
 
   // Make sure check is not called.
@@ -885,8 +888,9 @@ TEST_F(HttpFilterTest, FilterEnabled) {
   prepareCheck();
 
   ON_CALL(runtime_.snapshot_,
-          featureEnabled("http.ext_authz.enabled",
-                         testing::Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+          featureEnabled(
+              "http.ext_authz.enabled",
+              testing::Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillByDefault(Return(true));
 
   // Make sure check is called once.
@@ -903,7 +907,7 @@ TEST_F(HttpFilterTest, FilterEnabled) {
 // Test that context extensions make it into the check request.
 TEST_F(HttpFilterTestParam, ContextExtensions) {
   // Place something in the context extensions on the virtualhost.
-  envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute settingsvhost;
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute settingsvhost;
   (*settingsvhost.mutable_check_settings()->mutable_context_extensions())["key_vhost"] =
       "value_vhost";
   // add a default route value to see it overridden
@@ -916,7 +920,7 @@ TEST_F(HttpFilterTestParam, ContextExtensions) {
       .WillByDefault(Return(&auth_per_vhost));
 
   // Place something in the context extensions on the route.
-  envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute settingsroute;
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute settingsroute;
   (*settingsroute.mutable_check_settings()->mutable_context_extensions())["key_route"] =
       "value_route";
   // Initialize the route's per filter config.
@@ -927,10 +931,12 @@ TEST_F(HttpFilterTestParam, ContextExtensions) {
   prepareCheck();
 
   // Save the check request from the check call.
-  envoy::service::auth::v2::CheckRequest check_request;
+  envoy::service::auth::v3alpha::CheckRequest check_request;
   EXPECT_CALL(*client_, check(_, _, _))
-      .WillOnce(WithArgs<1>(Invoke([&](const envoy::service::auth::v2::CheckRequest& check_param)
-                                       -> void { check_request = check_param; })));
+      .WillOnce(WithArgs<1>(
+          Invoke([&](const envoy::service::auth::v3alpha::CheckRequest& check_param) -> void {
+            check_request = check_param;
+          })));
 
   // Engage the filter so that check is called.
   filter_->decodeHeaders(request_headers_, false);
@@ -944,7 +950,7 @@ TEST_F(HttpFilterTestParam, ContextExtensions) {
 
 // Test that filter can be disabled with route config.
 TEST_F(HttpFilterTestParam, DisabledOnRoute) {
-  envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute settings;
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute settings;
   FilterConfigPerRoute auth_per_route(settings);
 
   prepareCheck();
@@ -1322,7 +1328,7 @@ TEST_F(HttpFilterTestParam, NoCluster) {
   ON_CALL(filter_callbacks_, clusterInfo()).WillByDefault(Return(nullptr));
 
   // Place something in the context extensions on the route.
-  envoy::config::filter::http::ext_authz::v2::ExtAuthzPerRoute settingsroute;
+  envoy::extensions::filters::http::ext_authz::v3alpha::ExtAuthzPerRoute settingsroute;
   (*settingsroute.mutable_check_settings()->mutable_context_extensions())["key_route"] =
       "value_route";
   // Initialize the route's per filter config.
@@ -1333,11 +1339,13 @@ TEST_F(HttpFilterTestParam, NoCluster) {
   prepareCheck();
 
   // Save the check request from the check call.
-  envoy::service::auth::v2::CheckRequest check_request;
+  envoy::service::auth::v3alpha::CheckRequest check_request;
 
   EXPECT_CALL(*client_, check(_, _, _))
-      .WillOnce(WithArgs<1>(Invoke([&](const envoy::service::auth::v2::CheckRequest& check_param)
-                                       -> void { check_request = check_param; })));
+      .WillOnce(WithArgs<1>(
+          Invoke([&](const envoy::service::auth::v3alpha::CheckRequest& check_param) -> void {
+            check_request = check_param;
+          })));
   // Make sure that filter chain is not continued and the call has been invoked.
   EXPECT_EQ(Http::FilterHeadersStatus::StopAllIterationAndWatermark,
             filter_->decodeHeaders(request_headers_, false));
diff --git a/test/extensions/filters/http/fault/BUILD b/test/extensions/filters/http/fault/BUILD
index b2466b0dbd2f..ade68daa6bd0 100644
--- a/test/extensions/filters/http/fault/BUILD
+++ b/test/extensions/filters/http/fault/BUILD
@@ -31,8 +31,8 @@ envoy_extension_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/fault/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/fault/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,8 +44,8 @@ envoy_extension_cc_test(
         ":utility_lib",
         "//source/extensions/filters/http/fault:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/fault/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/fault/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -64,6 +64,6 @@ envoy_cc_test_library(
     hdrs = ["utility.h"],
     deps = [
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/fault/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/fault/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/fault/config_test.cc b/test/extensions/filters/http/fault/config_test.cc
index 87e7c58400a8..ebecdcb8f128 100644
--- a/test/extensions/filters/http/fault/config_test.cc
+++ b/test/extensions/filters/http/fault/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
-#include "envoy/config/filter/http/fault/v2/fault.pb.validate.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "extensions/filters/http/fault/config.h"
 
@@ -20,7 +20,7 @@ namespace {
 
 TEST(FaultFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   fault.mutable_abort();
   EXPECT_THROW(FaultFilterFactory().createFilterFactoryFromProto(fault, "stats", context),
                ProtoValidationException);
@@ -45,10 +45,10 @@ TEST(FaultFilterConfigTest, FaultFilterCorrectJson) {
 }
 
 TEST(FaultFilterConfigTest, FaultFilterCorrectProto) {
-  envoy::config::filter::http::fault::v2::HTTPFault config;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault config;
   config.mutable_delay()->mutable_percentage()->set_numerator(100);
   config.mutable_delay()->mutable_percentage()->set_denominator(
-      envoy::type::FractionalPercent::HUNDRED);
+      envoy::type::v3alpha::FractionalPercent::HUNDRED);
   config.mutable_delay()->mutable_fixed_delay()->set_seconds(5);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
diff --git a/test/extensions/filters/http/fault/fault_filter_test.cc b/test/extensions/filters/http/fault/fault_filter_test.cc
index 7d09e4aa4be5..e98d65cd69af 100644
--- a/test/extensions/filters/http/fault/fault_filter_test.cc
+++ b/test/extensions/filters/http/fault/fault_filter_test.cc
@@ -3,10 +3,10 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
-#include "envoy/config/filter/http/fault/v2/fault.pb.validate.h"
 #include "envoy/event/dispatcher.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/empty_string.h"
@@ -119,7 +119,7 @@ class FaultFilterTest : public testing::Test {
 
   const std::string v2_empty_fault_config_yaml = "{}";
 
-  void SetUpTest(const envoy::config::filter::http::fault::v2::HTTPFault fault) {
+  void SetUpTest(const envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault) {
     config_.reset(new FaultFilterConfig(fault, runtime_, "prefix.", stats_, time_system_));
     filter_ = std::make_unique<FaultFilter>(config_);
     filter_->setDecoderFilterCallbacks(decoder_filter_callbacks_);
@@ -152,7 +152,7 @@ class FaultFilterTest : public testing::Test {
 };
 
 void faultFilterBadConfigHelper(const std::string& yaml) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   EXPECT_THROW(TestUtility::loadFromYamlAndValidate(yaml, fault), EnvoyException);
 }
 
@@ -220,10 +220,10 @@ TEST(FaultFilterBadConfigTest, MissingDelayDuration) {
 }
 
 TEST_F(FaultFilterTest, AbortWithHttpStatus) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   fault.mutable_abort()->mutable_percentage()->set_numerator(100);
   fault.mutable_abort()->mutable_percentage()->set_denominator(
-      envoy::type::FractionalPercent::HUNDRED);
+      envoy::type::v3alpha::FractionalPercent::HUNDRED);
   fault.mutable_abort()->set_http_status(429);
   SetUpTest(fault);
 
@@ -239,7 +239,7 @@ TEST_F(FaultFilterTest, AbortWithHttpStatus) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", 429))
@@ -279,7 +279,7 @@ TEST_F(FaultFilterTest, FixedDelayZeroDuration) {
   // Delay related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   // Return 0ms delay
@@ -289,7 +289,7 @@ TEST_F(FaultFilterTest, FixedDelayZeroDuration) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", _)).Times(0);
@@ -307,7 +307,7 @@ TEST_F(FaultFilterTest, FixedDelayZeroDuration) {
 }
 
 TEST_F(FaultFilterTest, Overflow) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   fault.mutable_max_active_faults()->set_value(0);
   SetUpTest(fault);
 
@@ -320,10 +320,10 @@ TEST_F(FaultFilterTest, Overflow) {
 }
 
 TEST_F(FaultFilterTest, FixedDelayDeprecatedPercentAndNonZeroDuration) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   fault.mutable_delay()->mutable_percentage()->set_numerator(50);
   fault.mutable_delay()->mutable_percentage()->set_denominator(
-      envoy::type::FractionalPercent::HUNDRED);
+      envoy::type::v3alpha::FractionalPercent::HUNDRED);
   fault.mutable_delay()->mutable_fixed_delay()->set_seconds(5);
   SetUpTest(fault);
 
@@ -334,7 +334,7 @@ TEST_F(FaultFilterTest, FixedDelayDeprecatedPercentAndNonZeroDuration) {
   // Delay related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(50))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(50))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -351,7 +351,7 @@ TEST_F(FaultFilterTest, FixedDelayDeprecatedPercentAndNonZeroDuration) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
 
   // Delay only case
@@ -384,11 +384,11 @@ TEST_F(FaultFilterTest, DelayForDownstreamCluster) {
   // Delay related calls.
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(false));
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.cluster.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -405,11 +405,11 @@ TEST_F(FaultFilterTest, DelayForDownstreamCluster) {
   // Abort related calls.
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.cluster.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
 
   // Delay only case, no aborts.
@@ -445,11 +445,11 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortDownstream) {
   // Delay related calls.
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(false));
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.cluster.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -469,11 +469,11 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortDownstream) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(false));
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.cluster.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", 503))
@@ -515,7 +515,7 @@ TEST_F(FaultFilterTest, FixedDelayAndAbort) {
   // Delay related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -533,7 +533,7 @@ TEST_F(FaultFilterTest, FixedDelayAndAbort) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", 503))
@@ -569,7 +569,7 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortDownstreamNodes) {
   // Delay related calls.
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
       .WillOnce(Return(5000UL));
@@ -586,7 +586,7 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortDownstreamNodes) {
   // Abort related calls.
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", 503))
       .WillOnce(Return(503));
@@ -633,7 +633,7 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortHeaderMatchSuccess) {
   // Delay related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -651,7 +651,7 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortHeaderMatchSuccess) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", 503))
@@ -685,12 +685,14 @@ TEST_F(FaultFilterTest, FixedDelayAndAbortHeaderMatchFail) {
               getInteger("fault.http.max_active_faults", std::numeric_limits<uint64_t>::max()))
       .WillOnce(Return(std::numeric_limits<uint64_t>::max()));
 
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.delay.fixed_delay_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.delay.fixed_delay_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", _)).Times(0);
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.abort.abort_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.abort.abort_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", _)).Times(0);
   EXPECT_CALL(decoder_filter_callbacks_, encodeHeaders_(_, _)).Times(0);
@@ -716,7 +718,7 @@ TEST_F(FaultFilterTest, TimerResetAfterStreamReset) {
   // Prep up with a 5s delay
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -739,8 +741,9 @@ TEST_F(FaultFilterTest, TimerResetAfterStreamReset) {
   EXPECT_CALL(*timer_, disableTimer());
 
   // The timer callback should never be called.
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.abort.abort_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.abort.abort_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", _)).Times(0);
   EXPECT_CALL(decoder_filter_callbacks_, encodeHeaders_(_, _)).Times(0);
@@ -769,7 +772,7 @@ TEST_F(FaultFilterTest, FaultWithTargetClusterMatchSuccess) {
   // Delay related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -786,7 +789,7 @@ TEST_F(FaultFilterTest, FaultWithTargetClusterMatchSuccess) {
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
 
   // Delay only case
@@ -814,12 +817,14 @@ TEST_F(FaultFilterTest, FaultWithTargetClusterMatchFail) {
   EXPECT_CALL(runtime_.snapshot_,
               getInteger("fault.http.max_active_faults", std::numeric_limits<uint64_t>::max()))
       .WillOnce(Return(std::numeric_limits<uint64_t>::max()));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.delay.fixed_delay_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.delay.fixed_delay_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", _)).Times(0);
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.abort.abort_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.abort.abort_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", _)).Times(0);
   EXPECT_CALL(decoder_filter_callbacks_, encodeHeaders_(_, _)).Times(0);
@@ -842,12 +847,14 @@ TEST_F(FaultFilterTest, FaultWithTargetClusterNullRoute) {
   EXPECT_CALL(runtime_.snapshot_,
               getInteger("fault.http.max_active_faults", std::numeric_limits<uint64_t>::max()))
       .WillOnce(Return(std::numeric_limits<uint64_t>::max()));
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.delay.fixed_delay_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.delay.fixed_delay_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", _)).Times(0);
-  EXPECT_CALL(runtime_.snapshot_, featureEnabled("fault.http.abort.abort_percent",
-                                                 Matcher<const envoy::type::FractionalPercent&>(_)))
+  EXPECT_CALL(runtime_.snapshot_,
+              featureEnabled("fault.http.abort.abort_percent",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(_)))
       .Times(0);
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.abort.http_status", _)).Times(0);
   EXPECT_CALL(decoder_filter_callbacks_, encodeHeaders_(_, _)).Times(0);
@@ -885,7 +892,7 @@ void FaultFilterTest::TestPerFilterConfigFault(
   // Delay related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.delay.fixed_delay_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
       .WillOnce(Return(true));
 
   EXPECT_CALL(runtime_.snapshot_, getInteger("fault.http.delay.fixed_duration_ms", 5000))
@@ -902,7 +909,7 @@ void FaultFilterTest::TestPerFilterConfigFault(
   // Abort related calls
   EXPECT_CALL(runtime_.snapshot_,
               featureEnabled("fault.http.abort.abort_percent",
-                             Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
       .WillOnce(Return(false));
 
   EXPECT_CALL(decoder_filter_callbacks_, continueDecoding());
@@ -946,18 +953,19 @@ TEST_F(FaultFilterTest, RouteFaultOverridesListenerFault) {
 class FaultFilterRateLimitTest : public FaultFilterTest {
 public:
   void setupRateLimitTest(bool enable_runtime) {
-    envoy::config::filter::http::fault::v2::HTTPFault fault;
+    envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
     fault.mutable_response_rate_limit()->mutable_fixed_limit()->set_limit_kbps(1);
     fault.mutable_response_rate_limit()->mutable_percentage()->set_numerator(100);
     SetUpTest(fault);
 
-    EXPECT_CALL(runtime_.snapshot_,
-                featureEnabled("fault.http.rate_limit.response_percent",
-                               Matcher<const envoy::type::FractionalPercent&>(Percent(100))))
+    EXPECT_CALL(
+        runtime_.snapshot_,
+        featureEnabled("fault.http.rate_limit.response_percent",
+                       Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(100))))
         .WillOnce(Return(enable_runtime));
     EXPECT_CALL(runtime_.snapshot_,
                 featureEnabled("fault.http.abort.abort_percent",
-                               Matcher<const envoy::type::FractionalPercent&>(Percent(0))))
+                               Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(0))))
         .WillOnce(Return(false));
   }
 };
@@ -1074,7 +1082,7 @@ TEST_F(FaultFilterRateLimitTest, ResponseRateLimitEnabled) {
 class FaultFilterSettingsTest : public FaultFilterTest {};
 
 TEST_F(FaultFilterSettingsTest, CheckDefaultRuntimeKeys) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
 
   Fault::FaultSettings settings(fault);
 
@@ -1087,7 +1095,7 @@ TEST_F(FaultFilterSettingsTest, CheckDefaultRuntimeKeys) {
 }
 
 TEST_F(FaultFilterSettingsTest, CheckOverrideRuntimeKeys) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   fault.set_abort_percent_runtime(std::string("fault.abort_percent_runtime"));
   fault.set_delay_percent_runtime(std::string("fault.delay_percent_runtime"));
   fault.set_abort_http_status_runtime(std::string("fault.abort_http_status_runtime"));
diff --git a/test/extensions/filters/http/fault/utility.h b/test/extensions/filters/http/fault/utility.h
index 6d2eb33a45c1..d41b17bd086e 100644
--- a/test/extensions/filters/http/fault/utility.h
+++ b/test/extensions/filters/http/fault/utility.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/config/filter/http/fault/v2/fault.pb.h"
+#include "envoy/extensions/filters/http/fault/v3alpha/fault.pb.h"
 
 #include "test/test_common/utility.h"
 
@@ -11,9 +11,9 @@ namespace Extensions {
 namespace HttpFilters {
 namespace Fault {
 
-inline envoy::config::filter::http::fault::v2::HTTPFault
+inline envoy::extensions::filters::http::fault::v3alpha::HTTPFault
 convertYamlStrToProtoConfig(const std::string& yaml) {
-  envoy::config::filter::http::fault::v2::HTTPFault fault;
+  envoy::extensions::filters::http::fault::v3alpha::HTTPFault fault;
   TestUtility::loadFromYaml(yaml, fault);
   return fault;
 }
diff --git a/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD b/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
index c6a383ca71d2..b59f917152ca 100644
--- a/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
+++ b/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
@@ -20,7 +20,7 @@ envoy_extension_cc_test(
         "//source/common/http:header_map_lib",
         "//source/extensions/filters/http/grpc_http1_reverse_bridge:filter_lib",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_test.cc b/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_test.cc
index 41d4f01c487a..2ea85dd722d9 100644
--- a/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_test.cc
+++ b/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3alpha/config.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/grpc/codec.h"
@@ -555,7 +555,7 @@ TEST_F(ReverseBridgeTest, FilterConfigPerRouteDisabled) {
   initialize();
   decoder_callbacks_.is_grpc_request_ = true;
 
-  envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute
+  envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::FilterConfigPerRoute
       filter_config_per_route;
   filter_config_per_route.set_disabled(true);
   FilterConfigPerRoute filterConfigPerRoute(filter_config_per_route);
@@ -584,7 +584,7 @@ TEST_F(ReverseBridgeTest, FilterConfigPerRouteEnabled) {
   initialize();
   decoder_callbacks_.is_grpc_request_ = true;
 
-  envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute
+  envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::FilterConfigPerRoute
       filter_config_per_route;
   filter_config_per_route.set_disabled(false);
   FilterConfigPerRoute filterConfigPerRoute(filter_config_per_route);
@@ -671,7 +671,7 @@ TEST_F(ReverseBridgeTest, RouteWithTrailers) {
   initialize();
   decoder_callbacks_.is_grpc_request_ = true;
 
-  envoy::config::filter::http::grpc_http1_reverse_bridge::v2alpha1::FilterConfigPerRoute
+  envoy::extensions::filters::http::grpc_http1_reverse_bridge::v3alpha::FilterConfigPerRoute
       filter_config_per_route;
   filter_config_per_route.set_disabled(false);
   FilterConfigPerRoute filterConfigPerRoute(filter_config_per_route);
diff --git a/test/extensions/filters/http/grpc_json_transcoder/BUILD b/test/extensions/filters/http/grpc_json_transcoder/BUILD
index eb4e266b22e4..e403401acb75 100644
--- a/test/extensions/filters/http/grpc_json_transcoder/BUILD
+++ b/test/extensions/filters/http/grpc_json_transcoder/BUILD
@@ -26,7 +26,7 @@ envoy_extension_cc_test(
         "//test/proto:bookstore_proto_cc_proto",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/transcoder/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_json_transcoder/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -66,6 +66,6 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/http/grpc_json_transcoder:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/transcoder/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_json_transcoder/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/grpc_json_transcoder/config_test.cc b/test/extensions/filters/http/grpc_json_transcoder/config_test.cc
index b7d92917ff4b..2858dd85e56d 100644
--- a/test/extensions/filters/http/grpc_json_transcoder/config_test.cc
+++ b/test/extensions/filters/http/grpc_json_transcoder/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.h"
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.validate.h"
 
 #include "extensions/filters/http/grpc_json_transcoder/config.h"
 
@@ -18,7 +18,8 @@ TEST(GrpcJsonTranscoderFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(
       GrpcJsonTranscoderFilterConfig().createFilterFactoryFromProto(
-          envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder(), "stats", context),
+          envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder(),
+          "stats", context),
       ProtoValidationException);
 }
 
diff --git a/test/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter_test.cc b/test/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter_test.cc
index 39b2ceda7b00..f81451735043 100644
--- a/test/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter_test.cc
+++ b/test/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter_test.cc
@@ -1,7 +1,7 @@
 #include <fstream>
 #include <functional>
 
-#include "envoy/config/filter/http/transcoder/v2/transcoder.pb.h"
+#include "envoy/extensions/filters/http/grpc_json_transcoder/v3alpha/transcoder.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/grpc/codec.h"
@@ -49,13 +49,14 @@ class GrpcJsonTranscoderFilterTestBase {
 
 class GrpcJsonTranscoderConfigTest : public testing::Test, public GrpcJsonTranscoderFilterTestBase {
 protected:
-  const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder
+  const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
   getProtoConfig(const std::string& descriptor_path, const std::string& service_name,
                  bool match_incoming_request_route = false,
                  const std::vector<std::string>& ignored_query_parameters = {}) {
     const std::string json_string = "{\"proto_descriptor\": \"" + descriptor_path +
                                     "\",\"services\": [\"" + service_name + "\"]}";
-    envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder proto_config;
+    envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+        proto_config;
     TestUtility::loadFromJson(json_string, proto_config);
     proto_config.set_match_incoming_request_route(match_incoming_request_route);
     for (const auto& query_param : ignored_query_parameters) {
@@ -128,7 +129,7 @@ TEST_F(GrpcJsonTranscoderConfigTest, ParseConfigSkipRecalculating) {
 }
 
 TEST_F(GrpcJsonTranscoderConfigTest, ParseBinaryConfig) {
-  envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder proto_config;
+  envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder proto_config;
   proto_config.set_proto_descriptor_bin(api_->fileSystem().fileReadToEnd(
       TestEnvironment::runfilesPath("test/proto/bookstore.descriptor")));
   proto_config.add_services("bookstore.Bookstore");
@@ -165,7 +166,7 @@ TEST_F(GrpcJsonTranscoderConfigTest, NonProto) {
 }
 
 TEST_F(GrpcJsonTranscoderConfigTest, NonBinaryProto) {
-  envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder proto_config;
+  envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder proto_config;
   proto_config.set_proto_descriptor_bin("This is invalid proto");
   proto_config.add_services("bookstore.Bookstore");
   EXPECT_THROW_WITH_MESSAGE(JsonTranscoderConfig config(proto_config, *api_), EnvoyException,
@@ -308,18 +309,20 @@ TEST_F(GrpcJsonTranscoderConfigTest, InvalidVariableBinding) {
 
 class GrpcJsonTranscoderFilterTest : public testing::Test, public GrpcJsonTranscoderFilterTestBase {
 protected:
-  GrpcJsonTranscoderFilterTest(envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder
-                                   proto_config = bookstoreProtoConfig())
+  GrpcJsonTranscoderFilterTest(
+      envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+          proto_config = bookstoreProtoConfig())
       : config_(proto_config, *api_), filter_(config_) {
     filter_.setDecoderFilterCallbacks(decoder_callbacks_);
     filter_.setEncoderFilterCallbacks(encoder_callbacks_);
   }
 
-  static const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder
+  static const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
   bookstoreProtoConfig() {
     const std::string json_string = "{\"proto_descriptor\": \"" + bookstoreDescriptorPath() +
                                     "\",\"services\": [\"bookstore.Bookstore\"]}";
-    envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder proto_config;
+    envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+        proto_config;
     TestUtility::loadFromJson(json_string, proto_config);
     return proto_config;
   }
@@ -577,7 +580,8 @@ class GrpcJsonTranscoderFilterSkipRecalculatingTest : public GrpcJsonTranscoderF
       : GrpcJsonTranscoderFilterTest(makeProtoConfig()) {}
 
 private:
-  const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder makeProtoConfig() {
+  const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+  makeProtoConfig() {
     auto proto_config = bookstoreProtoConfig();
     proto_config.set_match_incoming_request_route(true);
     return proto_config;
@@ -744,7 +748,8 @@ TEST_F(GrpcJsonTranscoderFilterTest, TranscodingUnaryWithHttpBodyAsOutputAndSpli
 class GrpcJsonTranscoderFilterGrpcStatusTest : public GrpcJsonTranscoderFilterTest {
 public:
   GrpcJsonTranscoderFilterGrpcStatusTest(
-      const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder& proto_config)
+      const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder&
+          proto_config)
       : GrpcJsonTranscoderFilterTest(proto_config) {}
   GrpcJsonTranscoderFilterGrpcStatusTest() : GrpcJsonTranscoderFilterTest(makeProtoConfig()) {}
 
@@ -763,7 +768,8 @@ class GrpcJsonTranscoderFilterGrpcStatusTest : public GrpcJsonTranscoderFilterTe
   }
 
 private:
-  const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder makeProtoConfig() {
+  const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+  makeProtoConfig() {
     auto proto_config = bookstoreProtoConfig();
     return proto_config;
   }
@@ -776,7 +782,8 @@ class GrpcJsonTranscoderFilterConvertGrpcStatusTest
       : GrpcJsonTranscoderFilterGrpcStatusTest(makeProtoConfig()) {}
 
 private:
-  const envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder makeProtoConfig() {
+  const envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+  makeProtoConfig() {
     auto proto_config = bookstoreProtoConfig();
     proto_config.set_convert_grpc_status(true);
     return proto_config;
@@ -923,7 +930,8 @@ class GrpcJsonTranscoderFilterPrintTest
       public GrpcJsonTranscoderFilterTestBase {
 protected:
   GrpcJsonTranscoderFilterPrintTest() {
-    envoy::config::filter::http::transcoder::v2::GrpcJsonTranscoder proto_config;
+    envoy::extensions::filters::http::grpc_json_transcoder::v3alpha::GrpcJsonTranscoder
+        proto_config;
     TestUtility::loadFromJson(TestEnvironment::substitute(GetParam().config_json_), proto_config);
     config_ = new JsonTranscoderConfig(proto_config, *api_);
     filter_ = new JsonTranscoderFilter(*config_);
diff --git a/test/extensions/filters/http/grpc_stats/BUILD b/test/extensions/filters/http/grpc_stats/BUILD
index bbd9d4acb633..b5c02397a7d6 100644
--- a/test/extensions/filters/http/grpc_stats/BUILD
+++ b/test/extensions/filters/http/grpc_stats/BUILD
@@ -21,6 +21,6 @@ envoy_extension_cc_test(
         "//test/common/buffer:utility_lib",
         "//test/common/stream_info:test_util",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/grpc_stats/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/grpc_stats/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/grpc_stats/config_test.cc b/test/extensions/filters/http/grpc_stats/config_test.cc
index cab9b31075b9..b50caf769153 100644
--- a/test/extensions/filters/http/grpc_stats/config_test.cc
+++ b/test/extensions/filters/http/grpc_stats/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/grpc_stats/v2alpha/config.pb.h"
-#include "envoy/config/filter/http/grpc_stats/v2alpha/config.pb.validate.h"
+#include "envoy/extensions/filters/http/grpc_stats/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/grpc_stats/v3alpha/config.pb.validate.h"
 
 #include "common/grpc/common.h"
 
@@ -23,7 +23,7 @@ namespace {
 class GrpcStatsFilterConfigTest : public testing::Test {
 protected:
   void initialize(bool emit_filter_state) {
-    envoy::config::filter::http::grpc_stats::v2alpha::FilterConfig config{};
+    envoy::extensions::filters::http::grpc_stats::v3alpha::FilterConfig config{};
     config.set_emit_filter_state(emit_filter_state);
     GrpcStatsFilterConfig factory;
     Http::FilterFactoryCb cb = factory.createFilterFactoryFromProto(config, "stats", context_);
@@ -178,7 +178,7 @@ TEST_F(GrpcStatsFilterConfigTest, MessageCounts) {
   EXPECT_EQ(3U, data.response_message_count);
 
   auto filter_object =
-      *dynamic_cast<envoy::config::filter::http::grpc_stats::v2alpha::FilterObject*>(
+      *dynamic_cast<envoy::extensions::filters::http::grpc_stats::v3alpha::FilterObject*>(
           data.serializeAsProto().get());
   EXPECT_EQ(2U, filter_object.request_message_count());
   EXPECT_EQ(3U, filter_object.response_message_count());
diff --git a/test/extensions/filters/http/gzip/BUILD b/test/extensions/filters/http/gzip/BUILD
index 5e644db4c2ad..ce237d2308f8 100644
--- a/test/extensions/filters/http/gzip/BUILD
+++ b/test/extensions/filters/http/gzip/BUILD
@@ -23,7 +23,7 @@ envoy_extension_cc_test(
         "//test/mocks/http:http_mocks",
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/gzip/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/gzip/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/http/gzip/gzip_filter_test.cc b/test/extensions/filters/http/gzip/gzip_filter_test.cc
index e9c908faa2ee..c9aadb43417f 100644
--- a/test/extensions/filters/http/gzip/gzip_filter_test.cc
+++ b/test/extensions/filters/http/gzip/gzip_filter_test.cc
@@ -1,6 +1,6 @@
 #include <memory>
 
-#include "envoy/config/filter/http/gzip/v2/gzip.pb.h"
+#include "envoy/extensions/filters/http/gzip/v3alpha/gzip.pb.h"
 
 #include "common/common/hex.h"
 #include "common/common/stack_array.h"
@@ -66,7 +66,7 @@ class GzipFilterTest : public testing::Test {
   // GzipFilterTest Helpers
   void setUpFilter(std::string&& json) {
     Json::ObjectSharedPtr config = Json::Factory::loadFromString(json);
-    envoy::config::filter::http::gzip::v2::Gzip gzip;
+    envoy::extensions::filters::http::gzip::v3alpha::Gzip gzip;
     TestUtility::loadFromJson(json, gzip);
     config_.reset(new GzipFilterConfig(gzip, "test.", stats_, runtime_));
     filter_ = std::make_unique<GzipFilter>(config_);
diff --git a/test/extensions/filters/http/header_to_metadata/BUILD b/test/extensions/filters/http/header_to_metadata/BUILD
index 959131002ee9..2b3310bda778 100644
--- a/test/extensions/filters/http/header_to_metadata/BUILD
+++ b/test/extensions/filters/http/header_to_metadata/BUILD
@@ -19,7 +19,7 @@ envoy_extension_cc_test(
         "//source/common/common:base64_lib",
         "//source/extensions/filters/http/header_to_metadata:header_to_metadata_filter_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/header_to_metadata/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/header_to_metadata/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -31,6 +31,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/header_to_metadata:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/header_to_metadata/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/header_to_metadata/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/header_to_metadata/config_test.cc b/test/extensions/filters/http/header_to_metadata/config_test.cc
index 3c6d091ced99..9798b641e6bb 100644
--- a/test/extensions/filters/http/header_to_metadata/config_test.cc
+++ b/test/extensions/filters/http/header_to_metadata/config_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.h"
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.validate.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.validate.h"
 
 #include "extensions/filters/http/header_to_metadata/config.h"
 
@@ -16,7 +16,8 @@ namespace Extensions {
 namespace HttpFilters {
 namespace HeaderToMetadataFilter {
 
-using HeaderToMetadataProtoConfig = envoy::config::filter::http::header_to_metadata::v2::Config;
+using HeaderToMetadataProtoConfig =
+    envoy::extensions::filters::http::header_to_metadata::v3alpha::Config;
 
 TEST(HeaderToMetadataFilterConfigTest, InvalidEmptyHeader) {
   const std::string yaml = R"EOF(
diff --git a/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc b/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc
index 909aeb272569..10d9ae8038b1 100644
--- a/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc
+++ b/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.pb.h"
+#include "envoy/extensions/filters/http/header_to_metadata/v3alpha/header_to_metadata.pb.h"
 
 #include "common/common/base64.h"
 #include "common/http/header_map_impl.h"
@@ -39,7 +39,7 @@ class HeaderToMetadataTest : public testing::Test {
 )EOF";
 
   void initializeFilter(const std::string& yaml) {
-    envoy::config::filter::http::header_to_metadata::v2::Config config;
+    envoy::extensions::filters::http::header_to_metadata::v3alpha::Config config;
     TestUtility::loadFromYaml(yaml, config);
     config_.reset(new Config(config));
     filter_.reset(new HeaderToMetadataFilter(config_));
diff --git a/test/extensions/filters/http/health_check/BUILD b/test/extensions/filters/http/health_check/BUILD
index b4f5ea3c7c13..ab48d038632a 100644
--- a/test/extensions/filters/http/health_check/BUILD
+++ b/test/extensions/filters/http/health_check/BUILD
@@ -21,7 +21,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/health_check:health_check_lib",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -33,7 +33,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/health_check:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/health_check/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/health_check/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/health_check/config_test.cc b/test/extensions/filters/http/health_check/config_test.cc
index faa815246596..8fdb72aa658a 100644
--- a/test/extensions/filters/http/health_check/config_test.cc
+++ b/test/extensions/filters/http/health_check/config_test.cc
@@ -1,8 +1,8 @@
 #include <string>
 
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/filter/http/health_check/v2/health_check.pb.h"
-#include "envoy/config/filter/http/health_check/v2/health_check.pb.validate.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/http/health_check/v3alpha/health_check.pb.h"
+#include "envoy/extensions/filters/http/health_check/v3alpha/health_check.pb.validate.h"
 
 #include "extensions/filters/http/health_check/config.h"
 
@@ -29,7 +29,7 @@ TEST(HealthCheckFilterConfig, HealthCheckFilter) {
       exact_match: "/hc"
   )EOF";
 
-  envoy::config::filter::http::health_check::v2::HealthCheck proto_config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   HealthCheckFilterConfig factory;
@@ -48,7 +48,7 @@ TEST(HealthCheckFilterConfig, BadHealthCheckFilterConfig) {
   status: 500
   )EOF";
 
-  envoy::config::filter::http::health_check::v2::HealthCheck proto_config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck proto_config;
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYaml(yaml_string, proto_config), EnvoyException,
                           "status: Cannot find field");
 }
@@ -62,7 +62,7 @@ TEST(HealthCheckFilterConfig, FailsWhenNotPassThroughButTimeoutSetYaml) {
       exact_match: "/foo"
   )EOF";
 
-  envoy::config::filter::http::health_check::v2::HealthCheck proto_config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
 
   HealthCheckFilterConfig factory;
@@ -81,7 +81,7 @@ TEST(HealthCheckFilterConfig, NotFailingWhenNotPassThroughAndTimeoutNotSetYaml)
       exact_match: "/foo"
   )EOF";
 
-  envoy::config::filter::http::health_check::v2::HealthCheck proto_config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
 
   HealthCheckFilterConfig factory;
@@ -93,12 +93,12 @@ TEST(HealthCheckFilterConfig, NotFailingWhenNotPassThroughAndTimeoutNotSetYaml)
 
 TEST(HealthCheckFilterConfig, FailsWhenNotPassThroughButTimeoutSetProto) {
   HealthCheckFilterConfig healthCheckFilterConfig;
-  envoy::config::filter::http::health_check::v2::HealthCheck config{};
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config{};
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
   config.mutable_pass_through_mode()->set_value(false);
   config.mutable_cache_time()->set_seconds(10);
-  envoy::api::v2::route::HeaderMatcher& header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& header = *config.add_headers();
   header.set_name(":path");
   header.set_exact_match("foo");
 
@@ -109,11 +109,11 @@ TEST(HealthCheckFilterConfig, FailsWhenNotPassThroughButTimeoutSetProto) {
 
 TEST(HealthCheckFilterConfig, NotFailingWhenNotPassThroughAndTimeoutNotSetProto) {
   HealthCheckFilterConfig healthCheckFilterConfig;
-  envoy::config::filter::http::health_check::v2::HealthCheck config{};
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config{};
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
   config.mutable_pass_through_mode()->set_value(false);
-  envoy::api::v2::route::HeaderMatcher& header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& header = *config.add_headers();
   header.set_name(":path");
   header.set_exact_match("foo");
   healthCheckFilterConfig.createFilterFactoryFromProto(config, "dummy_stats_prefix", context);
@@ -122,25 +122,25 @@ TEST(HealthCheckFilterConfig, NotFailingWhenNotPassThroughAndTimeoutNotSetProto)
 TEST(HealthCheckFilterConfig, HealthCheckFilterWithEmptyProto) {
   HealthCheckFilterConfig healthCheckFilterConfig;
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  envoy::config::filter::http::health_check::v2::HealthCheck config =
-      *dynamic_cast<envoy::config::filter::http::health_check::v2::HealthCheck*>(
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config =
+      *dynamic_cast<envoy::extensions::filters::http::health_check::v3alpha::HealthCheck*>(
           healthCheckFilterConfig.createEmptyConfigProto().get());
 
   config.mutable_pass_through_mode()->set_value(false);
-  envoy::api::v2::route::HeaderMatcher& header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& header = *config.add_headers();
   header.set_name(":path");
   header.set_exact_match("foo");
   healthCheckFilterConfig.createFilterFactoryFromProto(config, "dummy_stats_prefix", context);
 }
 
 void testHealthCheckHeaderMatch(
-    const envoy::config::filter::http::health_check::v2::HealthCheck& input_config,
+    const envoy::extensions::filters::http::health_check::v3alpha::HealthCheck& input_config,
     Http::TestHeaderMapImpl& input_headers, bool expect_health_check_response) {
   HealthCheckFilterConfig healthCheckFilterConfig;
   NiceMock<Server::Configuration::MockFactoryContext> context;
   ProtobufTypes::MessagePtr config_msg = healthCheckFilterConfig.createEmptyConfigProto();
-  auto config =
-      dynamic_cast<envoy::config::filter::http::health_check::v2::HealthCheck*>(config_msg.get());
+  auto config = dynamic_cast<envoy::extensions::filters::http::health_check::v3alpha::HealthCheck*>(
+      config_msg.get());
   ASSERT_NE(config, nullptr);
 
   *config = input_config;
@@ -175,14 +175,14 @@ void testHealthCheckHeaderMatch(
 
 // Basic header match with two conditions should match if both conditions are satisfied.
 TEST(HealthCheckFilterConfig, HealthCheckFilterHeaderMatch) {
-  envoy::config::filter::http::health_check::v2::HealthCheck config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config;
 
   config.mutable_pass_through_mode()->set_value(false);
 
-  envoy::api::v2::route::HeaderMatcher& xheader = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& xheader = *config.add_headers();
   xheader.set_name("x-healthcheck");
 
-  envoy::api::v2::route::HeaderMatcher& yheader = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& yheader = *config.add_headers();
   yheader.set_name("y-healthcheck");
   yheader.set_exact_match("foo");
 
@@ -193,14 +193,14 @@ TEST(HealthCheckFilterConfig, HealthCheckFilterHeaderMatch) {
 
 // The match should fail if a single header value fails to match.
 TEST(HealthCheckFilterConfig, HealthCheckFilterHeaderMatchWrongValue) {
-  envoy::config::filter::http::health_check::v2::HealthCheck config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config;
 
   config.mutable_pass_through_mode()->set_value(false);
 
-  envoy::api::v2::route::HeaderMatcher& xheader = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& xheader = *config.add_headers();
   xheader.set_name("x-healthcheck");
 
-  envoy::api::v2::route::HeaderMatcher& yheader = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& yheader = *config.add_headers();
   yheader.set_name("y-healthcheck");
   yheader.set_exact_match("foo");
 
@@ -211,14 +211,14 @@ TEST(HealthCheckFilterConfig, HealthCheckFilterHeaderMatchWrongValue) {
 
 // If either of the specified headers is completely missing the match should fail.
 TEST(HealthCheckFilterConfig, HealthCheckFilterHeaderMatchMissingHeader) {
-  envoy::config::filter::http::health_check::v2::HealthCheck config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config;
 
   config.mutable_pass_through_mode()->set_value(false);
 
-  envoy::api::v2::route::HeaderMatcher& xheader = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& xheader = *config.add_headers();
   xheader.set_name("x-healthcheck");
 
-  envoy::api::v2::route::HeaderMatcher& yheader = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& yheader = *config.add_headers();
   yheader.set_name("y-healthcheck");
   yheader.set_exact_match("foo");
 
@@ -229,15 +229,15 @@ TEST(HealthCheckFilterConfig, HealthCheckFilterHeaderMatchMissingHeader) {
 
 // Conditions for the same header should match if they are both satisfied.
 TEST(HealthCheckFilterConfig, HealthCheckFilterDuplicateMatch) {
-  envoy::config::filter::http::health_check::v2::HealthCheck config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config;
 
   config.mutable_pass_through_mode()->set_value(false);
 
-  envoy::api::v2::route::HeaderMatcher& header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& header = *config.add_headers();
   header.set_name("x-healthcheck");
   header.set_exact_match("foo");
 
-  envoy::api::v2::route::HeaderMatcher& dup_header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& dup_header = *config.add_headers();
   dup_header.set_name("x-healthcheck");
 
   Http::TestHeaderMapImpl headers{{"x-healthcheck", "foo"}};
@@ -247,15 +247,15 @@ TEST(HealthCheckFilterConfig, HealthCheckFilterDuplicateMatch) {
 
 // Conditions on the same header should not match if one or more is not satisfied.
 TEST(HealthCheckFilterConfig, HealthCheckFilterDuplicateNoMatch) {
-  envoy::config::filter::http::health_check::v2::HealthCheck config;
+  envoy::extensions::filters::http::health_check::v3alpha::HealthCheck config;
 
   config.mutable_pass_through_mode()->set_value(false);
 
-  envoy::api::v2::route::HeaderMatcher& header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& header = *config.add_headers();
   header.set_name("x-healthcheck");
   header.set_exact_match("foo");
 
-  envoy::api::v2::route::HeaderMatcher& dup_header = *config.add_headers();
+  envoy::config::route::v3alpha::HeaderMatcher& dup_header = *config.add_headers();
   dup_header.set_name("x-healthcheck");
   dup_header.set_exact_match("bar");
 
diff --git a/test/extensions/filters/http/health_check/health_check_test.cc b/test/extensions/filters/http/health_check/health_check_test.cc
index b23aceef3e66..98863a3c9726 100644
--- a/test/extensions/filters/http/health_check/health_check_test.cc
+++ b/test/extensions/filters/http/health_check/health_check_test.cc
@@ -1,7 +1,7 @@
 #include <chrono>
 #include <memory>
 
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/http/header_utility.h"
@@ -47,7 +47,7 @@ class HealthCheckFilterTest : public testing::Test {
       bool pass_through,
       ClusterMinHealthyPercentagesConstSharedPtr cluster_min_healthy_percentages = nullptr) {
     header_data_ = std::make_shared<std::vector<Http::HeaderUtility::HeaderDataPtr>>();
-    envoy::api::v2::route::HeaderMatcher matcher;
+    envoy::config::route::v3alpha::HeaderMatcher matcher;
     matcher.set_name(":path");
     matcher.set_exact_match("/healthcheck");
     header_data_->emplace_back(std::make_unique<Http::HeaderUtility::HeaderData>(matcher));
diff --git a/test/extensions/filters/http/jwt_authn/BUILD b/test/extensions/filters/http/jwt_authn/BUILD
index f616ac5b654f..8c236e7be5f6 100644
--- a/test/extensions/filters/http/jwt_authn/BUILD
+++ b/test/extensions/filters/http/jwt_authn/BUILD
@@ -36,7 +36,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/jwt_authn:extractor_lib",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -49,7 +49,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/jwt_authn:filter_lib",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -63,7 +63,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/jwt_authn:config",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -75,7 +75,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/jwt_authn:config",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -90,7 +90,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -108,8 +108,8 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -125,9 +125,9 @@ envoy_extension_cc_test(
         "//test/config:utility_lib",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
         "//test/integration:http_protocol_integration_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -140,7 +140,7 @@ envoy_extension_cc_test(
         ":test_common_lib",
         "//source/extensions/filters/http/jwt_authn:matchers_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -153,7 +153,7 @@ envoy_extension_cc_test(
         ":test_common_lib",
         "//source/extensions/filters/http/jwt_authn:verifier_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -171,6 +171,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/jwt_authn:matchers_lib",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/jwt_authn/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/jwt_authn/all_verifier_test.cc b/test/extensions/filters/http/jwt_authn/all_verifier_test.cc
index 846c40643305..93c43f8bbd7f 100644
--- a/test/extensions/filters/http/jwt_authn/all_verifier_test.cc
+++ b/test/extensions/filters/http/jwt_authn/all_verifier_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "extensions/filters/http/jwt_authn/filter_config.h"
 #include "extensions/filters/http/jwt_authn/verifier.h"
@@ -11,7 +11,7 @@
 #include "absl/strings/string_view.h"
 #include "gmock/gmock.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using ::google::jwt_verify::Status;
 using ::testing::NiceMock;
 
diff --git a/test/extensions/filters/http/jwt_authn/authenticator_test.cc b/test/extensions/filters/http/jwt_authn/authenticator_test.cc
index 332861033f31..612b70a8daf8 100644
--- a/test/extensions/filters/http/jwt_authn/authenticator_test.cc
+++ b/test/extensions/filters/http/jwt_authn/authenticator_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/http_uri.pb.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/config/core/v3alpha/http_uri.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/http/message_impl.h"
 #include "common/protobuf/utility.h"
@@ -16,7 +16,7 @@
 
 #include "gtest/gtest.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using Envoy::Extensions::HttpFilters::Common::JwksFetcher;
 using Envoy::Extensions::HttpFilters::Common::JwksFetcherPtr;
 using Envoy::Extensions::HttpFilters::Common::MockJwksFetcher;
@@ -92,7 +92,7 @@ class AuthenticatorTest : public testing::Test {
 // It also verifies Jwks cache with 10 JWT authentications, but only one Jwks fetch.
 TEST_F(AuthenticatorTest, TestOkJWTandCache) {
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -115,7 +115,7 @@ TEST_F(AuthenticatorTest, TestForwardJwt) {
   (*proto_config_.mutable_providers())[std::string(ProviderName)].set_forward(true);
   CreateAuthenticator();
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -139,7 +139,7 @@ TEST_F(AuthenticatorTest, TestSetPayload) {
       "my_payload");
   CreateAuthenticator();
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -160,7 +160,7 @@ TEST_F(AuthenticatorTest, TestSetPayload) {
 // This test verifies the Jwt with non existing kid
 TEST_F(AuthenticatorTest, TestJwtWithNonExistKid) {
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -263,7 +263,7 @@ TEST_F(AuthenticatorTest, TestIssuerNotFound) {
 // This test verifies that when Jwks fetching fails, JwksFetchFail status is returned.
 TEST_F(AuthenticatorTest, TestPubkeyFetchFail) {
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                           JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksError(JwksFetcher::JwksReceiver::Failure::InvalidJwks);
       }));
@@ -302,7 +302,7 @@ TEST_F(AuthenticatorTest, TestNoForwardPayloadHeader) {
   provider0.clear_forward_payload_header();
   CreateAuthenticator();
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -327,7 +327,7 @@ TEST_F(AuthenticatorTest, TestAllowFailedMultipleTokens) {
 
   CreateAuthenticator(nullptr, absl::nullopt);
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -375,7 +375,7 @@ TEST_F(AuthenticatorTest, TestAllowFailedMultipleIssuers) {
   CreateAuthenticator(nullptr, absl::nullopt);
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
       .Times(2)
-      .WillRepeatedly(Invoke([](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillRepeatedly(Invoke([](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                                 JwksFetcher::JwksReceiver& receiver) {
         ::google::jwt_verify::JwksPtr jwks = Jwks::createFrom(PublicKey, Jwks::JWKS);
         EXPECT_TRUE(jwks->getStatus() == Status::Ok);
@@ -401,7 +401,7 @@ TEST_F(AuthenticatorTest, TestCustomCheckAudience) {
       std::vector<std::string>{"invalid_service"});
   CreateAuthenticator(check_audience.get());
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([this](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([this](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                               JwksFetcher::JwksReceiver& receiver) {
         receiver.onJwksSuccess(std::move(jwks_));
       }));
@@ -417,7 +417,7 @@ TEST_F(AuthenticatorTest, TestCustomCheckAudience) {
 // This test verifies that when invalid JWKS is fetched, an JWKS error status is returned.
 TEST_F(AuthenticatorTest, TestInvalidPubkeyKey) {
   EXPECT_CALL(*raw_fetcher_, fetch(_, _, _))
-      .WillOnce(Invoke([](const ::envoy::api::v2::core::HttpUri&, Tracing::Span&,
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::HttpUri&, Tracing::Span&,
                           JwksFetcher::JwksReceiver& receiver) {
         auto jwks = Jwks::createFrom(PublicKey, Jwks::PEM);
         receiver.onJwksSuccess(std::move(jwks));
diff --git a/test/extensions/filters/http/jwt_authn/extractor_test.cc b/test/extensions/filters/http/jwt_authn/extractor_test.cc
index eac701791376..0ab28211612e 100644
--- a/test/extensions/filters/http/jwt_authn/extractor_test.cc
+++ b/test/extensions/filters/http/jwt_authn/extractor_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -7,8 +7,8 @@
 #include "test/extensions/filters/http/jwt_authn/test_common.h"
 #include "test/test_common/utility.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtProvider;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtProvider;
 using Envoy::Http::TestHeaderMapImpl;
 
 namespace Envoy {
diff --git a/test/extensions/filters/http/jwt_authn/filter_config_test.cc b/test/extensions/filters/http/jwt_authn/filter_config_test.cc
index d4237206f475..5d7a8f497938 100644
--- a/test/extensions/filters/http/jwt_authn/filter_config_test.cc
+++ b/test/extensions/filters/http/jwt_authn/filter_config_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/router/string_accessor_impl.h"
 #include "common/stream_info/filter_state_impl.h"
@@ -11,7 +11,7 @@
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 
 namespace Envoy {
 namespace Extensions {
diff --git a/test/extensions/filters/http/jwt_authn/filter_factory_test.cc b/test/extensions/filters/http/jwt_authn/filter_factory_test.cc
index 5e4ce54adf40..ddb967156fbf 100644
--- a/test/extensions/filters/http/jwt_authn/filter_factory_test.cc
+++ b/test/extensions/filters/http/jwt_authn/filter_factory_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.validate.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.validate.h"
 
 #include "extensions/filters/http/jwt_authn/filter_factory.h"
 
@@ -9,7 +9,7 @@
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using testing::_;
 
 namespace Envoy {
diff --git a/test/extensions/filters/http/jwt_authn/filter_integration_test.cc b/test/extensions/filters/http/jwt_authn/filter_integration_test.cc
index 43a30922d115..2bd66be8cf38 100644
--- a/test/extensions/filters/http/jwt_authn/filter_integration_test.cc
+++ b/test/extensions/filters/http/jwt_authn/filter_integration_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/router/string_accessor_impl.h"
 
@@ -11,8 +11,8 @@
 #include "test/extensions/filters/http/jwt_authn/test_common.h"
 #include "test/integration/http_protocol_integration.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
-using ::envoy::config::filter::network::http_connection_manager::v2::HttpFilter;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
+using envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpFilter;
 
 namespace Envoy {
 namespace Extensions {
@@ -314,7 +314,7 @@ class RemoteJwksIntegrationTest : public HttpProtocolIntegrationTest {
     config_helper_.addFilter(getFilterConfig(false));
 
     if (add_cluster) {
-      config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+      config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
         auto* jwks_cluster = bootstrap.mutable_static_resources()->add_clusters();
         jwks_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
         jwks_cluster->set_name("pubkey_cluster");
diff --git a/test/extensions/filters/http/jwt_authn/filter_test.cc b/test/extensions/filters/http/jwt_authn/filter_test.cc
index a885737b9c44..404057ea3477 100644
--- a/test/extensions/filters/http/jwt_authn/filter_test.cc
+++ b/test/extensions/filters/http/jwt_authn/filter_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "extensions/filters/http/jwt_authn/filter.h"
 #include "extensions/filters/http/well_known_names.h"
@@ -10,7 +10,7 @@
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using ::google::jwt_verify::Status;
 
 using testing::_;
@@ -31,7 +31,7 @@ class MockMatcher : public Matcher {
 class MockFilterConfig : public FilterConfig {
 public:
   MockFilterConfig(
-      const ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication& proto_config,
+      const envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication& proto_config,
       const std::string& stats_prefix, Server::Configuration::FactoryContext& context)
       : FilterConfig(proto_config, stats_prefix, context) {}
   MOCK_CONST_METHOD2(findVerifier, const Verifier*(const Http::HeaderMap& headers,
diff --git a/test/extensions/filters/http/jwt_authn/group_verifier_test.cc b/test/extensions/filters/http/jwt_authn/group_verifier_test.cc
index 6aa68f5b3a38..e407449c34e8 100644
--- a/test/extensions/filters/http/jwt_authn/group_verifier_test.cc
+++ b/test/extensions/filters/http/jwt_authn/group_verifier_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "extensions/filters/http/jwt_authn/verifier.h"
 
@@ -8,7 +8,7 @@
 
 #include "gmock/gmock.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using ::google::jwt_verify::Status;
 using ::testing::NiceMock;
 
diff --git a/test/extensions/filters/http/jwt_authn/jwks_cache_test.cc b/test/extensions/filters/http/jwt_authn/jwks_cache_test.cc
index ea331f92974c..c5f63687ce89 100644
--- a/test/extensions/filters/http/jwt_authn/jwks_cache_test.cc
+++ b/test/extensions/filters/http/jwt_authn/jwks_cache_test.cc
@@ -1,7 +1,7 @@
 #include <chrono>
 #include <thread>
 
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/protobuf/utility.h"
 #include "common/stats/isolated_store_impl.h"
@@ -12,7 +12,7 @@
 #include "test/test_common/simulated_time_system.h"
 #include "test/test_common/utility.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using ::google::jwt_verify::Status;
 
 namespace Envoy {
diff --git a/test/extensions/filters/http/jwt_authn/matcher_test.cc b/test/extensions/filters/http/jwt_authn/matcher_test.cc
index 0b899cdd5a8e..99682dfb8bb0 100644
--- a/test/extensions/filters/http/jwt_authn/matcher_test.cc
+++ b/test/extensions/filters/http/jwt_authn/matcher_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -8,7 +8,7 @@
 #include "test/extensions/filters/http/jwt_authn/test_common.h"
 #include "test/test_common/utility.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::RequirementRule;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::RequirementRule;
 using Envoy::Http::TestHeaderMapImpl;
 
 namespace Envoy {
diff --git a/test/extensions/filters/http/jwt_authn/provider_verifier_test.cc b/test/extensions/filters/http/jwt_authn/provider_verifier_test.cc
index e7243509804a..0c731c8d746d 100644
--- a/test/extensions/filters/http/jwt_authn/provider_verifier_test.cc
+++ b/test/extensions/filters/http/jwt_authn/provider_verifier_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/http/jwt_authn/v2alpha/config.pb.h"
+#include "envoy/extensions/filters/http/jwt_authn/v3alpha/config.pb.h"
 
 #include "extensions/filters/http/jwt_authn/filter_config.h"
 #include "extensions/filters/http/jwt_authn/verifier.h"
@@ -11,7 +11,7 @@
 
 #include "gmock/gmock.h"
 
-using ::envoy::config::filter::http::jwt_authn::v2alpha::JwtAuthentication;
+using envoy::extensions::filters::http::jwt_authn::v3alpha::JwtAuthentication;
 using ::google::jwt_verify::Status;
 using ::testing::Eq;
 using ::testing::NiceMock;
diff --git a/test/extensions/filters/http/lua/BUILD b/test/extensions/filters/http/lua/BUILD
index 469018a1ebda..cbd443169b9e 100644
--- a/test/extensions/filters/http/lua/BUILD
+++ b/test/extensions/filters/http/lua/BUILD
@@ -24,7 +24,7 @@ envoy_extension_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -38,7 +38,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/common/lua:lua_wrappers_lib",
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -50,8 +50,8 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/lua:config",
         "//test/integration:http_integration_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -63,6 +63,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/lua:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/lua/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/lua/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/lua/config_test.cc b/test/extensions/filters/http/lua/config_test.cc
index 28a756d772ef..71f6c3addef9 100644
--- a/test/extensions/filters/http/lua/config_test.cc
+++ b/test/extensions/filters/http/lua/config_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
-#include "envoy/config/filter/http/lua/v2/lua.pb.h"
-#include "envoy/config/filter/http/lua/v2/lua.pb.validate.h"
+#include "envoy/extensions/filters/http/lua/v3alpha/lua.pb.h"
+#include "envoy/extensions/filters/http/lua/v3alpha/lua.pb.validate.h"
 
 #include "extensions/filters/http/lua/config.h"
 
@@ -22,7 +22,7 @@ namespace {
 TEST(LuaFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(LuaFilterConfig().createFilterFactoryFromProto(
-                   envoy::config::filter::http::lua::v2::Lua(), "stats", context),
+                   envoy::extensions::filters::http::lua::v3alpha::Lua(), "stats", context),
                ProtoValidationException);
 }
 
@@ -31,7 +31,7 @@ TEST(LuaFilterConfigTest, LuaFilterInJson) {
   inline_code : "print(5)"
   )EOF";
 
-  envoy::config::filter::http::lua::v2::Lua proto_config;
+  envoy::extensions::filters::http::lua::v3alpha::Lua proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   LuaFilterConfig factory;
diff --git a/test/extensions/filters/http/lua/lua_filter_test.cc b/test/extensions/filters/http/lua/lua_filter_test.cc
index dc0b86197ab6..935e05eddc27 100644
--- a/test/extensions/filters/http/lua/lua_filter_test.cc
+++ b/test/extensions/filters/http/lua/lua_filter_test.cc
@@ -1,6 +1,6 @@
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/http/message_impl.h"
@@ -98,7 +98,7 @@ class LuaHttpFilterTest : public testing::Test {
   std::unique_ptr<TestFilter> filter_;
   Http::MockStreamDecoderFilterCallbacks decoder_callbacks_;
   Http::MockStreamEncoderFilterCallbacks encoder_callbacks_;
-  envoy::api::v2::core::Metadata metadata_;
+  envoy::config::core::v3alpha::Metadata metadata_;
   std::shared_ptr<NiceMock<Envoy::Ssl::MockConnectionInfo>> ssl_;
   NiceMock<Envoy::Network::MockConnection> connection_;
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info_;
diff --git a/test/extensions/filters/http/lua/lua_integration_test.cc b/test/extensions/filters/http/lua/lua_integration_test.cc
index 514db3a4c5c3..a27ec56b0c4e 100644
--- a/test/extensions/filters/http/lua/lua_integration_test.cc
+++ b/test/extensions/filters/http/lua/lua_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "extensions/filters/http/well_known_names.h"
 
@@ -27,7 +27,7 @@ class LuaIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
   void initializeFilter(const std::string& filter_config, const std::string& domain = "*") {
     config_helper_.addFilter(filter_config);
 
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* lua_cluster = bootstrap.mutable_static_resources()->add_clusters();
       lua_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
       lua_cluster->set_name("lua_cluster");
@@ -38,8 +38,8 @@ class LuaIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     });
 
     config_helper_.addConfigModifier(
-        [domain](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                     hcm) {
+        [domain](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                     HttpConnectionManager& hcm) {
           hcm.mutable_route_config()
               ->mutable_virtual_hosts(0)
               ->mutable_routes(0)
diff --git a/test/extensions/filters/http/lua/wrappers_test.cc b/test/extensions/filters/http/lua/wrappers_test.cc
index 6f9327636767..eee4a7be3030 100644
--- a/test/extensions/filters/http/lua/wrappers_test.cc
+++ b/test/extensions/filters/http/lua/wrappers_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/http/utility.h"
 #include "common/stream_info/stream_info_impl.h"
@@ -248,8 +248,8 @@ class LuaStreamInfoWrapperTest
     wrapper.reset();
   }
 
-  envoy::api::v2::core::Metadata parseMetadataFromYaml(const std::string& yaml_string) {
-    envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata parseMetadataFromYaml(const std::string& yaml_string) {
+    envoy::config::core::v3alpha::Metadata metadata;
     TestUtility::loadFromYaml(yaml_string, metadata);
     return metadata;
   }
diff --git a/test/extensions/filters/http/original_src/BUILD b/test/extensions/filters/http/original_src/BUILD
index 79a6a8573fe6..98b3f2be7b9f 100644
--- a/test/extensions/filters/http/original_src/BUILD
+++ b/test/extensions/filters/http/original_src/BUILD
@@ -17,7 +17,7 @@ envoy_extension_cc_test(
     extension_name = "envoy.filters.http.original_src",
     deps = [
         "//source/extensions/filters/http/original_src:config_lib",
-        "@envoy_api//envoy/config/filter/http/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/original_src/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -30,7 +30,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/original_src:config_lib",
         "//source/extensions/filters/http/original_src:original_src_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/original_src/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -47,7 +47,7 @@ envoy_extension_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/test_common:printers_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/original_src/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/original_src/config_test.cc b/test/extensions/filters/http/original_src/config_test.cc
index e00ac0ee5a15..918f90f7211a 100644
--- a/test/extensions/filters/http/original_src/config_test.cc
+++ b/test/extensions/filters/http/original_src/config_test.cc
@@ -1,6 +1,6 @@
 #include <numeric>
 
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
 
 #include "extensions/filters/http/original_src/config.h"
 
@@ -17,13 +17,13 @@ namespace {
 class OriginalSrcHttpConfigTest : public testing::Test {
 public:
   Config makeConfigFromProto(
-      const envoy::config::filter::http::original_src::v2alpha1::OriginalSrc& proto_config) {
+      const envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc& proto_config) {
     return Config(proto_config);
   }
 };
 
 TEST_F(OriginalSrcHttpConfigTest, TestUseMark0) {
-  envoy::config::filter::http::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_mark(0);
   auto config = makeConfigFromProto(config_proto);
 
@@ -31,7 +31,7 @@ TEST_F(OriginalSrcHttpConfigTest, TestUseMark0) {
 }
 
 TEST_F(OriginalSrcHttpConfigTest, TestUseMark1234) {
-  envoy::config::filter::http::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_mark(1234);
   auto config = makeConfigFromProto(config_proto);
 
@@ -39,7 +39,7 @@ TEST_F(OriginalSrcHttpConfigTest, TestUseMark1234) {
 }
 
 TEST_F(OriginalSrcHttpConfigTest, TestUseMarkMax) {
-  envoy::config::filter::http::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_mark(std::numeric_limits<uint32_t>::max());
   auto config = makeConfigFromProto(config_proto);
 
diff --git a/test/extensions/filters/http/original_src/original_src_config_factory_test.cc b/test/extensions/filters/http/original_src/original_src_config_factory_test.cc
index 4d05b45fabeb..aec1b0507dfb 100644
--- a/test/extensions/filters/http/original_src/original_src_config_factory_test.cc
+++ b/test/extensions/filters/http/original_src/original_src_config_factory_test.cc
@@ -1,4 +1,5 @@
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.validate.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.validate.h"
 
 #include "extensions/filters/http/original_src/config.h"
 #include "extensions/filters/http/original_src/original_src.h"
diff --git a/test/extensions/filters/http/original_src/original_src_test.cc b/test/extensions/filters/http/original_src/original_src_test.cc
index 6f20821c72aa..efb4c781fd33 100644
--- a/test/extensions/filters/http/original_src/original_src_test.cc
+++ b/test/extensions/filters/http/original_src/original_src_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/http/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/original_src/v3alpha/original_src.pb.h"
 
 #include "common/network/socket_option_impl.h"
 #include "common/network/utility.h"
@@ -41,7 +41,7 @@ class OriginalSrcHttpTest : public testing::Test {
   }
 
   std::unique_ptr<OriginalSrcFilter> makeMarkingFilter(uint32_t mark) {
-    envoy::config::filter::http::original_src::v2alpha1::OriginalSrc proto_config;
+    envoy::extensions::filters::http::original_src::v3alpha::OriginalSrc proto_config;
     proto_config.set_mark(mark);
 
     const Config config(proto_config);
@@ -62,7 +62,7 @@ class OriginalSrcHttpTest : public testing::Test {
 
   absl::optional<Network::Socket::Option::Details>
   findOptionDetails(const Network::Socket::Options& options, Network::SocketOptionName name,
-                    envoy::api::v2::core::SocketOption::SocketState state) {
+                    envoy::config::core::v3alpha::SocketOption::SocketState state) {
     for (const auto& option : options) {
       const auto details = option->getOptionDetails(socket_, state);
       if (details.has_value() && details->name_ == name) {
@@ -94,7 +94,7 @@ TEST_F(OriginalSrcHttpTest, DecodeHeadersIpv4AddressAddsOption) {
   EXPECT_CALL(socket,
               setLocalAddress(PointeesEq(callbacks_.stream_info_.downstream_remote_address_)));
   for (const auto& option : *options) {
-    option->setOption(socket, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+    option->setOption(socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   }
 }
 
@@ -128,7 +128,7 @@ TEST_F(OriginalSrcHttpTest, DecodeHeadersIpv4AddressBleachesPort) {
 
   EXPECT_CALL(socket, setLocalAddress(PointeesEq(expected_address)));
   for (const auto& option : *options) {
-    option->setOption(socket, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+    option->setOption(socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   }
 }
 
@@ -145,8 +145,9 @@ TEST_F(OriginalSrcHttpTest, FilterAddsTransparentOption) {
 
   filter->decodeHeaders(headers_, false);
 
-  const auto transparent_option = findOptionDetails(
-      *options, ENVOY_SOCKET_IP_TRANSPARENT, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  const auto transparent_option =
+      findOptionDetails(*options, ENVOY_SOCKET_IP_TRANSPARENT,
+                        envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   EXPECT_TRUE(transparent_option.has_value());
 }
@@ -164,8 +165,8 @@ TEST_F(OriginalSrcHttpTest, FilterAddsMarkOption) {
 
   filter->decodeHeaders(headers_, false);
 
-  const auto mark_option = findOptionDetails(*options, ENVOY_SOCKET_SO_MARK,
-                                             envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  const auto mark_option = findOptionDetails(
+      *options, ENVOY_SOCKET_SO_MARK, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   ASSERT_TRUE(mark_option.has_value());
   uint32_t value = 1234;
@@ -186,8 +187,8 @@ TEST_F(OriginalSrcHttpTest, Mark0NotAdded) {
 
   filter->decodeHeaders(headers_, false);
 
-  const auto mark_option = findOptionDetails(*options, ENVOY_SOCKET_SO_MARK,
-                                             envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  const auto mark_option = findOptionDetails(
+      *options, ENVOY_SOCKET_SO_MARK, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   ASSERT_FALSE(mark_option.has_value());
 }
diff --git a/test/extensions/filters/http/ratelimit/BUILD b/test/extensions/filters/http/ratelimit/BUILD
index a411be36e21f..3c529547b3b2 100644
--- a/test/extensions/filters/http/ratelimit/BUILD
+++ b/test/extensions/filters/http/ratelimit/BUILD
@@ -30,7 +30,7 @@ envoy_extension_cc_test(
         "//test/mocks/tracing:tracing_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -41,7 +41,7 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/http/ratelimit:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/ratelimit/config_test.cc b/test/extensions/filters/http/ratelimit/config_test.cc
index 7c78cfee2a1c..6aee2c2149f5 100644
--- a/test/extensions/filters/http/ratelimit/config_test.cc
+++ b/test/extensions/filters/http/ratelimit/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.validate.h"
 
 #include "extensions/filters/http/ratelimit/config.h"
 
@@ -19,9 +19,10 @@ namespace {
 
 TEST(RateLimitFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_THROW(RateLimitFilterConfig().createFilterFactoryFromProto(
-                   envoy::config::filter::http::rate_limit::v2::RateLimit(), "stats", context),
-               ProtoValidationException);
+  EXPECT_THROW(
+      RateLimitFilterConfig().createFilterFactoryFromProto(
+          envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit(), "stats", context),
+      ProtoValidationException);
 }
 
 TEST(RateLimitFilterConfigTest, RatelimitCorrectProto) {
@@ -34,13 +35,13 @@ TEST(RateLimitFilterConfigTest, RatelimitCorrectProto) {
         cluster_name: ratelimit_cluster
   )EOF";
 
-  envoy::config::filter::http::rate_limit::v2::RateLimit proto_config{};
+  envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit proto_config{};
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
   EXPECT_CALL(context.cluster_manager_.async_client_manager_, factoryForGrpcService(_, _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         return std::make_unique<NiceMock<Grpc::MockAsyncClientFactory>>();
       }));
 
@@ -57,8 +58,8 @@ TEST(RateLimitFilterConfigTest, RateLimitFilterEmptyProto) {
 
   RateLimitFilterConfig factory;
 
-  envoy::config::filter::http::rate_limit::v2::RateLimit empty_proto_config =
-      *dynamic_cast<envoy::config::filter::http::rate_limit::v2::RateLimit*>(
+  envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit empty_proto_config =
+      *dynamic_cast<envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit*>(
           factory.createEmptyConfigProto().get());
 
   EXPECT_THROW(factory.createFilterFactoryFromProto(empty_proto_config, "stats", context),
@@ -71,7 +72,7 @@ TEST(RateLimitFilterConfigTest, BadRateLimitFilterConfig) {
   route_key: my_route
   )EOF";
 
-  envoy::config::filter::http::rate_limit::v2::RateLimit proto_config{};
+  envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit proto_config{};
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYamlAndValidate(yaml, proto_config), EnvoyException,
                           "route_key: Cannot find field");
 }
diff --git a/test/extensions/filters/http/ratelimit/ratelimit_test.cc b/test/extensions/filters/http/ratelimit/ratelimit_test.cc
index 664f90593114..182577fccb70 100644
--- a/test/extensions/filters/http/ratelimit/ratelimit_test.cc
+++ b/test/extensions/filters/http/ratelimit/ratelimit_test.cc
@@ -2,7 +2,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/empty_string.h"
@@ -51,7 +51,7 @@ class HttpRateLimitFilterTest : public testing::Test {
   }
 
   void SetUpTest(const std::string& yaml) {
-    envoy::config::filter::http::rate_limit::v2::RateLimit proto_config{};
+    envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit proto_config{};
     TestUtility::loadFromYaml(yaml, proto_config);
 
     config_.reset(
diff --git a/test/extensions/filters/http/rbac/BUILD b/test/extensions/filters/http/rbac/BUILD
index e5edfaa2ab88..de634ab3f255 100644
--- a/test/extensions/filters/http/rbac/BUILD
+++ b/test/extensions/filters/http/rbac/BUILD
@@ -19,8 +19,8 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/http/rbac:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/http/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -35,8 +35,8 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/rbac:route_config_mocks",
         "//test/mocks/http:http_mocks",
         "//test/mocks/network:network_mocks",
-        "@envoy_api//envoy/config/filter/http/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -48,8 +48,8 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/rbac:config",
         "//test/config:utility_lib",
         "//test/integration:http_protocol_integration_lib",
-        "@envoy_api//envoy/config/filter/http/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -60,6 +60,6 @@ envoy_extension_cc_mock(
     deps = [
         "//source/extensions/filters/common/rbac:utility_lib",
         "//source/extensions/filters/http/rbac:rbac_filter_lib",
-        "@envoy_api//envoy/config/filter/http/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/rbac/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/rbac/config_test.cc b/test/extensions/filters/http/rbac/config_test.cc
index bc22a019f086..33fb8be2b300 100644
--- a/test/extensions/filters/http/rbac/config_test.cc
+++ b/test/extensions/filters/http/rbac/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.validate.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.validate.h"
 
 #include "extensions/filters/common/rbac/engine.h"
 #include "extensions/filters/http/rbac/config.h"
@@ -20,10 +20,10 @@ namespace RBACFilter {
 namespace {
 
 TEST(RoleBasedAccessControlFilterConfigFactoryTest, ValidProto) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
-  envoy::config::filter::http::rbac::v2::RBAC config;
+  envoy::extensions::filters::http::rbac::v3alpha::RBAC config;
   (*config.mutable_rules()->mutable_policies())["foo"] = policy;
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -36,14 +36,14 @@ TEST(RoleBasedAccessControlFilterConfigFactoryTest, ValidProto) {
 
 TEST(RoleBasedAccessControlFilterConfigFactoryTest, EmptyProto) {
   RoleBasedAccessControlFilterConfigFactory factory;
-  auto* config = dynamic_cast<envoy::config::filter::http::rbac::v2::RBAC*>(
+  auto* config = dynamic_cast<envoy::extensions::filters::http::rbac::v3alpha::RBAC*>(
       factory.createEmptyConfigProto().get());
   EXPECT_NE(nullptr, config);
 }
 
 TEST(RoleBasedAccessControlFilterConfigFactoryTest, EmptyRouteProto) {
   RoleBasedAccessControlFilterConfigFactory factory;
-  auto* config = dynamic_cast<envoy::config::filter::http::rbac::v2::RBACPerRoute*>(
+  auto* config = dynamic_cast<envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute*>(
       factory.createEmptyRouteConfigProto().get());
   EXPECT_NE(nullptr, config);
 }
diff --git a/test/extensions/filters/http/rbac/mocks.h b/test/extensions/filters/http/rbac/mocks.h
index 0897ddc5d5cf..7bcb1d211b4f 100644
--- a/test/extensions/filters/http/rbac/mocks.h
+++ b/test/extensions/filters/http/rbac/mocks.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
 
 #include "extensions/filters/common/rbac/utility.h"
 #include "extensions/filters/http/rbac/rbac_filter.h"
@@ -17,7 +17,7 @@ class MockRoleBasedAccessControlRouteSpecificFilterConfig
     : public RoleBasedAccessControlRouteSpecificFilterConfig {
 public:
   MockRoleBasedAccessControlRouteSpecificFilterConfig(
-      const envoy::config::filter::http::rbac::v2::RBACPerRoute& r)
+      const envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute& r)
       : RoleBasedAccessControlRouteSpecificFilterConfig(r){};
 
   MOCK_CONST_METHOD0(engine, Filters::Common::RBAC::RoleBasedAccessControlEngineImpl&());
diff --git a/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc b/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc
index ac753690e485..f67c4c309c90 100644
--- a/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc
+++ b/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -87,9 +87,8 @@ TEST_P(RBACIntegrationTest, Denied) {
 
 TEST_P(RBACIntegrationTest, DeniedWithPrefixRule) {
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& cfg) {
-        cfg.mutable_normalize_path()->set_value(false);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& cfg) { cfg.mutable_normalize_path()->set_value(false); });
   config_helper_.addFilter(RBAC_CONFIG_WITH_PREFIX_MATCH);
   initialize();
 
@@ -114,9 +113,8 @@ TEST_P(RBACIntegrationTest, DeniedWithPrefixRule) {
 
 TEST_P(RBACIntegrationTest, RbacPrefixRuleUseNormalizePath) {
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& cfg) {
-        cfg.mutable_normalize_path()->set_value(true);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& cfg) { cfg.mutable_normalize_path()->set_value(true); });
   config_helper_.addFilter(RBAC_CONFIG_WITH_PREFIX_MATCH);
   initialize();
 
@@ -161,18 +159,18 @@ TEST_P(RBACIntegrationTest, DeniedHeadReply) {
 }
 
 TEST_P(RBACIntegrationTest, RouteOverride) {
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& cfg) {
-        envoy::config::filter::http::rbac::v2::RBACPerRoute per_route_config;
-        TestUtility::loadFromJson("{}", per_route_config);
-
-        auto* config = cfg.mutable_route_config()
-                           ->mutable_virtual_hosts()
-                           ->Mutable(0)
-                           ->mutable_typed_per_filter_config();
-
-        (*config)[Extensions::HttpFilters::HttpFilterNames::get().Rbac].PackFrom(per_route_config);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& cfg) {
+    envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute per_route_config;
+    TestUtility::loadFromJson("{}", per_route_config);
+
+    auto* config = cfg.mutable_route_config()
+                       ->mutable_virtual_hosts()
+                       ->Mutable(0)
+                       ->mutable_typed_per_filter_config();
+
+    (*config)[Extensions::HttpFilters::HttpFilterNames::get().Rbac].PackFrom(per_route_config);
+  });
   config_helper_.addFilter(RBAC_CONFIG);
 
   initialize();
diff --git a/test/extensions/filters/http/rbac/rbac_filter_test.cc b/test/extensions/filters/http/rbac/rbac_filter_test.cc
index 875ee5edf2a2..c15155ebe8d6 100644
--- a/test/extensions/filters/http/rbac/rbac_filter_test.cc
+++ b/test/extensions/filters/http/rbac/rbac_filter_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/http/rbac/v3alpha/rbac.pb.h"
 
 #include "common/config/metadata.h"
 #include "common/network/utility.h"
@@ -27,22 +27,23 @@ namespace {
 class RoleBasedAccessControlFilterTest : public testing::Test {
 public:
   RoleBasedAccessControlFilterConfigSharedPtr setupConfig() {
-    envoy::config::filter::http::rbac::v2::RBAC config;
+    envoy::extensions::filters::http::rbac::v3alpha::RBAC config;
 
-    envoy::config::rbac::v2::Policy policy;
+    envoy::config::rbac::v3alpha::Policy policy;
     auto policy_rules = policy.add_permissions()->mutable_or_rules();
-    policy_rules->add_rules()->mutable_requested_server_name()->set_regex(".*cncf.io");
+    policy_rules->add_rules()->mutable_requested_server_name()->set_hidden_envoy_deprecated_regex(
+        ".*cncf.io");
     policy_rules->add_rules()->set_destination_port(123);
     policy.add_principals()->set_any(true);
-    config.mutable_rules()->set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+    config.mutable_rules()->set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
     (*config.mutable_rules()->mutable_policies())["foo"] = policy;
 
-    envoy::config::rbac::v2::Policy shadow_policy;
+    envoy::config::rbac::v3alpha::Policy shadow_policy;
     auto shadow_policy_rules = shadow_policy.add_permissions()->mutable_or_rules();
     shadow_policy_rules->add_rules()->mutable_requested_server_name()->set_exact("xyz.cncf.io");
     shadow_policy_rules->add_rules()->set_destination_port(456);
     shadow_policy.add_principals()->set_any(true);
-    config.mutable_shadow_rules()->set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+    config.mutable_shadow_rules()->set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
     (*config.mutable_shadow_rules()->mutable_policies())["bar"] = shadow_policy;
 
     return std::make_shared<RoleBasedAccessControlFilterConfig>(config, "test", store_);
@@ -141,8 +142,9 @@ TEST_F(RoleBasedAccessControlFilterTest, Denied) {
 TEST_F(RoleBasedAccessControlFilterTest, RouteLocalOverride) {
   setDestinationPort(456);
 
-  envoy::config::filter::http::rbac::v2::RBACPerRoute route_config;
-  route_config.mutable_rbac()->mutable_rules()->set_action(envoy::config::rbac::v2::RBAC::DENY);
+  envoy::extensions::filters::http::rbac::v3alpha::RBACPerRoute route_config;
+  route_config.mutable_rbac()->mutable_rules()->set_action(
+      envoy::config::rbac::v3alpha::RBAC::DENY);
   NiceMock<Filters::Common::RBAC::MockEngine> engine{route_config.rbac().rules()};
   NiceMock<MockRoleBasedAccessControlRouteSpecificFilterConfig> per_route_config_{route_config};
 
diff --git a/test/extensions/filters/http/router/BUILD b/test/extensions/filters/http/router/BUILD
index fb15c9c5f805..5f8c202c0409 100644
--- a/test/extensions/filters/http/router/BUILD
+++ b/test/extensions/filters/http/router/BUILD
@@ -19,6 +19,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/router:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/router/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/router/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/router/config_test.cc b/test/extensions/filters/http/router/config_test.cc
index 607fd06bcbc7..a7df8c3dd45b 100644
--- a/test/extensions/filters/http/router/config_test.cc
+++ b/test/extensions/filters/http/router/config_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
-#include "envoy/config/filter/http/router/v2/router.pb.h"
-#include "envoy/config/filter/http/router/v2/router.pb.validate.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/filters/http/router/config.h"
@@ -26,7 +26,7 @@ TEST(RouterFilterConfigTest, SimpleRouterFilterConfig) {
   start_child_span: true
   )EOF";
 
-  envoy::config::filter::http::router::v2::Router proto_config;
+  envoy::extensions::filters::http::router::v3alpha::Router proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   RouterFilterConfig factory;
@@ -42,7 +42,7 @@ TEST(RouterFilterConfigTest, BadRouterFilterConfig) {
   route: {}
   )EOF";
 
-  envoy::config::filter::http::router::v2::Router proto_config;
+  envoy::extensions::filters::http::router::v3alpha::Router proto_config;
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYaml(yaml_string, proto_config), EnvoyException,
                           "route: Cannot find field");
 }
@@ -53,7 +53,7 @@ TEST(RouterFilterConfigTest, RouterFilterWithUnsupportedStrictHeaderCheck) {
   - unsupportedHeader
   )EOF";
 
-  envoy::config::filter::http::router::v2::Router router_config;
+  envoy::extensions::filters::http::router::v3alpha::Router router_config;
   TestUtility::loadFromYaml(yaml, router_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -72,7 +72,7 @@ TEST(RouterFilterConfigTest, RouterFilterWithUnsupportedStrictHeaderCheck) {
 }
 
 TEST(RouterFilterConfigTest, RouterV2Filter) {
-  envoy::config::filter::http::router::v2::Router router_config;
+  envoy::extensions::filters::http::router::v3alpha::Router router_config;
   router_config.mutable_dynamic_stats()->set_value(true);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
diff --git a/test/extensions/filters/http/squash/BUILD b/test/extensions/filters/http/squash/BUILD
index 4cb807da79ec..232b63f43544 100644
--- a/test/extensions/filters/http/squash/BUILD
+++ b/test/extensions/filters/http/squash/BUILD
@@ -24,7 +24,7 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/config/filter/http/squash/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/squash/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -35,7 +35,7 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/http/squash:config",
         "//test/integration:http_integration_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -47,6 +47,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/http/squash:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/http/squash/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/squash/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/squash/config_test.cc b/test/extensions/filters/http/squash/config_test.cc
index deca536063ab..1751eecb9c9e 100644
--- a/test/extensions/filters/http/squash/config_test.cc
+++ b/test/extensions/filters/http/squash/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/http/squash/v2/squash.pb.h"
-#include "envoy/config/filter/http/squash/v2/squash.pb.validate.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.validate.h"
 
 #include "extensions/filters/http/squash/config.h"
 
@@ -27,7 +27,7 @@ TEST(SquashFilterConfigFactoryTest, SquashFilterCorrectYaml) {
   attachment_timeout: 3.003s
   )EOF";
 
-  envoy::config::filter::http::squash::v2::Squash proto_config;
+  envoy::extensions::filters::http::squash::v3alpha::Squash proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   SquashFilterConfigFactory factory;
diff --git a/test/extensions/filters/http/squash/squash_filter_integration_test.cc b/test/extensions/filters/http/squash/squash_filter_integration_test.cc
index 8949459ca36e..9c36756f9a3c 100644
--- a/test/extensions/filters/http/squash/squash_filter_integration_test.cc
+++ b/test/extensions/filters/http/squash/squash_filter_integration_test.cc
@@ -1,6 +1,6 @@
 #include <cstdlib>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -86,7 +86,7 @@ class SquashFilterIntegrationTest : public testing::TestWithParam<Network::Addre
 
     config_helper_.addFilter(ConfigHelper::DEFAULT_SQUASH_FILTER);
 
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* squash_cluster = bootstrap.mutable_static_resources()->add_clusters();
       squash_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
       squash_cluster->set_name("squash");
diff --git a/test/extensions/filters/http/squash/squash_filter_test.cc b/test/extensions/filters/http/squash/squash_filter_test.cc
index ffaa170b32e8..bca290c20ed0 100644
--- a/test/extensions/filters/http/squash/squash_filter_test.cc
+++ b/test/extensions/filters/http/squash/squash_filter_test.cc
@@ -2,7 +2,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/http/squash/v2/squash.pb.h"
+#include "envoy/extensions/filters/http/squash/v3alpha/squash.pb.h"
 
 #include "common/http/message_impl.h"
 #include "common/protobuf/protobuf.h"
@@ -34,7 +34,7 @@ namespace {
 
 SquashFilterConfig constructSquashFilterConfigFromYaml(
     const std::string& yaml, NiceMock<Envoy::Server::Configuration::MockFactoryContext>& context) {
-  envoy::config::filter::http::squash::v2::Squash proto_config;
+  envoy::extensions::filters::http::squash::v3alpha::Squash proto_config;
   TestUtility::loadFromYaml(yaml, proto_config);
   return SquashFilterConfig(proto_config, context.cluster_manager_);
 }
@@ -163,7 +163,7 @@ class SquashFilterTest : public testing::Test {
   void SetUp() override {}
 
   void initFilter() {
-    envoy::config::filter::http::squash::v2::Squash p;
+    envoy::extensions::filters::http::squash::v3alpha::Squash p;
     p.set_cluster("squash");
     config_ = std::make_shared<SquashFilterConfig>(p, factory_context_.cluster_manager_);
 
diff --git a/test/extensions/filters/http/tap/BUILD b/test/extensions/filters/http/tap/BUILD
index c8fae1227508..913955ab750e 100644
--- a/test/extensions/filters/http/tap/BUILD
+++ b/test/extensions/filters/http/tap/BUILD
@@ -53,7 +53,7 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/http/tap:config",
         "//test/integration:http_integration_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/http/tap/tap_filter_integration_test.cc b/test/extensions/filters/http/tap/tap_filter_integration_test.cc
index acfe538d0126..2e913fad78b2 100644
--- a/test/extensions/filters/http/tap/tap_filter_integration_test.cc
+++ b/test/extensions/filters/http/tap/tap_filter_integration_test.cc
@@ -1,7 +1,7 @@
 #include <fstream>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
 
 #include "test/integration/http_integration.h"
 
@@ -30,9 +30,9 @@ class TapIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     initialize();
   }
 
-  const envoy::api::v2::core::HeaderValue*
+  const envoy::config::core::v3alpha::HeaderValue*
   findHeader(const std::string& key,
-             const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValue>& headers) {
+             const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValue>& headers) {
     for (const auto& header : headers) {
       if (header.key() == key) {
         return &header;
@@ -99,7 +99,7 @@ class TapIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     return path_prefix;
   }
 
-  std::vector<envoy::data::tap::v2alpha::TraceWrapper>
+  std::vector<envoy::data::tap::v3alpha::TraceWrapper>
   readTracesFromFile(const std::string& path_prefix) {
     // Find the written .pb file and verify it.
     auto files = TestUtility::listFiles(path_prefix, false);
@@ -108,7 +108,7 @@ class TapIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     });
     EXPECT_NE(pb_file_name, files.end());
 
-    std::vector<envoy::data::tap::v2alpha::TraceWrapper> traces;
+    std::vector<envoy::data::tap::v3alpha::TraceWrapper> traces;
     std::ifstream pb_file(*pb_file_name, std::ios_base::binary);
     Protobuf::io::IstreamInputStream stream(&pb_file);
     Protobuf::io::CodedInputStream coded_stream(&stream);
@@ -196,7 +196,7 @@ name: envoy.filters.http.tap
                               [](const std::string& s) { return absl::EndsWith(s, ".pb"); });
   ASSERT_NE(pb_file, files.end());
 
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   TestUtility::loadFromFile(*pb_file, trace, *api_);
   EXPECT_TRUE(trace.has_http_buffered_trace());
 }
@@ -245,7 +245,7 @@ config_id: test_config_id
 
   // Wait for the tap message.
   admin_response_->waitForBodyData(1);
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   TestUtility::loadFromYaml(admin_response_->body(), trace);
   EXPECT_EQ(trace.http_buffered_trace().request().headers().size(), 8);
   EXPECT_EQ(trace.http_buffered_trace().response().headers().size(), 4);
@@ -341,7 +341,7 @@ config_id: test_config_id
   makeRequest(request_headers_no_tap_, {}, &request_trailers_, response_headers_no_tap_, {},
               &response_trailers_);
 
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   admin_response_->waitForBodyData(1);
   TestUtility::loadFromYaml(admin_response_->body(), trace);
   EXPECT_EQ("bar",
@@ -372,7 +372,7 @@ config_id: test_config_id
   codec_client_ = makeHttpConnection(makeClientConnection(lookupPort("http")));
   makeRequest(request_headers_no_tap_, {{"hello"}}, nullptr, response_headers_no_tap_, {{"world"}},
               nullptr);
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   admin_response_->waitForBodyData(1);
   TestUtility::loadFromYaml(admin_response_->body(), trace);
   EXPECT_EQ("hello", trace.http_buffered_trace().request().body().as_bytes());
@@ -404,7 +404,7 @@ config_id: test_config_id
   codec_client_ = makeHttpConnection(makeClientConnection(lookupPort("http")));
   makeRequest(request_headers_no_tap_, {{"hello"}}, nullptr, response_headers_no_tap_, {{"world"}},
               nullptr);
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   admin_response_->waitForBodyData(1);
   TestUtility::loadFromYaml(admin_response_->body(), trace);
   EXPECT_EQ("hello", trace.http_buffered_trace().request().body().as_string());
@@ -437,7 +437,7 @@ config_id: test_config_id
   codec_client_ = makeHttpConnection(makeClientConnection(lookupPort("http")));
   makeRequest(request_headers_no_tap_, {{"hello"}}, nullptr, response_headers_no_tap_, {{"world"}},
               nullptr);
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   admin_response_->waitForBodyData(1);
   TestUtility::loadFromYaml(admin_response_->body(), trace);
   EXPECT_EQ("hel", trace.http_buffered_trace().request().body().as_bytes());
@@ -481,7 +481,7 @@ name: envoy.filters.http.tap
   codec_client_->close();
   test_server_->waitForCounterGe("http.config_test.downstream_cx_destroy", 1);
 
-  std::vector<envoy::data::tap::v2alpha::TraceWrapper> traces = readTracesFromFile(path_prefix);
+  std::vector<envoy::data::tap::v3alpha::TraceWrapper> traces = readTracesFromFile(path_prefix);
   ASSERT_EQ(6, traces.size());
   EXPECT_TRUE(traces[0].http_streamed_trace_segment().has_request_headers());
   EXPECT_EQ("hello", traces[1].http_streamed_trace_segment().request_body_chunk().as_bytes());
@@ -526,7 +526,7 @@ name: envoy.filters.http.tap
   codec_client_->close();
   test_server_->waitForCounterGe("http.config_test.downstream_cx_destroy", 1);
 
-  std::vector<envoy::data::tap::v2alpha::TraceWrapper> traces = readTracesFromFile(path_prefix);
+  std::vector<envoy::data::tap::v3alpha::TraceWrapper> traces = readTracesFromFile(path_prefix);
   ASSERT_EQ(6, traces.size());
   EXPECT_TRUE(traces[0].http_streamed_trace_segment().has_request_headers());
   EXPECT_EQ("hello", traces[1].http_streamed_trace_segment().request_body_chunk().as_bytes());
diff --git a/test/extensions/filters/listener/original_src/BUILD b/test/extensions/filters/listener/original_src/BUILD
index 9c0c2cc249ef..2b2cfe44214f 100644
--- a/test/extensions/filters/listener/original_src/BUILD
+++ b/test/extensions/filters/listener/original_src/BUILD
@@ -17,7 +17,7 @@ envoy_extension_cc_test(
     extension_name = "envoy.filters.listener.original_src",
     deps = [
         "//source/extensions/filters/listener/original_src:config_lib",
-        "@envoy_api//envoy/config/filter/listener/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/listener/original_src/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,7 +44,7 @@ envoy_extension_cc_test(
         "//test/mocks/buffer:buffer_mocks",
         "//test/mocks/network:network_mocks",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/listener/original_src/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/listener/original_src/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/listener/original_src/config_test.cc b/test/extensions/filters/listener/original_src/config_test.cc
index 08cdb4acfeb6..c903a1e47fea 100644
--- a/test/extensions/filters/listener/original_src/config_test.cc
+++ b/test/extensions/filters/listener/original_src/config_test.cc
@@ -1,6 +1,6 @@
 #include <numeric>
 
-#include "envoy/config/filter/listener/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/extensions/filters/listener/original_src/v3alpha/original_src.pb.h"
 
 #include "extensions/filters/listener/original_src/config.h"
 
@@ -17,13 +17,14 @@ namespace {
 class OriginalSrcConfigTest : public testing::Test {
 public:
   Config makeConfigFromProto(
-      const envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc& proto_config) {
+      const envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc&
+          proto_config) {
     return {proto_config};
   }
 };
 
 TEST_F(OriginalSrcConfigTest, TestUsePortTrue) {
-  envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_bind_port(true);
   auto config = makeConfigFromProto(config_proto);
 
@@ -31,7 +32,7 @@ TEST_F(OriginalSrcConfigTest, TestUsePortTrue) {
 }
 
 TEST_F(OriginalSrcConfigTest, TestUsePortFalse) {
-  envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_bind_port(false);
   auto config = makeConfigFromProto(config_proto);
 
@@ -39,7 +40,7 @@ TEST_F(OriginalSrcConfigTest, TestUsePortFalse) {
 }
 
 TEST_F(OriginalSrcConfigTest, TestUseMark0) {
-  envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_mark(0);
   auto config = makeConfigFromProto(config_proto);
 
@@ -47,7 +48,7 @@ TEST_F(OriginalSrcConfigTest, TestUseMark0) {
 }
 
 TEST_F(OriginalSrcConfigTest, TestUseMark1234) {
-  envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_mark(1234);
   auto config = makeConfigFromProto(config_proto);
 
@@ -55,7 +56,7 @@ TEST_F(OriginalSrcConfigTest, TestUseMark1234) {
 }
 
 TEST_F(OriginalSrcConfigTest, TestUseMarkMax) {
-  envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc config_proto;
+  envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc config_proto;
   config_proto.set_mark(std::numeric_limits<uint32_t>::max());
   auto config = makeConfigFromProto(config_proto);
 
diff --git a/test/extensions/filters/listener/original_src/original_src_test.cc b/test/extensions/filters/listener/original_src/original_src_test.cc
index bdad2f8f3566..30620b728656 100644
--- a/test/extensions/filters/listener/original_src/original_src_test.cc
+++ b/test/extensions/filters/listener/original_src/original_src_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/listener/original_src/v2alpha1/original_src.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/listener/original_src/v3alpha/original_src.pb.h"
 
 #include "common/network/socket_option_impl.h"
 #include "common/network/utility.h"
@@ -31,7 +31,7 @@ class OriginalSrcTest : public testing::Test {
   }
 
   std::unique_ptr<OriginalSrcFilter> makeMarkingFilter(uint32_t mark) {
-    envoy::config::filter::listener::original_src::v2alpha1::OriginalSrc proto_config;
+    envoy::extensions::filters::listener::original_src::v3alpha::OriginalSrc proto_config;
     proto_config.set_mark(mark);
 
     Config config(proto_config);
@@ -48,7 +48,7 @@ class OriginalSrcTest : public testing::Test {
 
   absl::optional<Network::Socket::Option::Details>
   findOptionDetails(const Network::Socket::Options& options, Network::SocketOptionName name,
-                    envoy::api::v2::core::SocketOption::SocketState state) {
+                    envoy::config::core::v3alpha::SocketOption::SocketState state) {
     for (const auto& option : options) {
       auto details = option->getOptionDetails(callbacks_.socket_, state);
       if (details.has_value() && details->name_ == name) {
@@ -82,7 +82,7 @@ TEST_F(OriginalSrcTest, onNewConnectionIpv4AddressAddsOption) {
 
   NiceMock<Network::MockConnectionSocket> socket;
   EXPECT_CALL(socket, setLocalAddress(PointeesEq(callbacks_.socket_.remote_address_)));
-  options->at(0)->setOption(socket, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  options->at(0)->setOption(socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 }
 
 TEST_F(OriginalSrcTest, onNewConnectionIpv4AddressUsesCorrectAddress) {
@@ -115,7 +115,7 @@ TEST_F(OriginalSrcTest, onNewConnectionIpv4AddressBleachesPort) {
 
   // not ideal -- we're assuming that the original_src option is first, but it's a fair assumption
   // for now.
-  options->at(0)->setOption(socket, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  options->at(0)->setOption(socket, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 }
 
 TEST_F(OriginalSrcTest, filterAddsTransparentOption) {
@@ -131,8 +131,9 @@ TEST_F(OriginalSrcTest, filterAddsTransparentOption) {
 
   filter->onAccept(callbacks_);
 
-  auto transparent_option = findOptionDetails(*options, ENVOY_SOCKET_IP_TRANSPARENT,
-                                              envoy::api::v2::core::SocketOption::STATE_PREBIND);
+  auto transparent_option =
+      findOptionDetails(*options, ENVOY_SOCKET_IP_TRANSPARENT,
+                        envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   EXPECT_TRUE(transparent_option.has_value());
 }
@@ -151,7 +152,7 @@ TEST_F(OriginalSrcTest, filterAddsMarkOption) {
   filter->onAccept(callbacks_);
 
   auto mark_option = findOptionDetails(*options, ENVOY_SOCKET_SO_MARK,
-                                       envoy::api::v2::core::SocketOption::STATE_PREBIND);
+                                       envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   ASSERT_TRUE(mark_option.has_value());
   uint32_t value = 1234;
@@ -173,7 +174,7 @@ TEST_F(OriginalSrcTest, Mark0NotAdded) {
   filter->onAccept(callbacks_);
 
   auto mark_option = findOptionDetails(*options, ENVOY_SOCKET_SO_MARK,
-                                       envoy::api::v2::core::SocketOption::STATE_PREBIND);
+                                       envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
 
   ASSERT_FALSE(mark_option.has_value());
 }
diff --git a/test/extensions/filters/listener/proxy_protocol/BUILD b/test/extensions/filters/listener/proxy_protocol/BUILD
index 716612d0ac09..de27d5b55454 100644
--- a/test/extensions/filters/listener/proxy_protocol/BUILD
+++ b/test/extensions/filters/listener/proxy_protocol/BUILD
@@ -33,6 +33,6 @@ envoy_extension_cc_test(
         "//test/test_common:network_utility_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/listener/proxy_protocol/proxy_protocol_test.cc b/test/extensions/filters/listener/proxy_protocol/proxy_protocol_test.cc
index f831e3346edb..1bc8a22b22df 100644
--- a/test/extensions/filters/listener/proxy_protocol/proxy_protocol_test.cc
+++ b/test/extensions/filters/listener/proxy_protocol/proxy_protocol_test.cc
@@ -2,7 +2,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -83,8 +83,8 @@ class ProxyProtocolTest : public testing::TestWithParam<Network::Address::IpVers
   uint64_t listenerTag() const override { return 1; }
   const std::string& name() const override { return name_; }
   const Network::ActiveUdpListenerFactory* udpListenerFactory() override { return nullptr; }
-  envoy::api::v2::core::TrafficDirection direction() const override {
-    return envoy::api::v2::core::TrafficDirection::UNSPECIFIED;
+  envoy::config::core::v3alpha::TrafficDirection direction() const override {
+    return envoy::config::core::v3alpha::UNSPECIFIED;
   }
   Network::ConnectionBalancer& connectionBalancer() override { return connection_balancer_; }
 
@@ -947,8 +947,8 @@ class WildcardProxyProtocolTest : public testing::TestWithParam<Network::Address
   uint64_t listenerTag() const override { return 1; }
   const std::string& name() const override { return name_; }
   const Network::ActiveUdpListenerFactory* udpListenerFactory() override { return nullptr; }
-  envoy::api::v2::core::TrafficDirection direction() const override {
-    return envoy::api::v2::core::TrafficDirection::UNSPECIFIED;
+  envoy::config::core::v3alpha::TrafficDirection direction() const override {
+    return envoy::config::core::v3alpha::UNSPECIFIED;
   }
   Network::ConnectionBalancer& connectionBalancer() override { return connection_balancer_; }
 
diff --git a/test/extensions/filters/network/client_ssl_auth/BUILD b/test/extensions/filters/network/client_ssl_auth/BUILD
index df44e6910d52..a2ba6ba3369a 100644
--- a/test/extensions/filters/network/client_ssl_auth/BUILD
+++ b/test/extensions/filters/network/client_ssl_auth/BUILD
@@ -25,7 +25,7 @@ envoy_extension_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/client_ssl_auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/client_ssl_auth/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -37,6 +37,6 @@ envoy_extension_cc_test(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/network/client_ssl_auth:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/network/client_ssl_auth/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/client_ssl_auth/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc b/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc
index 8f1f81b1593b..aead265d9c9d 100644
--- a/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc
+++ b/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc
@@ -2,7 +2,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.h"
 
 #include "common/http/message_impl.h"
 #include "common/network/address_impl.h"
@@ -49,7 +49,7 @@ auth_api_cluster: fake_cluster
 test: a
   )EOF";
 
-  envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth proto_config{};
+  envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth proto_config{};
   EXPECT_THROW(TestUtility::loadFromYaml(yaml, proto_config), EnvoyException);
 }
 
@@ -72,7 +72,7 @@ stat_prefix: vpn
   prefix_len: 64
     )EOF";
 
-    envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth proto_config{};
+    envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth proto_config{};
     TestUtility::loadFromYaml(yaml, proto_config);
     EXPECT_CALL(cm_, get(Eq("vpn")));
     setupRequest();
@@ -124,7 +124,7 @@ auth_api_cluster: bad_cluster
 stat_prefix: bad_cluster
   )EOF";
 
-  envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth proto_config{};
+  envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth proto_config{};
   TestUtility::loadFromYaml(yaml, proto_config);
   EXPECT_CALL(cm_, get(Eq("bad_cluster"))).WillOnce(Return(nullptr));
   EXPECT_THROW(
diff --git a/test/extensions/filters/network/client_ssl_auth/config_test.cc b/test/extensions/filters/network/client_ssl_auth/config_test.cc
index 02dc012014c8..fd32f1033768 100644
--- a/test/extensions/filters/network/client_ssl_auth/config_test.cc
+++ b/test/extensions/filters/network/client_ssl_auth/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.h"
-#include "envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.pb.validate.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.h"
+#include "envoy/extensions/filters/network/client_ssl_auth/v3alpha/client_ssl_auth.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -41,7 +41,7 @@ auth_api_cluster: fake_cluster
 ip_white_list:
 )EOF" + GetParam();
 
-  envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth proto_config;
+  envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth proto_config;
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   ClientSslAuthConfigFactory factory;
@@ -58,7 +58,7 @@ auth_api_cluster: fake_cluster
 ip_white_list:
 )EOF" + GetParam();
 
-  envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth proto_config;
+  envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth proto_config;
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   ClientSslAuthConfigFactory factory;
@@ -77,8 +77,8 @@ auth_api_cluster: fake_cluster
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
   ClientSslAuthConfigFactory factory;
-  envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth proto_config =
-      *dynamic_cast<envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth*>(
+  envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth proto_config =
+      *dynamic_cast<envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth*>(
           factory.createEmptyConfigProto().get());
 
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
@@ -90,9 +90,10 @@ auth_api_cluster: fake_cluster
 
 TEST(ClientSslAuthConfigFactoryTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_THROW(ClientSslAuthConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::client_ssl_auth::v2::ClientSSLAuth(), context),
-               ProtoValidationException);
+  EXPECT_THROW(
+      ClientSslAuthConfigFactory().createFilterFactoryFromProto(
+          envoy::extensions::filters::network::client_ssl_auth::v3alpha::ClientSSLAuth(), context),
+      ProtoValidationException);
 }
 
 TEST(ClientSslAuthConfigFactoryTest, DoubleRegistrationTest) {
diff --git a/test/extensions/filters/network/common/redis/BUILD b/test/extensions/filters/network/common/redis/BUILD
index 0b7cb824a581..78142e993a4b 100644
--- a/test/extensions/filters/network/common/redis/BUILD
+++ b/test/extensions/filters/network/common/redis/BUILD
@@ -26,7 +26,7 @@ envoy_cc_test_library(
     hdrs = ["test_utils.h"],
     deps = [
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -56,6 +56,6 @@ envoy_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/common/redis/client_impl_test.cc b/test/extensions/filters/network/common/redis/client_impl_test.cc
index 682e944c2b3c..863b09bd7ed9 100644
--- a/test/extensions/filters/network/common/redis/client_impl_test.cc
+++ b/test/extensions/filters/network/common/redis/client_impl_test.cc
@@ -1,6 +1,6 @@
 #include <vector>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/network/utility.h"
@@ -102,9 +102,8 @@ class RedisClientImplTest : public testing::Test, public Common::Redis::DecoderF
     client_impl->onRespValue(std::move(response1));
   }
 
-  void testInitializeReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ReadPolicy
-          read_policy) {
+  void testInitializeReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::
+                                    RedisProxy::ConnPoolSettings::ReadPolicy read_policy) {
     InSequence s;
 
     setup(std::make_unique<ConfigImpl>(createConnPoolSettings(20, true, true, 100, read_policy)));
@@ -355,23 +354,23 @@ TEST_F(RedisClientImplTest, InitializedWithAuthPassword) {
 }
 
 TEST_F(RedisClientImplTest, InitializedWithPreferMasterReadPolicy) {
-  testInitializeReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::PREFER_MASTER);
+  testInitializeReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                               ConnPoolSettings::PREFER_MASTER);
 }
 
 TEST_F(RedisClientImplTest, InitializedWithReplicaReadPolicy) {
-  testInitializeReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::REPLICA);
+  testInitializeReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                               ConnPoolSettings::REPLICA);
 }
 
 TEST_F(RedisClientImplTest, InitializedWithPreferReplicaReadPolicy) {
-  testInitializeReadPolicy(envoy::config::filter::network::redis_proxy::v2::RedisProxy::
+  testInitializeReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
                                ConnPoolSettings::PREFER_REPLICA);
 }
 
 TEST_F(RedisClientImplTest, InitializedWithAnyReadPolicy) {
   testInitializeReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ANY);
+      envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::ANY);
 }
 
 TEST_F(RedisClientImplTest, Cancel) {
diff --git a/test/extensions/filters/network/common/redis/test_utils.h b/test/extensions/filters/network/common/redis/test_utils.h
index 52fbc6ade199..ca5bfde70297 100644
--- a/test/extensions/filters/network/common/redis/test_utils.h
+++ b/test/extensions/filters/network/common/redis/test_utils.h
@@ -4,7 +4,7 @@
 #include <list>
 #include <string>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -15,14 +15,14 @@ namespace Common {
 namespace Redis {
 namespace Client {
 
-inline envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings
-createConnPoolSettings(
-    int64_t millis = 20, bool hashtagging = true, bool redirection_support = true,
-    uint32_t max_unknown_conns = 100,
-    envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ReadPolicy
-        read_policy =
-            envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::MASTER) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings setting{};
+inline envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings
+createConnPoolSettings(int64_t millis = 20, bool hashtagging = true,
+                       bool redirection_support = true, uint32_t max_unknown_conns = 100,
+                       envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                           ConnPoolSettings::ReadPolicy read_policy =
+                               envoy::extensions::filters::network::redis_proxy::v3alpha::
+                                   RedisProxy::ConnPoolSettings::MASTER) {
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings setting{};
   setting.mutable_op_timeout()->CopyFrom(Protobuf::util::TimeUtil::MillisecondsToDuration(millis));
   setting.set_enable_hashtagging(hashtagging);
   setting.set_enable_redirection(redirection_support);
diff --git a/test/extensions/filters/network/dubbo_proxy/BUILD b/test/extensions/filters/network/dubbo_proxy/BUILD
index d56f5a21aa3e..2e8f457efc98 100644
--- a/test/extensions/filters/network/dubbo_proxy/BUILD
+++ b/test/extensions/filters/network/dubbo_proxy/BUILD
@@ -91,7 +91,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/dubbo_proxy/filters:filter_config_interface",
         "//test/mocks/server:server_mocks",
         "//test/test_common:registry_lib",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -113,7 +113,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/dubbo_proxy:metadata_lib",
         "//source/extensions/filters/network/dubbo_proxy/router:route_matcher",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -157,7 +157,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/dubbo_proxy/filters:well_known_names",
         "//source/extensions/filters/network/dubbo_proxy/router:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/dubbo/router/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/router/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -185,6 +185,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/dubbo_proxy:dubbo_hessian2_serializer_impl_lib",
         "//source/extensions/filters/network/dubbo_proxy:dubbo_protocol_impl_lib",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/dubbo_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/dubbo_proxy/config_test.cc b/test/extensions/filters/network/dubbo_proxy/config_test.cc
index ecac96786272..59c92c263846 100644
--- a/test/extensions/filters/network/dubbo_proxy/config_test.cc
+++ b/test/extensions/filters/network/dubbo_proxy/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.validate.h"
 
 #include "extensions/filters/network/dubbo_proxy/config.h"
 #include "extensions/filters/network/dubbo_proxy/filters/filter_config.h"
@@ -18,7 +18,7 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace DubboProxy {
 
-using DubboProxyProto = envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy;
+using DubboProxyProto = envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy;
 
 namespace {
 
@@ -49,13 +49,14 @@ class DubboFilterConfigTest : public DubboFilterConfigTestBase, public testing::
 
 TEST_F(DubboFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_THROW(DubboProxyFilterConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy(), context),
-               ProtoValidationException);
+  EXPECT_THROW(
+      DubboProxyFilterConfigFactory().createFilterFactoryFromProto(
+          envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy(), context),
+      ProtoValidationException);
 }
 
 TEST_F(DubboFilterConfigTest, ValidProtoConfiguration) {
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy config{};
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy config{};
 
   config.set_stat_prefix("my_stat_prefix");
 
@@ -71,8 +72,8 @@ TEST_F(DubboFilterConfigTest, ValidProtoConfiguration) {
 TEST_F(DubboFilterConfigTest, DubboProxyWithEmptyProto) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   DubboProxyFilterConfigFactory factory;
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy config =
-      *dynamic_cast<envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy*>(
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy config =
+      *dynamic_cast<envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy*>(
           factory.createEmptyConfigProto().get());
   config.set_stat_prefix("my_stat_prefix");
 
diff --git a/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc b/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc
index f37ced3f9d0b..d93ebe976446 100644
--- a/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc
+++ b/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.validate.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -30,7 +30,7 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace DubboProxy {
 
-using ConfigDubboProxy = envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy;
+using ConfigDubboProxy = envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy;
 
 class ConnectionManagerTest;
 class TestConfigImpl : public ConfigImpl {
diff --git a/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc b/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc
index 2c4261e8f9c2..692b57eddbce 100644
--- a/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc
+++ b/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.pb.validate.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/route.pb.h"
-#include "envoy/config/filter/network/dubbo_proxy/v2alpha1/route.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/dubbo_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/route.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/v3alpha/route.pb.validate.h"
 
 #include "common/protobuf/protobuf.h"
 
@@ -20,17 +20,17 @@ namespace DubboProxy {
 namespace Router {
 namespace {
 
-envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration
+envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration
 parseRouteConfigurationFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration route_config;
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration route_config;
   TestUtility::loadFromYaml(yaml, route_config);
   TestUtility::validate(route_config);
   return route_config;
 }
 
-envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy
+envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy
 parseDubboProxyFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy config;
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy config;
   TestUtility::loadFromYaml(yaml, config);
   TestUtility::validate(config);
   return config;
@@ -54,7 +54,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-    envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
         parseRouteConfigurationFromV2Yaml(yaml);
 
     NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -103,7 +103,7 @@ group: test
         cluster: user_service_dubbo_server
 )EOF";
 
-    envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
         parseRouteConfigurationFromV2Yaml(yaml);
 
     NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -139,7 +139,7 @@ version: 1.0.0
         cluster: user_service_dubbo_server
 )EOF";
 
-    envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
         parseRouteConfigurationFromV2Yaml(yaml);
 
     NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -180,7 +180,7 @@ group: HSF
         cluster: user_service_dubbo_server
 )EOF";
 
-    envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
         parseRouteConfigurationFromV2Yaml(yaml);
 
     NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -216,7 +216,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -247,7 +247,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -278,7 +278,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -314,7 +314,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -353,7 +353,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -383,7 +383,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -416,7 +416,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -470,7 +470,7 @@ serialization_type: Hessian2
             cluster: format_service
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy config =
       parseDubboProxyFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -484,7 +484,7 @@ serialization_type: Hessian2
   EXPECT_EQ("user_service_dubbo_server", matcher.route(metadata, 0)->routeEntry()->clusterName());
 
   {
-    envoy::config::filter::network::dubbo_proxy::v2alpha1::DubboProxy invalid_config;
+    envoy::extensions::filters::network::dubbo_proxy::v3alpha::DubboProxy invalid_config;
     MultiRouteMatcher matcher(invalid_config.route_config(), context);
     EXPECT_EQ(nullptr, matcher.route(metadata, 0));
   }
@@ -506,7 +506,7 @@ interface: org.apache.dubbo.demo.DemoService
         cluster: user_service_dubbo_server
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -567,7 +567,7 @@ interface: org.apache.dubbo.demo.DemoService
             weight: 5000
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   auto invo = std::make_shared<RpcInvocationImpl>();
   MessageMetadata metadata;
@@ -620,7 +620,7 @@ name: config
             weight: 5000
 )EOF";
 
-  envoy::config::filter::network::dubbo_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::dubbo_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(SingleRouteMatcherImpl m(config, context), EnvoyException);
diff --git a/test/extensions/filters/network/dubbo_proxy/router_filter_config_test.cc b/test/extensions/filters/network/dubbo_proxy/router_filter_config_test.cc
index 86fe835183e4..de534272538c 100644
--- a/test/extensions/filters/network/dubbo_proxy/router_filter_config_test.cc
+++ b/test/extensions/filters/network/dubbo_proxy/router_filter_config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/dubbo/router/v2alpha1/router.pb.h"
-#include "envoy/config/filter/dubbo/router/v2alpha1/router.pb.validate.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/network/dubbo_proxy/router/v3alpha/router.pb.validate.h"
 
 #include "extensions/filters/network/dubbo_proxy/filters/well_known_names.h"
 #include "extensions/filters/network/dubbo_proxy/router/config.h"
@@ -19,7 +19,7 @@ namespace DubboProxy {
 namespace Router {
 
 TEST(DubboProxyRouterFilterConfigTest, RouterV2Alpha1Filter) {
-  envoy::config::filter::dubbo::router::v2alpha1::Router router_config;
+  envoy::extensions::filters::network::dubbo_proxy::router::v3alpha::Router router_config;
   NiceMock<Server::Configuration::MockFactoryContext> context;
   RouterFilterConfig factory;
   DubboFilters::FilterFactoryCb cb =
diff --git a/test/extensions/filters/network/ext_authz/BUILD b/test/extensions/filters/network/ext_authz/BUILD
index 3697dc3b9fd5..b5170eded066 100644
--- a/test/extensions/filters/network/ext_authz/BUILD
+++ b/test/extensions/filters/network/ext_authz/BUILD
@@ -28,7 +28,7 @@ envoy_extension_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/tracing:tracing_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/filter/network/ext_authz/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ext_authz/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,7 +39,7 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/network/ext_authz:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/ext_authz/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ext_authz/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/ext_authz/config_test.cc b/test/extensions/filters/network/ext_authz/config_test.cc
index 796175bb356d..8d5b5e02f293 100644
--- a/test/extensions/filters/network/ext_authz/config_test.cc
+++ b/test/extensions/filters/network/ext_authz/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.validate.h"
 #include "envoy/stats/scope.h"
 
 #include "extensions/filters/network/ext_authz/config.h"
@@ -21,7 +21,7 @@ namespace ExtAuthz {
 TEST(ExtAuthzFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(ExtAuthzConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::ext_authz::v2::ExtAuthz(), context),
+                   envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz(), context),
                ProtoValidationException);
 }
 
@@ -42,7 +42,7 @@ TEST(ExtAuthzFilterConfigTest, ExtAuthzCorrectProto) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
   EXPECT_CALL(context.cluster_manager_.async_client_manager_, factoryForGrpcService(_, _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         return std::make_unique<NiceMock<Grpc::MockAsyncClientFactory>>();
       }));
   Network::FilterFactoryCb cb = factory.createFilterFactoryFromProto(*proto_config, context);
diff --git a/test/extensions/filters/network/ext_authz/ext_authz_test.cc b/test/extensions/filters/network/ext_authz/ext_authz_test.cc
index 1ada6ef207f9..f75ac9480791 100644
--- a/test/extensions/filters/network/ext_authz/ext_authz_test.cc
+++ b/test/extensions/filters/network/ext_authz/ext_authz_test.cc
@@ -2,8 +2,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.h"
-#include "envoy/config/filter/network/ext_authz/v2/ext_authz.pb.validate.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.h"
+#include "envoy/extensions/filters/network/ext_authz/v3alpha/ext_authz.pb.validate.h"
 #include "envoy/stats/stats.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -48,7 +48,7 @@ class ExtAuthzFilterTest : public testing::Test {
     }
     )EOF";
 
-    envoy::config::filter::network::ext_authz::v2::ExtAuthz proto_config{};
+    envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz proto_config{};
     TestUtility::loadFromJson(json, proto_config);
     config_.reset(new Config(proto_config, stats_store_));
     client_ = new Filters::Common::ExtAuthz::MockClient();
@@ -92,12 +92,13 @@ TEST_F(ExtAuthzFilterTest, BadExtAuthzConfig) {
   }
   )EOF";
 
-  envoy::config::filter::network::ext_authz::v2::ExtAuthz proto_config{};
+  envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz proto_config{};
   TestUtility::loadFromJson(json_string, proto_config);
 
-  EXPECT_THROW(TestUtility::downcastAndValidate<
-                   const envoy::config::filter::network::ext_authz::v2::ExtAuthz&>(proto_config),
-               ProtoValidationException);
+  EXPECT_THROW(
+      TestUtility::downcastAndValidate<
+          const envoy::extensions::filters::network::ext_authz::v3alpha::ExtAuthz&>(proto_config),
+      ProtoValidationException);
 }
 
 TEST_F(ExtAuthzFilterTest, OKWithOnData) {
diff --git a/test/extensions/filters/network/http_connection_manager/BUILD b/test/extensions/filters/network/http_connection_manager/BUILD
index 4d3278aed0c2..92fbd946dc65 100644
--- a/test/extensions/filters/network/http_connection_manager/BUILD
+++ b/test/extensions/filters/network/http_connection_manager/BUILD
@@ -27,8 +27,8 @@ envoy_extension_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/http_connection_manager/config_test.cc b/test/extensions/filters/network/http_connection_manager/config_test.cc
index d4c9af71d728..a34ef8174e41 100644
--- a/test/extensions/filters/network/http_connection_manager/config_test.cc
+++ b/test/extensions/filters/network/http_connection_manager/config_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.validate.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/http/date_provider_impl.h"
@@ -28,9 +28,9 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace HttpConnectionManager {
 
-envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager
+envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
 parseHttpConnectionManagerFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager
       http_connection_manager;
   TestUtility::loadFromYamlAndValidate(yaml, http_connection_manager);
   return http_connection_manager;
@@ -49,11 +49,11 @@ class HttpConnectionManagerConfigTest : public testing::Test {
 };
 
 TEST_F(HttpConnectionManagerConfigTest, ValidateFail) {
-  EXPECT_THROW(
-      HttpConnectionManagerFilterConfigFactory().createFilterFactoryFromProto(
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager(),
-          context_),
-      ProtoValidationException);
+  EXPECT_THROW(HttpConnectionManagerFilterConfigFactory().createFilterFactoryFromProto(
+                   envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                       HttpConnectionManager(),
+                   context_),
+               ProtoValidationException);
 }
 
 TEST_F(HttpConnectionManagerConfigTest, InvalidFilterName) {
@@ -249,8 +249,7 @@ stat_prefix: router
 - name: envoy.router
   )EOF";
 
-  ON_CALL(context_, direction())
-      .WillByDefault(Return(envoy::api::v2::core::TrafficDirection::OUTBOUND));
+  ON_CALL(context_, direction()).WillByDefault(Return(envoy::config::core::v3alpha::OUTBOUND));
   HttpConnectionManagerConfig config(parseHttpConnectionManagerFromV2Yaml(yaml_string), context_,
                                      date_provider_, route_config_provider_manager_,
                                      scoped_routes_config_provider_manager_);
@@ -276,8 +275,7 @@ stat_prefix: router
 - name: envoy.router
   )EOF";
 
-  ON_CALL(context_, direction())
-      .WillByDefault(Return(envoy::api::v2::core::TrafficDirection::INBOUND));
+  ON_CALL(context_, direction()).WillByDefault(Return(envoy::config::core::v3alpha::INBOUND));
   HttpConnectionManagerConfig config(parseHttpConnectionManagerFromV2Yaml(yaml_string), context_,
                                      date_provider_, route_config_provider_manager_,
                                      scoped_routes_config_provider_manager_);
@@ -303,13 +301,13 @@ TEST_F(HttpConnectionManagerConfigTest, SamplingDefault) {
 
   EXPECT_EQ(100, config.tracingConfig()->client_sampling_.numerator());
   EXPECT_EQ(Tracing::DefaultMaxPathTagLength, config.tracingConfig()->max_path_tag_length_);
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED,
             config.tracingConfig()->client_sampling_.denominator());
   EXPECT_EQ(10000, config.tracingConfig()->random_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::TEN_THOUSAND,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND,
             config.tracingConfig()->random_sampling_.denominator());
   EXPECT_EQ(100, config.tracingConfig()->overall_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED,
             config.tracingConfig()->overall_sampling_.denominator());
 }
 
@@ -337,13 +335,13 @@ TEST_F(HttpConnectionManagerConfigTest, SamplingConfigured) {
                                      scoped_routes_config_provider_manager_);
 
   EXPECT_EQ(1, config.tracingConfig()->client_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED,
             config.tracingConfig()->client_sampling_.denominator());
   EXPECT_EQ(200, config.tracingConfig()->random_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::TEN_THOUSAND,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND,
             config.tracingConfig()->random_sampling_.denominator());
   EXPECT_EQ(3, config.tracingConfig()->overall_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED,
             config.tracingConfig()->overall_sampling_.denominator());
 }
 
@@ -371,13 +369,13 @@ TEST_F(HttpConnectionManagerConfigTest, FractionalSamplingConfigured) {
                                      scoped_routes_config_provider_manager_);
 
   EXPECT_EQ(0, config.tracingConfig()->client_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED,
             config.tracingConfig()->client_sampling_.denominator());
   EXPECT_EQ(20, config.tracingConfig()->random_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::TEN_THOUSAND,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::TEN_THOUSAND,
             config.tracingConfig()->random_sampling_.denominator());
   EXPECT_EQ(0, config.tracingConfig()->overall_sampling_.numerator());
-  EXPECT_EQ(envoy::type::FractionalPercent::HUNDRED,
+  EXPECT_EQ(envoy::type::v3alpha::FractionalPercent::HUNDRED,
             config.tracingConfig()->overall_sampling_.denominator());
 }
 
@@ -906,7 +904,7 @@ stat_prefix: my_stat_prefix
         cluster: fake_cluster
 http_filters:
 - name: envoy.http_dynamo_filter
-  config: {}
+  typed_config: {}
 access_log:
 - name: envoy.file_access_log
   typed_config:
@@ -936,7 +934,7 @@ stat_prefix: my_stat_prefix
         cluster: fake_cluster
 http_filters:
 - name: envoy.http_dynamo_filter
-  config: {}
+  typed_config: {}
 access_log:
 - name: envoy.file_access_log
   typed_config:
diff --git a/test/extensions/filters/network/local_ratelimit/BUILD b/test/extensions/filters/network/local_ratelimit/BUILD
index 24170c575cc7..7ad1931b56ae 100644
--- a/test/extensions/filters/network/local_ratelimit/BUILD
+++ b/test/extensions/filters/network/local_ratelimit/BUILD
@@ -20,7 +20,7 @@ envoy_extension_cc_test(
         "//test/mocks/event:event_mocks",
         "//test/mocks/network:network_mocks",
         "//test/mocks/runtime:runtime_mocks",
-        "@envoy_api//envoy/config/filter/network/local_rate_limit/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/network/local_rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc b/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc
index 4bd980619e55..ea545db20bec 100644
--- a/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc
+++ b/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc
@@ -1,4 +1,5 @@
-#include "envoy/config/filter/network/local_rate_limit/v2alpha/local_rate_limit.pb.validate.h"
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.h"
+#include "envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.pb.validate.h"
 
 #include "common/stats/isolated_store_impl.h"
 
@@ -24,7 +25,7 @@ namespace LocalRateLimitFilter {
 class LocalRateLimitTestBase : public testing::Test {
 public:
   void initialize(const std::string& filter_yaml, bool expect_timer_create = true) {
-    envoy::config::filter::network::local_rate_limit::v2alpha::LocalRateLimit proto_config;
+    envoy::config::filter::network::local_rate_limit::v3alpha::LocalRateLimit proto_config;
     TestUtility::loadFromYamlAndValidate(filter_yaml, proto_config);
     fill_timer_ = new Event::MockTimer(&dispatcher_);
     if (expect_timer_create) {
diff --git a/test/extensions/filters/network/mongo_proxy/BUILD b/test/extensions/filters/network/mongo_proxy/BUILD
index 76498c471fa4..d5ab22f671f6 100644
--- a/test/extensions/filters/network/mongo_proxy/BUILD
+++ b/test/extensions/filters/network/mongo_proxy/BUILD
@@ -48,8 +48,8 @@ envoy_extension_cc_test(
         "//test/mocks/event:event_mocks",
         "//test/mocks/network:network_mocks",
         "//test/mocks/runtime:runtime_mocks",
-        "@envoy_api//envoy/config/filter/fault/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/common/fault/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -72,7 +72,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/mongo_proxy:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/mongo_proxy/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/mongo_proxy/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/mongo_proxy/config_test.cc b/test/extensions/filters/network/mongo_proxy/config_test.cc
index 591ca97d5d90..a073eedbc54b 100644
--- a/test/extensions/filters/network/mongo_proxy/config_test.cc
+++ b/test/extensions/filters/network/mongo_proxy/config_test.cc
@@ -1,8 +1,8 @@
 #include <string>
 
-#include "envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.pb.h"
-#include "envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.pb.validate.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/network/mongo_proxy/v3alpha/mongo_proxy.pb.h"
+#include "envoy/extensions/filters/network/mongo_proxy/v3alpha/mongo_proxy.pb.validate.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "extensions/filters/network/mongo_proxy/config.h"
 
@@ -21,9 +21,10 @@ namespace MongoProxy {
 
 TEST(MongoFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_THROW(MongoProxyFilterConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::mongo_proxy::v2::MongoProxy(), context),
-               ProtoValidationException);
+  EXPECT_THROW(
+      MongoProxyFilterConfigFactory().createFilterFactoryFromProto(
+          envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy(), context),
+      ProtoValidationException);
 }
 
 TEST(MongoFilterConfigTest, CorrectConfigurationNoFaults) {
@@ -32,7 +33,7 @@ TEST(MongoFilterConfigTest, CorrectConfigurationNoFaults) {
   access_log: path/to/access/log
   )EOF";
 
-  envoy::config::filter::network::mongo_proxy::v2::MongoProxy proto_config;
+  envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   MongoProxyFilterConfigFactory factory;
@@ -43,7 +44,7 @@ TEST(MongoFilterConfigTest, CorrectConfigurationNoFaults) {
 }
 
 TEST(MongoFilterConfigTest, ValidProtoConfigurationNoFaults) {
-  envoy::config::filter::network::mongo_proxy::v2::MongoProxy config;
+  envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy config;
 
   config.set_access_log("path/to/access/log");
   config.set_stat_prefix("my_stat_prefix");
@@ -59,8 +60,8 @@ TEST(MongoFilterConfigTest, ValidProtoConfigurationNoFaults) {
 TEST(MongoFilterConfigTest, MongoFilterWithEmptyProto) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   MongoProxyFilterConfigFactory factory;
-  envoy::config::filter::network::mongo_proxy::v2::MongoProxy config =
-      *dynamic_cast<envoy::config::filter::network::mongo_proxy::v2::MongoProxy*>(
+  envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy config =
+      *dynamic_cast<envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy*>(
           factory.createEmptyConfigProto().get());
   config.set_access_log("path/to/access/log");
   config.set_stat_prefix("my_stat_prefix");
@@ -72,7 +73,7 @@ TEST(MongoFilterConfigTest, MongoFilterWithEmptyProto) {
 }
 
 void handleInvalidConfiguration(const std::string& yaml_string, const std::string& error_regex) {
-  envoy::config::filter::network::mongo_proxy::v2::MongoProxy config;
+  envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy config;
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYamlAndValidate(yaml_string, config), EnvoyException,
                           error_regex);
 }
@@ -195,7 +196,7 @@ TEST(MongoFilterConfigTest, CorrectFaultConfiguration) {
     fixed_delay: 0.001s
   )EOF";
 
-  envoy::config::filter::network::mongo_proxy::v2::MongoProxy proto_config;
+  envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy proto_config;
   TestUtility::loadFromYaml(yaml_string, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   MongoProxyFilterConfigFactory factory;
@@ -206,11 +207,11 @@ TEST(MongoFilterConfigTest, CorrectFaultConfiguration) {
 }
 
 TEST(MongoFilterConfigTest, CorrectFaultConfigurationInProto) {
-  envoy::config::filter::network::mongo_proxy::v2::MongoProxy config{};
+  envoy::extensions::filters::network::mongo_proxy::v3alpha::MongoProxy config{};
   config.set_stat_prefix("my_stat_prefix");
   config.mutable_delay()->mutable_percentage()->set_numerator(50);
   config.mutable_delay()->mutable_percentage()->set_denominator(
-      envoy::type::FractionalPercent::HUNDRED);
+      envoy::type::v3alpha::FractionalPercent::HUNDRED);
   config.mutable_delay()->mutable_fixed_delay()->set_seconds(500);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
diff --git a/test/extensions/filters/network/mongo_proxy/proxy_test.cc b/test/extensions/filters/network/mongo_proxy/proxy_test.cc
index 21fcc56ed77a..f63792e2fd70 100644
--- a/test/extensions/filters/network/mongo_proxy/proxy_test.cc
+++ b/test/extensions/filters/network/mongo_proxy/proxy_test.cc
@@ -3,9 +3,9 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/fault/v2/fault.pb.h"
+#include "envoy/extensions/filters/common/fault/v3alpha/fault.pb.h"
 #include "envoy/stats/stats.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "extensions/filters/network/mongo_proxy/bson_impl.h"
 #include "extensions/filters/network/mongo_proxy/codec_impl.h"
@@ -95,16 +95,17 @@ class MongoProxyFilterTest : public testing::Test {
   }
 
   void setupDelayFault(bool enable_fault) {
-    envoy::config::filter::fault::v2::FaultDelay fault;
+    envoy::extensions::filters::common::fault::v3alpha::FaultDelay fault;
     fault.mutable_percentage()->set_numerator(50);
-    fault.mutable_percentage()->set_denominator(envoy::type::FractionalPercent::HUNDRED);
+    fault.mutable_percentage()->set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
     fault.mutable_fixed_delay()->CopyFrom(Protobuf::util::TimeUtil::MillisecondsToDuration(10));
 
     fault_config_.reset(new Filters::Common::Fault::FaultDelayConfig(fault));
 
-    EXPECT_CALL(runtime_.snapshot_,
-                featureEnabled("mongo.fault.fixed_delay.percent",
-                               Matcher<const envoy::type::FractionalPercent&>(Percent(50))))
+    EXPECT_CALL(
+        runtime_.snapshot_,
+        featureEnabled("mongo.fault.fixed_delay.percent",
+                       Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(50))))
         .WillOnce(Return(enable_fault));
 
     if (enable_fault) {
diff --git a/test/extensions/filters/network/ratelimit/BUILD b/test/extensions/filters/network/ratelimit/BUILD
index 7b1d3588e26d..bd745dcc60ad 100644
--- a/test/extensions/filters/network/ratelimit/BUILD
+++ b/test/extensions/filters/network/ratelimit/BUILD
@@ -25,7 +25,7 @@ envoy_extension_cc_test(
         "//test/mocks/ratelimit:ratelimit_mocks",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/tracing:tracing_mocks",
-        "@envoy_api//envoy/config/filter/network/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -37,7 +37,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/ratelimit:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/rate_limit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/ratelimit/config_test.cc b/test/extensions/filters/network/ratelimit/config_test.cc
index f446a57b37a9..0e342fc32374 100644
--- a/test/extensions/filters/network/ratelimit/config_test.cc
+++ b/test/extensions/filters/network/ratelimit/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.validate.h"
 
 #include "extensions/filters/network/ratelimit/config.h"
 
@@ -20,7 +20,7 @@ namespace RateLimitFilter {
 TEST(RateLimitFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(RateLimitConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::rate_limit::v2::RateLimit(), context),
+                   envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit(), context),
                ProtoValidationException);
 }
 
@@ -39,13 +39,13 @@ TEST(RateLimitFilterConfigTest, CorrectProto) {
         cluster_name: ratelimit_cluster
   )EOF";
 
-  envoy::config::filter::network::rate_limit::v2::RateLimit proto_config{};
+  envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit proto_config{};
   TestUtility::loadFromYaml(yaml, proto_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
   EXPECT_CALL(context.cluster_manager_.async_client_manager_, factoryForGrpcService(_, _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         return std::make_unique<NiceMock<Grpc::MockAsyncClientFactory>>();
       }));
 
@@ -61,8 +61,8 @@ TEST(RateLimitFilterConfigTest, EmptyProto) {
   NiceMock<Server::MockInstance> instance;
   RateLimitConfigFactory factory;
 
-  envoy::config::filter::network::rate_limit::v2::RateLimit empty_proto_config =
-      *dynamic_cast<envoy::config::filter::network::rate_limit::v2::RateLimit*>(
+  envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit empty_proto_config =
+      *dynamic_cast<envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit*>(
           factory.createEmptyConfigProto().get());
   EXPECT_THROW(factory.createFilterFactoryFromProto(empty_proto_config, context), EnvoyException);
 }
@@ -78,7 +78,7 @@ domain: fake_domain
 ip_white_list: '12'
   )EOF";
 
-  envoy::config::filter::network::rate_limit::v2::RateLimit proto_config;
+  envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit proto_config;
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYaml(yaml_string, proto_config), EnvoyException,
                           "ip_white_list: Cannot find field");
 }
diff --git a/test/extensions/filters/network/ratelimit/ratelimit_test.cc b/test/extensions/filters/network/ratelimit/ratelimit_test.cc
index e483026d8435..7fa594cda018 100644
--- a/test/extensions/filters/network/ratelimit/ratelimit_test.cc
+++ b/test/extensions/filters/network/ratelimit/ratelimit_test.cc
@@ -2,7 +2,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/network/rate_limit/v2/rate_limit.pb.h"
+#include "envoy/extensions/filters/network/ratelimit/v3alpha/rate_limit.pb.h"
 #include "envoy/stats/stats.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -39,7 +39,7 @@ class RateLimitFilterTest : public testing::Test {
     ON_CALL(runtime_.snapshot_, featureEnabled("ratelimit.tcp_filter_enforcing", 100))
         .WillByDefault(Return(true));
 
-    envoy::config::filter::network::rate_limit::v2::RateLimit proto_config{};
+    envoy::extensions::filters::network::ratelimit::v3alpha::RateLimit proto_config{};
     TestUtility::loadFromYaml(yaml, proto_config);
     config_.reset(new Config(proto_config, stats_store_, runtime_));
     client_ = new Filters::Common::RateLimit::MockClient();
diff --git a/test/extensions/filters/network/rbac/BUILD b/test/extensions/filters/network/rbac/BUILD
index a4602e23d1ce..a3c8b60970d7 100644
--- a/test/extensions/filters/network/rbac/BUILD
+++ b/test/extensions/filters/network/rbac/BUILD
@@ -18,8 +18,8 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/network/rbac:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/network/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -32,8 +32,8 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network:well_known_names",
         "//source/extensions/filters/network/rbac:rbac_filter",
         "//test/mocks/network:network_mocks",
-        "@envoy_api//envoy/config/filter/network/rbac/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/rbac/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/rbac/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -46,8 +46,8 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/rbac:config",
         "//test/integration:integration_lib",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/rbac/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/rbac/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/rbac/config_test.cc b/test/extensions/filters/network/rbac/config_test.cc
index 45931f219f37..127d218b6102 100644
--- a/test/extensions/filters/network/rbac/config_test.cc
+++ b/test/extensions/filters/network/rbac/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.h"
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.validate.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.validate.h"
 
 #include "extensions/filters/network/rbac/config.h"
 
@@ -33,10 +33,10 @@ class RoleBasedAccessControlNetworkFilterConfigFactoryTest : public testing::Tes
 
 private:
   void checkRule(const std::string& policy_json) {
-    envoy::config::rbac::v2::Policy policy_proto{};
+    envoy::config::rbac::v3alpha::Policy policy_proto{};
     TestUtility::loadFromJson(policy_json, policy_proto);
 
-    envoy::config::filter::network::rbac::v2::RBAC config{};
+    envoy::extensions::filters::network::rbac::v3alpha::RBAC config{};
     config.set_stat_prefix("test");
     (*config.mutable_rules()->mutable_policies())["foo"] = policy_proto;
 
@@ -51,10 +51,10 @@ class RoleBasedAccessControlNetworkFilterConfigFactoryTest : public testing::Tes
 };
 
 TEST_F(RoleBasedAccessControlNetworkFilterConfigFactoryTest, ValidProto) {
-  envoy::config::rbac::v2::Policy policy;
+  envoy::config::rbac::v3alpha::Policy policy;
   policy.add_permissions()->set_any(true);
   policy.add_principals()->set_any(true);
-  envoy::config::filter::network::rbac::v2::RBAC config;
+  envoy::extensions::filters::network::rbac::v3alpha::RBAC config;
   config.set_stat_prefix("stats");
   (*config.mutable_rules()->mutable_policies())["foo"] = policy;
 
@@ -68,7 +68,7 @@ TEST_F(RoleBasedAccessControlNetworkFilterConfigFactoryTest, ValidProto) {
 
 TEST_F(RoleBasedAccessControlNetworkFilterConfigFactoryTest, EmptyProto) {
   RoleBasedAccessControlNetworkFilterConfigFactory factory;
-  auto* config = dynamic_cast<envoy::config::filter::network::rbac::v2::RBAC*>(
+  auto* config = dynamic_cast<envoy::extensions::filters::network::rbac::v3alpha::RBAC*>(
       factory.createEmptyConfigProto().get());
   EXPECT_NE(nullptr, config);
 }
diff --git a/test/extensions/filters/network/rbac/filter_test.cc b/test/extensions/filters/network/rbac/filter_test.cc
index 49c820307c84..b069bc981a17 100644
--- a/test/extensions/filters/network/rbac/filter_test.cc
+++ b/test/extensions/filters/network/rbac/filter_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.h"
-#include "envoy/config/rbac/v2/rbac.pb.h"
+#include "envoy/config/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
 
 #include "common/network/utility.h"
 
@@ -24,29 +24,31 @@ class RoleBasedAccessControlNetworkFilterTest : public testing::Test {
 public:
   RoleBasedAccessControlFilterConfigSharedPtr setupConfig(bool with_policy = true,
                                                           bool continuous = false) {
-    envoy::config::filter::network::rbac::v2::RBAC config;
+    envoy::extensions::filters::network::rbac::v3alpha::RBAC config;
     config.set_stat_prefix("tcp.");
 
     if (with_policy) {
-      envoy::config::rbac::v2::Policy policy;
+      envoy::config::rbac::v3alpha::Policy policy;
       auto policy_rules = policy.add_permissions()->mutable_or_rules();
-      policy_rules->add_rules()->mutable_requested_server_name()->set_regex(".*cncf.io");
+      policy_rules->add_rules()->mutable_requested_server_name()->set_hidden_envoy_deprecated_regex(
+          ".*cncf.io");
       policy_rules->add_rules()->set_destination_port(123);
       policy.add_principals()->set_any(true);
-      config.mutable_rules()->set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+      config.mutable_rules()->set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
       (*config.mutable_rules()->mutable_policies())["foo"] = policy;
 
-      envoy::config::rbac::v2::Policy shadow_policy;
+      envoy::config::rbac::v3alpha::Policy shadow_policy;
       auto shadow_policy_rules = shadow_policy.add_permissions()->mutable_or_rules();
       shadow_policy_rules->add_rules()->mutable_requested_server_name()->set_exact("xyz.cncf.io");
       shadow_policy_rules->add_rules()->set_destination_port(456);
       shadow_policy.add_principals()->set_any(true);
-      config.mutable_shadow_rules()->set_action(envoy::config::rbac::v2::RBAC::ALLOW);
+      config.mutable_shadow_rules()->set_action(envoy::config::rbac::v3alpha::RBAC::ALLOW);
       (*config.mutable_shadow_rules()->mutable_policies())["bar"] = shadow_policy;
     }
 
     if (continuous) {
-      config.set_enforcement_type(envoy::config::filter::network::rbac::v2::RBAC::CONTINUOUS);
+      config.set_enforcement_type(
+          envoy::extensions::filters::network::rbac::v3alpha::RBAC::CONTINUOUS);
     }
 
     return std::make_shared<RoleBasedAccessControlFilterConfig>(config, store_);
diff --git a/test/extensions/filters/network/rbac/integration_test.cc b/test/extensions/filters/network/rbac/integration_test.cc
index 97073a1761d6..716c6a966155 100644
--- a/test/extensions/filters/network/rbac/integration_test.cc
+++ b/test/extensions/filters/network/rbac/integration_test.cc
@@ -1,6 +1,7 @@
-#include "envoy/api/v2/listener/listener.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/rbac/v2/rbac.pb.validate.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.h"
+#include "envoy/extensions/filters/network/rbac/v3alpha/rbac.pb.validate.h"
 
 #include "extensions/filters/network/rbac/config.h"
 
@@ -48,15 +49,16 @@ class RoleBasedAccessControlNetworkFilterIntegrationTest
   }
 
   void initializeFilter(const std::string& config) {
-    config_helper_.addConfigModifier([config](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      envoy::api::v2::listener::Filter filter;
-      TestUtility::loadFromYaml(config, filter);
-      ASSERT_GT(bootstrap.mutable_static_resources()->listeners_size(), 0);
-      auto l = bootstrap.mutable_static_resources()->mutable_listeners(0);
-      ASSERT_GT(l->filter_chains_size(), 0);
-      ASSERT_GT(l->filter_chains(0).filters_size(), 0);
-      l->mutable_filter_chains(0)->mutable_filters(0)->Swap(&filter);
-    });
+    config_helper_.addConfigModifier(
+        [config](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          envoy::config::listener::v3alpha::Filter filter;
+          TestUtility::loadFromYaml(config, filter);
+          ASSERT_GT(bootstrap.mutable_static_resources()->listeners_size(), 0);
+          auto l = bootstrap.mutable_static_resources()->mutable_listeners(0);
+          ASSERT_GT(l->filter_chains_size(), 0);
+          ASSERT_GT(l->filter_chains(0).filters_size(), 0);
+          l->mutable_filter_chains(0)->mutable_filters(0)->Swap(&filter);
+        });
 
     BaseIntegrationTest::initialize();
   }
diff --git a/test/extensions/filters/network/redis_proxy/BUILD b/test/extensions/filters/network/redis_proxy/BUILD
index 079d9c55d1bb..97bfc8a4cba7 100644
--- a/test/extensions/filters/network/redis_proxy/BUILD
+++ b/test/extensions/filters/network/redis_proxy/BUILD
@@ -50,9 +50,9 @@ envoy_extension_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
         "@envoy_api//envoy/config/cluster/redis:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -70,7 +70,7 @@ envoy_extension_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -97,7 +97,7 @@ envoy_extension_cc_test(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/network/redis_proxy:config",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -128,8 +128,8 @@ envoy_extension_cc_test(
         "//test/extensions/filters/network/common/redis:redis_mocks",
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/filters/network/redis_proxy/config_test.cc b/test/extensions/filters/network/redis_proxy/config_test.cc
index b24893593a52..e3c6f9eaded5 100644
--- a/test/extensions/filters/network/redis_proxy/config_test.cc
+++ b/test/extensions/filters/network/redis_proxy/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "common/protobuf/utility.h"
 
@@ -19,16 +19,17 @@ namespace RedisProxy {
 
 TEST(RedisProxyFilterConfigFactoryTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_THROW(RedisProxyFilterConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::redis_proxy::v2::RedisProxy(), context),
-               ProtoValidationException);
+  EXPECT_THROW(
+      RedisProxyFilterConfigFactory().createFilterFactoryFromProto(
+          envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy(), context),
+      ProtoValidationException);
 }
 
 TEST(RedisProxyFilterConfigFactoryTest, NoUpstreamDefined) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings settings;
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings settings;
   settings.mutable_op_timeout()->CopyFrom(Protobuf::util::TimeUtil::MillisecondsToDuration(20));
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy config;
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy config;
   config.set_stat_prefix("foo");
   config.mutable_settings()->CopyFrom(settings);
 
@@ -47,7 +48,7 @@ TEST(RedisProxyFilterConfigFactoryTest, RedisProxyNoSettings) {
 stat_prefix: foo
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config;
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config;
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYamlAndValidate(yaml, proto_config),
                           ProtoValidationException, "value is required");
 }
@@ -61,7 +62,7 @@ stat_prefix: foo
 settings: {}
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config;
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config;
   EXPECT_THROW_WITH_REGEX(TestUtility::loadFromYamlAndValidate(yaml, proto_config),
                           ProtoValidationException, "embedded message failed validation");
 }
@@ -75,7 +76,7 @@ stat_prefix: foo
   op_timeout: 0.02s
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config{};
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config{};
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   RedisProxyFilterConfigFactory factory;
@@ -96,7 +97,7 @@ stat_prefix: foo
   op_timeout: 0.02s
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config{};
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config{};
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   RedisProxyFilterConfigFactory factory;
@@ -117,7 +118,7 @@ stat_prefix: foo
   op_timeout: 0.02s
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config{};
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config{};
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
   NiceMock<Server::Configuration::MockFactoryContext> context;
   RedisProxyFilterConfigFactory factory;
@@ -140,8 +141,8 @@ stat_prefix: foo
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
   RedisProxyFilterConfigFactory factory;
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config =
-      *dynamic_cast<envoy::config::filter::network::redis_proxy::v2::RedisProxy*>(
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config =
+      *dynamic_cast<envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy*>(
           factory.createEmptyConfigProto().get());
 
   TestUtility::loadFromYamlAndValidate(yaml, proto_config);
diff --git a/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc b/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc
index 5eb69cd80d8a..3238638d5a58 100644
--- a/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc
+++ b/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc
@@ -1,9 +1,10 @@
 #include <memory>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/redis/redis_cluster.pb.h"
 #include "envoy/config/cluster/redis/redis_cluster.pb.validate.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "common/network/utility.h"
 #include "common/upstream/upstream_impl.h"
@@ -203,10 +204,9 @@ class RedisConnPoolImplTest : public testing::Test, public Common::Redis::Client
     return Common::Redis::Client::ClientPtr{create_(host)};
   }
 
-  void testReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ReadPolicy
-          read_policy,
-      NetworkFilters::Common::Redis::Client::ReadPolicy expected_read_policy) {
+  void testReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                          ConnPoolSettings::ReadPolicy read_policy,
+                      NetworkFilters::Common::Redis::Client::ReadPolicy expected_read_policy) {
     InSequence s;
 
     read_policy_ = read_policy;
@@ -274,9 +274,9 @@ class RedisConnPoolImplTest : public testing::Test, public Common::Redis::Client
   Network::Address::InstanceConstSharedPtr test_address_;
   std::string auth_password_;
   NiceMock<Api::MockApi> api_;
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ReadPolicy
-      read_policy_ =
-          envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::MASTER;
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::
+      ReadPolicy read_policy_ = envoy::extensions::filters::network::redis_proxy::v3alpha::
+          RedisProxy::ConnPoolSettings::MASTER;
   NiceMock<Stats::MockCounter> upstream_cx_drained_;
   NiceMock<Stats::MockCounter> max_upstream_unknown_connections_reached_;
   std::shared_ptr<NiceMock<Extensions::Common::Redis::MockClusterRefreshManager>>
@@ -375,17 +375,18 @@ TEST_F(RedisConnPoolImplTest, ClientRequestFailed) {
 };
 
 TEST_F(RedisConnPoolImplTest, BasicWithReadPolicy) {
+  testReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                     ConnPoolSettings::PREFER_MASTER,
+                 NetworkFilters::Common::Redis::Client::ReadPolicy::PreferMaster);
+  testReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                     ConnPoolSettings::REPLICA,
+                 NetworkFilters::Common::Redis::Client::ReadPolicy::Replica);
+  testReadPolicy(envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::
+                     ConnPoolSettings::PREFER_REPLICA,
+                 NetworkFilters::Common::Redis::Client::ReadPolicy::PreferReplica);
   testReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::PREFER_MASTER,
-      NetworkFilters::Common::Redis::Client::ReadPolicy::PreferMaster);
-  testReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::REPLICA,
-      NetworkFilters::Common::Redis::Client::ReadPolicy::Replica);
-  testReadPolicy(
-      envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::PREFER_REPLICA,
-      NetworkFilters::Common::Redis::Client::ReadPolicy::PreferReplica);
-  testReadPolicy(envoy::config::filter::network::redis_proxy::v2::RedisProxy::ConnPoolSettings::ANY,
-                 NetworkFilters::Common::Redis::Client::ReadPolicy::Any);
+      envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::ConnPoolSettings::ANY,
+      NetworkFilters::Common::Redis::Client::ReadPolicy::Any);
 };
 
 TEST_F(RedisConnPoolImplTest, Hashtagging) {
@@ -955,7 +956,7 @@ TEST_F(RedisConnPoolImplTest, HostsAddedAndEndWithClusterRemoval) {
 
 TEST_F(RedisConnPoolImplTest, MakeRequestToRedisCluster) {
 
-  absl::optional<envoy::api::v2::Cluster::CustomClusterType> cluster_type;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType> cluster_type;
   cluster_type.emplace();
   cluster_type->set_name("envoy.clusters.redis");
   EXPECT_CALL(*cm_.thread_local_cluster_.cluster_.info_, clusterType())
@@ -975,7 +976,7 @@ TEST_F(RedisConnPoolImplTest, MakeRequestToRedisCluster) {
 
 TEST_F(RedisConnPoolImplTest, MakeRequestToRedisClusterHashtag) {
 
-  absl::optional<envoy::api::v2::Cluster::CustomClusterType> cluster_type;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType> cluster_type;
   cluster_type.emplace();
   cluster_type->set_name("envoy.clusters.redis");
   EXPECT_CALL(*cm_.thread_local_cluster_.cluster_.info_, clusterType())
diff --git a/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc b/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc
index 480d79e392f3..881cbb29d89a 100644
--- a/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc
+++ b/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
 
 #include "extensions/filters/network/redis_proxy/proxy_filter.h"
 
@@ -33,9 +33,9 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace RedisProxy {
 
-envoy::config::filter::network::redis_proxy::v2::RedisProxy
+envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy
 parseProtoFromYaml(const std::string& yaml_string) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy config;
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy config;
   TestUtility::loadFromYaml(yaml_string, config);
   return config;
 }
@@ -58,7 +58,7 @@ TEST_F(RedisProxyFilterConfigTest, Normal) {
     op_timeout: 0.01s
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config =
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config =
       parseProtoFromYaml(yaml_string);
   ProxyFilterConfig config(proto_config, store_, drain_decision_, runtime_, api_);
   EXPECT_EQ("redis.foo.", config.stat_prefix_);
@@ -86,7 +86,7 @@ TEST_F(RedisProxyFilterConfigTest, DownstreamAuthPasswordSet) {
     inline_string: somepassword
   )EOF";
 
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config =
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config =
       parseProtoFromYaml(yaml_string);
   ProxyFilterConfig config(proto_config, store_, drain_decision_, runtime_, api_);
   EXPECT_EQ(config.downstream_auth_password_, "somepassword");
@@ -104,7 +104,7 @@ class RedisProxyFilterTest : public testing::Test, public Common::Redis::Decoder
   )EOF";
 
   RedisProxyFilterTest(const std::string& yaml_string) {
-    envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config =
+    envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy proto_config =
         parseProtoFromYaml(yaml_string);
     config_.reset(new ProxyFilterConfig(proto_config, store_, drain_decision_, runtime_, api_));
     filter_ = std::make_unique<ProxyFilter>(*this, Common::Redis::EncoderPtr{encoder_}, splitter_,
diff --git a/test/extensions/filters/network/redis_proxy/router_impl_test.cc b/test/extensions/filters/network/redis_proxy/router_impl_test.cc
index ad062ea38cb5..26ad8a8ffe69 100644
--- a/test/extensions/filters/network/redis_proxy/router_impl_test.cc
+++ b/test/extensions/filters/network/redis_proxy/router_impl_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "extensions/filters/network/redis_proxy/conn_pool_impl.h"
 #include "extensions/filters/network/redis_proxy/router_impl.h"
@@ -21,8 +21,9 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace RedisProxy {
 
-envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes createPrefixRoutes() {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes prefix_routes;
+envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes
+createPrefixRoutes() {
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes prefix_routes;
   auto* routes = prefix_routes.mutable_routes();
 
   {
@@ -193,7 +194,7 @@ TEST(PrefixRoutesTest, DuplicatePrefix) {
 }
 
 TEST(MirrorPolicyImplTest, ShouldMirrorDefault) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route::
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::Route::
       RequestMirrorPolicy config;
   auto upstream = std::make_shared<ConnPool::MockInstance>();
   NiceMock<Runtime::MockLoader> runtime;
@@ -207,7 +208,7 @@ TEST(MirrorPolicyImplTest, ShouldMirrorDefault) {
 }
 
 TEST(MirrorPolicyImplTest, MissingUpstream) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route::
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::Route::
       RequestMirrorPolicy config;
   NiceMock<Runtime::MockLoader> runtime;
 
@@ -220,7 +221,7 @@ TEST(MirrorPolicyImplTest, MissingUpstream) {
 }
 
 TEST(MirrorPolicyImplTest, ExcludeReadCommands) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route::
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::Route::
       RequestMirrorPolicy config;
   config.set_exclude_read_commands(true);
   auto upstream = std::make_shared<ConnPool::MockInstance>();
@@ -235,12 +236,12 @@ TEST(MirrorPolicyImplTest, ExcludeReadCommands) {
 }
 
 TEST(MirrorPolicyImplTest, DefaultValueZero) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route::
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::Route::
       RequestMirrorPolicy config;
   auto* runtime_fraction = config.mutable_runtime_fraction();
   auto* percentage = runtime_fraction->mutable_default_value();
   percentage->set_numerator(0);
-  percentage->set_denominator(envoy::type::FractionalPercent::HUNDRED);
+  percentage->set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   auto upstream = std::make_shared<ConnPool::MockInstance>();
   NiceMock<Runtime::MockLoader> runtime;
 
@@ -251,21 +252,21 @@ TEST(MirrorPolicyImplTest, DefaultValueZero) {
 }
 
 TEST(MirrorPolicyImplTest, DeterminedByRuntimeFraction) {
-  envoy::config::filter::network::redis_proxy::v2::RedisProxy::PrefixRoutes::Route::
+  envoy::extensions::filters::network::redis_proxy::v3alpha::RedisProxy::PrefixRoutes::Route::
       RequestMirrorPolicy config;
   auto* runtime_fraction = config.mutable_runtime_fraction();
   runtime_fraction->set_runtime_key("runtime_key");
   auto* percentage = runtime_fraction->mutable_default_value();
   percentage->set_numerator(50);
-  percentage->set_denominator(envoy::type::FractionalPercent::HUNDRED);
+  percentage->set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   auto upstream = std::make_shared<ConnPool::MockInstance>();
 
   NiceMock<Runtime::MockLoader> runtime;
   MirrorPolicyImpl policy(config, upstream, runtime);
 
-  EXPECT_CALL(
-      runtime.snapshot_,
-      featureEnabled("runtime_key", Matcher<const envoy::type::FractionalPercent&>(Percent(50))))
+  EXPECT_CALL(runtime.snapshot_,
+              featureEnabled("runtime_key",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(50))))
       .Times(4)
       .WillRepeatedly(Return(true));
   EXPECT_EQ(true, policy.shouldMirror("get"));
@@ -273,9 +274,9 @@ TEST(MirrorPolicyImplTest, DeterminedByRuntimeFraction) {
   EXPECT_EQ(true, policy.shouldMirror("GET"));
   EXPECT_EQ(true, policy.shouldMirror("SET"));
 
-  EXPECT_CALL(
-      runtime.snapshot_,
-      featureEnabled("runtime_key", Matcher<const envoy::type::FractionalPercent&>(Percent(50))))
+  EXPECT_CALL(runtime.snapshot_,
+              featureEnabled("runtime_key",
+                             Matcher<const envoy::type::v3alpha::FractionalPercent&>(Percent(50))))
       .Times(4)
       .WillRepeatedly(Return(false));
   EXPECT_EQ(false, policy.shouldMirror("get"));
diff --git a/test/extensions/filters/network/tcp_proxy/BUILD b/test/extensions/filters/network/tcp_proxy/BUILD
index ff72e8ed51eb..8893c9a7f54e 100644
--- a/test/extensions/filters/network/tcp_proxy/BUILD
+++ b/test/extensions/filters/network/tcp_proxy/BUILD
@@ -19,6 +19,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/tcp_proxy:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/tcp_proxy/config_test.cc b/test/extensions/filters/network/tcp_proxy/config_test.cc
index 9282fa7d7e85..086e7ddd2d99 100644
--- a/test/extensions/filters/network/tcp_proxy/config_test.cc
+++ b/test/extensions/filters/network/tcp_proxy/config_test.cc
@@ -1,7 +1,7 @@
 #include <string>
 
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.validate.h"
 
 #include "extensions/filters/network/tcp_proxy/config.h"
 
@@ -90,7 +90,7 @@ TEST_P(RouteIpListConfigTest, DEPRECATED_FEATURE_TEST(TcpProxy)) {
   }
   )EOF";
 
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy proto_config;
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy proto_config;
   TestUtility::loadFromJson(json_string, proto_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
@@ -104,7 +104,7 @@ TEST_P(RouteIpListConfigTest, DEPRECATED_FEATURE_TEST(TcpProxy)) {
 TEST(ConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(ConfigFactory().createFilterFactoryFromProto(
-                   envoy::config::filter::network::tcp_proxy::v2::TcpProxy(), context),
+                   envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy(), context),
                ProtoValidationException);
 }
 
@@ -112,8 +112,8 @@ TEST(ConfigTest, ValidateFail) {
 TEST(ConfigTest, ConfigTest) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   ConfigFactory factory;
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy config =
-      *dynamic_cast<envoy::config::filter::network::tcp_proxy::v2::TcpProxy*>(
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy config =
+      *dynamic_cast<envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy*>(
           factory.createEmptyConfigProto().get());
   config.set_stat_prefix("prefix");
   config.set_cluster("cluster");
diff --git a/test/extensions/filters/network/thrift_proxy/BUILD b/test/extensions/filters/network/thrift_proxy/BUILD
index efc877bd9906..54436b5ac09c 100644
--- a/test/extensions/filters/network/thrift_proxy/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/BUILD
@@ -56,7 +56,7 @@ envoy_extension_cc_test_library(
         "//source/common/common:byte_order_lib",
         "//source/extensions/filters/network/thrift_proxy:thrift_lib",
         "//test/common/buffer:utility_lib",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -211,7 +211,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/thrift_proxy/router:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:registry_lib",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -231,7 +231,7 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -293,8 +293,8 @@ envoy_extension_cc_test(
         "//test/mocks/ratelimit:ratelimit_mocks",
         "//test/mocks/server:server_mocks",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -308,8 +308,8 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/thrift_proxy/router:router_interface",
         "//source/extensions/filters/network/thrift_proxy/router:router_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
         "@envoy_api//envoy/config/filter/thrift/router/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -338,7 +338,7 @@ envoy_extension_cc_test(
         ":utility_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -354,7 +354,7 @@ envoy_extension_cc_test(
         ":utility_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/thrift_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/thrift_proxy/config_test.cc b/test/extensions/filters/network/thrift_proxy/config_test.cc
index 71510591494e..7c1fb9196f62 100644
--- a/test/extensions/filters/network/thrift_proxy/config_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.validate.h"
 
 #include "extensions/filters/network/thrift_proxy/config.h"
 #include "extensions/filters/network/thrift_proxy/filters/factory_base.h"
@@ -19,33 +19,36 @@ namespace NetworkFilters {
 namespace ThriftProxy {
 namespace {
 
-std::vector<envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType>
+std::vector<envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType>
 getTransportTypes() {
-  std::vector<envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType> v;
-  int transport = envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType_MIN;
-  while (transport <= envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType_MAX) {
-    v.push_back(static_cast<envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType>(
-        transport));
+  std::vector<envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType> v;
+  int transport = envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType_MIN;
+  while (transport <=
+         envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType_MAX) {
+    v.push_back(
+        static_cast<envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType>(
+            transport));
     transport++;
   }
   return v;
 }
 
-std::vector<envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType>
+std::vector<envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType>
 getProtocolTypes() {
-  std::vector<envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType> v;
-  int protocol = envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType_MIN;
-  while (protocol <= envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType_MAX) {
-    v.push_back(static_cast<envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType>(
-        protocol));
+  std::vector<envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType> v;
+  int protocol = envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType_MIN;
+  while (protocol <= envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType_MAX) {
+    v.push_back(
+        static_cast<envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType>(
+            protocol));
     protocol++;
   }
   return v;
 }
 
-envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy
+envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy
 parseThriftProxyFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy thrift_proxy;
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy thrift_proxy;
   TestUtility::loadFromYaml(yaml, thrift_proxy);
   return thrift_proxy;
 }
@@ -54,7 +57,7 @@ parseThriftProxyFromV2Yaml(const std::string& yaml) {
 
 class ThriftFilterConfigTestBase {
 public:
-  void testConfig(envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy& config) {
+  void testConfig(envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy& config) {
     Network::FilterFactoryCb cb;
     EXPECT_NO_THROW({ cb = factory_.createFilterFactoryFromProto(config, context_); });
     EXPECT_TRUE(factory_.isTerminalFilter());
@@ -72,7 +75,7 @@ class ThriftFilterConfigTest : public testing::Test, public ThriftFilterConfigTe
 
 class ThriftFilterTransportConfigTest
     : public testing::TestWithParam<
-          envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType>,
+          envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType>,
       public ThriftFilterConfigTestBase {};
 
 INSTANTIATE_TEST_SUITE_P(TransportTypes, ThriftFilterTransportConfigTest,
@@ -80,42 +83,43 @@ INSTANTIATE_TEST_SUITE_P(TransportTypes, ThriftFilterTransportConfigTest,
 
 class ThriftFilterProtocolConfigTest
     : public testing::TestWithParam<
-          envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType>,
+          envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType>,
       public ThriftFilterConfigTestBase {};
 
 INSTANTIATE_TEST_SUITE_P(ProtocolTypes, ThriftFilterProtocolConfigTest,
                          testing::ValuesIn(getProtocolTypes()));
 
 TEST_F(ThriftFilterConfigTest, ValidateFail) {
-  EXPECT_THROW(factory_.createFilterFactoryFromProto(
-                   envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy(), context_),
-               ProtoValidationException);
+  EXPECT_THROW(
+      factory_.createFilterFactoryFromProto(
+          envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy(), context_),
+      ProtoValidationException);
 }
 
 TEST_F(ThriftFilterConfigTest, ValidProtoConfiguration) {
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config{};
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config{};
   config.set_stat_prefix("my_stat_prefix");
 
   testConfig(config);
 }
 
 TEST_P(ThriftFilterTransportConfigTest, ValidProtoConfiguration) {
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config{};
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config{};
   config.set_stat_prefix("my_stat_prefix");
   config.set_transport(GetParam());
   testConfig(config);
 }
 
 TEST_P(ThriftFilterProtocolConfigTest, ValidProtoConfiguration) {
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config{};
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config{};
   config.set_stat_prefix("my_stat_prefix");
   config.set_protocol(GetParam());
   testConfig(config);
 }
 
 TEST_F(ThriftFilterConfigTest, ThriftProxyWithEmptyProto) {
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config =
-      *dynamic_cast<envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy*>(
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config =
+      *dynamic_cast<envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy*>(
           factory_.createEmptyConfigProto().get());
   config.set_stat_prefix("my_stat_prefix");
 
@@ -132,7 +136,7 @@ stat_prefix: thrift
   - name: envoy.filters.thrift.router
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config =
       parseThriftProxyFromV2Yaml(yaml);
   testConfig(config);
 }
@@ -148,7 +152,7 @@ stat_prefix: thrift
   - name: envoy.filters.thrift.router
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config =
       parseThriftProxyFromV2Yaml(yaml);
 
   EXPECT_THROW_WITH_REGEX(factory_.createFilterFactoryFromProto(config, context_), EnvoyException,
@@ -173,7 +177,7 @@ stat_prefix: ingress
   ThriftFilters::MockFilterConfigFactory factory;
   Registry::InjectFactory<ThriftFilters::NamedThriftFilterConfigFactory> registry(factory);
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config =
       parseThriftProxyFromV2Yaml(yaml);
   testConfig(config);
 
diff --git a/test/extensions/filters/network/thrift_proxy/conn_manager_test.cc b/test/extensions/filters/network/thrift_proxy/conn_manager_test.cc
index 13b40f281bcf..b40873c2e2c1 100644
--- a/test/extensions/filters/network/thrift_proxy/conn_manager_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/conn_manager_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.validate.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -37,9 +37,10 @@ namespace ThriftProxy {
 
 class TestConfigImpl : public ConfigImpl {
 public:
-  TestConfigImpl(envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy proto_config,
-                 Server::Configuration::MockFactoryContext& context,
-                 ThriftFilters::DecoderFilterSharedPtr decoder_filter, ThriftFilterStats& stats)
+  TestConfigImpl(
+      envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy proto_config,
+      Server::Configuration::MockFactoryContext& context,
+      ThriftFilters::DecoderFilterSharedPtr decoder_filter, ThriftFilterStats& stats)
       : ConfigImpl(proto_config, context), decoder_filter_(decoder_filter), stats_(stats) {}
 
   // ConfigImpl
@@ -296,7 +297,7 @@ class ThriftConnectionManagerTest : public testing::Test {
   std::shared_ptr<ThriftFilters::MockDecoderFilter> decoder_filter_;
   Stats::IsolatedStoreImpl store_;
   ThriftFilterStats stats_;
-  envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy proto_config_;
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy proto_config_;
 
   std::unique_ptr<TestConfigImpl> config_;
 
diff --git a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
index 907ddf164ee4..2d6f39679b30 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
@@ -27,7 +27,7 @@ envoy_extension_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/thrift/rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -39,7 +39,7 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/thrift_proxy/filters/ratelimit:config",
         "//test/extensions/filters/network/thrift_proxy:mocks",
         "//test/mocks/server:server_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/filter/thrift/rate_limit/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/config_test.cc b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/config_test.cc
index 0d7b0e30e0c2..5adba30bc0b2 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/config_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/config_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.h"
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.validate.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.validate.h"
 
 #include "extensions/filters/network/thrift_proxy/filters/ratelimit/config.h"
 
@@ -18,9 +18,9 @@ namespace ThriftFilters {
 namespace RateLimitFilter {
 namespace {
 
-envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit
+envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit
 parseRateLimitFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit rate_limit;
+  envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit rate_limit;
   TestUtility::loadFromYaml(yaml, rate_limit);
   return rate_limit;
 }
@@ -31,7 +31,7 @@ TEST(RateLimitFilterConfigTest, ValidateFail) {
   NiceMock<Server::Configuration::MockFactoryContext> context;
   EXPECT_THROW(
       RateLimitFilterConfig().createFilterFactoryFromProto(
-          envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit(), "stats", context),
+          envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit(), "stats", context),
       ProtoValidationException);
 }
 
@@ -50,7 +50,7 @@ timeout: "1.337s"
   NiceMock<Server::Configuration::MockFactoryContext> context;
 
   EXPECT_CALL(context.cluster_manager_.async_client_manager_, factoryForGrpcService(_, _, _))
-      .WillOnce(Invoke([](const envoy::api::v2::core::GrpcService&, Stats::Scope&, bool) {
+      .WillOnce(Invoke([](const envoy::config::core::v3alpha::GrpcService&, Stats::Scope&, bool) {
         return std::make_unique<NiceMock<Grpc::MockAsyncClientFactory>>();
       }));
 
diff --git a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit_test.cc b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit_test.cc
index 05fa0d2bbfb6..eb2e92af2f0d 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/ratelimit_test.cc
@@ -2,7 +2,7 @@
 #include <string>
 #include <vector>
 
-#include "envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.pb.h"
+#include "envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/empty_string.h"
@@ -51,7 +51,7 @@ class ThriftRateLimitFilterTest : public testing::Test {
   }
 
   void SetUpTest(const std::string& yaml) {
-    envoy::config::filter::thrift::rate_limit::v2alpha1::RateLimit proto_config{};
+    envoy::config::filter::thrift::rate_limit::v3alpha::RateLimit proto_config{};
     TestUtility::loadFromYaml(yaml, proto_config);
 
     config_.reset(new Config(proto_config, local_info_, stats_store_, runtime_, cm_));
diff --git a/test/extensions/filters/network/thrift_proxy/integration_test.cc b/test/extensions/filters/network/thrift_proxy/integration_test.cc
index 1e6ca6eea8e7..ff474effe5a1 100644
--- a/test/extensions/filters/network/thrift_proxy/integration_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "extensions/filters/network/thrift_proxy/buffer_helper.h"
 
@@ -111,7 +111,7 @@ class ThriftConnManagerIntegrationTest
   void initializeCommon() {
     setUpstreamCount(4);
 
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       for (int i = 1; i < 4; i++) {
         auto* c = bootstrap.mutable_static_resources()->add_clusters();
         c->MergeFrom(bootstrap.static_resources().clusters()[0]);
diff --git a/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc b/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc
index 96925869b1ad..c146e450cff8 100644
--- a/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc
@@ -1,6 +1,7 @@
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/route.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/route.pb.validate.h"
+#include "envoy/config/filter/thrift/router/v2alpha1/router.pb.h"
 #include "envoy/config/filter/thrift/router/v2alpha1/router.pb.validate.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/route.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/route.pb.validate.h"
 
 #include "extensions/filters/network/thrift_proxy/router/config.h"
 #include "extensions/filters/network/thrift_proxy/router/router_impl.h"
@@ -17,9 +18,9 @@ namespace ThriftProxy {
 namespace Router {
 namespace {
 
-envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration
+envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration
 parseRouteConfigurationFromV2Yaml(const std::string& yaml) {
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration route_config;
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration route_config;
   TestUtility::loadFromYaml(yaml, route_config);
   TestUtility::validate(route_config);
   return route_config;
@@ -39,7 +40,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -76,7 +77,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -119,7 +120,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -156,7 +157,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   EXPECT_THROW(new RouteMatcher(config), EnvoyException);
@@ -176,7 +177,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -213,7 +214,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -256,7 +257,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -293,7 +294,7 @@ name: config
       cluster: "cluster2"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   EXPECT_THROW(new RouteMatcher(config), EnvoyException);
@@ -312,7 +313,7 @@ name: config
       cluster: "cluster1"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -345,7 +346,7 @@ name: config
       cluster: "cluster1"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -383,7 +384,7 @@ name: config
       cluster: "cluster1"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -419,7 +420,7 @@ name: config
       cluster: "cluster1"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -456,7 +457,7 @@ name: config
       cluster: "cluster1"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -492,7 +493,7 @@ name: config
       cluster: "cluster1"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -530,7 +531,7 @@ name: config
       cluster_header: "x-cluster"
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
 
   RouteMatcher matcher(config);
@@ -586,7 +587,7 @@ name: config
             weight: 5000
 )EOF";
 
-  envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   RouteMatcher matcher(config);
   MessageMetadata metadata;
@@ -630,7 +631,7 @@ name: config
             weight: 5000
 )EOF";
 
-  const envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  const envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   EXPECT_THROW(RouteMatcher m(config), EnvoyException);
 }
@@ -654,7 +655,7 @@ name: config
       cluster: cluster2
 )EOF";
 
-  const envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  const envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   RouteMatcher matcher(config);
   MessageMetadata metadata;
@@ -726,7 +727,7 @@ name: config
                   k3: v3
 )EOF";
 
-  const envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  const envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   RouteMatcher matcher(config);
   MessageMetadata metadata;
@@ -813,7 +814,7 @@ name: config
                   k2: v3
 )EOF";
 
-  const envoy::config::filter::network::thrift_proxy::v2alpha1::RouteConfiguration config =
+  const envoy::extensions::filters::network::thrift_proxy::v3alpha::RouteConfiguration config =
       parseRouteConfigurationFromV2Yaml(yaml);
   RouteMatcher matcher(config);
   MessageMetadata metadata;
diff --git a/test/extensions/filters/network/thrift_proxy/router_ratelimit_test.cc b/test/extensions/filters/network/thrift_proxy/router_ratelimit_test.cc
index eb776bcf307b..e75b493cb44c 100644
--- a/test/extensions/filters/network/thrift_proxy/router_ratelimit_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/router_ratelimit_test.cc
@@ -1,9 +1,9 @@
 #include <memory>
 
-#include "envoy/api/v2/route/route.pb.h"
 #include "envoy/common/exception.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.validate.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.validate.h"
 #include "envoy/ratelimit/ratelimit.h"
 
 #include "common/protobuf/utility.h"
@@ -32,7 +32,7 @@ namespace {
 class ThriftRateLimitConfigurationTest : public testing::Test {
 public:
   void initialize(const std::string& yaml) {
-    envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProxy config;
+    envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProxy config;
     TestUtility::loadFromYaml(yaml, config);
     config_ = std::make_unique<ThriftProxy::ConfigImpl>(config, factory_context_);
   }
@@ -173,7 +173,7 @@ TEST_F(ThriftRateLimitConfigurationTest, Stages) {
 class ThriftRateLimitPolicyEntryTest : public testing::Test {
 public:
   void initialize(const std::string& yaml) {
-    envoy::api::v2::route::RateLimit rate_limit;
+    envoy::config::route::v3alpha::RateLimit rate_limit;
     TestUtility::loadFromYaml(yaml, rate_limit);
 
     rate_limit_entry_ = std::make_unique<RateLimitPolicyEntryImpl>(rate_limit);
diff --git a/test/extensions/filters/network/thrift_proxy/router_test.cc b/test/extensions/filters/network/thrift_proxy/router_test.cc
index 652ec3ca5f40..ef7a4ba6f843 100644
--- a/test/extensions/filters/network/thrift_proxy/router_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/router_test.cc
@@ -1,5 +1,6 @@
 #include <memory>
 
+#include "envoy/config/filter/thrift/router/v2alpha1/router.pb.h"
 #include "envoy/config/filter/thrift/router/v2alpha1/router.pb.validate.h"
 #include "envoy/tcp/conn_pool.h"
 
diff --git a/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc b/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc
index ccb391231985..58161dcbb111 100644
--- a/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
 
 #include "extensions/filters/network/well_known_names.h"
 
@@ -50,11 +50,11 @@ class ThriftTranslationIntegrationTest
     auto upstream_transport_proto = transportTypeToProto(upstream_transport);
     auto upstream_protocol_proto = protocolTypeToProto(upstream_protocol);
 
-    envoy::config::filter::network::thrift_proxy::v2alpha1::ThriftProtocolOptions proto_opts;
+    envoy::extensions::filters::network::thrift_proxy::v3alpha::ThriftProtocolOptions proto_opts;
     proto_opts.set_transport(upstream_transport_proto);
     proto_opts.set_protocol(upstream_protocol_proto);
 
-    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* opts = bootstrap.mutable_static_resources()
                        ->mutable_clusters(0)
                        ->mutable_typed_extension_protocol_options();
diff --git a/test/extensions/filters/network/thrift_proxy/utility.h b/test/extensions/filters/network/thrift_proxy/utility.h
index bd91e3b36b95..f61158872662 100644
--- a/test/extensions/filters/network/thrift_proxy/utility.h
+++ b/test/extensions/filters/network/thrift_proxy/utility.h
@@ -2,7 +2,7 @@
 
 #include <initializer_list>
 
-#include "envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.pb.h"
+#include "envoy/extensions/filters/network/thrift_proxy/v3alpha/thrift_proxy.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/byte_order.h"
@@ -63,27 +63,27 @@ inline std::string fieldTypeParamToString(const TestParamInfo<FieldType>& params
   return fieldTypeToString(params.param);
 }
 
-inline envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType
+inline envoy::extensions::filters::network::thrift_proxy::v3alpha::TransportType
 transportTypeToProto(TransportType transport_type) {
   switch (transport_type) {
   case TransportType::Framed:
-    return envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::FRAMED;
+    return envoy::extensions::filters::network::thrift_proxy::v3alpha::FRAMED;
   case TransportType::Unframed:
-    return envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::UNFRAMED;
+    return envoy::extensions::filters::network::thrift_proxy::v3alpha::UNFRAMED;
   case TransportType::Header:
-    return envoy::config::filter::network::thrift_proxy::v2alpha1::TransportType::HEADER;
+    return envoy::extensions::filters::network::thrift_proxy::v3alpha::HEADER;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 }
 
-inline envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType
+inline envoy::extensions::filters::network::thrift_proxy::v3alpha::ProtocolType
 protocolTypeToProto(ProtocolType protocol_type) {
   switch (protocol_type) {
   case ProtocolType::Binary:
-    return envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::BINARY;
+    return envoy::extensions::filters::network::thrift_proxy::v3alpha::BINARY;
   case ProtocolType::Compact:
-    return envoy::config::filter::network::thrift_proxy::v2alpha1::ProtocolType::COMPACT;
+    return envoy::extensions::filters::network::thrift_proxy::v3alpha::COMPACT;
   default:
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
diff --git a/test/extensions/filters/network/zookeeper_proxy/BUILD b/test/extensions/filters/network/zookeeper_proxy/BUILD
index 6c55a8a8e422..d6dc872cebe8 100644
--- a/test/extensions/filters/network/zookeeper_proxy/BUILD
+++ b/test/extensions/filters/network/zookeeper_proxy/BUILD
@@ -34,6 +34,6 @@ envoy_extension_cc_test(
         "//source/extensions/filters/network/zookeeper_proxy:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/zookeeper_proxy/v1alpha1:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/zookeeper_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/zookeeper_proxy/config_test.cc b/test/extensions/filters/network/zookeeper_proxy/config_test.cc
index 6a2bc9724237..1a83c65bc41e 100644
--- a/test/extensions/filters/network/zookeeper_proxy/config_test.cc
+++ b/test/extensions/filters/network/zookeeper_proxy/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.pb.h"
-#include "envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/zookeeper_proxy/v3alpha/zookeeper_proxy.pb.h"
+#include "envoy/extensions/filters/network/zookeeper_proxy/v3alpha/zookeeper_proxy.pb.validate.h"
 
 #include "extensions/filters/network/zookeeper_proxy/config.h"
 
@@ -15,7 +15,7 @@ namespace NetworkFilters {
 namespace ZooKeeperProxy {
 
 using ZooKeeperProxyProtoConfig =
-    envoy::config::filter::network::zookeeper_proxy::v1alpha1::ZooKeeperProxy;
+    envoy::extensions::filters::network::zookeeper_proxy::v3alpha::ZooKeeperProxy;
 
 TEST(ZookeeperFilterConfigTest, ValidateFail) {
   testing::NiceMock<Server::Configuration::MockFactoryContext> context;
diff --git a/test/extensions/filters/udp/udp_proxy/BUILD b/test/extensions/filters/udp/udp_proxy/BUILD
index a42eb221f00d..2c70f439d438 100644
--- a/test/extensions/filters/udp/udp_proxy/BUILD
+++ b/test/extensions/filters/udp/udp_proxy/BUILD
@@ -30,6 +30,6 @@ envoy_extension_cc_test(
     deps = [
         "//source/extensions/filters/udp/udp_proxy:config",
         "//test/integration:integration_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/udp/udp_proxy/udp_proxy_integration_test.cc b/test/extensions/filters/udp/udp_proxy/udp_proxy_integration_test.cc
index a0862942a3b4..1fb006d2acc4 100644
--- a/test/extensions/filters/udp/udp_proxy/udp_proxy_integration_test.cc
+++ b/test/extensions/filters/udp/udp_proxy/udp_proxy_integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "test/integration/integration.h"
 
@@ -56,13 +56,14 @@ class UdpProxyIntegrationTest : public testing::TestWithParam<Network::Address::
     if (upstream_count > 1) {
       setDeterministic();
       setUpstreamCount(upstream_count);
-      config_helper_.addConfigModifier([upstream_count](
-                                           envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-        for (uint32_t i = 1; i < upstream_count; i++) {
-          auto* new_host = bootstrap.mutable_static_resources()->mutable_clusters(0)->add_hosts();
-          new_host->MergeFrom(bootstrap.static_resources().clusters(0).hosts(0));
-        }
-      });
+      config_helper_.addConfigModifier(
+          [upstream_count](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+            for (uint32_t i = 1; i < upstream_count; i++) {
+              auto* new_host =
+                  bootstrap.mutable_static_resources()->mutable_clusters(0)->add_hosts();
+              new_host->MergeFrom(bootstrap.static_resources().clusters(0).hosts(0));
+            }
+          });
     }
     BaseIntegrationTest::initialize();
   }
diff --git a/test/extensions/grpc_credentials/aws_iam/aws_iam_grpc_credentials_test.cc b/test/extensions/grpc_credentials/aws_iam/aws_iam_grpc_credentials_test.cc
index 410f08da169b..5953c171971e 100644
--- a/test/extensions/grpc_credentials/aws_iam/aws_iam_grpc_credentials_test.cc
+++ b/test/extensions/grpc_credentials/aws_iam/aws_iam_grpc_credentials_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/aws_iam.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/aws_iam.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/common/utility.h"
@@ -49,7 +49,7 @@ class GrpcAwsIamClientIntegrationTest : public GrpcSslClientIntegrationTest {
     EXPECT_TRUE(absl::StartsWith(auth_parts[3], "Signature="));
   }
 
-  envoy::api::v2::core::GrpcService createGoogleGrpcConfig() override {
+  envoy::config::core::v3alpha::GrpcService createGoogleGrpcConfig() override {
     auto config = GrpcSslClientIntegrationTest::createGoogleGrpcConfig();
     auto* google_grpc = config.mutable_google_grpc();
     google_grpc->set_credentials_factory_name(credentials_factory_name_);
@@ -74,8 +74,9 @@ region: {}
 
     auto* plugin_config = google_grpc->add_call_credentials()->mutable_from_plugin();
     plugin_config->set_name(credentials_factory_name_);
-    envoy::config::grpc_credential::v2alpha::AwsIamConfig metadata_config;
-    Envoy::TestUtility::loadFromYaml(config_yaml, *plugin_config->mutable_config());
+    envoy::config::grpc_credential::v3alpha::AwsIamConfig metadata_config;
+    Envoy::TestUtility::loadFromYaml(config_yaml,
+                                     *plugin_config->mutable_hidden_envoy_deprecated_config());
 
     return config;
   }
diff --git a/test/extensions/grpc_credentials/file_based_metadata/file_based_metadata_grpc_credentials_test.cc b/test/extensions/grpc_credentials/file_based_metadata/file_based_metadata_grpc_credentials_test.cc
index 1617030c9aa7..933f57b54449 100644
--- a/test/extensions/grpc_credentials/file_based_metadata/file_based_metadata_grpc_credentials_test.cc
+++ b/test/extensions/grpc_credentials/file_based_metadata/file_based_metadata_grpc_credentials_test.cc
@@ -1,7 +1,7 @@
 #ifdef ENVOY_GOOGLE_GRPC
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
-#include "envoy/config/grpc_credential/v2alpha/file_based_metadata.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/grpc_credential/v3alpha/file_based_metadata.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/grpc/google_async_client_impl.h"
@@ -32,7 +32,7 @@ class GrpcFileBasedMetadataClientIntegrationTest : public GrpcSslClientIntegrati
     }
   }
 
-  envoy::api::v2::core::GrpcService createGoogleGrpcConfig() override {
+  envoy::config::core::v3alpha::GrpcService createGoogleGrpcConfig() override {
     auto config = GrpcClientIntegrationTest::createGoogleGrpcConfig();
     auto* google_grpc = config.mutable_google_grpc();
     google_grpc->set_credentials_factory_name(credentials_factory_name_);
@@ -49,8 +49,9 @@ header_prefix: {}
                                             header_value_1_, header_key_1_, header_prefix_1_);
       auto* plugin_config = google_grpc->add_call_credentials()->mutable_from_plugin();
       plugin_config->set_name(credentials_factory_name_);
-      envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig metadata_config;
-      Envoy::TestUtility::loadFromYaml(yaml1, *plugin_config->mutable_config());
+      envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig metadata_config;
+      Envoy::TestUtility::loadFromYaml(yaml1,
+                                       *plugin_config->mutable_hidden_envoy_deprecated_config());
     }
     if (!header_value_2_.empty()) {
       // uses default key/prefix
@@ -59,10 +60,11 @@ header_prefix: {}
   inline_string: {}
 )EOF",
                                             header_value_2_);
-      envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig metadata_config2;
+      envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig metadata_config2;
       auto* plugin_config2 = google_grpc->add_call_credentials()->mutable_from_plugin();
       plugin_config2->set_name(credentials_factory_name_);
-      Envoy::TestUtility::loadFromYaml(yaml2, *plugin_config2->mutable_config());
+      Envoy::TestUtility::loadFromYaml(yaml2,
+                                       *plugin_config2->mutable_hidden_envoy_deprecated_config());
     }
     if (!access_token_value_.empty()) {
       google_grpc->add_call_credentials()->set_access_token(access_token_value_);
@@ -157,7 +159,7 @@ TEST(GrpcFileBasedMetadata, MissingSecretData) {
 secret_data:
   filename: missing-file
 )EOF";
-  envoy::config::grpc_credential::v2alpha::FileBasedMetadataConfig metadata_config;
+  envoy::config::grpc_credential::v3alpha::FileBasedMetadataConfig metadata_config;
   Envoy::TestUtility::loadFromYaml(yaml, metadata_config);
   Api::ApiPtr api = Api::createApiForTest();
   Extensions::GrpcCredentials::FileBasedMetadata::FileBasedMetadataAuthenticator authenticator(
diff --git a/test/extensions/health_checkers/redis/BUILD b/test/extensions/health_checkers/redis/BUILD
index 03483171d5be..190cfb63edc9 100644
--- a/test/extensions/health_checkers/redis/BUILD
+++ b/test/extensions/health_checkers/redis/BUILD
@@ -27,8 +27,7 @@ envoy_extension_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/health_checker/redis/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -44,6 +43,6 @@ envoy_extension_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/server:server_mocks",
         "//test/mocks/upstream:upstream_mocks",
-        "@envoy_api//envoy/config/filter/network/redis_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/health_checkers/redis/config_test.cc b/test/extensions/health_checkers/redis/config_test.cc
index f4333fe85677..341b8334c3a7 100644
--- a/test/extensions/health_checkers/redis/config_test.cc
+++ b/test/extensions/health_checkers/redis/config_test.cc
@@ -1,4 +1,5 @@
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "common/upstream/health_checker_impl.h"
 
diff --git a/test/extensions/health_checkers/redis/redis_test.cc b/test/extensions/health_checkers/redis/redis_test.cc
index deda4f5803e1..80f5fe31baea 100644
--- a/test/extensions/health_checkers/redis/redis_test.cc
+++ b/test/extensions/health_checkers/redis/redis_test.cc
@@ -1,8 +1,8 @@
 #include <memory>
 
 #include "envoy/api/api.h"
-#include "envoy/config/filter/network/redis_proxy/v2/redis_proxy.pb.validate.h"
-#include "envoy/config/health_checker/redis/v2/redis.pb.validate.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.h"
+#include "envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.pb.validate.h"
 
 #include "extensions/health_checkers/redis/redis.h"
 #include "extensions/health_checkers/redis/utility.h"
diff --git a/test/extensions/quic_listeners/quiche/integration/BUILD b/test/extensions/quic_listeners/quiche/integration/BUILD
index b9c05f3c4759..967604c1296f 100644
--- a/test/extensions/quic_listeners/quiche/integration/BUILD
+++ b/test/extensions/quic_listeners/quiche/integration/BUILD
@@ -23,8 +23,8 @@ envoy_cc_test(
         "//source/extensions/quic_listeners/quiche:envoy_quic_proof_verifier_lib",
         "//source/extensions/quic_listeners/quiche:quic_transport_socket_factory_lib",
         "//test/integration:http_integration_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/quic_listeners/quiche/integration/quic_http_integration_test.cc b/test/extensions/quic_listeners/quiche/integration/quic_http_integration_test.cc
index 58d23d9af63e..d3cc7f1ff373 100644
--- a/test/extensions/quic_listeners/quiche/integration/quic_http_integration_test.cc
+++ b/test/extensions/quic_listeners/quiche/integration/quic_http_integration_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "test/config/utility.h"
 #include "test/integration/http_integration.h"
@@ -95,8 +95,8 @@ class QuicHttpIntegrationTest : public testing::TestWithParam<Network::Address::
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      envoy::api::v2::auth::DownstreamTlsContext tls_context;
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+      envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
       ConfigHelper::initializeTls({}, *tls_context.mutable_common_tls_context());
       auto* filter_chain =
           bootstrap.mutable_static_resources()->mutable_listeners(0)->mutable_filter_chains(0);
@@ -104,10 +104,10 @@ class QuicHttpIntegrationTest : public testing::TestWithParam<Network::Address::
       transport_socket->mutable_typed_config()->PackFrom(tls_context);
     });
     config_helper_.addConfigModifier(
-        [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-               hcm) {
-          EXPECT_EQ(hcm.codec_type(), envoy::config::filter::network::http_connection_manager::v2::
-                                          HttpConnectionManager::HTTP3);
+        [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+               HttpConnectionManager& hcm) {
+          EXPECT_EQ(hcm.codec_type(), envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager::HTTP3);
         });
 
     HttpIntegrationTest::initialize();
@@ -186,13 +186,13 @@ TEST_P(QuicHttpIntegrationTest, TestDelayedConnectionTeardownTimeoutTrigger) {
   config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
                            "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        // 200ms.
-        hcm.mutable_delayed_close_timeout()->set_nanos(200000000);
-        hcm.mutable_drain_timeout()->set_seconds(1);
-        hcm.mutable_common_http_protocol_options()->mutable_idle_timeout()->set_seconds(1);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) {
+    // 200ms.
+    hcm.mutable_delayed_close_timeout()->set_nanos(200000000);
+    hcm.mutable_drain_timeout()->set_seconds(1);
+    hcm.mutable_common_http_protocol_options()->mutable_idle_timeout()->set_seconds(1);
+  });
 
   initialize();
 
diff --git a/test/extensions/stats_sinks/dog_statsd/BUILD b/test/extensions/stats_sinks/dog_statsd/BUILD
index 29d4404ae6b4..1e0b25acad20 100644
--- a/test/extensions/stats_sinks/dog_statsd/BUILD
+++ b/test/extensions/stats_sinks/dog_statsd/BUILD
@@ -23,7 +23,7 @@ envoy_extension_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/stats_sinks/dog_statsd/config_test.cc b/test/extensions/stats_sinks/dog_statsd/config_test.cc
index 574ab55fece9..ec2a12a5ba99 100644
--- a/test/extensions/stats_sinks/dog_statsd/config_test.cc
+++ b/test/extensions/stats_sinks/dog_statsd/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 #include "envoy/registry/registry.h"
 
 #include "common/config/well_known_names.h"
@@ -33,10 +33,10 @@ INSTANTIATE_TEST_SUITE_P(IpVersions, DogStatsdConfigLoopbackTest,
 TEST_P(DogStatsdConfigLoopbackTest, ValidUdpIp) {
   const std::string name = StatsSinkNames::get().DogStatsd;
 
-  envoy::config::metrics::v2::DogStatsdSink sink_config;
-  envoy::api::v2::core::Address& address = *sink_config.mutable_address();
-  envoy::api::v2::core::SocketAddress& socket_address = *address.mutable_socket_address();
-  socket_address.set_protocol(envoy::api::v2::core::SocketAddress::UDP);
+  envoy::config::metrics::v3alpha::DogStatsdSink sink_config;
+  envoy::config::core::v3alpha::Address& address = *sink_config.mutable_address();
+  envoy::config::core::v3alpha::SocketAddress& socket_address = *address.mutable_socket_address();
+  socket_address.set_protocol(envoy::config::core::v3alpha::SocketAddress::UDP);
   auto loopback_flavor = Network::Test::getCanonicalLoopbackAddress(GetParam());
   socket_address.set_address(loopback_flavor->ip()->addressAsString());
   socket_address.set_port_value(8125);
@@ -60,18 +60,18 @@ TEST_P(DogStatsdConfigLoopbackTest, ValidUdpIp) {
 // Negative test for protoc-gen-validate constraints for dog_statsd.
 TEST(DogStatsdConfigTest, ValidateFail) {
   NiceMock<Server::MockInstance> server;
-  EXPECT_THROW(
-      DogStatsdSinkFactory().createStatsSink(envoy::config::metrics::v2::DogStatsdSink(), server),
-      ProtoValidationException);
+  EXPECT_THROW(DogStatsdSinkFactory().createStatsSink(
+                   envoy::config::metrics::v3alpha::DogStatsdSink(), server),
+               ProtoValidationException);
 }
 
 TEST_P(DogStatsdConfigLoopbackTest, WithCustomPrefix) {
   const std::string name = StatsSinkNames::get().DogStatsd;
 
-  envoy::config::metrics::v2::DogStatsdSink sink_config;
-  envoy::api::v2::core::Address& address = *sink_config.mutable_address();
-  envoy::api::v2::core::SocketAddress& socket_address = *address.mutable_socket_address();
-  socket_address.set_protocol(envoy::api::v2::core::SocketAddress::UDP);
+  envoy::config::metrics::v3alpha::DogStatsdSink sink_config;
+  envoy::config::core::v3alpha::Address& address = *sink_config.mutable_address();
+  envoy::config::core::v3alpha::SocketAddress& socket_address = *address.mutable_socket_address();
+  socket_address.set_protocol(envoy::config::core::v3alpha::SocketAddress::UDP);
   auto loopback_flavor = Network::Test::getCanonicalLoopbackAddress(GetParam());
   socket_address.set_address(loopback_flavor->ip()->addressAsString());
   socket_address.set_port_value(8125);
diff --git a/test/extensions/stats_sinks/hystrix/BUILD b/test/extensions/stats_sinks/hystrix/BUILD
index 420b4295d860..79a794aaebc2 100644
--- a/test/extensions/stats_sinks/hystrix/BUILD
+++ b/test/extensions/stats_sinks/hystrix/BUILD
@@ -23,7 +23,7 @@ envoy_extension_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/stats_sinks/hystrix/config_test.cc b/test/extensions/stats_sinks/hystrix/config_test.cc
index 0f730a32da7d..e6c290f70035 100644
--- a/test/extensions/stats_sinks/hystrix/config_test.cc
+++ b/test/extensions/stats_sinks/hystrix/config_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 #include "envoy/registry/registry.h"
 
 #include "common/protobuf/utility.h"
@@ -26,7 +26,7 @@ namespace {
 TEST(StatsConfigTest, ValidHystrixSink) {
   const std::string name = StatsSinkNames::get().Hystrix;
 
-  envoy::config::metrics::v2::HystrixSink sink_config;
+  envoy::config::metrics::v3alpha::HystrixSink sink_config;
 
   Server::Configuration::StatsSinkFactory* factory =
       Registry::FactoryRegistry<Server::Configuration::StatsSinkFactory>::getFactory(name);
diff --git a/test/extensions/stats_sinks/metrics_service/BUILD b/test/extensions/stats_sinks/metrics_service/BUILD
index ba1ecd0abd37..299b32c2246b 100644
--- a/test/extensions/stats_sinks/metrics_service/BUILD
+++ b/test/extensions/stats_sinks/metrics_service/BUILD
@@ -26,7 +26,7 @@ envoy_extension_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
-        "@envoy_api//envoy/service/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -43,8 +43,8 @@ envoy_extension_cc_test(
         "//test/common/grpc:grpc_client_integration_lib",
         "//test/integration:http_integration_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/stats_sinks/metrics_service/grpc_metrics_service_impl_test.cc b/test/extensions/stats_sinks/metrics_service/grpc_metrics_service_impl_test.cc
index 79724d85b49a..25db6de60322 100644
--- a/test/extensions/stats_sinks/metrics_service/grpc_metrics_service_impl_test.cc
+++ b/test/extensions/stats_sinks/metrics_service/grpc_metrics_service_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/service/metrics/v2/metrics_service.pb.h"
+#include "envoy/service/metrics/v3alpha/metrics_service.pb.h"
 
 #include "extensions/stat_sinks/metrics_service/grpc_metrics_service_impl.h"
 
@@ -25,7 +25,7 @@ class GrpcMetricsStreamerImplTest : public testing::Test {
 public:
   using MockMetricsStream = Grpc::MockAsyncStream;
   using MetricsServiceCallbacks =
-      Grpc::AsyncStreamCallbacks<envoy::service::metrics::v2::StreamMetricsResponse>;
+      Grpc::AsyncStreamCallbacks<envoy::service::metrics::v3alpha::StreamMetricsResponse>;
 
   GrpcMetricsStreamerImplTest() {
     EXPECT_CALL(*factory_, create()).WillOnce(Invoke([this] {
@@ -61,11 +61,11 @@ TEST_F(GrpcMetricsStreamerImplTest, BasicFlow) {
   expectStreamStart(stream1, &callbacks1);
   EXPECT_CALL(local_info_, node());
   EXPECT_CALL(stream1, sendMessageRaw_(_, false));
-  envoy::service::metrics::v2::StreamMetricsMessage message_metrics1;
+  envoy::service::metrics::v3alpha::StreamMetricsMessage message_metrics1;
   streamer_->send(message_metrics1);
   // Verify that sending an empty response message doesn't do anything bad.
   callbacks1->onReceiveMessage(
-      std::make_unique<envoy::service::metrics::v2::StreamMetricsResponse>());
+      std::make_unique<envoy::service::metrics::v3alpha::StreamMetricsResponse>());
 }
 
 // Test that stream failure is handled correctly.
@@ -80,21 +80,21 @@ TEST_F(GrpcMetricsStreamerImplTest, StreamFailure) {
             return nullptr;
           }));
   EXPECT_CALL(local_info_, node());
-  envoy::service::metrics::v2::StreamMetricsMessage message_metrics1;
+  envoy::service::metrics::v3alpha::StreamMetricsMessage message_metrics1;
   streamer_->send(message_metrics1);
 }
 
 class MockGrpcMetricsStreamer : public GrpcMetricsStreamer {
 public:
   // GrpcMetricsStreamer
-  MOCK_METHOD1(send, void(envoy::service::metrics::v2::StreamMetricsMessage& message));
+  MOCK_METHOD1(send, void(envoy::service::metrics::v3alpha::StreamMetricsMessage& message));
 };
 
 class TestGrpcMetricsStreamer : public GrpcMetricsStreamer {
 public:
   int metric_count;
   // GrpcMetricsStreamer
-  void send(envoy::service::metrics::v2::StreamMetricsMessage& message) override {
+  void send(envoy::service::metrics::v3alpha::StreamMetricsMessage& message) override {
     metric_count = message.envoy_metrics_size();
   }
 };
diff --git a/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc b/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc
index 9718eb95d28e..fcffb1e731e1 100644
--- a/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc
+++ b/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/metrics/v2/metrics_service.pb.h"
-#include "envoy/service/metrics/v2/metrics_service.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/metrics/v3alpha/metrics_service.pb.h"
+#include "envoy/service/metrics/v3alpha/metrics_service.pb.h"
 
 #include "common/common/version.h"
 #include "common/grpc/codec.h"
@@ -32,23 +32,24 @@ class MetricsServiceIntegrationTest : public Grpc::GrpcClientIntegrationParamTes
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      // metrics_service cluster for Envoy gRPC.
-      auto* metrics_service_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      metrics_service_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
-      metrics_service_cluster->set_name("metrics_service");
-      metrics_service_cluster->mutable_http2_protocol_options();
-      // metrics_service gRPC service definition.
-      auto* metrics_sink = bootstrap.add_stats_sinks();
-      metrics_sink->set_name("envoy.metrics_service");
-      envoy::config::metrics::v2::MetricsServiceConfig config;
-      setGrpcService(*config.mutable_grpc_service(), "metrics_service",
-                     fake_upstreams_.back()->localAddress());
-      metrics_sink->mutable_typed_config()->PackFrom(config);
-      // Shrink reporting period down to 1s to make test not take forever.
-      bootstrap.mutable_stats_flush_interval()->CopyFrom(
-          Protobuf::util::TimeUtil::MillisecondsToDuration(100));
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          // metrics_service cluster for Envoy gRPC.
+          auto* metrics_service_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          metrics_service_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
+          metrics_service_cluster->set_name("metrics_service");
+          metrics_service_cluster->mutable_http2_protocol_options();
+          // metrics_service gRPC service definition.
+          auto* metrics_sink = bootstrap.add_stats_sinks();
+          metrics_sink->set_name("envoy.metrics_service");
+          envoy::config::metrics::v3alpha::MetricsServiceConfig config;
+          setGrpcService(*config.mutable_grpc_service(), "metrics_service",
+                         fake_upstreams_.back()->localAddress());
+          metrics_sink->mutable_typed_config()->PackFrom(config);
+          // Shrink reporting period down to 1s to make test not take forever.
+          bootstrap.mutable_stats_flush_interval()->CopyFrom(
+              Protobuf::util::TimeUtil::MillisecondsToDuration(100));
+        });
 
     HttpIntegrationTest::initialize();
   }
@@ -77,7 +78,7 @@ class MetricsServiceIntegrationTest : public Grpc::GrpcClientIntegrationParamTes
     // TODO(ramaraochavali): Figure out a more robust way to find out all required stats have been
     // flushed.
     while (!(known_counter_exists && known_gauge_exists && known_histogram_exists)) {
-      envoy::service::metrics::v2::StreamMetricsMessage request_msg;
+      envoy::service::metrics::v3alpha::StreamMetricsMessage request_msg;
       VERIFY_ASSERTION(metrics_service_request_->waitForGrpcMessage(*dispatcher_, request_msg));
       EXPECT_EQ("POST", metrics_service_request_->headers().Method()->value().getStringView());
       EXPECT_EQ("/envoy.service.metrics.v2.MetricsService/StreamMetrics",
@@ -162,7 +163,7 @@ TEST_P(MetricsServiceIntegrationTest, BasicFlow) {
   // Send an empty response and end the stream. This should never happen but make sure nothing
   // breaks and we make a new stream on a follow up request.
   metrics_service_request_->startGrpcStream();
-  envoy::service::metrics::v2::StreamMetricsResponse response_msg;
+  envoy::service::metrics::v3alpha::StreamMetricsResponse response_msg;
   metrics_service_request_->sendGrpcMessage(response_msg);
   metrics_service_request_->finishGrpcStream(Grpc::Status::Ok);
 
diff --git a/test/extensions/stats_sinks/statsd/BUILD b/test/extensions/stats_sinks/statsd/BUILD
index 0ee9fab7b468..768b1e4b0e54 100644
--- a/test/extensions/stats_sinks/statsd/BUILD
+++ b/test/extensions/stats_sinks/statsd/BUILD
@@ -23,7 +23,7 @@ envoy_extension_cc_test(
         "//test/test_common:environment_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/stats_sinks/statsd/config_test.cc b/test/extensions/stats_sinks/statsd/config_test.cc
index 296fdd3a6510..965c90d1a962 100644
--- a/test/extensions/stats_sinks/statsd/config_test.cc
+++ b/test/extensions/stats_sinks/statsd/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/registry/registry.h"
 
@@ -29,7 +29,7 @@ namespace {
 TEST(StatsConfigTest, ValidTcpStatsd) {
   const std::string name = StatsSinkNames::get().Statsd;
 
-  envoy::config::metrics::v2::StatsdSink sink_config;
+  envoy::config::metrics::v3alpha::StatsdSink sink_config;
   sink_config.set_tcp_cluster_name("fake_cluster");
 
   Server::Configuration::StatsSinkFactory* factory =
@@ -55,10 +55,10 @@ TEST_P(StatsConfigParameterizedTest, UdpSinkDefaultPrefix) {
   const std::string name = StatsSinkNames::get().Statsd;
   const auto& defaultPrefix = Common::Statsd::getDefaultPrefix();
 
-  envoy::config::metrics::v2::StatsdSink sink_config;
-  envoy::api::v2::core::Address& address = *sink_config.mutable_address();
-  envoy::api::v2::core::SocketAddress& socket_address = *address.mutable_socket_address();
-  socket_address.set_protocol(envoy::api::v2::core::SocketAddress::UDP);
+  envoy::config::metrics::v3alpha::StatsdSink sink_config;
+  envoy::config::core::v3alpha::Address& address = *sink_config.mutable_address();
+  envoy::config::core::v3alpha::SocketAddress& socket_address = *address.mutable_socket_address();
+  socket_address.set_protocol(envoy::config::core::v3alpha::SocketAddress::UDP);
   if (GetParam() == Network::Address::IpVersion::v4) {
     socket_address.set_address("127.0.0.1");
   } else {
@@ -86,10 +86,10 @@ TEST_P(StatsConfigParameterizedTest, UdpSinkCustomPrefix) {
   const std::string name = StatsSinkNames::get().Statsd;
   const std::string customPrefix = "prefix.test";
 
-  envoy::config::metrics::v2::StatsdSink sink_config;
-  envoy::api::v2::core::Address& address = *sink_config.mutable_address();
-  envoy::api::v2::core::SocketAddress& socket_address = *address.mutable_socket_address();
-  socket_address.set_protocol(envoy::api::v2::core::SocketAddress::UDP);
+  envoy::config::metrics::v3alpha::StatsdSink sink_config;
+  envoy::config::core::v3alpha::Address& address = *sink_config.mutable_address();
+  envoy::config::core::v3alpha::SocketAddress& socket_address = *address.mutable_socket_address();
+  socket_address.set_protocol(envoy::config::core::v3alpha::SocketAddress::UDP);
   if (GetParam() == Network::Address::IpVersion::v4) {
     socket_address.set_address("127.0.0.1");
   } else {
@@ -117,7 +117,7 @@ TEST_P(StatsConfigParameterizedTest, UdpSinkCustomPrefix) {
 TEST(StatsConfigTest, TcpSinkDefaultPrefix) {
   const std::string name = StatsSinkNames::get().Statsd;
 
-  envoy::config::metrics::v2::StatsdSink sink_config;
+  envoy::config::metrics::v3alpha::StatsdSink sink_config;
   const auto& defaultPrefix = Common::Statsd::getDefaultPrefix();
   sink_config.set_tcp_cluster_name("fake_cluster");
 
@@ -140,7 +140,7 @@ TEST(StatsConfigTest, TcpSinkDefaultPrefix) {
 TEST(StatsConfigTest, TcpSinkCustomPrefix) {
   const std::string name = StatsSinkNames::get().Statsd;
 
-  envoy::config::metrics::v2::StatsdSink sink_config;
+  envoy::config::metrics::v3alpha::StatsdSink sink_config;
   std::string prefix = "prefixTest";
   sink_config.set_tcp_cluster_name("fake_cluster");
   ASSERT_NE(sink_config.prefix(), prefix);
@@ -170,10 +170,10 @@ INSTANTIATE_TEST_SUITE_P(IpVersions, StatsConfigLoopbackTest,
 TEST_P(StatsConfigLoopbackTest, ValidUdpIpStatsd) {
   const std::string name = StatsSinkNames::get().Statsd;
 
-  envoy::config::metrics::v2::StatsdSink sink_config;
-  envoy::api::v2::core::Address& address = *sink_config.mutable_address();
-  envoy::api::v2::core::SocketAddress& socket_address = *address.mutable_socket_address();
-  socket_address.set_protocol(envoy::api::v2::core::SocketAddress::UDP);
+  envoy::config::metrics::v3alpha::StatsdSink sink_config;
+  envoy::config::core::v3alpha::Address& address = *sink_config.mutable_address();
+  envoy::config::core::v3alpha::SocketAddress& socket_address = *address.mutable_socket_address();
+  socket_address.set_protocol(envoy::config::core::v3alpha::SocketAddress::UDP);
   auto loopback_flavor = Network::Test::getCanonicalLoopbackAddress(GetParam());
   socket_address.set_address(loopback_flavor->ip()->addressAsString());
   socket_address.set_port_value(8125);
@@ -196,7 +196,7 @@ TEST_P(StatsConfigLoopbackTest, ValidUdpIpStatsd) {
 TEST(StatsdConfigTest, ValidateFail) {
   NiceMock<Server::MockInstance> server;
   EXPECT_THROW(
-      StatsdSinkFactory().createStatsSink(envoy::config::metrics::v2::StatsdSink(), server),
+      StatsdSinkFactory().createStatsSink(envoy::config::metrics::v3alpha::StatsdSink(), server),
       ProtoValidationException);
 }
 
diff --git a/test/extensions/tracers/datadog/BUILD b/test/extensions/tracers/datadog/BUILD
index 5102a22a608c..d24dcd88a2e0 100644
--- a/test/extensions/tracers/datadog/BUILD
+++ b/test/extensions/tracers/datadog/BUILD
@@ -33,7 +33,7 @@ envoy_extension_cc_test(
         "//test/mocks/tracing:tracing_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -45,6 +45,6 @@ envoy_extension_cc_test(
         "//source/extensions/tracers/datadog:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/tracers/datadog/config_test.cc b/test/extensions/tracers/datadog/config_test.cc
index 1ae7d7c1f1b6..316f27296155 100644
--- a/test/extensions/tracers/datadog/config_test.cc
+++ b/test/extensions/tracers/datadog/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/datadog/config.h"
 
@@ -32,7 +32,7 @@ TEST(DatadogTracerConfigTest, DatadogHttpTracer) {
       collector_cluster: fake_cluster
       service_name: fake_file
    )EOF";
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   DatadogTracerFactory factory;
diff --git a/test/extensions/tracers/datadog/datadog_tracer_impl_test.cc b/test/extensions/tracers/datadog/datadog_tracer_impl_test.cc
index bec72f27b53b..e82a4c016c26 100644
--- a/test/extensions/tracers/datadog/datadog_tracer_impl_test.cc
+++ b/test/extensions/tracers/datadog/datadog_tracer_impl_test.cc
@@ -3,7 +3,7 @@
 #include <sstream>
 #include <string>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/common/base64.h"
 #include "common/http/header_map_impl.h"
@@ -43,7 +43,7 @@ namespace {
 
 class DatadogDriverTest : public testing::Test {
 public:
-  void setup(envoy::config::trace::v2::DatadogConfig& datadog_config, bool init_timer) {
+  void setup(envoy::config::trace::v3alpha::DatadogConfig& datadog_config, bool init_timer) {
     ON_CALL(cm_, httpAsyncClientForCluster("fake_cluster"))
         .WillByDefault(ReturnRef(cm_.async_client_));
 
@@ -63,7 +63,7 @@ class DatadogDriverTest : public testing::Test {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::DatadogConfig datadog_config;
+    envoy::config::trace::v3alpha::DatadogConfig datadog_config;
     TestUtility::loadFromYaml(yaml_string, datadog_config);
 
     setup(datadog_config, true);
@@ -89,7 +89,7 @@ class DatadogDriverTest : public testing::Test {
 
 TEST_F(DatadogDriverTest, InitializeDriver) {
   {
-    envoy::config::trace::v2::DatadogConfig datadog_config;
+    envoy::config::trace::v3alpha::DatadogConfig datadog_config;
 
     EXPECT_THROW(setup(datadog_config, false), EnvoyException);
   }
@@ -101,7 +101,7 @@ TEST_F(DatadogDriverTest, InitializeDriver) {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::DatadogConfig datadog_config;
+    envoy::config::trace::v3alpha::DatadogConfig datadog_config;
     TestUtility::loadFromYaml(yaml_string, datadog_config);
 
     EXPECT_THROW(setup(datadog_config, false), EnvoyException);
@@ -115,7 +115,7 @@ TEST_F(DatadogDriverTest, InitializeDriver) {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::DatadogConfig datadog_config;
+    envoy::config::trace::v3alpha::DatadogConfig datadog_config;
     TestUtility::loadFromYaml(yaml_string, datadog_config);
 
     setup(datadog_config, true);
diff --git a/test/extensions/tracers/dynamic_ot/BUILD b/test/extensions/tracers/dynamic_ot/BUILD
index f961fb056ccc..72f696818f68 100644
--- a/test/extensions/tracers/dynamic_ot/BUILD
+++ b/test/extensions/tracers/dynamic_ot/BUILD
@@ -42,6 +42,6 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/tracers/dynamic_ot/config_test.cc b/test/extensions/tracers/dynamic_ot/config_test.cc
index b09b08d75c01..e613b116b9cd 100644
--- a/test/extensions/tracers/dynamic_ot/config_test.cc
+++ b/test/extensions/tracers/dynamic_ot/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/dynamic_ot/config.h"
 
@@ -37,7 +37,7 @@ TEST(DynamicOtTracerConfigTest, DynamicOpentracingHttpTracer) {
         output_file: fake_file
   )EOF",
       TestEnvironment::runfilesPath("mocktracer/libmocktracer_plugin.so", "io_opentracing_cpp"));
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   DynamicOpenTracingTracerFactory factory;
diff --git a/test/extensions/tracers/lightstep/BUILD b/test/extensions/tracers/lightstep/BUILD
index a6a60444ef3f..a36f393284b7 100644
--- a/test/extensions/tracers/lightstep/BUILD
+++ b/test/extensions/tracers/lightstep/BUILD
@@ -35,7 +35,7 @@ envoy_extension_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:global_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -47,6 +47,6 @@ envoy_extension_cc_test(
         "//source/extensions/tracers/lightstep:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/tracers/lightstep/config_test.cc b/test/extensions/tracers/lightstep/config_test.cc
index 964d56230cbd..76decd0bcd56 100644
--- a/test/extensions/tracers/lightstep/config_test.cc
+++ b/test/extensions/tracers/lightstep/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 
 #include "extensions/tracers/lightstep/config.h"
 
@@ -32,7 +32,7 @@ TEST(LightstepTracerConfigTest, LightstepHttpTracer) {
       collector_cluster: fake_cluster
       access_token_file: fake_file
    )EOF";
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   LightstepTracerFactory factory;
diff --git a/test/extensions/tracers/lightstep/lightstep_tracer_impl_test.cc b/test/extensions/tracers/lightstep/lightstep_tracer_impl_test.cc
index 3da0e4c3e208..f898b001faa3 100644
--- a/test/extensions/tracers/lightstep/lightstep_tracer_impl_test.cc
+++ b/test/extensions/tracers/lightstep/lightstep_tracer_impl_test.cc
@@ -3,7 +3,7 @@
 #include <sstream>
 #include <string>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/common/base64.h"
 #include "common/grpc/common.h"
@@ -49,7 +49,7 @@ class LightStepDriverTest : public testing::Test {
 public:
   LightStepDriverTest() : grpc_context_(*symbol_table_) {}
 
-  void setup(envoy::config::trace::v2::LightstepConfig& lightstep_config, bool init_timer,
+  void setup(envoy::config::trace::v3alpha::LightstepConfig& lightstep_config, bool init_timer,
              Common::Ot::OpenTracingDriver::PropagationMode propagation_mode =
                  Common::Ot::OpenTracingDriver::PropagationMode::TracerNative) {
     std::unique_ptr<lightstep::LightStepTracerOptions> opts(
@@ -78,7 +78,7 @@ class LightStepDriverTest : public testing::Test {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::LightstepConfig lightstep_config;
+    envoy::config::trace::v3alpha::LightstepConfig lightstep_config;
     TestUtility::loadFromYaml(yaml_string, lightstep_config);
 
     setup(lightstep_config, true, propagation_mode);
@@ -116,7 +116,7 @@ TEST_F(LightStepDriverTest, LightStepLogger) {
 
 TEST_F(LightStepDriverTest, InitializeDriver) {
   {
-    envoy::config::trace::v2::LightstepConfig lightstep_config;
+    envoy::config::trace::v3alpha::LightstepConfig lightstep_config;
 
     EXPECT_THROW(setup(lightstep_config, false), EnvoyException);
   }
@@ -128,7 +128,7 @@ TEST_F(LightStepDriverTest, InitializeDriver) {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::LightstepConfig lightstep_config;
+    envoy::config::trace::v3alpha::LightstepConfig lightstep_config;
     TestUtility::loadFromYaml(yaml_string, lightstep_config);
 
     EXPECT_THROW(setup(lightstep_config, false), EnvoyException);
@@ -142,7 +142,7 @@ TEST_F(LightStepDriverTest, InitializeDriver) {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::LightstepConfig lightstep_config;
+    envoy::config::trace::v3alpha::LightstepConfig lightstep_config;
     TestUtility::loadFromYaml(yaml_string, lightstep_config);
 
     EXPECT_THROW(setup(lightstep_config, false), EnvoyException);
@@ -156,7 +156,7 @@ TEST_F(LightStepDriverTest, InitializeDriver) {
     const std::string yaml_string = R"EOF(
     collector_cluster: fake_cluster
     )EOF";
-    envoy::config::trace::v2::LightstepConfig lightstep_config;
+    envoy::config::trace::v3alpha::LightstepConfig lightstep_config;
     TestUtility::loadFromYaml(yaml_string, lightstep_config);
 
     setup(lightstep_config, true);
diff --git a/test/extensions/tracers/opencensus/BUILD b/test/extensions/tracers/opencensus/BUILD
index 65adf16a989b..e43da21ad2de 100644
--- a/test/extensions/tracers/opencensus/BUILD
+++ b/test/extensions/tracers/opencensus/BUILD
@@ -20,7 +20,7 @@ envoy_extension_cc_test(
         "//test/mocks/http:http_mocks",
         "//test/mocks/local_info:local_info_mocks",
         "//test/mocks/tracing:tracing_mocks",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -32,6 +32,6 @@ envoy_extension_cc_test(
         "//source/extensions/tracers/opencensus:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/tracers/opencensus/config_test.cc b/test/extensions/tracers/opencensus/config_test.cc
index 2d97ff2ef31b..cd95e721df2d 100644
--- a/test/extensions/tracers/opencensus/config_test.cc
+++ b/test/extensions/tracers/opencensus/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/tracers/opencensus/config.h"
@@ -23,7 +23,7 @@ TEST(OpenCensusTracerConfigTest, OpenCensusHttpTracer) {
     name: envoy.tracers.opencensus
   )EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   OpenCensusTracerFactory factory;
@@ -61,7 +61,7 @@ TEST(OpenCensusTracerConfigTest, OpenCensusHttpTracerWithTypedConfig) {
       outgoing_trace_context: trace_context
   )EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   OpenCensusTracerFactory factory;
diff --git a/test/extensions/tracers/opencensus/tracer_test.cc b/test/extensions/tracers/opencensus/tracer_test.cc
index 286346f3a1b2..e5c6a83b2d64 100644
--- a/test/extensions/tracers/opencensus/tracer_test.cc
+++ b/test/extensions/tracers/opencensus/tracer_test.cc
@@ -5,7 +5,7 @@
 #include <iostream>
 #include <vector>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/common/base64.h"
 
@@ -46,7 +46,7 @@ namespace Extensions {
 namespace Tracers {
 namespace OpenCensus {
 
-using envoy::config::trace::v2::OpenCensusConfig;
+using envoy::config::trace::v3alpha::OpenCensusConfig;
 using ::opencensus::trace::exporter::SpanData;
 using ::opencensus::trace::exporter::SpanExporter;
 
diff --git a/test/extensions/tracers/xray/BUILD b/test/extensions/tracers/xray/BUILD
index cd40df0e39ad..48d796e3d24d 100644
--- a/test/extensions/tracers/xray/BUILD
+++ b/test/extensions/tracers/xray/BUILD
@@ -44,8 +44,7 @@ envoy_extension_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/trace/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/extensions/tracers/xray/config_test.cc b/test/extensions/tracers/xray/config_test.cc
index 7fe7e41e29e2..ab559af403a0 100644
--- a/test/extensions/tracers/xray/config_test.cc
+++ b/test/extensions/tracers/xray/config_test.cc
@@ -1,5 +1,6 @@
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2alpha/xray.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/xray.pb.h"
+#include "envoy/config/trace/v3alpha/xray.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/tracers/xray/config.h"
@@ -34,7 +35,7 @@ TEST(XRayTracerConfigTest, XRayHttpTracerWithTypedConfig) {
       sampling_rule_manifest:
         filename: "rules.json")EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   XRayTracerFactory factory;
@@ -68,7 +69,7 @@ TEST(XRayTracerConfigTest, XRayHttpTracerWithInvalidFileName) {
       sampling_rule_manifest:
         filename: "rules.json")EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   XRayTracerFactory factory;
@@ -94,7 +95,7 @@ TEST(XRayTracerConfigTest, ProtocolNotUDPThrows) {
       sampling_rule_manifest:
         filename: "rules.json")EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   XRayTracerFactory factory;
@@ -119,7 +120,7 @@ TEST(XRayTracerConfigTest, UsingNamedPortThrows) {
       sampling_rule_manifest:
         filename: "rules.json")EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   XRayTracerFactory factory;
diff --git a/test/extensions/tracers/zipkin/BUILD b/test/extensions/tracers/zipkin/BUILD
index 6c74cb5de40e..46f8805f5387 100644
--- a/test/extensions/tracers/zipkin/BUILD
+++ b/test/extensions/tracers/zipkin/BUILD
@@ -44,7 +44,7 @@ envoy_extension_cc_test(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -56,6 +56,6 @@ envoy_extension_cc_test(
         "//source/extensions/tracers/zipkin:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/trace/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/trace/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/tracers/zipkin/config_test.cc b/test/extensions/tracers/zipkin/config_test.cc
index 5c698899f48b..5b55a41f5a1d 100644
--- a/test/extensions/tracers/zipkin/config_test.cc
+++ b/test/extensions/tracers/zipkin/config_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/trace/v2/trace.pb.h"
-#include "envoy/config/trace/v2/trace.pb.validate.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.validate.h"
 #include "envoy/registry/registry.h"
 
 #include "extensions/tracers/zipkin/config.h"
@@ -32,7 +32,7 @@ TEST(ZipkinTracerConfigTest, ZipkinHttpTracer) {
       collector_endpoint_version: HTTP_JSON
   )EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   ZipkinTracerFactory factory;
@@ -58,7 +58,7 @@ TEST(ZipkinTracerConfigTest, ZipkinHttpTracerWithTypedConfig) {
       collector_endpoint_version: HTTP_PROTO
   )EOF";
 
-  envoy::config::trace::v2::Tracing configuration;
+  envoy::config::trace::v3alpha::Tracing configuration;
   TestUtility::loadFromYaml(yaml_string, configuration);
 
   ZipkinTracerFactory factory;
diff --git a/test/extensions/tracers/zipkin/span_buffer_test.cc b/test/extensions/tracers/zipkin/span_buffer_test.cc
index 27b77859b766..4e7440ab18ef 100644
--- a/test/extensions/tracers/zipkin/span_buffer_test.cc
+++ b/test/extensions/tracers/zipkin/span_buffer_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/network/utility.h"
 
@@ -150,17 +150,19 @@ TEST(ZipkinSpanBufferTest, ConstructBuffer) {
   const bool shared = true;
   const bool delay_allocation = true;
 
-  SpanBuffer buffer1(envoy::config::trace::v2::ZipkinConfig::HTTP_JSON_V1, shared);
+  SpanBuffer buffer1(
+      envoy::config::trace::v3alpha::ZipkinConfig::hidden_envoy_deprecated_HTTP_JSON_V1, shared);
   expectSerializedBuffer(buffer1, delay_allocation, {expected1, expected2});
 
   // Prepare 3 slots, since we will add one more inside the `expectSerializedBuffer` function.
-  SpanBuffer buffer2(envoy::config::trace::v2::ZipkinConfig::HTTP_JSON_V1, shared, 3);
+  SpanBuffer buffer2(
+      envoy::config::trace::v3alpha::ZipkinConfig::hidden_envoy_deprecated_HTTP_JSON_V1, shared, 3);
   expectSerializedBuffer(buffer2, !delay_allocation, {expected1, expected2});
 }
 
 TEST(ZipkinSpanBufferTest, SerializeSpan) {
   const bool shared = true;
-  SpanBuffer buffer1(envoy::config::trace::v2::ZipkinConfig::HTTP_JSON, shared, 2);
+  SpanBuffer buffer1(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_JSON, shared, 2);
   buffer1.addSpan(createSpan({"cs"}, IpType::V4));
   EXPECT_EQ("[{"
             R"("traceId":"0000000000000001",)"
@@ -177,7 +179,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]",
             buffer1.serialize());
 
-  SpanBuffer buffer1_v6(envoy::config::trace::v2::ZipkinConfig::HTTP_JSON, shared, 2);
+  SpanBuffer buffer1_v6(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_JSON, shared, 2);
   buffer1_v6.addSpan(createSpan({"cs"}, IpType::V6));
   EXPECT_EQ("[{"
             R"("traceId":"0000000000000001",)"
@@ -194,7 +196,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]",
             buffer1_v6.serialize());
 
-  SpanBuffer buffer2(envoy::config::trace::v2::ZipkinConfig::HTTP_JSON, shared, 2);
+  SpanBuffer buffer2(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_JSON, shared, 2);
   buffer2.addSpan(createSpan({"cs", "sr"}, IpType::V4));
   EXPECT_EQ("[{"
             R"("traceId":"0000000000000001",)"
@@ -224,7 +226,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]",
             buffer2.serialize());
 
-  SpanBuffer buffer3(envoy::config::trace::v2::ZipkinConfig::HTTP_JSON, !shared, 2);
+  SpanBuffer buffer3(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_JSON, !shared, 2);
   buffer3.addSpan(createSpan({"cs", "sr"}, IpType::V4));
   EXPECT_EQ("[{"
             R"("traceId":"0000000000000001",)"
@@ -253,7 +255,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]",
             buffer3.serialize());
 
-  SpanBuffer buffer4(envoy::config::trace::v2::ZipkinConfig::HTTP_PROTO, shared, 2);
+  SpanBuffer buffer4(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_PROTO, shared, 2);
   buffer4.addSpan(createSpan({"cs"}, IpType::V4));
   EXPECT_EQ("{"
             R"("spans":[{)"
@@ -271,7 +273,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]}",
             serializedMessageToJson<zipkin::proto3::ListOfSpans>(buffer4.serialize()));
 
-  SpanBuffer buffer4_v6(envoy::config::trace::v2::ZipkinConfig::HTTP_PROTO, shared, 2);
+  SpanBuffer buffer4_v6(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_PROTO, shared, 2);
   buffer4_v6.addSpan(createSpan({"cs"}, IpType::V6));
   EXPECT_EQ("{"
             R"("spans":[{)"
@@ -289,7 +291,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]}",
             serializedMessageToJson<zipkin::proto3::ListOfSpans>(buffer4_v6.serialize()));
 
-  SpanBuffer buffer5(envoy::config::trace::v2::ZipkinConfig::HTTP_PROTO, shared, 2);
+  SpanBuffer buffer5(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_PROTO, shared, 2);
   buffer5.addSpan(createSpan({"cs", "sr"}, IpType::V4));
   EXPECT_EQ("{"
             R"("spans":[{)"
@@ -320,7 +322,7 @@ TEST(ZipkinSpanBufferTest, SerializeSpan) {
             "}]}",
             serializedMessageToJson<zipkin::proto3::ListOfSpans>(buffer5.serialize()));
 
-  SpanBuffer buffer6(envoy::config::trace::v2::ZipkinConfig::HTTP_PROTO, !shared, 2);
+  SpanBuffer buffer6(envoy::config::trace::v3alpha::ZipkinConfig::HTTP_PROTO, !shared, 2);
   buffer6.addSpan(createSpan({"cs", "sr"}, IpType::V4));
   EXPECT_EQ("{"
             R"("spans":[{)"
diff --git a/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc b/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc
index 8bcade8425ea..b18feb65513e 100644
--- a/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc
+++ b/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc
@@ -4,7 +4,7 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/config/trace/v2/trace.pb.h"
+#include "envoy/config/trace/v3alpha/trace.pb.h"
 
 #include "common/http/header_map_impl.h"
 #include "common/http/headers.h"
@@ -45,7 +45,7 @@ class ZipkinDriverTest : public testing::Test {
 public:
   ZipkinDriverTest() : time_source_(test_time_.timeSystem()) {}
 
-  void setup(envoy::config::trace::v2::ZipkinConfig& zipkin_config, bool init_timer) {
+  void setup(envoy::config::trace::v3alpha::ZipkinConfig& zipkin_config, bool init_timer) {
     ON_CALL(cm_, httpAsyncClientForCluster("fake_cluster"))
         .WillByDefault(ReturnRef(cm_.async_client_));
 
@@ -67,7 +67,7 @@ class ZipkinDriverTest : public testing::Test {
     collector_endpoint_version: {}
     )EOF",
                                                 version);
-    envoy::config::trace::v2::ZipkinConfig zipkin_config;
+    envoy::config::trace::v3alpha::ZipkinConfig zipkin_config;
     TestUtility::loadFromYaml(yaml_string, zipkin_config);
 
     setup(zipkin_config, true);
@@ -152,7 +152,7 @@ class ZipkinDriverTest : public testing::Test {
 TEST_F(ZipkinDriverTest, InitializeDriver) {
   {
     // Empty config
-    envoy::config::trace::v2::ZipkinConfig zipkin_config;
+    envoy::config::trace::v3alpha::ZipkinConfig zipkin_config;
 
     EXPECT_THROW(setup(zipkin_config, false), EnvoyException);
   }
@@ -164,7 +164,7 @@ TEST_F(ZipkinDriverTest, InitializeDriver) {
     collector_cluster: fake_cluster
     collector_endpoint: /api/v1/spans
     )EOF";
-    envoy::config::trace::v2::ZipkinConfig zipkin_config;
+    envoy::config::trace::v3alpha::ZipkinConfig zipkin_config;
     TestUtility::loadFromYaml(yaml_string, zipkin_config);
 
     EXPECT_THROW(setup(zipkin_config, false), EnvoyException);
@@ -179,7 +179,7 @@ TEST_F(ZipkinDriverTest, InitializeDriver) {
     collector_cluster: fake_cluster
     collector_endpoint: /api/v1/spans
     )EOF";
-    envoy::config::trace::v2::ZipkinConfig zipkin_config;
+    envoy::config::trace::v3alpha::ZipkinConfig zipkin_config;
     TestUtility::loadFromYaml(yaml_string, zipkin_config);
 
     setup(zipkin_config, true);
diff --git a/test/extensions/transport_sockets/alts/alts_integration_test.cc b/test/extensions/transport_sockets/alts/alts_integration_test.cc
index fc42eb9b0f4d..d797403f959f 100644
--- a/test/extensions/transport_sockets/alts/alts_integration_test.cc
+++ b/test/extensions/transport_sockets/alts/alts_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/transport_socket/alts/v2alpha/alts.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/transport_sockets/alts/v3alpha/alts.pb.h"
 
 #include "common/common/thread.h"
 
@@ -41,13 +41,14 @@ class AltsIntegrationTestBase : public testing::TestWithParam<Network::Address::
         client_connect_handshaker_(client_connect_handshaker) {}
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* transport_socket = bootstrap.mutable_static_resources()
                                    ->mutable_listeners(0)
                                    ->mutable_filter_chains(0)
                                    ->mutable_transport_socket();
       transport_socket->set_name("envoy.transport_sockets.alts");
-      envoy::config::transport_socket::alts::v2alpha::Alts alts_config;
+      envoy::extensions::transport_sockets::alts::v3alpha::Alts alts_config;
       if (!server_peer_identity_.empty()) {
         alts_config.add_peer_service_accounts(server_peer_identity_);
       }
@@ -89,7 +90,7 @@ class AltsIntegrationTestBase : public testing::TestWithParam<Network::Address::
     ON_CALL(mock_factory_ctx, singletonManager()).WillByDefault(ReturnRef(fsm));
     UpstreamAltsTransportSocketConfigFactory factory;
 
-    envoy::config::transport_socket::alts::v2alpha::Alts alts_config;
+    envoy::extensions::transport_sockets::alts::v3alpha::Alts alts_config;
     alts_config.set_handshaker_service(fakeHandshakerServerAddress(client_connect_handshaker_));
     if (!client_peer_identity_.empty()) {
       alts_config.add_peer_service_accounts(client_peer_identity_);
diff --git a/test/extensions/transport_sockets/tls/BUILD b/test/extensions/transport_sockets/tls/BUILD
index d9ee09ac0d30..0f04ae060db4 100644
--- a/test/extensions/transport_sockets/tls/BUILD
+++ b/test/extensions/transport_sockets/tls/BUILD
@@ -54,9 +54,8 @@ envoy_cc_test(
         "//test/test_common:registry_lib",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -84,8 +83,9 @@ envoy_cc_test(
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:simulated_time_system_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -136,6 +136,6 @@ envoy_cc_test_library(
         "//include/envoy/ssl/private_key:private_key_interface",
         "//source/common/config:utility_lib",
         "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/transport_sockets/tls/context_impl_test.cc b/test/extensions/transport_sockets/tls/context_impl_test.cc
index 346f4cf23de9..e789da4c8405 100644
--- a/test/extensions/transport_sockets/tls/context_impl_test.cc
+++ b/test/extensions/transport_sockets/tls/context_impl_test.cc
@@ -1,9 +1,10 @@
 #include <string>
 #include <vector>
 
-#include "envoy/admin/v2alpha/certs.pb.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/auth/cert.pb.validate.h"
+#include "envoy/admin/v3alpha/certs.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.validate.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
 
 #include "common/json/json_loader.h"
 #include "common/secret/sds_api.h"
@@ -67,8 +68,8 @@ TEST_F(SslContextImplTest, TestVerifySubjectAltNameDNSMatched) {
 TEST_F(SslContextImplTest, TestMatchSubjectAltNameDNSMatched) {
   bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
-  envoy::type::matcher::StringMatcher matcher;
-  matcher.set_regex(".*.example.com");
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
+  matcher.set_hidden_envoy_deprecated_regex(".*.example.com");
   std::vector<Matchers::StringMatcherImpl> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(Matchers::StringMatcherImpl(matcher));
   EXPECT_TRUE(ContextImpl::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
@@ -85,8 +86,8 @@ TEST_F(SslContextImplTest, TestVerifySubjectAltNameURIMatched) {
 TEST_F(SslContextImplTest, TestMatchSubjectAltNameURIMatched) {
   bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
-  envoy::type::matcher::StringMatcher matcher;
-  matcher.set_regex("spiffe://lyft.com/.*-team");
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
+  matcher.set_hidden_envoy_deprecated_regex("spiffe://lyft.com/.*-team");
   std::vector<Matchers::StringMatcherImpl> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(Matchers::StringMatcherImpl(matcher));
   EXPECT_TRUE(ContextImpl::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
@@ -102,8 +103,8 @@ TEST_F(SslContextImplTest, TestVerifySubjectAltNameNotMatched) {
 TEST_F(SslContextImplTest, TestMatchSubjectAltNameNotMatched) {
   bssl::UniquePtr<X509> cert = readCertFromFile(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
-  envoy::type::matcher::StringMatcher matcher;
-  matcher.set_regex(".*.foo.com");
+  envoy::type::matcher::v3alpha::StringMatcher matcher;
+  matcher.set_hidden_envoy_deprecated_regex(".*.foo.com");
   std::vector<Matchers::StringMatcherImpl> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(Matchers::StringMatcherImpl(matcher));
   EXPECT_FALSE(ContextImpl::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
@@ -116,7 +117,7 @@ TEST_F(SslContextImplTest, TestCipherSuites) {
       cipher_suites: "-ALL:+[AES128-SHA|BOGUS1]:BOGUS2:AES256-SHA"
   )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
   ClientContextConfigImpl cfg(tls_context, factory_context_);
   EXPECT_THROW_WITH_MESSAGE(manager_.createSslClientContext(store_, cfg), EnvoyException,
@@ -135,7 +136,7 @@ TEST_F(SslContextImplTest, TestExpiringCert) {
         filename: "{{ test_tmpdir }}/unittestkey.pem"
  )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
 
   ClientContextConfigImpl cfg(tls_context, factory_context_);
@@ -159,7 +160,7 @@ TEST_F(SslContextImplTest, TestExpiredCert) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/expired_key.pem"
 )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
   ClientContextConfigImpl cfg(tls_context, factory_context_);
   Envoy::Ssl::ClientContextSharedPtr context(manager_.createSslClientContext(store_, cfg));
@@ -179,7 +180,7 @@ TEST_F(SslContextImplTest, TestGetCertInformation) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_cert.pem"
 )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
   ClientContextConfigImpl cfg(tls_context, factory_context_);
 
@@ -205,7 +206,7 @@ TEST_F(SslContextImplTest, TestGetCertInformation) {
 
   std::string ca_cert_partial_output(TestEnvironment::substitute(ca_cert_json));
   std::string cert_chain_partial_output(TestEnvironment::substitute(cert_chain_json));
-  envoy::admin::v2alpha::CertificateDetails certificate_details, cert_chain_details;
+  envoy::admin::v3alpha::CertificateDetails certificate_details, cert_chain_details;
   TestUtility::loadFromJson(ca_cert_partial_output, certificate_details);
   TestUtility::loadFromJson(cert_chain_partial_output, cert_chain_details);
 
@@ -229,7 +230,7 @@ TEST_F(SslContextImplTest, TestGetCertInformationWithSAN) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns3_cert.pem"
 )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
   ClientContextConfigImpl cfg(tls_context, factory_context_);
 
@@ -259,7 +260,7 @@ TEST_F(SslContextImplTest, TestGetCertInformationWithSAN) {
   // every build. For cert_chain output, we check only for the certificate path.
   std::string ca_cert_partial_output(TestEnvironment::substitute(ca_cert_json));
   std::string cert_chain_partial_output(TestEnvironment::substitute(cert_chain_json));
-  envoy::admin::v2alpha::CertificateDetails certificate_details, cert_chain_details;
+  envoy::admin::v3alpha::CertificateDetails certificate_details, cert_chain_details;
   TestUtility::loadFromJson(ca_cert_partial_output, certificate_details);
   TestUtility::loadFromJson(cert_chain_partial_output, cert_chain_details);
 
@@ -287,7 +288,7 @@ TEST_F(SslContextImplTest, TestGetCertInformationWithExpiration) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns3_cert.pem"
 )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
   ClientContextConfigImpl cfg(tls_context, factory_context_);
 
@@ -310,7 +311,7 @@ TEST_F(SslContextImplTest, TestGetCertInformationWithExpiration) {
 )EOF");
 
   const std::string ca_cert_partial_output(TestEnvironment::substitute(ca_cert_json));
-  envoy::admin::v2alpha::CertificateDetails certificate_details;
+  envoy::admin::v3alpha::CertificateDetails certificate_details;
   TestUtility::loadFromJson(ca_cert_partial_output, certificate_details);
 
   MessageDifferencer message_differencer;
@@ -319,7 +320,7 @@ TEST_F(SslContextImplTest, TestGetCertInformationWithExpiration) {
 }
 
 TEST_F(SslContextImplTest, TestNoCert) {
-  envoy::api::v2::auth::UpstreamTlsContext config;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext config;
   ClientContextConfigImpl cfg(config, factory_context_);
   Envoy::Ssl::ClientContextSharedPtr context(manager_.createSslClientContext(store_, cfg));
   EXPECT_EQ(nullptr, context->getCaCertInformation());
@@ -328,7 +329,7 @@ TEST_F(SslContextImplTest, TestNoCert) {
 
 // Multiple RSA certificates are rejected.
 TEST_F(SslContextImplTest, AtMostOneRsaCert) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   const std::string tls_context_yaml = R"EOF(
   common_tls_context:
     tls_certificates:
@@ -350,7 +351,7 @@ TEST_F(SslContextImplTest, AtMostOneRsaCert) {
 
 // Multiple ECDSA certificates are rejected.
 TEST_F(SslContextImplTest, AtMostOneEcdsaCert) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   const std::string tls_context_yaml = R"EOF(
   common_tls_context:
     tls_certificates:
@@ -377,9 +378,9 @@ class SslServerContextImplTicketTest : public SslContextImplTest {
         manager_.createSslServerContext(store_, cfg, std::vector<std::string>{}));
   }
 
-  void loadConfigV2(envoy::api::v2::auth::DownstreamTlsContext& cfg) {
+  void loadConfigV2(envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext& cfg) {
     // Must add a certificate for the config to be considered valid.
-    envoy::api::v2::auth::TlsCertificate* server_cert =
+    envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
         cfg.mutable_common_tls_context()->add_tls_certificates();
     server_cert->mutable_certificate_chain()->set_filename(
         TestEnvironment::substitute("{{ test_tmpdir }}/unittestcert.pem"));
@@ -391,7 +392,7 @@ class SslServerContextImplTicketTest : public SslContextImplTest {
   }
 
   void loadConfigYaml(const std::string& yaml) {
-    envoy::api::v2::auth::DownstreamTlsContext tls_context;
+    envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
     TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context);
     ServerContextConfigImpl cfg(tls_context, factory_context_);
     loadConfig(cfg);
@@ -448,49 +449,49 @@ TEST_F(SslServerContextImplTicketTest, TicketKeyInvalidCannotRead) {
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyNone) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   EXPECT_NO_THROW(loadConfigV2(cfg));
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyInlineBytesSuccess) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   cfg.mutable_session_ticket_keys()->add_keys()->set_inline_bytes(std::string(80, '\0'));
   EXPECT_NO_THROW(loadConfigV2(cfg));
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyInlineStringSuccess) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   cfg.mutable_session_ticket_keys()->add_keys()->set_inline_string(std::string(80, '\0'));
   EXPECT_NO_THROW(loadConfigV2(cfg));
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyInlineBytesFailTooBig) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   cfg.mutable_session_ticket_keys()->add_keys()->set_inline_bytes(std::string(81, '\0'));
   EXPECT_THROW(loadConfigV2(cfg), EnvoyException);
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyInlineStringFailTooBig) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   cfg.mutable_session_ticket_keys()->add_keys()->set_inline_string(std::string(81, '\0'));
   EXPECT_THROW(loadConfigV2(cfg), EnvoyException);
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyInlineBytesFailTooSmall) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   cfg.mutable_session_ticket_keys()->add_keys()->set_inline_bytes(std::string(79, '\0'));
   EXPECT_THROW(loadConfigV2(cfg), EnvoyException);
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeyInlineStringFailTooSmall) {
-  envoy::api::v2::auth::DownstreamTlsContext cfg;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext cfg;
   cfg.mutable_session_ticket_keys()->add_keys()->set_inline_string(std::string(79, '\0'));
   EXPECT_THROW(loadConfigV2(cfg), EnvoyException);
 }
 
 TEST_F(SslServerContextImplTicketTest, TicketKeySdsNotReady) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
-  envoy::api::v2::auth::TlsCertificate* server_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
       tls_context.mutable_common_tls_context()->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"));
@@ -525,7 +526,7 @@ TEST_F(SslServerContextImplTicketTest, TicketKeySdsNotReady) {
 // Validate that client context config with static TLS ticket encryption keys is created
 // successfully.
 TEST_F(SslServerContextImplTicketTest, StaticTickeyKey) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
 
   const std::string yaml = R"EOF(
 name: "abc.com"
@@ -538,8 +539,8 @@ name: "abc.com"
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), secret_config);
   factory_context_.secretManager().addStaticSecret(secret_config);
 
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
-  envoy::api::v2::auth::TlsCertificate* server_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
       tls_context.mutable_common_tls_context()->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"));
@@ -625,7 +626,7 @@ class ClientContextConfigImplTest : public SslCertsTest {};
 
 // Validate that empty SNI (according to C string rules) fails config validation.
 TEST_F(ClientContextConfigImplTest, EmptyServerNameIndication) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context;
 
   tls_context.set_sni(std::string("\000", 1));
@@ -640,7 +641,7 @@ TEST_F(ClientContextConfigImplTest, EmptyServerNameIndication) {
 
 // Validate that values other than a hex-encoded SHA-256 fail config validation.
 TEST_F(ClientContextConfigImplTest, InvalidCertificateHash) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context;
   tls_context.mutable_common_tls_context()
       ->mutable_validation_context()
@@ -657,7 +658,7 @@ TEST_F(ClientContextConfigImplTest, InvalidCertificateHash) {
 
 // Validate that values other than a base64-encoded SHA-256 fail config validation.
 TEST_F(ClientContextConfigImplTest, InvalidCertificateSpki) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context;
   tls_context.mutable_common_tls_context()
       ->mutable_validation_context()
@@ -673,7 +674,7 @@ TEST_F(ClientContextConfigImplTest, InvalidCertificateSpki) {
 
 // Validate that 2048-bit RSA certificates load successfully.
 TEST_F(ClientContextConfigImplTest, RSA2048Cert) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"
@@ -691,7 +692,7 @@ TEST_F(ClientContextConfigImplTest, RSA2048Cert) {
 
 // Validate that 1024-bit RSA certificates are rejected.
 TEST_F(ClientContextConfigImplTest, RSA1024Cert) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_rsa_1024_cert.pem"
@@ -719,7 +720,7 @@ TEST_F(ClientContextConfigImplTest, RSA1024Cert) {
 
 // Validate that 3072-bit RSA certificates load successfully.
 TEST_F(ClientContextConfigImplTest, RSA3072Cert) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_rsa_3072_cert.pem"
@@ -738,7 +739,7 @@ TEST_F(ClientContextConfigImplTest, RSA3072Cert) {
 // Validate that 4096-bit RSA certificates load successfully in non-FIPS builds, but are rejected
 // in FIPS builds.
 TEST_F(ClientContextConfigImplTest, RSA4096Cert) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_rsa_4096_cert.pem"
@@ -763,7 +764,7 @@ TEST_F(ClientContextConfigImplTest, RSA4096Cert) {
 
 // Validate that P256 ECDSA certs load.
 TEST_F(ClientContextConfigImplTest, P256EcdsaCert) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_ecdsa_p256_cert.pem"
@@ -781,7 +782,7 @@ TEST_F(ClientContextConfigImplTest, P256EcdsaCert) {
 
 // Validate that non-P256 ECDSA certs are rejected.
 TEST_F(ClientContextConfigImplTest, NonP256EcdsaCert) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_ecdsa_p384_cert.pem"
@@ -803,7 +804,7 @@ TEST_F(ClientContextConfigImplTest, NonP256EcdsaCert) {
 // Multiple TLS certificates are not yet supported.
 // TODO(PiotrSikora): Support multiple TLS certificates.
 TEST_F(ClientContextConfigImplTest, MultipleTlsCertificates) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"
@@ -822,7 +823,7 @@ TEST_F(ClientContextConfigImplTest, MultipleTlsCertificates) {
 // Validate context config does not support handling both static TLS certificate and dynamic TLS
 // certificate.
 TEST_F(ClientContextConfigImplTest, TlsCertificatesAndSdsConfig) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   const std::string tls_certificate_yaml = R"EOF(
   certificate_chain:
     filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"
@@ -840,7 +841,7 @@ TEST_F(ClientContextConfigImplTest, TlsCertificatesAndSdsConfig) {
 // Validate context config supports SDS, and is marked as not ready if secrets are not yet
 // downloaded.
 TEST_F(ClientContextConfigImplTest, SecretNotReady) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   Stats::IsolatedStoreImpl stats;
   NiceMock<Init::MockManager> init_manager;
@@ -866,8 +867,8 @@ TEST_F(ClientContextConfigImplTest, SecretNotReady) {
 // Validate client context config supports SDS, and is marked as not ready if dynamic
 // certificate validation context is not yet downloaded.
 TEST_F(ClientContextConfigImplTest, ValidationContextNotReady) {
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       tls_context.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"));
@@ -897,7 +898,7 @@ TEST_F(ClientContextConfigImplTest, ValidationContextNotReady) {
 
 // Validate that client context config with static TLS certificates is created successfully.
 TEST_F(ClientContextConfigImplTest, StaticTlsCertificates) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
 
   const std::string yaml = R"EOF(
 name: "abc.com"
@@ -910,7 +911,7 @@ name: "abc.com"
 
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), secret_config);
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()
       ->mutable_tls_certificate_sds_secret_configs()
       ->Add()
@@ -932,7 +933,7 @@ name: "abc.com"
 // Validate that client context config with password-protected TLS certificates is created
 // successfully.
 TEST_F(ClientContextConfigImplTest, PasswordProtectedTlsCertificates) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
   secret_config.set_name("abc.com");
 
   auto* tls_certificate = secret_config.mutable_tls_certificate();
@@ -946,7 +947,7 @@ TEST_F(ClientContextConfigImplTest, PasswordProtectedTlsCertificates) {
       "{{ test_rundir "
       "}}/test/extensions/transport_sockets/tls/test_data/password_protected_password.txt"));
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()
       ->mutable_tls_certificate_sds_secret_configs()
       ->Add()
@@ -975,7 +976,7 @@ TEST_F(ClientContextConfigImplTest, PasswordProtectedTlsCertificates) {
 // Validate that not supplying a passphrase for password-protected TLS certificates
 // triggers a failure.
 TEST_F(ClientContextConfigImplTest, PasswordNotSuppliedTlsCertificates) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
   secret_config.set_name("abc.com");
 
   auto* tls_certificate = secret_config.mutable_tls_certificate();
@@ -988,7 +989,7 @@ TEST_F(ClientContextConfigImplTest, PasswordNotSuppliedTlsCertificates) {
   tls_certificate->mutable_private_key()->set_filename(private_key_path);
   // Don't supply the password.
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()
       ->mutable_tls_certificate_sds_secret_configs()
       ->Add()
@@ -1008,7 +1009,7 @@ TEST_F(ClientContextConfigImplTest, PasswordNotSuppliedTlsCertificates) {
 // Validate that client context config with static certificate validation context is created
 // successfully.
 TEST_F(ClientContextConfigImplTest, StaticCertificateValidationContext) {
-  envoy::api::v2::auth::Secret tls_certificate_secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret tls_certificate_secret_config;
   const std::string tls_certificate_yaml = R"EOF(
   name: "abc.com"
   tls_certificate:
@@ -1020,7 +1021,8 @@ TEST_F(ClientContextConfigImplTest, StaticCertificateValidationContext) {
   TestUtility::loadFromYaml(TestEnvironment::substitute(tls_certificate_yaml),
                             tls_certificate_secret_config);
   factory_context_.secretManager().addStaticSecret(tls_certificate_secret_config);
-  envoy::api::v2::auth::Secret certificate_validation_context_secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret
+      certificate_validation_context_secret_config;
   const std::string certificate_validation_context_yaml = R"EOF(
     name: "def.com"
     validation_context:
@@ -1031,7 +1033,7 @@ TEST_F(ClientContextConfigImplTest, StaticCertificateValidationContext) {
                             certificate_validation_context_secret_config);
   factory_context_.secretManager().addStaticSecret(certificate_validation_context_secret_config);
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()
       ->mutable_tls_certificate_sds_secret_configs()
       ->Add()
@@ -1050,7 +1052,7 @@ TEST_F(ClientContextConfigImplTest, StaticCertificateValidationContext) {
 // Validate that constructor of client context config throws an exception when static TLS
 // certificate is missing.
 TEST_F(ClientContextConfigImplTest, MissingStaticSecretTlsCertificates) {
-  envoy::api::v2::auth::Secret secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret secret_config;
 
   const std::string yaml = R"EOF(
 name: "abc.com"
@@ -1065,7 +1067,7 @@ name: "abc.com"
 
   factory_context_.secretManager().addStaticSecret(secret_config);
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()
       ->mutable_tls_certificate_sds_secret_configs()
       ->Add()
@@ -1079,7 +1081,7 @@ name: "abc.com"
 // Validate that constructor of client context config throws an exception when static certificate
 // validation context is missing.
 TEST_F(ClientContextConfigImplTest, MissingStaticCertificateValidationContext) {
-  envoy::api::v2::auth::Secret tls_certificate_secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret tls_certificate_secret_config;
   const std::string tls_certificate_yaml = R"EOF(
     name: "abc.com"
     tls_certificate:
@@ -1091,7 +1093,8 @@ TEST_F(ClientContextConfigImplTest, MissingStaticCertificateValidationContext) {
   TestUtility::loadFromYaml(TestEnvironment::substitute(tls_certificate_yaml),
                             tls_certificate_secret_config);
   factory_context_.secretManager().addStaticSecret(tls_certificate_secret_config);
-  envoy::api::v2::auth::Secret certificate_validation_context_secret_config;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret
+      certificate_validation_context_secret_config;
   const std::string certificate_validation_context_yaml = R"EOF(
       name: "def.com"
       validation_context:
@@ -1102,7 +1105,7 @@ TEST_F(ClientContextConfigImplTest, MissingStaticCertificateValidationContext) {
                             certificate_validation_context_secret_config);
   factory_context_.secretManager().addStaticSecret(certificate_validation_context_secret_config);
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()
       ->mutable_tls_certificate_sds_secret_configs()
       ->Add()
@@ -1119,7 +1122,7 @@ class ServerContextConfigImplTest : public SslCertsTest {};
 
 // Multiple TLS certificates are supported.
 TEST_F(ServerContextConfigImplTest, MultipleTlsCertificates) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   EXPECT_THROW_WITH_MESSAGE(
       ServerContextConfigImpl client_context_config(tls_context, factory_context_), EnvoyException,
       "No TLS certificates found for server context");
@@ -1147,7 +1150,7 @@ TEST_F(ServerContextConfigImplTest, MultipleTlsCertificates) {
 }
 
 TEST_F(ServerContextConfigImplTest, TlsCertificatesAndSdsConfig) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   EXPECT_THROW_WITH_MESSAGE(
       ServerContextConfigImpl server_context_config(tls_context, factory_context_), EnvoyException,
       "No TLS certificates found for server context");
@@ -1166,16 +1169,17 @@ TEST_F(ServerContextConfigImplTest, TlsCertificatesAndSdsConfig) {
 }
 
 TEST_F(ServerContextConfigImplTest, MultiSdsConfig) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()->add_tls_certificate_sds_secret_configs();
   tls_context.mutable_common_tls_context()->add_tls_certificate_sds_secret_configs();
   EXPECT_THROW_WITH_REGEX(
-      TestUtility::validate<envoy::api::v2::auth::DownstreamTlsContext>(tls_context),
+      TestUtility::validate<
+          envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext>(tls_context),
       EnvoyException, "Proto constraint validation failed");
 }
 
 TEST_F(ServerContextConfigImplTest, SecretNotReady) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   NiceMock<LocalInfo::MockLocalInfo> local_info;
   Stats::IsolatedStoreImpl stats;
   NiceMock<Init::MockManager> init_manager;
@@ -1201,8 +1205,8 @@ TEST_F(ServerContextConfigImplTest, SecretNotReady) {
 // Validate server context config supports SDS, and is marked as not ready if dynamic
 // certificate validation context is not yet downloaded.
 TEST_F(ServerContextConfigImplTest, ValidationContextNotReady) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
-  envoy::api::v2::auth::TlsCertificate* server_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
       tls_context.mutable_common_tls_context()->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/selfsigned_cert.pem"));
@@ -1232,7 +1236,7 @@ TEST_F(ServerContextConfigImplTest, ValidationContextNotReady) {
 
 // TlsCertificate messages must have a cert for servers.
 TEST_F(ServerContextConfigImplTest, TlsCertificateNonEmpty) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()->add_tls_certificates();
   ServerContextConfigImpl client_context_config(tls_context, factory_context_);
   Event::SimulatedTimeSystem time_system;
@@ -1246,10 +1250,11 @@ TEST_F(ServerContextConfigImplTest, TlsCertificateNonEmpty) {
 
 // Cannot ignore certificate expiration without a trusted CA.
 TEST_F(ServerContextConfigImplTest, InvalidIgnoreCertsNoCA) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
 
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      tls_context.mutable_common_tls_context()->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx =
+          tls_context.mutable_common_tls_context()->mutable_validation_context();
 
   server_validation_ctx->set_allow_expired_certificate(true);
 
@@ -1257,7 +1262,7 @@ TEST_F(ServerContextConfigImplTest, InvalidIgnoreCertsNoCA) {
       ServerContextConfigImpl server_context_config(tls_context, factory_context_), EnvoyException,
       "Certificate validity period is always ignored without trusted CA");
 
-  envoy::api::v2::auth::TlsCertificate* server_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
       tls_context.mutable_common_tls_context()->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(
       TestEnvironment::substitute("{{ test_tmpdir }}/unittestcert.pem"));
@@ -1282,7 +1287,7 @@ TEST_F(ServerContextConfigImplTest, InvalidIgnoreCertsNoCA) {
 }
 
 TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadFailureNoProvider) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   NiceMock<Ssl::MockContextManager> context_manager;
   NiceMock<Ssl::MockPrivateKeyMethodManager> private_key_method_manager;
   EXPECT_CALL(factory_context_, sslContextManager()).WillOnce(ReturnRef(context_manager));
@@ -1307,7 +1312,7 @@ TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadFailureNoProvider) {
 }
 
 TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadFailureNoMethod) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()->add_tls_certificates();
   Stats::IsolatedStoreImpl store;
   NiceMock<Ssl::MockContextManager> context_manager;
@@ -1342,7 +1347,7 @@ TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadFailureNoMethod) {
 }
 
 TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadSuccess) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   NiceMock<Ssl::MockContextManager> context_manager;
   NiceMock<Ssl::MockPrivateKeyMethodManager> private_key_method_manager;
   auto private_key_method_provider_ptr =
@@ -1369,7 +1374,7 @@ TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadSuccess) {
 }
 
 TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadFailureBothKeyAndMethod) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   NiceMock<Ssl::MockContextManager> context_manager;
   NiceMock<Ssl::MockPrivateKeyMethodManager> private_key_method_manager;
   auto private_key_method_provider_ptr =
diff --git a/test/extensions/transport_sockets/tls/integration/BUILD b/test/extensions/transport_sockets/tls/integration/BUILD
index 79ee5129ce4e..a9d05d89e305 100644
--- a/test/extensions/transport_sockets/tls/integration/BUILD
+++ b/test/extensions/transport_sockets/tls/integration/BUILD
@@ -28,12 +28,12 @@ envoy_cc_test(
         "//test/integration:http_integration_lib",
         "//test/mocks/secret:secret_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/transport_socket/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/data/tap/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/service/tap/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc b/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc
index 4b86fd895aaa..96d7de50f9f9 100644
--- a/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc
+++ b/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc
@@ -3,14 +3,14 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/config/transport_socket/tap/v2alpha/tap.pb.h"
-#include "envoy/data/tap/v2alpha/wrapper.pb.h"
-#include "envoy/service/tap/v2alpha/common.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/tap/v3alpha/common.pb.h"
+#include "envoy/data/tap/v3alpha/wrapper.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tap/v3alpha/tap.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/event/dispatcher_impl.h"
 #include "common/network/connection_impl.h"
@@ -103,8 +103,8 @@ TEST_P(SslIntegrationTest, RouterRequestAndResponseWithBodyNoBuffer) {
 
 TEST_P(SslIntegrationTest, RouterRequestAndResponseWithBodyNoBufferHttp2) {
   setDownstreamProtocol(Http::CodecClient::Type::HTTP2);
-  config_helper_.setClientCodec(
-      envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::AUTO);
+  config_helper_.setClientCodec(envoy::extensions::filters::network::http_connection_manager::
+                                    v3alpha::HttpConnectionManager::AUTO);
   ConnectionCreationFunction creator = [&]() -> Network::ClientConnectionPtr {
     return makeSslClientConnection(ClientSslTransportOptions().setAlpn(true));
   };
@@ -179,8 +179,9 @@ TEST_P(SslIntegrationTest, AdminCertEndpoint) {
 
 // Validate certificate selection across different certificate types and client TLS versions.
 class SslCertficateIntegrationTest
-    : public testing::TestWithParam<
-          std::tuple<Network::Address::IpVersion, envoy::api::v2::auth::TlsParameters_TlsProtocol>>,
+    : public testing::TestWithParam<std::tuple<
+          Network::Address::IpVersion,
+          envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol>>,
       public SslIntegrationTestBase {
 public:
   SslCertficateIntegrationTest() : SslIntegrationTestBase(std::get<0>(GetParam())) {
@@ -197,7 +198,8 @@ class SslCertficateIntegrationTest
   void TearDown() override { SslIntegrationTestBase::TearDown(); };
 
   ClientSslTransportOptions rsaOnlyClientOptions() {
-    if (tls_version_ == envoy::api::v2::auth::TlsParameters::TLSv1_3) {
+    if (tls_version_ ==
+        envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3) {
       return ClientSslTransportOptions().setSigningAlgorithmsForTest("rsa_pss_rsae_sha256");
     } else {
       return ClientSslTransportOptions().setCipherSuites({"ECDHE-RSA-AES128-GCM-SHA256"});
@@ -206,7 +208,8 @@ class SslCertficateIntegrationTest
 
   ClientSslTransportOptions ecdsaOnlyClientOptions() {
     auto options = ClientSslTransportOptions().setClientEcdsaCert(true);
-    if (tls_version_ == envoy::api::v2::auth::TlsParameters::TLSv1_3) {
+    if (tls_version_ ==
+        envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3) {
       return options.setSigningAlgorithmsForTest("ecdsa_secp256r1_sha256");
     } else {
       return options.setCipherSuites({"ECDHE-ECDSA-AES128-GCM-SHA256"});
@@ -214,8 +217,9 @@ class SslCertficateIntegrationTest
   }
 
   static std::string ipClientVersionTestParamsToString(
-      const ::testing::TestParamInfo<
-          std::tuple<Network::Address::IpVersion, envoy::api::v2::auth::TlsParameters_TlsProtocol>>&
+      const ::testing::TestParamInfo<std::tuple<
+          Network::Address::IpVersion,
+          envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol>>&
           params) {
     return fmt::format("{}_TLSv1_{}",
                        std::get<0>(params.param) == Network::Address::IpVersion::v4 ? "IPv4"
@@ -223,14 +227,17 @@ class SslCertficateIntegrationTest
                        std::get<1>(params.param) - 1);
   }
 
-  const envoy::api::v2::auth::TlsParameters_TlsProtocol tls_version_{std::get<1>(GetParam())};
+  const envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol tls_version_{
+      std::get<1>(GetParam())};
 };
 
 INSTANTIATE_TEST_SUITE_P(
     IpVersionsClientVersions, SslCertficateIntegrationTest,
-    testing::Combine(testing::ValuesIn(TestEnvironment::getIpVersionsForTest()),
-                     testing::Values(envoy::api::v2::auth::TlsParameters::TLSv1_2,
-                                     envoy::api::v2::auth::TlsParameters::TLSv1_3)),
+    testing::Combine(
+        testing::ValuesIn(TestEnvironment::getIpVersionsForTest()),
+        testing::Values(
+            envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2,
+            envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3)),
     SslCertficateIntegrationTest::ipClientVersionTestParamsToString);
 
 // Server with an RSA certificate and a client with RSA/ECDSA cipher suites works.
@@ -347,49 +354,50 @@ class SslTapIntegrationTest : public SslIntegrationTest {
 public:
   void initialize() override {
     // TODO(mattklein123): Merge/use the code in ConfigHelper::setTapTransportSocket().
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      // The test supports tapping either the downstream or upstream connection, but not both.
-      if (upstream_tap_) {
-        setupUpstreamTap(bootstrap);
-      } else {
-        setupDownstreamTap(bootstrap);
-      }
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          // The test supports tapping either the downstream or upstream connection, but not both.
+          if (upstream_tap_) {
+            setupUpstreamTap(bootstrap);
+          } else {
+            setupDownstreamTap(bootstrap);
+          }
+        });
     SslIntegrationTest::initialize();
     // This confuses our socket counting.
     debug_with_s_client_ = false;
   }
 
-  void setupUpstreamTap(envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  void setupUpstreamTap(envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* transport_socket =
         bootstrap.mutable_static_resources()->mutable_clusters(0)->mutable_transport_socket();
     transport_socket->set_name("envoy.transport_sockets.tap");
-    envoy::api::v2::core::TransportSocket raw_transport_socket;
+    envoy::config::core::v3alpha::TransportSocket raw_transport_socket;
     raw_transport_socket.set_name("raw_buffer");
-    envoy::config::transport_socket::tap::v2alpha::Tap tap_config =
+    envoy::extensions::transport_sockets::tap::v3alpha::Tap tap_config =
         createTapConfig(raw_transport_socket);
     tap_config.mutable_transport_socket()->MergeFrom(raw_transport_socket);
     transport_socket->mutable_typed_config()->PackFrom(tap_config);
   }
 
-  void setupDownstreamTap(envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  void setupDownstreamTap(envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* filter_chain =
         bootstrap.mutable_static_resources()->mutable_listeners(0)->mutable_filter_chains(0);
     // Configure inner SSL transport socket based on existing config.
-    envoy::api::v2::core::TransportSocket ssl_transport_socket;
+    envoy::config::core::v3alpha::TransportSocket ssl_transport_socket;
     auto* transport_socket = filter_chain->mutable_transport_socket();
     ssl_transport_socket.Swap(transport_socket);
     // Configure outer tap transport socket.
     transport_socket->set_name("envoy.transport_sockets.tap");
-    envoy::config::transport_socket::tap::v2alpha::Tap tap_config =
+    envoy::extensions::transport_sockets::tap::v3alpha::Tap tap_config =
         createTapConfig(ssl_transport_socket);
     tap_config.mutable_transport_socket()->MergeFrom(ssl_transport_socket);
     transport_socket->mutable_typed_config()->PackFrom(tap_config);
   }
 
-  envoy::config::transport_socket::tap::v2alpha::Tap
-  createTapConfig(const envoy::api::v2::core::TransportSocket& inner_transport) {
-    envoy::config::transport_socket::tap::v2alpha::Tap tap_config;
+  envoy::extensions::transport_sockets::tap::v3alpha::Tap
+  createTapConfig(const envoy::config::core::v3alpha::TransportSocket& inner_transport) {
+    envoy::extensions::transport_sockets::tap::v3alpha::Tap tap_config;
     tap_config.mutable_common_config()
         ->mutable_static_config()
         ->mutable_match_config()
@@ -411,8 +419,8 @@ class SslTapIntegrationTest : public SslIntegrationTest {
   }
 
   std::string path_prefix_ = TestEnvironment::temporaryPath("ssl_trace");
-  envoy::service::tap::v2alpha::OutputSink::Format format_{
-      envoy::service::tap::v2alpha::OutputSink::PROTO_BINARY};
+  envoy::config::tap::v3alpha::OutputSink::Format format_{
+      envoy::config::tap::v3alpha::OutputSink::PROTO_BINARY};
   absl::optional<uint64_t> max_rx_bytes_;
   absl::optional<uint64_t> max_tx_bytes_;
   bool upstream_tap_{};
@@ -443,15 +451,15 @@ TEST_P(SslTapIntegrationTest, TwoRequestsWithBinaryProto) {
   EXPECT_EQ("200", response->headers().Status()->value().getStringView());
   EXPECT_EQ(256, response->body().size());
   checkStats();
-  envoy::api::v2::core::Address expected_local_address;
+  envoy::config::core::v3alpha::Address expected_local_address;
   Network::Utility::addressToProtobufAddress(*codec_client_->connection()->remoteAddress(),
                                              expected_local_address);
-  envoy::api::v2::core::Address expected_remote_address;
+  envoy::config::core::v3alpha::Address expected_remote_address;
   Network::Utility::addressToProtobufAddress(*codec_client_->connection()->localAddress(),
                                              expected_remote_address);
   codec_client_->close();
   test_server_->waitForCounterGe("http.config_test.downstream_cx_destroy", 1);
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   TestUtility::loadFromFile(fmt::format("{}_{}.pb", path_prefix_, first_id), trace, *api_);
   // Validate general expected properties in the trace.
   EXPECT_EQ(first_id, trace.socket_buffered_trace().trace_id());
@@ -529,7 +537,7 @@ TEST_P(SslTapIntegrationTest, TruncationWithMultipleDataFrames) {
   codec_client_->close();
   test_server_->waitForCounterGe("http.config_test.downstream_cx_destroy", 1);
 
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   TestUtility::loadFromFile(fmt::format("{}_{}.pb", path_prefix_, id), trace, *api_);
 
   ASSERT_EQ(trace.socket_buffered_trace().events().size(), 2);
@@ -541,7 +549,7 @@ TEST_P(SslTapIntegrationTest, TruncationWithMultipleDataFrames) {
 
 // Validate a single request with text proto output.
 TEST_P(SslTapIntegrationTest, RequestWithTextProto) {
-  format_ = envoy::service::tap::v2alpha::OutputSink::PROTO_TEXT;
+  format_ = envoy::config::tap::v3alpha::OutputSink::PROTO_TEXT;
   ConnectionCreationFunction creator = [&]() -> Network::ClientConnectionPtr {
     return makeSslClientConnection({});
   };
@@ -550,7 +558,7 @@ TEST_P(SslTapIntegrationTest, RequestWithTextProto) {
   checkStats();
   codec_client_->close();
   test_server_->waitForCounterGe("http.config_test.downstream_cx_destroy", 1);
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   TestUtility::loadFromFile(fmt::format("{}_{}.pb_text", path_prefix_, id), trace, *api_);
   // Test some obvious properties.
   EXPECT_TRUE(absl::StartsWith(trace.socket_buffered_trace().events(0).read().data().as_bytes(),
@@ -567,7 +575,7 @@ TEST_P(SslTapIntegrationTest, RequestWithJsonBodyAsStringUpstreamTap) {
   max_rx_bytes_ = 5;
   max_tx_bytes_ = 4;
 
-  format_ = envoy::service::tap::v2alpha::OutputSink::JSON_BODY_AS_STRING;
+  format_ = envoy::config::tap::v3alpha::OutputSink::JSON_BODY_AS_STRING;
   ConnectionCreationFunction creator = [&]() -> Network::ClientConnectionPtr {
     return makeSslClientConnection({});
   };
@@ -580,7 +588,7 @@ TEST_P(SslTapIntegrationTest, RequestWithJsonBodyAsStringUpstreamTap) {
 
   // This must be done after server shutdown so that connection pool connections are closed and
   // the tap written.
-  envoy::data::tap::v2alpha::TraceWrapper trace;
+  envoy::data::tap::v3alpha::TraceWrapper trace;
   TestUtility::loadFromFile(fmt::format("{}_{}.json", path_prefix_, id), trace, *api_);
 
   // Test some obvious properties.
diff --git a/test/extensions/transport_sockets/tls/ssl_socket_test.cc b/test/extensions/transport_sockets/tls/ssl_socket_test.cc
index 561f36a98afa..daf87886ea95 100644
--- a/test/extensions/transport_sockets/tls/ssl_socket_test.cc
+++ b/test/extensions/transport_sockets/tls/ssl_socket_test.cc
@@ -2,9 +2,9 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/network/transport_socket.h"
 
 #include "common/buffer/buffer_impl.h"
@@ -270,7 +270,7 @@ void testUtil(const TestUtilOptions& options) {
         .WillRepeatedly(ReturnRef(private_key_method_manager));
   }
 
-  envoy::api::v2::auth::DownstreamTlsContext server_tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(options.serverCtxYaml()),
                             server_tls_context);
   auto server_cfg =
@@ -286,7 +286,7 @@ void testUtil(const TestUtilOptions& options) {
   Network::MockConnectionHandler connection_handler;
   Network::ListenerPtr listener = dispatcher->createListener(socket, callbacks, true);
 
-  envoy::api::v2::auth::UpstreamTlsContext client_tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(options.clientCtxYaml()),
                             client_tls_context);
 
@@ -426,8 +426,9 @@ void testUtil(const TestUtilOptions& options) {
  */
 class TestUtilOptionsV2 : public TestUtilOptionsBase {
 public:
-  TestUtilOptionsV2(const envoy::api::v2::Listener& listener,
-                    const envoy::api::v2::auth::UpstreamTlsContext& client_ctx_proto,
+  TestUtilOptionsV2(const envoy::config::listener::v3alpha::Listener& listener,
+                    const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext&
+                        client_ctx_proto,
                     bool expect_success, Network::Address::IpVersion version)
       : TestUtilOptionsBase(expect_success, version), listener_(listener),
         client_ctx_proto_(client_ctx_proto), transport_socket_options_(nullptr) {
@@ -439,8 +440,9 @@ class TestUtilOptionsV2 : public TestUtilOptionsBase {
     }
   }
 
-  const envoy::api::v2::Listener& listener() const { return listener_; }
-  const envoy::api::v2::auth::UpstreamTlsContext& clientCtxProto() const {
+  const envoy::config::listener::v3alpha::Listener& listener() const { return listener_; }
+  const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext&
+  clientCtxProto() const {
     return client_ctx_proto_;
   }
   const std::string& expectedClientStats() const { return expected_client_stats_; }
@@ -524,8 +526,8 @@ class TestUtilOptionsV2 : public TestUtilOptionsBase {
   }
 
 private:
-  const envoy::api::v2::Listener& listener_;
-  const envoy::api::v2::auth::UpstreamTlsContext& client_ctx_proto_;
+  const envoy::config::listener::v3alpha::Listener& listener_;
+  const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext& client_ctx_proto_;
   std::string expected_client_stats_;
 
   std::string client_session_;
@@ -554,8 +556,8 @@ const std::string testUtilV2(const TestUtilOptionsV2& options) {
       server_factory_context;
   ON_CALL(server_factory_context, api()).WillByDefault(ReturnRef(*server_api));
 
-  auto server_cfg =
-      std::make_unique<ServerContextConfigImpl>(filter_chain.tls_context(), server_factory_context);
+  auto server_cfg = std::make_unique<ServerContextConfigImpl>(
+      filter_chain.hidden_envoy_deprecated_tls_context(), server_factory_context);
   ServerSslSocketFactory server_ssl_socket_factory(std::move(server_cfg), manager,
                                                    server_stats_store, server_names);
 
@@ -716,23 +718,26 @@ const std::string testUtilV2(const TestUtilOptionsV2& options) {
 
 // Configure the listener with unittest{cert,key}.pem and ca_cert.pem.
 // Configure the client with expired_san_uri_{cert,key}.pem
-void configureServerAndExpiredClientCertificate(envoy::api::v2::Listener& listener,
-                                                envoy::api::v2::auth::UpstreamTlsContext& client) {
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+void configureServerAndExpiredClientCertificate(
+    envoy::config::listener::v3alpha::Listener& listener,
+    envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext& client) {
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(
       TestEnvironment::substitute("{{ test_tmpdir }}/unittestcert.pem"));
   server_cert->mutable_private_key()->set_filename(
       TestEnvironment::substitute("{{ test_tmpdir }}/unittestkey.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
 
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir "
@@ -787,10 +792,12 @@ TEST_P(SslSocketTest, GetCertDigest) {
 }
 
 TEST_P(SslSocketTest, GetCertDigestInline) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
 
   // From test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem.
   server_cert->mutable_certificate_chain()->set_inline_bytes(
@@ -803,7 +810,7 @@ TEST_P(SslSocketTest, GetCertDigestInline) {
           "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem")));
 
   // From test/extensions/transport_sockets/tls/test_data/ca_certificates.pem.
-  filter_chain->mutable_tls_context()
+  filter_chain->mutable_hidden_envoy_deprecated_tls_context()
       ->mutable_common_tls_context()
       ->mutable_validation_context()
       ->mutable_trusted_ca()
@@ -811,8 +818,8 @@ TEST_P(SslSocketTest, GetCertDigestInline) {
           "{{ test_rundir "
           "}}/test/extensions/transport_sockets/tls/test_data/ca_certificates.pem")));
 
-  envoy::api::v2::auth::UpstreamTlsContext client_ctx;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client_ctx;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client_ctx.mutable_common_tls_context()->add_tls_certificates();
 
   // From test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem.
@@ -1294,8 +1301,8 @@ TEST_P(SslSocketTest, FailedClientAuthSanVerification) {
 
 // By default, expired certificates are not permitted.
 TEST_P(SslSocketTest, FailedClientCertificateDefaultExpirationVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   configureServerAndExpiredClientCertificate(listener, client);
 
@@ -1307,13 +1314,13 @@ TEST_P(SslSocketTest, FailedClientCertificateDefaultExpirationVerification) {
 // Expired certificates will not be accepted when explicitly disallowed via
 // allow_expired_certificate.
 TEST_P(SslSocketTest, FailedClientCertificateExpirationVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   configureServerAndExpiredClientCertificate(listener, client);
 
   listener.mutable_filter_chains(0)
-      ->mutable_tls_context()
+      ->mutable_hidden_envoy_deprecated_tls_context()
       ->mutable_common_tls_context()
       ->mutable_validation_context()
       ->set_allow_expired_certificate(false);
@@ -1325,13 +1332,13 @@ TEST_P(SslSocketTest, FailedClientCertificateExpirationVerification) {
 
 // Expired certificates will be accepted when explicitly allowed via allow_expired_certificate.
 TEST_P(SslSocketTest, ClientCertificateExpirationAllowedVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   configureServerAndExpiredClientCertificate(listener, client);
 
   listener.mutable_filter_chains(0)
-      ->mutable_tls_context()
+      ->mutable_hidden_envoy_deprecated_tls_context()
       ->mutable_common_tls_context()
       ->mutable_validation_context()
       ->set_allow_expired_certificate(true);
@@ -1343,16 +1350,16 @@ TEST_P(SslSocketTest, ClientCertificateExpirationAllowedVerification) {
 
 // Allow expired certificates, but add a certificate hash requirement so it still fails.
 TEST_P(SslSocketTest, FailedClientCertAllowExpiredBadHashVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   configureServerAndExpiredClientCertificate(listener, client);
 
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      listener.mutable_filter_chains(0)
-          ->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = listener.mutable_filter_chains(0)
+                                  ->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
 
   server_validation_ctx->set_allow_expired_certificate(true);
   server_validation_ctx->add_verify_certificate_hash(
@@ -1366,16 +1373,16 @@ TEST_P(SslSocketTest, FailedClientCertAllowExpiredBadHashVerification) {
 
 // Allow expired certificates, but use the wrong CA so it should fail still.
 TEST_P(SslSocketTest, FailedClientCertAllowServerExpiredWrongCAVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   configureServerAndExpiredClientCertificate(listener, client);
 
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      listener.mutable_filter_chains(0)
-          ->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = listener.mutable_filter_chains(0)
+                                  ->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
 
   server_validation_ctx->set_allow_expired_certificate(true);
 
@@ -1443,26 +1450,28 @@ TEST_P(SslSocketTest, ClientCertificateHashVerificationNoCA) {
 }
 
 TEST_P(SslSocketTest, ClientCertificateHashListVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_hash(TEST_SAN_URI_CERT_HASH);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1479,24 +1488,26 @@ TEST_P(SslSocketTest, ClientCertificateHashListVerification) {
 }
 
 TEST_P(SslSocketTest, ClientCertificateHashListVerificationNoCA) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_hash(TEST_SAN_URI_CERT_HASH);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1634,10 +1645,12 @@ TEST_P(SslSocketTest, FailedClientCertificateHashVerificationWrongCA) {
 }
 
 TEST_P(SslSocketTest, CertificatesWithPassword) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir "
       "}}/test/extensions/transport_sockets/tls/test_data/password_protected_cert.pem"));
@@ -1647,18 +1660,18 @@ TEST_P(SslSocketTest, CertificatesWithPassword) {
   server_cert->mutable_password()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir "
       "}}/test/extensions/transport_sockets/tls/test_data/password_protected_password.txt"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_hash(TEST_PASSWORD_PROTECTED_CERT_HASH);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir "
@@ -1681,25 +1694,27 @@ TEST_P(SslSocketTest, CertificatesWithPassword) {
 }
 
 TEST_P(SslSocketTest, ClientCertificateSpkiVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1716,23 +1731,25 @@ TEST_P(SslSocketTest, ClientCertificateSpkiVerification) {
 }
 
 TEST_P(SslSocketTest, ClientCertificateSpkiVerificationNoCA) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1749,24 +1766,26 @@ TEST_P(SslSocketTest, ClientCertificateSpkiVerificationNoCA) {
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationNoClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
   TestUtilOptionsV2 test_options(listener, client, false, GetParam());
   testUtilV2(test_options.setExpectedServerStats("ssl.fail_verify_no_cert")
                  .setExpectedTransportFailureReasonContains("SSLV3_ALERT_HANDSHAKE_FAILURE"));
@@ -1777,22 +1796,24 @@ TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationNoClientCertificate
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationNoCANoClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   TestUtilOptionsV2 test_options(listener, client, false, GetParam());
   testUtilV2(test_options.setExpectedServerStats("ssl.fail_verify_no_cert")
@@ -1804,25 +1825,27 @@ TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationNoCANoClientCertifi
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationWrongClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_cert.pem"));
@@ -1839,23 +1862,25 @@ TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationWrongClientCertific
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationNoCAWrongClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_cert.pem"));
@@ -1872,25 +1897,27 @@ TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationNoCAWrongClientCert
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationWrongCA) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/fake_ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1906,18 +1933,20 @@ TEST_P(SslSocketTest, FailedClientCertificateSpkiVerificationWrongCA) {
 }
 
 TEST_P(SslSocketTest, ClientCertificateHashAndSpkiVerification) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_hash(
@@ -1925,8 +1954,8 @@ TEST_P(SslSocketTest, ClientCertificateHashAndSpkiVerification) {
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1943,25 +1972,27 @@ TEST_P(SslSocketTest, ClientCertificateHashAndSpkiVerification) {
 }
 
 TEST_P(SslSocketTest, ClientCertificateHashAndSpkiVerificationNoCA) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_DNS_CERT_SPKI);
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -1978,25 +2009,27 @@ TEST_P(SslSocketTest, ClientCertificateHashAndSpkiVerificationNoCA) {
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationNoClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   TestUtilOptionsV2 test_options(listener, client, false, GetParam());
   testUtilV2(test_options.setExpectedServerStats("ssl.fail_verify_no_cert")
@@ -2008,23 +2041,25 @@ TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationNoClientCert
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationNoCANoClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   TestUtilOptionsV2 test_options(listener, client, false, GetParam());
   testUtilV2(test_options.setExpectedServerStats("ssl.fail_verify_no_cert")
@@ -2036,26 +2071,28 @@ TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationNoCANoClient
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationWrongClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_cert.pem"));
@@ -2072,24 +2109,26 @@ TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationWrongClientC
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationNoCAWrongClientCertificate) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_cert.pem"));
@@ -2106,26 +2145,28 @@ TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationNoCAWrongCli
 }
 
 TEST_P(SslSocketTest, FailedClientCertificateHashAndSpkiVerificationWrongCA) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/fake_ca_cert.pem"));
   server_validation_ctx->add_verify_certificate_hash(
       "0000000000000000000000000000000000000000000000000000000000000000");
   server_validation_ctx->add_verify_certificate_spki(TEST_SAN_URI_CERT_SPKI);
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -2155,7 +2196,7 @@ TEST_P(SslSocketTest, FlushCloseDuringHandshake) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_certificates.pem"
 )EOF";
 
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context, factory_context_);
   ContextManagerImpl manager(time_system_);
@@ -2210,7 +2251,7 @@ TEST_P(SslSocketTest, HalfClose) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_certificates.pem"
 )EOF";
 
-  envoy::api::v2::auth::DownstreamTlsContext server_tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
   ContextManagerImpl manager(time_system_);
@@ -2230,7 +2271,7 @@ TEST_P(SslSocketTest, HalfClose) {
     common_tls_context:
   )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(client_ctx_yaml), tls_context);
   auto client_cfg = std::make_unique<ClientContextConfigImpl>(tls_context, factory_context_);
   Stats::IsolatedStoreImpl client_stats_store;
@@ -2291,7 +2332,7 @@ TEST_P(SslSocketTest, ClientAuthMultipleCAs) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_certificates.pem"
 )EOF";
 
-  envoy::api::v2::auth::DownstreamTlsContext server_tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
   ContextManagerImpl manager(time_system_);
@@ -2314,7 +2355,7 @@ TEST_P(SslSocketTest, ClientAuthMultipleCAs) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_key.pem"
 )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(client_ctx_yaml), tls_context);
   auto client_cfg = std::make_unique<ClientContextConfigImpl>(tls_context, factory_context_);
   Stats::IsolatedStoreImpl client_stats_store;
@@ -2378,12 +2419,12 @@ void testTicketSessionResumption(const std::string& server_ctx_yaml1,
       server_factory_context;
   ON_CALL(server_factory_context, api()).WillByDefault(ReturnRef(*server_api));
 
-  envoy::api::v2::auth::DownstreamTlsContext server_tls_context1;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext server_tls_context1;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml1), server_tls_context1);
   auto server_cfg1 =
       std::make_unique<ServerContextConfigImpl>(server_tls_context1, server_factory_context);
 
-  envoy::api::v2::auth::DownstreamTlsContext server_tls_context2;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext server_tls_context2;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml2), server_tls_context2);
   auto server_cfg2 =
       std::make_unique<ServerContextConfigImpl>(server_tls_context2, server_factory_context);
@@ -2402,7 +2443,7 @@ void testTicketSessionResumption(const std::string& server_ctx_yaml1,
   Network::ListenerPtr listener1 = dispatcher->createListener(socket1, callbacks, true);
   Network::ListenerPtr listener2 = dispatcher->createListener(socket2, callbacks, true);
 
-  envoy::api::v2::auth::UpstreamTlsContext client_tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(client_ctx_yaml), client_tls_context);
 
   Stats::IsolatedStoreImpl client_stats_store;
@@ -2797,10 +2838,10 @@ TEST_P(SslSocketTest, ClientAuthCrossListenerSessionResumption) {
       filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ticket_key_a"
 )EOF";
 
-  envoy::api::v2::auth::DownstreamTlsContext tls_context1;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context1;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), tls_context1);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context1, factory_context_);
-  envoy::api::v2::auth::DownstreamTlsContext tls_context2;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context2;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server2_ctx_yaml), tls_context2);
   auto server2_cfg = std::make_unique<ServerContextConfigImpl>(tls_context2, factory_context_);
   ContextManagerImpl manager(time_system_);
@@ -2827,7 +2868,7 @@ TEST_P(SslSocketTest, ClientAuthCrossListenerSessionResumption) {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_key.pem"
 )EOF";
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(client_ctx_yaml), tls_context);
 
   auto client_cfg = std::make_unique<ClientContextConfigImpl>(tls_context, factory_context_);
@@ -2918,7 +2959,7 @@ void SslSocketTest::testClientSessionResumption(const std::string& server_ctx_ya
       server_factory_context;
   ON_CALL(server_factory_context, api()).WillByDefault(ReturnRef(*server_api));
 
-  envoy::api::v2::auth::DownstreamTlsContext server_ctx_proto;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext server_ctx_proto;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_ctx_proto);
   auto server_cfg =
       std::make_unique<ServerContextConfigImpl>(server_ctx_proto, server_factory_context);
@@ -2936,7 +2977,7 @@ void SslSocketTest::testClientSessionResumption(const std::string& server_ctx_ya
   Network::ConnectionPtr server_connection;
   Network::MockConnectionCallbacks server_connection_callbacks;
 
-  envoy::api::v2::auth::UpstreamTlsContext client_ctx_proto;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client_ctx_proto;
   TestUtility::loadFromYaml(TestEnvironment::substitute(client_ctx_yaml), client_ctx_proto);
 
   Stats::IsolatedStoreImpl client_stats_store;
@@ -2981,9 +3022,9 @@ void SslSocketTest::testClientSessionResumption(const std::string& server_ctx_ya
 
   const bool expect_tls13 =
       client_ctx_proto.common_tls_context().tls_params().tls_maximum_protocol_version() ==
-          envoy::api::v2::auth::TlsParameters::TLSv1_3 &&
+          envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3 &&
       server_ctx_proto.common_tls_context().tls_params().tls_maximum_protocol_version() ==
-          envoy::api::v2::auth::TlsParameters::TLSv1_3;
+          envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3;
 
   // The order of "Connected" events depends on the version of the TLS protocol (1.3 or older).
   if (expect_tls13) {
@@ -3177,7 +3218,7 @@ TEST_P(SslSocketTest, SslError) {
       verify_certificate_hash: "7B:0C:3F:0D:97:0E:FC:16:70:11:7A:0C:35:75:54:6B:17:AB:CF:20:D8:AA:A0:ED:87:08:0F:FB:60:4C:40:77"
 )EOF";
 
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context, factory_context_);
   ContextManagerImpl manager(time_system_);
@@ -3218,10 +3259,10 @@ TEST_P(SslSocketTest, SslError) {
   EXPECT_EQ(1UL, server_stats_store.counter("ssl.connection_error").value());
 }
 
-static TestUtilOptionsV2
-createProtocolTestOptions(const envoy::api::v2::Listener& listener,
-                          const envoy::api::v2::auth::UpstreamTlsContext& client_ctx,
-                          Network::Address::IpVersion version, std::string protocol) {
+static TestUtilOptionsV2 createProtocolTestOptions(
+    const envoy::config::listener::v3alpha::Listener& listener,
+    const envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext& client_ctx,
+    Network::Address::IpVersion version, std::string protocol) {
   std::string stats = "ssl.versions." + protocol;
   TestUtilOptionsV2 options(listener, client_ctx, true, version);
   options.setExpectedServerStats(stats).setExpectedClientStats(stats);
@@ -3229,19 +3270,23 @@ createProtocolTestOptions(const envoy::api::v2::Listener& listener,
 }
 
 TEST_P(SslSocketTest, ProtocolVersions) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::TlsParameters* server_params =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->mutable_tls_params();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters* server_params =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->mutable_tls_params();
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsParameters* client_params =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters* client_params =
       client.mutable_common_tls_context()->mutable_tls_params();
 
   // Connection using defaults (client & server) succeeds, negotiating TLSv1.2.
@@ -3256,8 +3301,10 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   client.set_allow_renegotiation(false);
 
   // Connection using TLSv1.0 (client) and defaults (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
   TestUtilOptionsV2 tls_v1_test_options =
       createProtocolTestOptions(listener, client, GetParam(), "TLSv1");
   testUtilV2(tls_v1_test_options);
@@ -3265,8 +3312,10 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   client_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.1 (client) and defaults (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_1);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_1);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_1);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_1);
   TestUtilOptionsV2 tls_v1_1_test_options =
       createProtocolTestOptions(listener, client, GetParam(), "TLSv1.1");
   testUtilV2(tls_v1_1_test_options);
@@ -3274,15 +3323,19 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   client_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.2 (client) and defaults (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_2);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_2);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2);
   testUtilV2(tls_v1_2_test_options);
   client_params->clear_tls_minimum_protocol_version();
   client_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.3 (client) and defaults (server) succeeds (non-FIPS) or fails (FIPS).
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
   TestUtilOptionsV2 tls_v1_3_test_options =
       createProtocolTestOptions(listener, client, GetParam(), "TLSv1.3");
   TestUtilOptionsV2 error_test_options(listener, client, false, GetParam());
@@ -3297,8 +3350,10 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   client_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.0-1.3 (client) and defaults (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
 #ifndef BORINGSSL_FIPS
   testUtilV2(tls_v1_3_test_options);
 #else // BoringSSL FIPS
@@ -3308,10 +3363,14 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   client_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.0 (client) and TLSv1.0-1.3 (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
   testUtilV2(tls_v1_test_options);
   client_params->clear_tls_minimum_protocol_version();
   client_params->clear_tls_maximum_protocol_version();
@@ -3319,10 +3378,14 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.3 (client) and TLSv1.0-1.3 (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
   testUtilV2(tls_v1_3_test_options);
   client_params->clear_tls_minimum_protocol_version();
   client_params->clear_tls_maximum_protocol_version();
@@ -3334,45 +3397,59 @@ TEST_P(SslSocketTest, ProtocolVersions) {
       .setExpectedTransportFailureReasonContains("UNSUPPORTED_PROTOCOL");
 
   // Connection using defaults (client) and TLSv1.0 (server) fails.
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
   testUtilV2(unsupported_protocol_test_options);
   server_params->clear_tls_minimum_protocol_version();
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using defaults (client) and TLSv1.1 (server) fails.
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_1);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_1);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_1);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_1);
   testUtilV2(unsupported_protocol_test_options);
   server_params->clear_tls_minimum_protocol_version();
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using defaults (client) and TLSv1.2 (server) succeeds.
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_2);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_2);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_2);
   testUtilV2(tls_v1_2_test_options);
   server_params->clear_tls_minimum_protocol_version();
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using defaults (client) and TLSv1.3 (server) fails.
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
   testUtilV2(error_test_options);
   server_params->clear_tls_minimum_protocol_version();
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using defaults (client) and TLSv1.0-1.3 (server) succeeds.
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
   testUtilV2(tls_v1_2_test_options);
   server_params->clear_tls_minimum_protocol_version();
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.0-TLSv1.3 (client) and TLSv1.0 (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
   testUtilV2(tls_v1_test_options);
   client_params->clear_tls_minimum_protocol_version();
   client_params->clear_tls_maximum_protocol_version();
@@ -3380,10 +3457,14 @@ TEST_P(SslSocketTest, ProtocolVersions) {
   server_params->clear_tls_maximum_protocol_version();
 
   // Connection using TLSv1.0-TLSv1.3 (client) and TLSv1.3 (server) succeeds.
-  client_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_0);
-  client_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  server_params->set_tls_minimum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
-  server_params->set_tls_maximum_protocol_version(envoy::api::v2::auth::TlsParameters::TLSv1_3);
+  client_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_0);
+  client_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  server_params->set_tls_minimum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
+  server_params->set_tls_maximum_protocol_version(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLSv1_3);
   testUtilV2(tls_v1_3_test_options);
   client_params->clear_tls_minimum_protocol_version();
   client_params->clear_tls_maximum_protocol_version();
@@ -3392,19 +3473,22 @@ TEST_P(SslSocketTest, ProtocolVersions) {
 }
 
 TEST_P(SslSocketTest, ALPN) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CommonTlsContext* server_ctx =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext* server_ctx =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()->mutable_common_tls_context();
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::CommonTlsContext* client_ctx = client.mutable_common_tls_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext* client_ctx =
+      client.mutable_common_tls_context();
 
   // Connection using defaults (client & server) succeeds, no ALPN is negotiated.
   TestUtilOptionsV2 test_options(listener, client, true, GetParam());
@@ -3457,19 +3541,23 @@ TEST_P(SslSocketTest, ALPN) {
 }
 
 TEST_P(SslSocketTest, CipherSuites) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::TlsParameters* server_params =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->mutable_tls_params();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters* server_params =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->mutable_tls_params();
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsParameters* client_params =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters* client_params =
       client.mutable_common_tls_context()->mutable_tls_params();
 
   // Connection using defaults (client & server) succeeds.
@@ -3514,19 +3602,23 @@ TEST_P(SslSocketTest, CipherSuites) {
 }
 
 TEST_P(SslSocketTest, EcdhCurves) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::TlsParameters* server_params =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->mutable_tls_params();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters* server_params =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->mutable_tls_params();
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
-  envoy::api::v2::auth::TlsParameters* client_params =
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters* client_params =
       client.mutable_common_tls_context()->mutable_tls_params();
 
   // Connection using defaults (client & server) succeeds.
@@ -3577,17 +3669,19 @@ TEST_P(SslSocketTest, EcdhCurves) {
 }
 
 TEST_P(SslSocketTest, SignatureAlgorithms) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::CertificateValidationContext* server_validation_ctx =
-      filter_chain->mutable_tls_context()
-          ->mutable_common_tls_context()
-          ->mutable_validation_context();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext*
+      server_validation_ctx = filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+                                  ->mutable_common_tls_context()
+                                  ->mutable_validation_context();
   server_validation_ctx->mutable_trusted_ca()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ca_cert.pem"));
   // Server ECDSA certificate.
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir "
       "}}/test/extensions/transport_sockets/tls/test_data/selfsigned_ecdsa_p256_cert.pem"));
@@ -3595,9 +3689,9 @@ TEST_P(SslSocketTest, SignatureAlgorithms) {
       "{{ test_rundir "
       "}}/test/extensions/transport_sockets/tls/test_data/selfsigned_ecdsa_p256_key.pem"));
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
   // Client RSA certificate.
-  envoy::api::v2::auth::TlsCertificate* client_cert =
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* client_cert =
       client.mutable_common_tls_context()->add_tls_certificates();
   client_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_uri_cert.pem"));
@@ -3703,16 +3797,18 @@ TEST_P(SslSocketTest, RevokedCertificateCRLInTrustedCA) {
 }
 
 TEST_P(SslSocketTest, GetRequestedServerName) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
   client.set_sni("lyft.com");
 
   TestUtilOptionsV2 test_options(listener, client, true, GetParam());
@@ -3720,16 +3816,18 @@ TEST_P(SslSocketTest, GetRequestedServerName) {
 }
 
 TEST_P(SslSocketTest, OverrideRequestedServerName) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
   client.set_sni("lyft.com");
 
   Network::TransportSocketOptionsSharedPtr transport_socket_options(
@@ -3741,16 +3839,18 @@ TEST_P(SslSocketTest, OverrideRequestedServerName) {
 }
 
 TEST_P(SslSocketTest, OverrideRequestedServerNameWithoutSniInUpstreamTlsContext) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
 
   Network::TransportSocketOptionsSharedPtr transport_socket_options(
       new Network::TransportSocketOptionsImpl("example.com"));
@@ -3760,18 +3860,20 @@ TEST_P(SslSocketTest, OverrideRequestedServerNameWithoutSniInUpstreamTlsContext)
 }
 
 TEST_P(SslSocketTest, OverrideApplicationProtocols) {
-  envoy::api::v2::Listener listener;
-  envoy::api::v2::listener::FilterChain* filter_chain = listener.add_filter_chains();
-  envoy::api::v2::auth::TlsCertificate* server_cert =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context()->add_tls_certificates();
+  envoy::config::listener::v3alpha::Listener listener;
+  envoy::config::listener::v3alpha::FilterChain* filter_chain = listener.add_filter_chains();
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate* server_cert =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()
+          ->mutable_common_tls_context()
+          ->add_tls_certificates();
   server_cert->mutable_certificate_chain()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_cert.pem"));
   server_cert->mutable_private_key()->set_filename(TestEnvironment::substitute(
       "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/san_dns_key.pem"));
-  envoy::api::v2::auth::CommonTlsContext* server_ctx =
-      filter_chain->mutable_tls_context()->mutable_common_tls_context();
+  envoy::extensions::transport_sockets::tls::v3alpha::CommonTlsContext* server_ctx =
+      filter_chain->mutable_hidden_envoy_deprecated_tls_context()->mutable_common_tls_context();
 
-  envoy::api::v2::auth::UpstreamTlsContext client;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext client;
   TestUtilOptionsV2 test_options(listener, client, true, GetParam());
 
   // Client connects without ALPN to a server with "test" ALPN, no ALPN is negotiated.
@@ -3802,7 +3904,7 @@ TEST_P(SslSocketTest, DownstreamNotReadySslSocket) {
   EXPECT_CALL(factory_context, stats()).WillOnce(ReturnRef(stats_store));
   EXPECT_CALL(factory_context, initManager()).WillRepeatedly(Return(&init_manager));
 
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   auto sds_secret_configs =
       tls_context.mutable_common_tls_context()->mutable_tls_certificate_sds_secret_configs()->Add();
   sds_secret_configs->set_name("abc.com");
@@ -3838,7 +3940,7 @@ TEST_P(SslSocketTest, UpstreamNotReadySslSocket) {
   EXPECT_CALL(factory_context, initManager()).WillRepeatedly(Return(&init_manager));
   EXPECT_CALL(factory_context, dispatcher()).WillOnce(ReturnRef(dispatcher));
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   auto sds_secret_configs =
       tls_context.mutable_common_tls_context()->mutable_tls_certificate_sds_secret_configs()->Add();
   sds_secret_configs->set_name("abc.com");
@@ -4041,11 +4143,11 @@ class SslReadBufferLimitTest : public SslSocketTest {
         filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/no_san_key.pem"
 )EOF";
 
-  envoy::api::v2::auth::DownstreamTlsContext downstream_tls_context_;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext downstream_tls_context_;
   std::unique_ptr<ContextManagerImpl> manager_;
   Network::TransportSocketFactoryPtr server_ssl_socket_factory_;
   Network::ListenerPtr listener_;
-  envoy::api::v2::auth::UpstreamTlsContext upstream_tls_context_;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext upstream_tls_context_;
   Envoy::Ssl::ClientContextSharedPtr client_ctx_;
   Network::TransportSocketFactoryPtr client_ssl_socket_factory_;
   Network::ClientConnectionPtr client_connection_;
diff --git a/test/extensions/transport_sockets/tls/test_private_key_method_provider.h b/test/extensions/transport_sockets/tls/test_private_key_method_provider.h
index 417ddff3ebb6..44fb2271b718 100644
--- a/test/extensions/transport_sockets/tls/test_private_key_method_provider.h
+++ b/test/extensions/transport_sockets/tls/test_private_key_method_provider.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/auth/cert.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/server/transport_socket_config.h"
 #include "envoy/ssl/private_key/private_key.h"
 #include "envoy/ssl/private_key/private_key_config.h"
@@ -84,7 +84,7 @@ class TestPrivateKeyMethodFactory : public Ssl::PrivateKeyMethodProviderInstance
 public:
   // Ssl::PrivateKeyMethodProviderInstanceFactory
   Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance(
-      const envoy::api::v2::auth::PrivateKeyProvider& config,
+      const envoy::extensions::transport_sockets::tls::v3alpha::PrivateKeyProvider& config,
       Server::Configuration::TransportSocketFactoryContext& factory_context) override {
     return std::make_shared<TestPrivateKeyMethodProvider>(config.typed_config(), factory_context);
   }
diff --git a/test/fuzz/BUILD b/test/fuzz/BUILD
index 7e911baf6b74..b703760d1526 100644
--- a/test/fuzz/BUILD
+++ b/test/fuzz/BUILD
@@ -12,7 +12,7 @@ envoy_package()
 envoy_proto_library(
     name = "common_proto",
     srcs = ["common.proto"],
-    deps = ["@envoy_api//envoy/api/v2/core:pkg"],
+    deps = ["@envoy_api//envoy/config/core/v3alpha:pkg"],
 )
 
 envoy_cc_test_library(
@@ -57,6 +57,6 @@ envoy_cc_test_library(
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/fuzz/common.proto b/test/fuzz/common.proto
index d1e3251a032a..9623e372baa8 100644
--- a/test/fuzz/common.proto
+++ b/test/fuzz/common.proto
@@ -2,8 +2,8 @@ syntax = "proto3";
 
 package test.fuzz;
 
-import "envoy/api/v2/core/base.proto";
-import "envoy/api/v2/core/address.proto";
+import "envoy/config/core/v3alpha/base.proto";
+import "envoy/config/core/v3alpha/address.proto";
 
 import "google/protobuf/wrappers.proto";
 
@@ -12,15 +12,15 @@ import "validate/validate.proto";
 // Common fuzzing input types.
 
 message Headers {
-  repeated envoy.api.v2.core.HeaderValue headers = 1;
+  repeated envoy.config.core.v3alpha.HeaderValue headers = 1;
 }
 
 message StreamInfo {
-  envoy.api.v2.core.Metadata dynamic_metadata = 1;
+  envoy.config.core.v3alpha.Metadata dynamic_metadata = 1;
   uint64 start_time = 2;
   google.protobuf.UInt32Value response_code = 3;
-  envoy.api.v2.core.Metadata upstream_metadata = 4;
+  envoy.config.core.v3alpha.Metadata upstream_metadata = 4;
   string requested_server_name = 5;
-  envoy.api.v2.core.Address address = 6;
-  envoy.api.v2.core.Address upstream_local_address = 7;
+  envoy.config.core.v3alpha.Address address = 6;
+  envoy.config.core.v3alpha.Address upstream_local_address = 7;
 }
diff --git a/test/fuzz/utility.h b/test/fuzz/utility.h
index 96456f110d9c..8bcaf6bebbf2 100644
--- a/test/fuzz/utility.h
+++ b/test/fuzz/utility.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/empty_string.h"
 #include "common/network/resolver_impl.h"
@@ -46,9 +46,11 @@ inline std::string replaceInvalidCharacters(absl::string_view string) {
 }
 
 // Return a new RepeatedPtrField of HeaderValueOptions with invalid characters removed.
-inline Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption> replaceInvalidHeaders(
-    const Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& headers_to_add) {
-  Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption> processed;
+inline Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>
+replaceInvalidHeaders(
+    const Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>&
+        headers_to_add) {
+  Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption> processed;
   for (const auto& header : headers_to_add) {
     auto* header_value_option = processed.Add();
     auto* mutable_header = header_value_option->mutable_header();
@@ -59,9 +61,9 @@ inline Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption> repla
   return processed;
 }
 
-inline envoy::api::v2::core::Metadata
-replaceInvalidStringValues(const envoy::api::v2::core::Metadata& upstream_metadata) {
-  envoy::api::v2::core::Metadata processed = upstream_metadata;
+inline envoy::config::core::v3alpha::Metadata
+replaceInvalidStringValues(const envoy::config::core::v3alpha::Metadata& upstream_metadata) {
+  envoy::config::core::v3alpha::Metadata processed = upstream_metadata;
   for (auto& metadata_struct : *processed.mutable_filter_metadata()) {
     // Metadata fields consist of keyed Structs, which is a map of dynamically typed values. These
     // values can be null, a number, a string, a boolean, a list of values, or a recursive struct.
@@ -138,7 +140,7 @@ inline TestStreamInfo fromStreamInfo(const test::fuzz::StreamInfo& stream_info)
   }
   test_stream_info.setRequestedServerName(stream_info.requested_server_name());
   auto upstream_host = std::make_shared<NiceMock<Upstream::MockHostDescription>>();
-  auto upstream_metadata = std::make_shared<envoy::api::v2::core::Metadata>(
+  auto upstream_metadata = std::make_shared<envoy::config::core::v3alpha::Metadata>(
       replaceInvalidStringValues(stream_info.upstream_metadata()));
   ON_CALL(*upstream_host, metadata()).WillByDefault(testing::Return(upstream_metadata));
   test_stream_info.upstream_host_ = upstream_host;
diff --git a/test/integration/BUILD b/test/integration/BUILD
index 495e9c64951b..850dc0d0bbe0 100644
--- a/test/integration/BUILD
+++ b/test/integration/BUILD
@@ -34,10 +34,13 @@ envoy_cc_test_library(
         "//test/common/grpc:grpc_client_integration_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -53,8 +56,11 @@ envoy_cc_test(
         "//test/common/grpc:grpc_client_integration_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -91,7 +97,8 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -104,11 +111,12 @@ envoy_cc_test(
         "//test/config:utility_lib",
         "//test/integration/filters:eds_ready_filter_config_lib",
         "//test/test_common:network_utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -133,7 +141,7 @@ envoy_cc_test(
         "//test/server:utility_lib",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -146,7 +154,7 @@ envoy_cc_test(
         "//include/envoy/registry",
         "//source/extensions/filters/network/tcp_proxy:config",
         "//test/config:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -159,8 +167,8 @@ envoy_cc_test(
         "//test/config:utility_lib",
         "//test/integration/clusters:custom_static_cluster",
         "//test/test_common:network_utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -180,8 +188,7 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -221,10 +228,11 @@ envoy_cc_test(
         "//source/common/protobuf",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/router/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/router/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -249,8 +257,9 @@ envoy_cc_test(
         "//test/mocks/http:http_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -262,10 +271,10 @@ envoy_cc_test(
     deps = [
         ":http_integration_lib",
         "//test/common/upstream:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -281,10 +290,10 @@ envoy_cc_test(
         ":http_integration_lib",
         "//source/extensions/transport_sockets/tls:context_lib",
         "//test/common/upstream:utility_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -295,8 +304,8 @@ envoy_cc_test(
     ],
     deps = [
         ":http_integration_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -308,8 +317,8 @@ envoy_cc_test(
     ],
     deps = [
         ":http_integration_lib",
-        "@envoy_api//envoy/config/filter/http/router/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/router/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -329,9 +338,9 @@ envoy_cc_test(
         "//source/extensions/filters/http/health_check:config",
         "//test/integration/filters:random_pause_filter_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -350,8 +359,8 @@ envoy_cc_test(
         "//source/extensions/filters/http/health_check:config",
         "//test/integration/filters:random_pause_filter_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -368,10 +377,10 @@ envoy_cc_test(
         "//source/extensions/filters/http/buffer:config",
         "//source/extensions/filters/http/health_check:config",
         "//test/common/stats:stat_test_utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -411,7 +420,8 @@ envoy_cc_test_library(
         "//test/integration/filters:passthrough_filter_config_lib",
         "//test/integration/filters:pause_filter_lib",
         "//test/test_common:registry_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -438,8 +448,8 @@ envoy_cc_test(
     deps = [
         ":http_protocol_integration_lib",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -528,12 +538,12 @@ envoy_cc_test_library(
         "//test/test_common:test_time_lib",
         "//test/test_common:test_time_system_interface",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -555,9 +565,9 @@ envoy_cc_test(
         "//test/integration/filters:process_context_lib",
         "//test/mocks/http:http_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -570,8 +580,8 @@ envoy_cc_test(
         ":http_protocol_integration_lib",
         "//source/common/http:header_map_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -587,8 +597,8 @@ envoy_cc_test(
         "//source/extensions/access_loggers/file:config",
         "//source/extensions/filters/http/buffer:config",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -622,8 +632,8 @@ envoy_cc_test(
         "//test/common/stats:stat_test_utility_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -636,11 +646,11 @@ envoy_cc_test(
         "//test/config:utility_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/load_stats/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/load_stats/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -660,9 +670,9 @@ envoy_cc_test(
         "//test/common/upstream:utility_lib",
         "//test/config:utility_lib",
         "//test/test_common:network_utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/health/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -672,7 +682,7 @@ envoy_cc_test(
     coverage = False,
     deps = [
         ":http_protocol_integration_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -682,8 +692,8 @@ envoy_cc_test(
     deps = [
         ":http_protocol_integration_lib",
         "//source/extensions/resource_monitors/injected_resource:config",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/overload/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/overload/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -699,8 +709,8 @@ envoy_cc_test(
         "//source/common/http:codec_client_lib",
         "//source/extensions/filters/listener/proxy_protocol:config",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -714,11 +724,11 @@ envoy_cc_test(
         "//source/common/grpc:common_lib",
         "//source/extensions/filters/http/ratelimit:config",
         "//test/common/grpc:grpc_client_integration_lib",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/http/rate_limit/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/ratelimit/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/http/ratelimit/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/ratelimit/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -728,7 +738,7 @@ envoy_cc_test(
     deps = [
         ":http_integration_lib",
         "//test/common/grpc:grpc_client_integration_lib",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/runtime/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -757,8 +767,8 @@ envoy_cc_test(
         "//source/extensions/transport_sockets/tls:context_lib",
         "//test/mocks/secret:secret_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -787,10 +797,10 @@ envoy_cc_test(
         "//test/mocks/secret:secret_mocks",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/secret/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -817,11 +827,12 @@ envoy_cc_test(
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/secret:secret_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/accesslog/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/access_loggers/grpc/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -863,7 +874,7 @@ envoy_cc_test(
         "//source/common/http:codec_client_lib",
         "//source/common/stats:stats_lib",
         "//test/test_common:environment_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -883,7 +894,7 @@ envoy_cc_test(
     deps = [
         ":http_integration_lib",
         "//source/common/stats:stats_lib",
-        "@envoy_api//envoy/config/filter/network/tcp_proxy/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/tcp_proxy/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -896,8 +907,8 @@ envoy_cc_test(
         ":http_protocol_integration_lib",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -916,9 +927,9 @@ envoy_cc_test(
         "//source/extensions/transport_sockets/tls:config",
         "//test/mocks/server:server_mocks",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -950,7 +961,7 @@ envoy_cc_fuzz_test(
     corpus = "h1_corpus",
     deps = [
         ":h1_fuzz_lib",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -970,9 +981,10 @@ envoy_cc_test(
         "//test/common/grpc:grpc_client_integration_lib",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/integration/ads_integration.cc b/test/integration/ads_integration.cc
index 0a0d74a55185..a5d324676755 100644
--- a/test/integration/ads_integration.cc
+++ b/test/integration/ads_integration.cc
@@ -1,12 +1,12 @@
 #include "test/integration/ads_integration.h"
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/config/protobuf_link_hacks.h"
 #include "common/config/resources.h"
@@ -36,8 +36,8 @@ void AdsIntegrationTest::TearDown() {
   fake_upstreams_.clear();
 }
 
-envoy::api::v2::Cluster AdsIntegrationTest::buildCluster(const std::string& name) {
-  return TestUtility::parseYaml<envoy::api::v2::Cluster>(fmt::format(R"EOF(
+envoy::config::cluster::v3alpha::Cluster AdsIntegrationTest::buildCluster(const std::string& name) {
+  return TestUtility::parseYaml<envoy::config::cluster::v3alpha::Cluster>(fmt::format(R"EOF(
       name: {}
       connect_timeout: 5s
       type: EDS
@@ -45,23 +45,24 @@ envoy::api::v2::Cluster AdsIntegrationTest::buildCluster(const std::string& name
       lb_policy: ROUND_ROBIN
       http2_protocol_options: {{}}
     )EOF",
-                                                                     name));
+                                                                                      name));
 }
 
-envoy::api::v2::Cluster AdsIntegrationTest::buildRedisCluster(const std::string& name) {
-  return TestUtility::parseYaml<envoy::api::v2::Cluster>(fmt::format(R"EOF(
+envoy::config::cluster::v3alpha::Cluster
+AdsIntegrationTest::buildRedisCluster(const std::string& name) {
+  return TestUtility::parseYaml<envoy::config::cluster::v3alpha::Cluster>(fmt::format(R"EOF(
       name: {}
       connect_timeout: 5s
       type: EDS
       eds_cluster_config: {{ eds_config: {{ ads: {{}} }} }}
       lb_policy: MAGLEV
     )EOF",
-                                                                     name));
+                                                                                      name));
 }
 
-envoy::api::v2::ClusterLoadAssignment
+envoy::config::endpoint::v3alpha::ClusterLoadAssignment
 AdsIntegrationTest::buildClusterLoadAssignment(const std::string& name) {
-  return TestUtility::parseYaml<envoy::api::v2::ClusterLoadAssignment>(
+  return TestUtility::parseYaml<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       fmt::format(R"EOF(
       cluster_name: {}
       endpoints:
@@ -76,10 +77,10 @@ AdsIntegrationTest::buildClusterLoadAssignment(const std::string& name) {
                   fake_upstreams_[0]->localAddress()->ip()->port()));
 }
 
-envoy::api::v2::Listener AdsIntegrationTest::buildListener(const std::string& name,
-                                                           const std::string& route_config,
-                                                           const std::string& stat_prefix) {
-  return TestUtility::parseYaml<envoy::api::v2::Listener>(fmt::format(
+envoy::config::listener::v3alpha::Listener
+AdsIntegrationTest::buildListener(const std::string& name, const std::string& route_config,
+                                  const std::string& stat_prefix) {
+  return TestUtility::parseYaml<envoy::config::listener::v3alpha::Listener>(fmt::format(
       R"EOF(
       name: {}
       address:
@@ -101,9 +102,9 @@ envoy::api::v2::Listener AdsIntegrationTest::buildListener(const std::string& na
       name, Network::Test::getLoopbackAddressString(ipVersion()), stat_prefix, route_config));
 }
 
-envoy::api::v2::Listener AdsIntegrationTest::buildRedisListener(const std::string& name,
-                                                                const std::string& cluster) {
-  return TestUtility::parseYaml<envoy::api::v2::Listener>(fmt::format(
+envoy::config::listener::v3alpha::Listener
+AdsIntegrationTest::buildRedisListener(const std::string& name, const std::string& cluster) {
+  return TestUtility::parseYaml<envoy::config::listener::v3alpha::Listener>(fmt::format(
       R"EOF(
       name: {}
       address:
@@ -125,9 +126,10 @@ envoy::api::v2::Listener AdsIntegrationTest::buildRedisListener(const std::strin
       name, Network::Test::getLoopbackAddressString(ipVersion()), name, cluster));
 }
 
-envoy::api::v2::RouteConfiguration
+envoy::config::route::v3alpha::RouteConfiguration
 AdsIntegrationTest::buildRouteConfig(const std::string& name, const std::string& cluster) {
-  return TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(fmt::format(R"EOF(
+  return TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+      fmt::format(R"EOF(
       name: {}
       virtual_hosts:
       - name: integration
@@ -136,7 +138,7 @@ AdsIntegrationTest::buildRouteConfig(const std::string& name, const std::string&
         - match: {{ prefix: "/" }}
           route: {{ cluster: {} }}
     )EOF",
-                                                                                name, cluster));
+                  name, cluster));
 }
 
 void AdsIntegrationTest::makeSingleRequest() {
@@ -149,7 +151,7 @@ void AdsIntegrationTest::initialize() { initializeAds(false); }
 
 void AdsIntegrationTest::initializeAds(const bool rate_limiting) {
   config_helper_.addConfigModifier([this, &rate_limiting](
-                                       envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+                                       envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* ads_config = bootstrap.mutable_dynamic_resources()->mutable_ads_config();
     if (rate_limiting) {
       ads_config->mutable_rate_limit_settings();
@@ -159,7 +161,7 @@ void AdsIntegrationTest::initializeAds(const bool rate_limiting) {
     auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
     ads_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
     ads_cluster->set_name("ads_cluster");
-    envoy::api::v2::auth::UpstreamTlsContext context;
+    envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext context;
     auto* validation_context = context.mutable_common_tls_context()->mutable_validation_context();
     validation_context->mutable_trusted_ca()->set_filename(
         TestEnvironment::runfilesPath("test/config/integration/certs/upstreamcacert.pem"));
@@ -186,19 +188,19 @@ void AdsIntegrationTest::initializeAds(const bool rate_limiting) {
 void AdsIntegrationTest::testBasicFlow() {
   // Send initial configuration, validate we can process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "1", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
@@ -206,7 +208,7 @@ void AdsIntegrationTest::testBasicFlow() {
                                       {"cluster_0"}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                       {"route_config_0"}, {"route_config_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
 
@@ -224,11 +226,11 @@ void AdsIntegrationTest::testBasicFlow() {
       getRoutesConfigDump().dynamic_route_configs()[0].last_updated();
 
   // Upgrade RDS/CDS/EDS to a newer config, validate we can process a request.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
       Config::TypeUrl::get().Cluster, {buildCluster("cluster_1"), buildCluster("cluster_2")},
       {buildCluster("cluster_1"), buildCluster("cluster_2")}, {"cluster_0"}, "2");
   test_server_->waitForGaugeEq("cluster_manager.warming_clusters", 2);
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment,
       {buildClusterLoadAssignment("cluster_1"), buildClusterLoadAssignment("cluster_2")},
       {buildClusterLoadAssignment("cluster_1"), buildClusterLoadAssignment("cluster_2")},
@@ -240,7 +242,7 @@ void AdsIntegrationTest::testBasicFlow() {
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "2", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "2",
                                       {"cluster_2", "cluster_1"}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_1")},
       {buildRouteConfig("route_config_0", "cluster_1")}, {}, "2");
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "2",
@@ -255,12 +257,13 @@ void AdsIntegrationTest::testBasicFlow() {
       getRoutesConfigDump().dynamic_route_configs()[0].last_updated();
 
   // Upgrade LDS/RDS, validate we can process a request.
-  sendDiscoveryResponse<envoy::api::v2::Listener>(Config::TypeUrl::get().Listener,
-                                                  {buildListener("listener_1", "route_config_1"),
-                                                   buildListener("listener_2", "route_config_2")},
-                                                  {buildListener("listener_1", "route_config_1"),
-                                                   buildListener("listener_2", "route_config_2")},
-                                                  {"listener_0"}, "2");
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
+      Config::TypeUrl::get().Listener,
+      {buildListener("listener_1", "route_config_1"),
+       buildListener("listener_2", "route_config_2")},
+      {buildListener("listener_1", "route_config_1"),
+       buildListener("listener_2", "route_config_2")},
+      {"listener_0"}, "2");
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "2",
                                       {"route_config_2", "route_config_1", "route_config_0"},
                                       {"route_config_2", "route_config_1"}, {}));
@@ -268,7 +271,7 @@ void AdsIntegrationTest::testBasicFlow() {
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "2",
                                       {"route_config_2", "route_config_1"}, {},
                                       {"route_config_0"}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration,
       {buildRouteConfig("route_config_1", "cluster_1"),
        buildRouteConfig("route_config_2", "cluster_1")},
@@ -299,22 +302,22 @@ void AdsIntegrationTest::testBasicFlow() {
   EXPECT_GT(first_route_config_ts_3, first_route_config_ts_2);
 }
 
-envoy::admin::v2alpha::ClustersConfigDump AdsIntegrationTest::getClustersConfigDump() {
+envoy::admin::v3alpha::ClustersConfigDump AdsIntegrationTest::getClustersConfigDump() {
   auto message_ptr =
       test_server_->server().admin().getConfigTracker().getCallbacksMap().at("clusters")();
-  return dynamic_cast<const envoy::admin::v2alpha::ClustersConfigDump&>(*message_ptr);
+  return dynamic_cast<const envoy::admin::v3alpha::ClustersConfigDump&>(*message_ptr);
 }
 
-envoy::admin::v2alpha::ListenersConfigDump AdsIntegrationTest::getListenersConfigDump() {
+envoy::admin::v3alpha::ListenersConfigDump AdsIntegrationTest::getListenersConfigDump() {
   auto message_ptr =
       test_server_->server().admin().getConfigTracker().getCallbacksMap().at("listeners")();
-  return dynamic_cast<const envoy::admin::v2alpha::ListenersConfigDump&>(*message_ptr);
+  return dynamic_cast<const envoy::admin::v3alpha::ListenersConfigDump&>(*message_ptr);
 }
 
-envoy::admin::v2alpha::RoutesConfigDump AdsIntegrationTest::getRoutesConfigDump() {
+envoy::admin::v3alpha::RoutesConfigDump AdsIntegrationTest::getRoutesConfigDump() {
   auto message_ptr =
       test_server_->server().admin().getConfigTracker().getCallbacksMap().at("routes")();
-  return dynamic_cast<const envoy::admin::v2alpha::RoutesConfigDump&>(*message_ptr);
+  return dynamic_cast<const envoy::admin::v3alpha::RoutesConfigDump&>(*message_ptr);
 }
 
 } // namespace Envoy
diff --git a/test/integration/ads_integration.h b/test/integration/ads_integration.h
index 31956bd6bb12..cf5e76ef10a8 100644
--- a/test/integration/ads_integration.h
+++ b/test/integration/ads_integration.h
@@ -3,11 +3,11 @@
 #include <memory>
 #include <string>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/rds.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 
 #include "test/common/grpc/grpc_client_integration.h"
 #include "test/integration/http_integration.h"
@@ -54,19 +54,22 @@ class AdsIntegrationTest : public Grpc::DeltaSotwIntegrationParamTest, public Ht
 
   void TearDown() override;
 
-  envoy::api::v2::Cluster buildCluster(const std::string& name);
+  envoy::config::cluster::v3alpha::Cluster buildCluster(const std::string& name);
 
-  envoy::api::v2::Cluster buildRedisCluster(const std::string& name);
+  envoy::config::cluster::v3alpha::Cluster buildRedisCluster(const std::string& name);
 
-  envoy::api::v2::ClusterLoadAssignment buildClusterLoadAssignment(const std::string& name);
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment
+  buildClusterLoadAssignment(const std::string& name);
 
-  envoy::api::v2::Listener buildListener(const std::string& name, const std::string& route_config,
-                                         const std::string& stat_prefix = "ads_test");
+  envoy::config::listener::v3alpha::Listener
+  buildListener(const std::string& name, const std::string& route_config,
+                const std::string& stat_prefix = "ads_test");
 
-  envoy::api::v2::Listener buildRedisListener(const std::string& name, const std::string& cluster);
+  envoy::config::listener::v3alpha::Listener buildRedisListener(const std::string& name,
+                                                                const std::string& cluster);
 
-  envoy::api::v2::RouteConfiguration buildRouteConfig(const std::string& name,
-                                                      const std::string& cluster);
+  envoy::config::route::v3alpha::RouteConfiguration buildRouteConfig(const std::string& name,
+                                                                     const std::string& cluster);
 
   void makeSingleRequest();
 
@@ -75,9 +78,9 @@ class AdsIntegrationTest : public Grpc::DeltaSotwIntegrationParamTest, public Ht
 
   void testBasicFlow();
 
-  envoy::admin::v2alpha::ClustersConfigDump getClustersConfigDump();
-  envoy::admin::v2alpha::ListenersConfigDump getListenersConfigDump();
-  envoy::admin::v2alpha::RoutesConfigDump getRoutesConfigDump();
+  envoy::admin::v3alpha::ClustersConfigDump getClustersConfigDump();
+  envoy::admin::v3alpha::ListenersConfigDump getListenersConfigDump();
+  envoy::admin::v3alpha::RoutesConfigDump getRoutesConfigDump();
 };
 
 } // namespace Envoy
diff --git a/test/integration/ads_integration_test.cc b/test/integration/ads_integration_test.cc
index e750ef111ddb..aa89ddee597c 100644
--- a/test/integration/ads_integration_test.cc
+++ b/test/integration/ads_integration_test.cc
@@ -1,8 +1,8 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/grpc/status.h"
 
 #include "common/config/protobuf_link_hacks.h"
@@ -45,7 +45,7 @@ TEST_P(AdsIntegrationTest, Failure) {
   // Send initial configuration, failing each xDS once (via a type mismatch), validate we can
   // process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().Cluster, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
@@ -55,15 +55,15 @@ TEST_P(AdsIntegrationTest, Failure) {
       Config::TypeUrl::get().Cluster, "", {}, {}, {}, true,
       Grpc::Status::WellKnownGrpcStatus::Internal,
       fmt::format("does not match the message-wide type URL {}", Config::TypeUrl::get().Cluster)));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().ClusterLoadAssignment,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().ClusterLoadAssignment, {buildCluster("cluster_0")},
+      {buildCluster("cluster_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "1", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
@@ -71,13 +71,13 @@ TEST_P(AdsIntegrationTest, Failure) {
                                       Grpc::Status::WellKnownGrpcStatus::Internal,
                                       fmt::format("does not match the message-wide type URL {}",
                                                   Config::TypeUrl::get().ClusterLoadAssignment)));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "1",
                                       {"cluster_0"}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().Listener, {buildRouteConfig("listener_0", "route_config_0")},
       {buildRouteConfig("listener_0", "route_config_0")}, {}, "1");
 
@@ -85,13 +85,13 @@ TEST_P(AdsIntegrationTest, Failure) {
       Config::TypeUrl::get().Listener, "", {}, {}, {}, true,
       Grpc::Status::WellKnownGrpcStatus::Internal,
       fmt::format("does not match the message-wide type URL {}", Config::TypeUrl::get().Listener)));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                       {"route_config_0"}, {"route_config_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().RouteConfiguration, {buildListener("route_config_0", "cluster_0")},
       {buildListener("route_config_0", "cluster_0")}, {}, "1");
 
@@ -101,7 +101,7 @@ TEST_P(AdsIntegrationTest, Failure) {
                                       Grpc::Status::WellKnownGrpcStatus::Internal,
                                       fmt::format("does not match the message-wide type URL {}",
                                                   Config::TypeUrl::get().RouteConfiguration)));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
 
@@ -119,13 +119,13 @@ TEST_P(AdsIntegrationTest, DuplicateWarmingListeners) {
 
   // Send initial configuration, validate we can process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
@@ -133,7 +133,7 @@ TEST_P(AdsIntegrationTest, DuplicateWarmingListeners) {
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
 
   // Send duplicate listeners and validate that the update is rejected.
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener,
       {buildListener("duplicae_listener", "route_config_0"),
        buildListener("duplicae_listener", "route_config_0")},
@@ -148,16 +148,16 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsWithNoRdsChanges) {
   initialize();
 
   // Send initial configuration.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
   test_server_->waitForCounterGe("listener_manager.listener_create_success", 1);
@@ -166,13 +166,13 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsWithNoRdsChanges) {
   makeSingleRequest();
 
   // Update existing LDS (change stat_prefix).
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0", "rds_crash")},
       {buildListener("listener_0", "route_config_0", "rds_crash")}, {}, "2");
   test_server_->waitForCounterGe("listener_manager.listener_create_success", 2);
 
   // Update existing RDS (no changes).
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "2");
 
@@ -188,7 +188,7 @@ TEST_P(AdsIntegrationTest, DuplicateInitialClusters) {
   // Send initial configuration, failing each xDS once (via a type mismatch), validate we can
   // process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
       Config::TypeUrl::get().Cluster,
       {buildCluster("duplicate_cluster"), buildCluster("duplicate_cluster")},
       {buildCluster("duplicate_cluster"), buildCluster("duplicate_cluster")}, {}, "1");
@@ -203,19 +203,19 @@ TEST_P(AdsIntegrationTest, RedisClusterRemoval) {
 
   // Send initial configuration with a redis cluster and a redis proxy listener.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildRedisCluster("redis_cluster")},
-                                                 {buildRedisCluster("redis_cluster")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildRedisCluster("redis_cluster")},
+      {buildRedisCluster("redis_cluster")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"redis_cluster"}, {"redis_cluster"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("redis_cluster")},
       {buildClusterLoadAssignment("redis_cluster")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "1", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildRedisListener("listener_0", "redis_cluster")},
       {buildRedisListener("listener_0", "redis_cluster")}, {}, "1");
 
@@ -228,7 +228,7 @@ TEST_P(AdsIntegrationTest, RedisClusterRemoval) {
   test_server_->waitForCounterGe("listener_manager.listener_create_success", 1);
 
   // Now send a CDS update, removing redis cluster added above.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
       Config::TypeUrl::get().Cluster, {buildCluster("cluster_2")}, {buildCluster("cluster_2")},
       {"redis_cluster"}, "2");
 
@@ -243,19 +243,19 @@ TEST_P(AdsIntegrationTest, DuplicateWarmingClusters) {
 
   // Send initial configuration, validate we can process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "1", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
@@ -263,7 +263,7 @@ TEST_P(AdsIntegrationTest, DuplicateWarmingClusters) {
                                       {"cluster_0"}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                       {"route_config_0"}, {"route_config_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
 
@@ -275,7 +275,7 @@ TEST_P(AdsIntegrationTest, DuplicateWarmingClusters) {
   makeSingleRequest();
 
   // Send duplicate warming clusters and validate that the update is rejected.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
       Config::TypeUrl::get().Cluster,
       {buildCluster("duplicate_cluster"), buildCluster("duplicate_cluster")},
       {buildCluster("duplicate_cluster"), buildCluster("duplicate_cluster")}, {}, "2");
@@ -288,19 +288,19 @@ TEST_P(AdsIntegrationTest, CdsPausedDuringWarming) {
 
   // Send initial configuration, validate we can process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
 
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "1", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
@@ -308,7 +308,7 @@ TEST_P(AdsIntegrationTest, CdsPausedDuringWarming) {
                                       {"cluster_0"}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                       {"route_config_0"}, {"route_config_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
 
@@ -322,7 +322,7 @@ TEST_P(AdsIntegrationTest, CdsPausedDuringWarming) {
   EXPECT_FALSE(
       test_server_->server().clusterManager().adsMux()->paused(Config::TypeUrl::get().Cluster));
   // Send the first warming cluster.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
       Config::TypeUrl::get().Cluster, {buildCluster("warming_cluster_1")},
       {buildCluster("warming_cluster_1")}, {"cluster_0"}, "2");
 
@@ -334,9 +334,9 @@ TEST_P(AdsIntegrationTest, CdsPausedDuringWarming) {
                                       {"warming_cluster_1"}, {"warming_cluster_1"}, {"cluster_0"}));
 
   // Send the second warming cluster.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("warming_cluster_2")},
-                                                 {buildCluster("warming_cluster_2")}, {}, "3");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("warming_cluster_2")},
+      {buildCluster("warming_cluster_2")}, {}, "3");
   test_server_->waitForGaugeEq("cluster_manager.warming_clusters", 2);
   // We would've got a Cluster discovery request with version 2 here, had the CDS not been paused.
 
@@ -347,7 +347,7 @@ TEST_P(AdsIntegrationTest, CdsPausedDuringWarming) {
   EXPECT_TRUE(
       test_server_->server().clusterManager().adsMux()->paused(Config::TypeUrl::get().Cluster));
   // Finish warming the clusters.
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment,
       {buildClusterLoadAssignment("warming_cluster_1"),
        buildClusterLoadAssignment("warming_cluster_2")},
@@ -378,19 +378,19 @@ TEST_P(AdsIntegrationTest, ClusterWarmingOnNamedResponse) {
 
   // Send initial configuration, validate we can process a request.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
 
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "1", {}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
@@ -398,7 +398,7 @@ TEST_P(AdsIntegrationTest, ClusterWarmingOnNamedResponse) {
                                       {"cluster_0"}, {}, {}));
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                       {"route_config_0"}, {"route_config_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
 
@@ -410,7 +410,7 @@ TEST_P(AdsIntegrationTest, ClusterWarmingOnNamedResponse) {
   makeSingleRequest();
 
   // Send the first warming cluster.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
       Config::TypeUrl::get().Cluster, {buildCluster("warming_cluster_1")},
       {buildCluster("warming_cluster_1")}, {"cluster_0"}, "2");
   test_server_->waitForGaugeEq("cluster_manager.warming_clusters", 1);
@@ -419,9 +419,9 @@ TEST_P(AdsIntegrationTest, ClusterWarmingOnNamedResponse) {
                                       {"warming_cluster_1"}, {"warming_cluster_1"}, {"cluster_0"}));
 
   // Send the second warming cluster.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("warming_cluster_2")},
-                                                 {buildCluster("warming_cluster_2")}, {}, "3");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("warming_cluster_2")},
+      {buildCluster("warming_cluster_2")}, {}, "3");
   test_server_->waitForGaugeEq("cluster_manager.warming_clusters", 2);
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "1",
@@ -429,7 +429,7 @@ TEST_P(AdsIntegrationTest, ClusterWarmingOnNamedResponse) {
                                       {"warming_cluster_2"}, {}));
 
   // Finish warming the first cluster.
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment,
       {buildClusterLoadAssignment("warming_cluster_1")},
       {buildClusterLoadAssignment("warming_cluster_1")}, {}, "2");
@@ -450,7 +450,7 @@ TEST_P(AdsIntegrationTest, ClusterWarmingOnNamedResponse) {
   test_server_->waitForGaugeEq("cluster_manager.warming_clusters", 1);
 
   // Finish warming the second cluster.
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment,
       {buildClusterLoadAssignment("warming_cluster_2")},
       {buildClusterLoadAssignment("warming_cluster_2")}, {}, "3");
@@ -463,16 +463,16 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsWithRdsChange) {
   initialize();
 
   // Send initial configuration.
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
   test_server_->waitForCounterGe("listener_manager.listener_create_success", 1);
@@ -481,19 +481,19 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsWithRdsChange) {
   makeSingleRequest();
 
   // Update existing LDS (change stat_prefix).
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_1")},
-                                                 {buildCluster("cluster_1")}, {"cluster_0"}, "2");
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_1")}, {buildCluster("cluster_1")},
+      {"cluster_0"}, "2");
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_1")},
       {buildClusterLoadAssignment("cluster_1")}, {"cluster_0"}, "2");
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0", "rds_crash")},
       {buildListener("listener_0", "route_config_0", "rds_crash")}, {}, "2");
   test_server_->waitForCounterGe("listener_manager.listener_create_success", 2);
 
   // Update existing RDS (migrate traffic to cluster_1).
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_1")},
       {buildRouteConfig("route_config_0", "cluster_1")}, {}, "2");
 
@@ -513,14 +513,14 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsInvalidated) {
 
   // Initial request for any cluster, respond with cluster_0 version 1
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
 
   // Initial request for load assignment for cluster_0, respond with version 1
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
 
@@ -529,7 +529,7 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsInvalidated) {
 
   // Initial request for any listener, respond with listener_0 version 1
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
@@ -540,7 +540,7 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsInvalidated) {
   // Initial request for route_config_0 (referenced by listener_0), respond with version 1
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                       {"route_config_0"}, {"route_config_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_0", "cluster_0")},
       {buildRouteConfig("route_config_0", "cluster_0")}, {}, "1");
 
@@ -554,7 +554,7 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsInvalidated) {
   // Request for updates to listener_0 version 1, respond with version 2. Under the hood, this
   // registers RdsRouteConfigSubscription's init target with the new ListenerImpl instance.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "1", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_1")},
       {buildListener("listener_0", "route_config_1")}, {}, "2");
 
@@ -573,14 +573,14 @@ TEST_P(AdsIntegrationTest, RdsAfterLdsInvalidated) {
   // This should blow away the previous ListenerImpl instance, which is still waiting for
   // route_config_1...
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "2", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_1", "omg")},
       {buildListener("listener_0", "route_config_1", "omg")}, {}, "3");
 
   // Respond to prior request for route_config_1. Under the hood, this invokes
   // RdsRouteConfigSubscription::runInitializeCallbackIfAny, which references the defunct
   // ListenerImpl instance. We should not crash in this event!
-  sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration, {buildRouteConfig("route_config_1", "cluster_0")},
       {buildRouteConfig("route_config_1", "cluster_0")}, {"route_config_0"}, "1");
 
@@ -606,14 +606,15 @@ class AdsFailIntegrationTest : public Grpc::DeltaSotwIntegrationParamTest,
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      auto* grpc_service =
-          bootstrap.mutable_dynamic_resources()->mutable_ads_config()->add_grpc_services();
-      setGrpcService(*grpc_service, "ads_cluster", xds_upstream_->localAddress());
-      auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      ads_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
-      ads_cluster->set_name("ads_cluster");
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          auto* grpc_service =
+              bootstrap.mutable_dynamic_resources()->mutable_ads_config()->add_grpc_services();
+          setGrpcService(*grpc_service, "ads_cluster", xds_upstream_->localAddress());
+          auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          ads_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
+          ads_cluster->set_name("ads_cluster");
+        });
     setUpstreamProtocol(FakeHttpConnection::Type::HTTP2);
     HttpIntegrationTest::initialize();
   }
@@ -650,22 +651,23 @@ class AdsConfigIntegrationTest : public Grpc::DeltaSotwIntegrationParamTest,
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      auto* grpc_service =
-          bootstrap.mutable_dynamic_resources()->mutable_ads_config()->add_grpc_services();
-      setGrpcService(*grpc_service, "ads_cluster", xds_upstream_->localAddress());
-      auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      ads_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
-      ads_cluster->set_name("ads_cluster");
-
-      // Add EDS static Cluster that uses ADS as config Source.
-      auto* ads_eds_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      ads_eds_cluster->set_name("ads_eds_cluster");
-      ads_eds_cluster->set_type(envoy::api::v2::Cluster::EDS);
-      auto* eds_cluster_config = ads_eds_cluster->mutable_eds_cluster_config();
-      auto* eds_config = eds_cluster_config->mutable_eds_config();
-      eds_config->mutable_ads();
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          auto* grpc_service =
+              bootstrap.mutable_dynamic_resources()->mutable_ads_config()->add_grpc_services();
+          setGrpcService(*grpc_service, "ads_cluster", xds_upstream_->localAddress());
+          auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          ads_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
+          ads_cluster->set_name("ads_cluster");
+
+          // Add EDS static Cluster that uses ADS as config Source.
+          auto* ads_eds_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          ads_eds_cluster->set_name("ads_eds_cluster");
+          ads_eds_cluster->set_type(envoy::config::cluster::v3alpha::Cluster::EDS);
+          auto* eds_cluster_config = ads_eds_cluster->mutable_eds_cluster_config();
+          auto* eds_config = eds_cluster_config->mutable_eds_config();
+          eds_config->mutable_ads();
+        });
     setUpstreamProtocol(FakeHttpConnection::Type::HTTP2);
     HttpIntegrationTest::initialize();
   }
@@ -685,7 +687,7 @@ TEST_P(AdsConfigIntegrationTest, EdsClusterWithAdsConfigSource) {
 
 // Validates that the initial xDS request batches all resources referred to in static config
 TEST_P(AdsIntegrationTest, XdsBatching) {
-  config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     bootstrap.mutable_dynamic_resources()->clear_cds_config();
     bootstrap.mutable_dynamic_resources()->clear_lds_config();
 
@@ -705,7 +707,7 @@ TEST_P(AdsIntegrationTest, XdsBatching) {
     EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                         {"eds_cluster2", "eds_cluster"},
                                         {"eds_cluster2", "eds_cluster"}, {}, true));
-    sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+    sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
         Config::TypeUrl::get().ClusterLoadAssignment,
         {buildClusterLoadAssignment("eds_cluster"), buildClusterLoadAssignment("eds_cluster2")},
         {buildClusterLoadAssignment("eds_cluster"), buildClusterLoadAssignment("eds_cluster2")}, {},
@@ -714,7 +716,7 @@ TEST_P(AdsIntegrationTest, XdsBatching) {
     EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                         {"route_config2", "route_config"},
                                         {"route_config2", "route_config"}, {}));
-    sendDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+    sendDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
         Config::TypeUrl::get().RouteConfiguration,
         {buildRouteConfig("route_config2", "eds_cluster2"),
          buildRouteConfig("route_config", "dummy_cluster")},
@@ -732,14 +734,14 @@ TEST_P(AdsIntegrationTest, ListenerDrainBeforeServerStart) {
 
   // Initial request for cluster, response for cluster_0.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {buildCluster("cluster_0")},
-                                                 {buildCluster("cluster_0")}, {}, "1");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {buildCluster("cluster_0")}, {buildCluster("cluster_0")}, {},
+      "1");
 
   // Initial request for load assignment for cluster_0, respond with version 1
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"cluster_0"}, {"cluster_0"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("cluster_0")},
       {buildClusterLoadAssignment("cluster_0")}, {}, "1");
   // Request for updates to cluster_0 version 1, no response
@@ -747,7 +749,7 @@ TEST_P(AdsIntegrationTest, ListenerDrainBeforeServerStart) {
 
   // Initial request for any listener, respond with listener_0 version 1
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(
       Config::TypeUrl::get().Listener, {buildListener("listener_0", "route_config_0")},
       {buildListener("listener_0", "route_config_0")}, {}, "1");
 
@@ -767,8 +769,8 @@ TEST_P(AdsIntegrationTest, ListenerDrainBeforeServerStart) {
 
   // Remove listener.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Listener, "1", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Listener>(Config::TypeUrl::get().Listener, {}, {},
-                                                  {"listener_0"}, "2");
+  sendDiscoveryResponse<envoy::config::listener::v3alpha::Listener>(Config::TypeUrl::get().Listener,
+                                                                    {}, {}, {"listener_0"}, "2");
   test_server_->waitForGaugeEq("listener_manager.total_listeners_active", 0);
 }
 
@@ -792,39 +794,41 @@ class AdsClusterFromFileIntegrationTest : public Grpc::DeltaSotwIntegrationParam
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      auto* grpc_service =
-          bootstrap.mutable_dynamic_resources()->mutable_ads_config()->add_grpc_services();
-      setGrpcService(*grpc_service, "ads_cluster", xds_upstream_->localAddress());
-      // Define ADS cluster
-      auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      ads_cluster->set_name("ads_cluster");
-      ads_cluster->mutable_http2_protocol_options();
-      ads_cluster->set_type(envoy::api::v2::Cluster::EDS);
-      auto* ads_cluster_config = ads_cluster->mutable_eds_cluster_config();
-      auto* ads_cluster_eds_config = ads_cluster_config->mutable_eds_config();
-      // Define port of ADS cluster
-      TestEnvironment::PortMap port_map_;
-      port_map_["upstream_0"] = xds_upstream_->localAddress()->ip()->port();
-      // Path to EDS for ads_cluster
-      const std::string eds_path = TestEnvironment::temporaryFileSubstitute(
-          "test/config/integration/server_xds.eds.ads_cluster.yaml", port_map_, version_);
-      ads_cluster_eds_config->set_path(eds_path);
-
-      // Add EDS static Cluster that uses ADS as config Source.
-      auto* ads_eds_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      ads_eds_cluster->set_name("ads_eds_cluster");
-      ads_eds_cluster->set_type(envoy::api::v2::Cluster::EDS);
-      auto* eds_cluster_config = ads_eds_cluster->mutable_eds_cluster_config();
-      auto* eds_config = eds_cluster_config->mutable_eds_config();
-      eds_config->mutable_ads();
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          auto* grpc_service =
+              bootstrap.mutable_dynamic_resources()->mutable_ads_config()->add_grpc_services();
+          setGrpcService(*grpc_service, "ads_cluster", xds_upstream_->localAddress());
+          // Define ADS cluster
+          auto* ads_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          ads_cluster->set_name("ads_cluster");
+          ads_cluster->mutable_http2_protocol_options();
+          ads_cluster->set_type(envoy::config::cluster::v3alpha::Cluster::EDS);
+          auto* ads_cluster_config = ads_cluster->mutable_eds_cluster_config();
+          auto* ads_cluster_eds_config = ads_cluster_config->mutable_eds_config();
+          // Define port of ADS cluster
+          TestEnvironment::PortMap port_map_;
+          port_map_["upstream_0"] = xds_upstream_->localAddress()->ip()->port();
+          // Path to EDS for ads_cluster
+          const std::string eds_path = TestEnvironment::temporaryFileSubstitute(
+              "test/config/integration/server_xds.eds.ads_cluster.yaml", port_map_, version_);
+          ads_cluster_eds_config->set_path(eds_path);
+
+          // Add EDS static Cluster that uses ADS as config Source.
+          auto* ads_eds_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          ads_eds_cluster->set_name("ads_eds_cluster");
+          ads_eds_cluster->set_type(envoy::config::cluster::v3alpha::Cluster::EDS);
+          auto* eds_cluster_config = ads_eds_cluster->mutable_eds_cluster_config();
+          auto* eds_config = eds_cluster_config->mutable_eds_config();
+          eds_config->mutable_ads();
+        });
     setUpstreamProtocol(FakeHttpConnection::Type::HTTP2);
     HttpIntegrationTest::initialize();
   }
 
-  envoy::api::v2::ClusterLoadAssignment buildClusterLoadAssignment(const std::string& name) {
-    return TestUtility::parseYaml<envoy::api::v2::ClusterLoadAssignment>(
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment
+  buildClusterLoadAssignment(const std::string& name) {
+    return TestUtility::parseYaml<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
         fmt::format(R"EOF(
       cluster_name: {}
       endpoints:
@@ -853,7 +857,7 @@ TEST_P(AdsClusterFromFileIntegrationTest, BasicTestWidsAdsEndpointLoadedFromFile
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().ClusterLoadAssignment, "",
                                       {"ads_eds_cluster"}, {"ads_eds_cluster"}, {}));
-  sendDiscoveryResponse<envoy::api::v2::ClusterLoadAssignment>(
+  sendDiscoveryResponse<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
       Config::TypeUrl::get().ClusterLoadAssignment, {buildClusterLoadAssignment("ads_eds_cluster")},
       {buildClusterLoadAssignment("ads_eds_cluster")}, {}, "1");
 
diff --git a/test/integration/cds_integration_test.cc b/test/integration/cds_integration_test.cc
index 4c8f7184f53d..54418e70e170 100644
--- a/test/integration/cds_integration_test.cc
+++ b/test/integration/cds_integration_test.cc
@@ -1,6 +1,6 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/grpc/status.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/config/protobuf_link_hacks.h"
@@ -92,8 +92,8 @@ class CdsIntegrationTest : public Grpc::DeltaSotwIntegrationParamTest, public Ht
 
     // Do the initial compareDiscoveryRequest / sendDiscoveryResponse for cluster_1.
     EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "", {}, {}, {}, true));
-    sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster1_},
-                                                   {cluster1_}, {}, "55");
+    sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+        Config::TypeUrl::get().Cluster, {cluster1_}, {cluster1_}, {}, "55");
 
     // We can continue the test once we're sure that Envoy's ClusterManager has made use of
     // the DiscoveryResponse describing cluster_1 that we sent.
@@ -128,8 +128,8 @@ class CdsIntegrationTest : public Grpc::DeltaSotwIntegrationParamTest, public Ht
     fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
   }
 
-  envoy::api::v2::Cluster cluster1_;
-  envoy::api::v2::Cluster cluster2_;
+  envoy::config::cluster::v3alpha::Cluster cluster1_;
+  envoy::config::cluster::v3alpha::Cluster cluster2_;
   // True if we decided not to run the test after all.
   bool test_skipped_{true};
 };
@@ -150,8 +150,8 @@ TEST_P(CdsIntegrationTest, CdsClusterUpDownUp) {
 
   // Tell Envoy that cluster_1 is gone.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "55", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {}, {},
-                                                 {ClusterName1}, "42");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(Config::TypeUrl::get().Cluster,
+                                                                  {}, {}, {ClusterName1}, "42");
   // We can continue the test once we're sure that Envoy's ClusterManager has made use of
   // the DiscoveryResponse that says cluster_1 is gone.
   test_server_->waitForCounterGe("cluster_manager.cluster_removed", 1);
@@ -167,8 +167,8 @@ TEST_P(CdsIntegrationTest, CdsClusterUpDownUp) {
 
   // Tell Envoy that cluster_1 is back.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "42", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster1_},
-                                                 {cluster1_}, {}, "413");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster1_}, {cluster1_}, {}, "413");
 
   // We can continue the test once we're sure that Envoy's ClusterManager has made use of
   // the DiscoveryResponse describing cluster_1 that we sent. Again, 2 includes CDS server.
@@ -190,8 +190,8 @@ TEST_P(CdsIntegrationTest, TwoClusters) {
 
   // Tell Envoy that cluster_2 is here.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "55", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {cluster1_, cluster2_}, {cluster2_}, {}, "42");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster1_, cluster2_}, {cluster2_}, {}, "42");
   // The '3' includes the fake CDS server.
   test_server_->waitForGaugeGe("cluster_manager.active_clusters", 3);
 
@@ -202,8 +202,8 @@ TEST_P(CdsIntegrationTest, TwoClusters) {
 
   // Tell Envoy that cluster_1 is gone.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "42", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster2_}, {},
-                                                 {ClusterName1}, "42");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster2_}, {}, {ClusterName1}, "42");
   // We can continue the test once we're sure that Envoy's ClusterManager has made use of
   // the DiscoveryResponse that says cluster_1 is gone.
   test_server_->waitForCounterGe("cluster_manager.cluster_removed", 1);
@@ -215,8 +215,8 @@ TEST_P(CdsIntegrationTest, TwoClusters) {
 
   // Tell Envoy that cluster_1 is back.
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Cluster, "42", {}, {}, {}));
-  sendDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster,
-                                                 {cluster1_, cluster2_}, {cluster1_}, {}, "413");
+  sendDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster1_, cluster2_}, {cluster1_}, {}, "413");
 
   // We can continue the test once we're sure that Envoy's ClusterManager has made use of
   // the DiscoveryResponse describing cluster_1 that we sent. Again, 3 includes CDS server.
@@ -248,7 +248,7 @@ TEST_P(CdsIntegrationTest, VersionsRememberedAfterReconnect) {
   acceptXdsConnection();
 
   // Upon reconnecting, the Envoy should tell us its current resource versions.
-  envoy::api::v2::DeltaDiscoveryRequest request;
+  envoy::service::discovery::v3alpha::DeltaDiscoveryRequest request;
   result = xds_stream_->waitForGrpcMessage(*dispatcher_, request);
   RELEASE_ASSERT(result, result.message());
   const auto& initial_resource_versions = request.initial_resource_versions();
@@ -257,8 +257,8 @@ TEST_P(CdsIntegrationTest, VersionsRememberedAfterReconnect) {
 
   // Tell Envoy that cluster_2 is here. This update does *not* need to include cluster_1,
   // which Envoy should already know about despite the disconnect.
-  sendDeltaDiscoveryResponse<envoy::api::v2::Cluster>(Config::TypeUrl::get().Cluster, {cluster2_},
-                                                      {}, "42");
+  sendDeltaDiscoveryResponse<envoy::config::cluster::v3alpha::Cluster>(
+      Config::TypeUrl::get().Cluster, {cluster2_}, {}, "42");
   // The '3' includes the fake CDS server.
   test_server_->waitForGaugeGe("cluster_manager.active_clusters", 3);
 
diff --git a/test/integration/cluster_filter_integration_test.cc b/test/integration/cluster_filter_integration_test.cc
index 4f63cfe2d81f..ebce95d0121b 100644
--- a/test/integration/cluster_filter_integration_test.cc
+++ b/test/integration/cluster_filter_integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/network/filter.h"
 #include "envoy/registry/registry.h"
 
@@ -85,7 +85,7 @@ class ClusterFilterIntegrationTest : public testing::TestWithParam<Network::Addr
 
   void initialize() override {
     enable_half_close_ = true;
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
       auto* filter = cluster_0->add_filters();
       filter->set_name("envoy.upstream.polite");
diff --git a/test/integration/clusters/BUILD b/test/integration/clusters/BUILD
index 3c3236c93cac..a039b89d5edf 100644
--- a/test/integration/clusters/BUILD
+++ b/test/integration/clusters/BUILD
@@ -32,9 +32,9 @@ envoy_cc_test_library(
         "//test/common/upstream:utility_lib",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/endpoint:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/integration/clusters/custom_static_cluster.cc b/test/integration/clusters/custom_static_cluster.cc
index 97231e7935d0..5110968c8c26 100644
--- a/test/integration/clusters/custom_static_cluster.cc
+++ b/test/integration/clusters/custom_static_cluster.cc
@@ -1,8 +1,8 @@
 #include "custom_static_cluster.h"
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 
 namespace Envoy {
 
@@ -24,9 +24,9 @@ Upstream::HostSharedPtr CustomStaticCluster::makeHost() {
       Network::Utility::parseInternetAddress(address_, port_, true);
   return Upstream::HostSharedPtr{new Upstream::HostImpl(
       info(), "", address, info()->metadata(), 1,
-      envoy::api::v2::core::Locality::default_instance(),
-      envoy::api::v2::endpoint::Endpoint::HealthCheckConfig::default_instance(), priority_,
-      envoy::api::v2::core::HealthStatus::UNKNOWN)};
+      envoy::config::core::v3alpha::Locality::default_instance(),
+      envoy::config::endpoint::v3alpha::Endpoint::HealthCheckConfig::default_instance(), priority_,
+      envoy::config::core::v3alpha::UNKNOWN)};
 }
 
 Upstream::ThreadAwareLoadBalancerPtr CustomStaticCluster::threadAwareLb() {
diff --git a/test/integration/clusters/custom_static_cluster.h b/test/integration/clusters/custom_static_cluster.h
index 38127455be34..918edd7077db 100644
--- a/test/integration/clusters/custom_static_cluster.h
+++ b/test/integration/clusters/custom_static_cluster.h
@@ -5,7 +5,7 @@
 #include <vector>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/http/codec.h"
 #include "envoy/upstream/cluster_manager.h"
 
@@ -23,7 +23,8 @@ namespace Envoy {
 
 class CustomStaticCluster : public Upstream::ClusterImplBase {
 public:
-  CustomStaticCluster(const envoy::api::v2::Cluster& cluster, Runtime::Loader& runtime,
+  CustomStaticCluster(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                      Runtime::Loader& runtime,
                       Server::Configuration::TransportSocketFactoryContext& factory_context,
                       Stats::ScopePtr&& stats_scope, bool added_via_api, uint32_t priority,
                       std::string address, uint32_t port)
@@ -86,7 +87,7 @@ class CustomStaticClusterFactoryBase : public Upstream::ConfigurableClusterFacto
 private:
   std::pair<Upstream::ClusterImplBaseSharedPtr, Upstream::ThreadAwareLoadBalancerPtr>
   createClusterWithConfig(
-      const envoy::api::v2::Cluster& cluster,
+      const envoy::config::cluster::v3alpha::Cluster& cluster,
       const test::integration::clusters::CustomStaticConfig& proto_config,
       Upstream::ClusterFactoryContext& context,
       Server::Configuration::TransportSocketFactoryContext& socket_factory_context,
diff --git a/test/integration/custom_cluster_integration_test.cc b/test/integration/custom_cluster_integration_test.cc
index 504e18f42b88..d092870e5e41 100644
--- a/test/integration/custom_cluster_integration_test.cc
+++ b/test/integration/custom_cluster_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/upstream/load_balancer_impl.h"
@@ -24,26 +24,27 @@ class CustomClusterIntegrationTest : public testing::TestWithParam<Network::Addr
   void initialize() override {
     setUpstreamCount(1);
     // change the configuration of the cluster_0 to a custom static cluster
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
-
-      cluster_0->clear_hosts();
-
-      if (cluster_provided_lb_) {
-        cluster_0->set_lb_policy(envoy::api::v2::Cluster::CLUSTER_PROVIDED);
-      }
-
-      envoy::api::v2::Cluster_CustomClusterType cluster_type;
-      cluster_type.set_name(cluster_provided_lb_ ? "envoy.clusters.custom_static_with_lb"
-                                                 : "envoy.clusters.custom_static");
-      test::integration::clusters::CustomStaticConfig config;
-      config.set_priority(10);
-      config.set_address(Network::Test::getLoopbackAddressString(ipVersion()));
-      config.set_port_value(fake_upstreams_[UpstreamIndex]->localAddress()->ip()->port());
-      cluster_type.mutable_typed_config()->PackFrom(config);
-
-      cluster_0->mutable_cluster_type()->CopyFrom(cluster_type);
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
+
+          cluster_0->clear_hosts();
+
+          if (cluster_provided_lb_) {
+            cluster_0->set_lb_policy(envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED);
+          }
+
+          envoy::config::cluster::v3alpha::Cluster::CustomClusterType cluster_type;
+          cluster_type.set_name(cluster_provided_lb_ ? "envoy.clusters.custom_static_with_lb"
+                                                     : "envoy.clusters.custom_static");
+          test::integration::clusters::CustomStaticConfig config;
+          config.set_priority(10);
+          config.set_address(Network::Test::getLoopbackAddressString(ipVersion()));
+          config.set_port_value(fake_upstreams_[UpstreamIndex]->localAddress()->ip()->port());
+          cluster_type.mutable_typed_config()->PackFrom(config);
+
+          cluster_0->mutable_cluster_type()->CopyFrom(cluster_type);
+        });
     HttpIntegrationTest::initialize();
     test_server_->waitForGaugeGe("cluster_manager.active_clusters", 1);
   }
diff --git a/test/integration/dynamic_validation_integration_test.cc b/test/integration/dynamic_validation_integration_test.cc
index 6e80fcb674d3..a78c692be27f 100644
--- a/test/integration/dynamic_validation_integration_test.cc
+++ b/test/integration/dynamic_validation_integration_test.cc
@@ -1,7 +1,7 @@
 #include <fstream>
 
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
-#include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.validate.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.validate.h"
 
 #include "extensions/filters/network/common/factory_base.h"
 
@@ -23,22 +23,22 @@ class TestDynamicValidationNetworkFilter : public Network::WriteFilter {
 
 class TestDynamicValidationNetworkFilterConfigFactory
     : public Extensions::NetworkFilters::Common::FactoryBase<
-          envoy::config::filter::network::tcp_proxy::v2::TcpProxy> {
+          envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy> {
 public:
   TestDynamicValidationNetworkFilterConfigFactory()
       : Extensions::NetworkFilters::Common::FactoryBase<
-            envoy::config::filter::network::tcp_proxy::v2::TcpProxy>(
+            envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy>(
             "envoy.test.dynamic_validation") {}
 
 private:
   Network::FilterFactoryCb createFilterFactoryFromProtoTyped(
-      const envoy::config::filter::network::tcp_proxy::v2::TcpProxy& /*proto_config*/,
+      const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy& /*proto_config*/,
       Server::Configuration::FactoryContext& /*context*/) override {
     return Network::FilterFactoryCb();
   }
 
   Upstream::ProtocolOptionsConfigConstSharedPtr createProtocolOptionsTyped(
-      const envoy::config::filter::network::tcp_proxy::v2::TcpProxy&) override {
+      const envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy&) override {
     return nullptr;
   }
 };
diff --git a/test/integration/eds_integration_test.cc b/test/integration/eds_integration_test.cc
index c6a62be4bbfa..120b110022c8 100644
--- a/test/integration/eds_integration_test.cc
+++ b/test/integration/eds_integration_test.cc
@@ -1,9 +1,9 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/type/http.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/type/v3alpha/http.pb.h"
 
 #include "common/upstream/load_balancer_impl.h"
 
@@ -23,13 +23,13 @@ class EdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
 public:
   EdsIntegrationTest()
       : HttpIntegrationTest(Http::CodecClient::Type::HTTP1, GetParam()),
-        codec_client_type_(envoy::type::HTTP1) {}
+        codec_client_type_(envoy::type::v3alpha::HTTP1) {}
 
   // We need to supply the endpoints via EDS to provide health status. Use a
   // filesystem delivery to simplify test mechanics.
   void setEndpointsInPriorities(uint32_t first_priority, uint32_t second_priority,
                                 bool await_update = true) {
-    envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
     cluster_load_assignment.set_cluster_name("cluster_0");
 
     {
@@ -63,7 +63,7 @@ class EdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
                     absl::optional<uint32_t> overprovisioning_factor = absl::nullopt,
                     bool await_update = true) {
     ASSERT(total_endpoints >= healthy_endpoints + degraded_endpoints);
-    envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
     cluster_load_assignment.set_cluster_name("cluster_0");
     if (overprovisioning_factor.has_value()) {
       cluster_load_assignment.mutable_policy()->mutable_overprovisioning_factor()->set_value(
@@ -77,11 +77,10 @@ class EdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
       // First N endpoints are degraded, next M are healthy and the remaining endpoints are
       // unhealthy or unknown depending on remaining_unhealthy.
       if (i < degraded_endpoints) {
-        endpoint->set_health_status(envoy::api::v2::core::HealthStatus::DEGRADED);
+        endpoint->set_health_status(envoy::config::core::v3alpha::DEGRADED);
       } else if (i >= healthy_endpoints + degraded_endpoints) {
-        endpoint->set_health_status(remaining_unhealthy
-                                        ? envoy::api::v2::core::HealthStatus::UNHEALTHY
-                                        : envoy::api::v2::core::HealthStatus::UNKNOWN);
+        endpoint->set_health_status(remaining_unhealthy ? envoy::config::core::v3alpha::UNHEALTHY
+                                                        : envoy::config::core::v3alpha::UNKNOWN);
       }
     }
 
@@ -94,10 +93,11 @@ class EdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
 
   void initializeTest(bool http_active_hc) {
     setUpstreamCount(4);
-    if (codec_client_type_ == envoy::type::HTTP2) {
+    if (codec_client_type_ == envoy::type::v3alpha::HTTP2) {
       setUpstreamProtocol(FakeHttpConnection::Type::HTTP2);
     }
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       // Switch predefined cluster_0 to CDS filesystem sourcing.
       bootstrap.mutable_dynamic_resources()->mutable_cds_config()->set_path(cds_helper_.cds_path());
       bootstrap.mutable_static_resources()->clear_clusters();
@@ -105,14 +105,16 @@ class EdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
 
     // Set validate_clusters to false to allow us to reference a CDS cluster.
     config_helper_.addConfigModifier(
-        [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-               hcm) { hcm.mutable_route_config()->mutable_validate_clusters()->set_value(false); });
+        [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+               HttpConnectionManager& hcm) {
+          hcm.mutable_route_config()->mutable_validate_clusters()->set_value(false);
+        });
 
     cluster_.mutable_connect_timeout()->CopyFrom(
         Protobuf::util::TimeUtil::MillisecondsToDuration(100));
     cluster_.set_name("cluster_0");
     cluster_.mutable_hosts()->Clear();
-    cluster_.set_type(envoy::api::v2::Cluster::EDS);
+    cluster_.set_type(envoy::config::cluster::v3alpha::Cluster::EDS);
     auto* eds_cluster_config = cluster_.mutable_eds_cluster_config();
     eds_cluster_config->mutable_eds_config()->set_path(eds_helper_.eds_path());
     if (http_active_hc) {
@@ -134,10 +136,10 @@ class EdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     test_server_->waitForGaugeEq("cluster_manager.warming_clusters", 0);
   }
 
-  envoy::type::CodecClientType codec_client_type_{};
+  envoy::type::v3alpha::CodecClientType codec_client_type_{};
   EdsHelper eds_helper_;
   CdsHelper cds_helper_;
-  envoy::api::v2::Cluster cluster_;
+  envoy::config::cluster::v3alpha::Cluster cluster_;
 };
 
 INSTANTIATE_TEST_SUITE_P(IpVersions, EdsIntegrationTest,
@@ -146,7 +148,7 @@ INSTANTIATE_TEST_SUITE_P(IpVersions, EdsIntegrationTest,
 // Validates that endpoints can be added and then moved to other priorities without causing crashes.
 // Primarily as a regression test for https://github.com/envoyproxy/envoy/issues/8764
 TEST_P(EdsIntegrationTest, Http2UpdatePriorities) {
-  codec_client_type_ = envoy::type::HTTP2;
+  codec_client_type_ = envoy::type::v3alpha::HTTP2;
   initializeTest(true);
 
   fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
@@ -164,7 +166,7 @@ TEST_P(EdsIntegrationTest, Http2UpdatePriorities) {
 // Verifies that a new cluster can we warmed when using HTTP/2 health checking. Regression test
 // of the issue detailed in issue #6951.
 TEST_P(EdsIntegrationTest, Http2HcClusterRewarming) {
-  codec_client_type_ = envoy::type::HTTP2;
+  codec_client_type_ = envoy::type::v3alpha::HTTP2;
   initializeTest(true);
   fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
   setEndpoints(1, 0, 0, false);
@@ -362,7 +364,7 @@ TEST_P(EdsIntegrationTest, BatchMemberUpdateCb) {
     member_update_count++;
   });
 
-  envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+  envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
   cluster_load_assignment.set_cluster_name("cluster_0");
 
   {
diff --git a/test/integration/fake_upstream.h b/test/integration/fake_upstream.h
index 764f3349ab38..8ce5a2c57f70 100644
--- a/test/integration/fake_upstream.h
+++ b/test/integration/fake_upstream.h
@@ -6,7 +6,7 @@
 #include <string>
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/event/timer.h"
 #include "envoy/grpc/status.h"
 #include "envoy/http/codec.h"
@@ -677,8 +677,8 @@ class FakeUpstream : Logger::Loggable<Logger::Id::testing>,
       return udp_listener_factory_.get();
     }
     Network::ConnectionBalancer& connectionBalancer() override { return connection_balancer_; }
-    envoy::api::v2::core::TrafficDirection direction() const override {
-      return envoy::api::v2::core::TrafficDirection::UNSPECIFIED;
+    envoy::config::core::v3alpha::TrafficDirection direction() const override {
+      return envoy::config::core::v3alpha::UNSPECIFIED;
     }
 
     FakeUpstream& parent_;
diff --git a/test/integration/filter_manager_integration_test.cc b/test/integration/filter_manager_integration_test.cc
index 7ff2cf3e6835..782c99f4eae0 100644
--- a/test/integration/filter_manager_integration_test.cc
+++ b/test/integration/filter_manager_integration_test.cc
@@ -2,7 +2,7 @@
 
 #include <regex>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "test/integration/http_integration.h"
 #include "test/integration/integration.h"
@@ -75,10 +75,11 @@ class TestWithAuxiliaryFilter {
                                                 auxiliary_filter_name_) +
                                         filterConfig(auxiliary_filter_name_));
     // double-check the filter was actually added
-    config_helper.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      ASSERT_EQ(auxiliary_filter_name_,
-                bootstrap.static_resources().listeners(0).filter_chains(0).filters(0).name());
-    });
+    config_helper.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          ASSERT_EQ(auxiliary_filter_name_,
+                    bootstrap.static_resources().listeners(0).filter_chains(0).filters(0).name());
+        });
   }
 
   /**
@@ -88,7 +89,7 @@ class TestWithAuxiliaryFilter {
    */
   void addNetworkFilter(ConfigHelper& config_helper, const std::string& filter_yaml) {
     config_helper.addConfigModifier(
-        [filter_yaml](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+        [filter_yaml](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
           ASSERT_GT(bootstrap.mutable_static_resources()->listeners_size(), 0);
           auto l = bootstrap.mutable_static_resources()->mutable_listeners(0);
           ASSERT_GT(l->filter_chains_size(), 0);
diff --git a/test/integration/h1_capture_direct_response_fuzz_test.cc b/test/integration/h1_capture_direct_response_fuzz_test.cc
index 42a637b270e4..5a6e7c3e6c40 100644
--- a/test/integration/h1_capture_direct_response_fuzz_test.cc
+++ b/test/integration/h1_capture_direct_response_fuzz_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/h1_fuzz.h"
 
@@ -10,9 +10,8 @@ void H1FuzzIntegrationTest::initialize() {
   const std::string prefix("/");
   const Http::Code status(Http::Code::OK);
   config_helper_.addConfigModifier(
-      [&file_path, &prefix](
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&file_path, &prefix](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                                HttpConnectionManager& hcm) -> void {
         auto* route_config = hcm.mutable_route_config();
         // adding direct response mode to the default route
         auto* default_route =
diff --git a/test/integration/hds_integration_test.cc b/test/integration/hds_integration_test.cc
index 4a3c01777238..61e8b7ba99c7 100644
--- a/test/integration/hds_integration_test.cc
+++ b/test/integration/hds_integration_test.cc
@@ -1,9 +1,9 @@
 #include <memory>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/core/health_check.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/service/discovery/v2/hds.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/core/v3alpha/health_check.pb.h"
+#include "envoy/service/health/v3alpha/hds.pb.h"
 #include "envoy/upstream/upstream.h"
 
 #include "common/config/metadata.h"
@@ -41,10 +41,10 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
 
   void initialize() override {
     setUpstreamCount(upstream_endpoints_);
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       // Setup hds and corresponding gRPC cluster.
       auto* hds_config = bootstrap.mutable_hds_config();
-      hds_config->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+      hds_config->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
       hds_config->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("hds_cluster");
       auto* hds_cluster = bootstrap.mutable_static_resources()->add_clusters();
       hds_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
@@ -124,8 +124,8 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
 
   // Creates a basic HealthCheckSpecifier message containing one endpoint and
   // one HTTP health_check
-  envoy::service::discovery::v2::HealthCheckSpecifier makeHttpHealthCheckSpecifier() {
-    envoy::service::discovery::v2::HealthCheckSpecifier server_health_check_specifier_;
+  envoy::service::health::v3alpha::HealthCheckSpecifier makeHttpHealthCheckSpecifier() {
+    envoy::service::health::v3alpha::HealthCheckSpecifier server_health_check_specifier_;
     server_health_check_specifier_.mutable_interval()->set_nanos(100000000); // 0.1 seconds
 
     auto* health_check = server_health_check_specifier_.add_cluster_health_checks();
@@ -143,7 +143,9 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     health_check->mutable_health_checks(0)->mutable_unhealthy_threshold()->set_value(2);
     health_check->mutable_health_checks(0)->mutable_healthy_threshold()->set_value(2);
     health_check->mutable_health_checks(0)->mutable_grpc_health_check();
-    health_check->mutable_health_checks(0)->mutable_http_health_check()->set_use_http2(false);
+    health_check->mutable_health_checks(0)
+        ->mutable_http_health_check()
+        ->set_hidden_envoy_deprecated_use_http2(false);
     health_check->mutable_health_checks(0)->mutable_http_health_check()->set_path("/healthcheck");
 
     return server_health_check_specifier_;
@@ -151,8 +153,8 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
 
   // Creates a basic HealthCheckSpecifier message containing one endpoint and
   // one TCP health_check
-  envoy::service::discovery::v2::HealthCheckSpecifier makeTcpHealthCheckSpecifier() {
-    envoy::service::discovery::v2::HealthCheckSpecifier server_health_check_specifier_;
+  envoy::service::health::v3alpha::HealthCheckSpecifier makeTcpHealthCheckSpecifier() {
+    envoy::service::health::v3alpha::HealthCheckSpecifier server_health_check_specifier_;
     server_health_check_specifier_.mutable_interval()->set_nanos(100000000); // 0.1 seconds
 
     auto* health_check = server_health_check_specifier_.add_cluster_health_checks();
@@ -177,8 +179,8 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
   }
 
   // Checks if Envoy reported the health status of an endpoint correctly
-  bool checkEndpointHealthResponse(envoy::service::discovery::v2::EndpointHealth endpoint,
-                                   envoy::api::v2::core::HealthStatus healthy,
+  bool checkEndpointHealthResponse(envoy::service::health::v3alpha::EndpointHealth endpoint,
+                                   envoy::config::core::v3alpha::HealthStatus healthy,
                                    Network::Address::InstanceConstSharedPtr address) {
 
     if (healthy != endpoint.health_status()) {
@@ -202,7 +204,7 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
     EXPECT_EQ(failures, test_server_->counter("cluster.anna.health_check.failure")->value());
   }
 
-  void waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus healthy) {
+  void waitForEndpointHealthResponse(envoy::config::core::v3alpha::HealthStatus healthy) {
     ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
     while (!checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(0),
                                         healthy, host_upstream_->localAddress())) {
@@ -225,9 +227,9 @@ class HdsIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
   FakeRawConnectionPtr host_fake_raw_connection_;
 
   static constexpr int MaxTimeout = 100;
-  envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse envoy_msg_;
-  envoy::service::discovery::v2::HealthCheckRequestOrEndpointHealthResponse response_;
-  envoy::service::discovery::v2::HealthCheckSpecifier server_health_check_specifier_;
+  envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse envoy_msg_;
+  envoy::service::health::v3alpha::HealthCheckRequestOrEndpointHealthResponse response_;
+  envoy::service::health::v3alpha::HealthCheckSpecifier server_health_check_specifier_;
 };
 
 INSTANTIATE_TEST_SUITE_P(IpVersions, HdsIntegrationTest,
@@ -243,7 +245,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointHealthyHttp) {
   waitForHdsStream();
   ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, envoy_msg_));
   EXPECT_EQ(envoy_msg_.health_check_request().capability().health_check_protocols(0),
-            envoy::service::discovery::v2::Capability::HTTP);
+            envoy::service::health::v3alpha::Capability::HTTP);
 
   // Server asks for health checking
   server_health_check_specifier_ = makeHttpHealthCheckSpecifier();
@@ -259,7 +261,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointHealthyHttp) {
   host_stream_->encodeData(1024, true);
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::HEALTHY);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::HEALTHY);
 
   checkCounters(1, 2, 1, 0);
 
@@ -298,7 +300,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointTimeoutHttp) {
   // Endpoint doesn't respond to the health check
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::TIMEOUT);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::TIMEOUT);
 
   checkCounters(1, 2, 0, 1);
 
@@ -330,7 +332,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointUnhealthyHttp) {
   host_stream_->encodeData(1024, true);
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::UNHEALTHY);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::UNHEALTHY);
 
   checkCounters(1, 2, 0, 1);
 
@@ -348,7 +350,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointTimeoutTcp) {
   waitForHdsStream();
   ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, envoy_msg_));
   EXPECT_EQ(envoy_msg_.health_check_request().capability().health_check_protocols(1),
-            envoy::service::discovery::v2::Capability::TCP);
+            envoy::service::health::v3alpha::Capability::TCP);
 
   // Server asks for health checking
   server_health_check_specifier_ = makeTcpHealthCheckSpecifier();
@@ -374,7 +376,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointTimeoutTcp) {
   // No response from the endpoint
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::TIMEOUT);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::TIMEOUT);
 
   // Clean up connections
   cleanupHostConnections();
@@ -405,7 +407,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointHealthyTcp) {
   RELEASE_ASSERT(result, result.message());
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::HEALTHY);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::HEALTHY);
 
   // Clean up connections
   cleanupHostConnections();
@@ -440,7 +442,7 @@ TEST_P(HdsIntegrationTest, SingleEndpointUnhealthyTcp) {
   RELEASE_ASSERT(result, result.message());
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::UNHEALTHY);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::UNHEALTHY);
 
   // Clean up connections
   cleanupHostConnections();
@@ -479,10 +481,10 @@ TEST_P(HdsIntegrationTest, TwoEndpointsSameLocality) {
   // Receive updates until the one we expect arrives
   ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   while (!(checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(0),
-                                       envoy::api::v2::core::HealthStatus::UNHEALTHY,
+                                       envoy::config::core::v3alpha::UNHEALTHY,
                                        host_upstream_->localAddress()) &&
            checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(1),
-                                       envoy::api::v2::core::HealthStatus::HEALTHY,
+                                       envoy::config::core::v3alpha::HEALTHY,
                                        host2_upstream_->localAddress()))) {
     ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   }
@@ -531,10 +533,10 @@ TEST_P(HdsIntegrationTest, TwoEndpointsDifferentLocality) {
   // Receive updates until the one we expect arrives
   ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   while (!(checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(0),
-                                       envoy::api::v2::core::HealthStatus::UNHEALTHY,
+                                       envoy::config::core::v3alpha::UNHEALTHY,
                                        host_upstream_->localAddress()) &&
            checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(1),
-                                       envoy::api::v2::core::HealthStatus::HEALTHY,
+                                       envoy::config::core::v3alpha::HEALTHY,
                                        host2_upstream_->localAddress()))) {
     ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   }
@@ -568,7 +570,9 @@ TEST_P(HdsIntegrationTest, TwoEndpointsDifferentClusters) {
   health_check->mutable_health_checks(0)->mutable_unhealthy_threshold()->set_value(2);
   health_check->mutable_health_checks(0)->mutable_healthy_threshold()->set_value(2);
   health_check->mutable_health_checks(0)->mutable_grpc_health_check();
-  health_check->mutable_health_checks(0)->mutable_http_health_check()->set_use_http2(false);
+  health_check->mutable_health_checks(0)
+      ->mutable_http_health_check()
+      ->set_hidden_envoy_deprecated_use_http2(false);
   health_check->mutable_health_checks(0)->mutable_http_health_check()->set_path("/healthcheck");
 
   // Server <--> Envoy
@@ -592,10 +596,10 @@ TEST_P(HdsIntegrationTest, TwoEndpointsDifferentClusters) {
   // Receive updates until the one we expect arrives
   ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   while (!(checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(0),
-                                       envoy::api::v2::core::HealthStatus::UNHEALTHY,
+                                       envoy::config::core::v3alpha::UNHEALTHY,
                                        host_upstream_->localAddress()) &&
            checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(1),
-                                       envoy::api::v2::core::HealthStatus::HEALTHY,
+                                       envoy::config::core::v3alpha::HEALTHY,
                                        host2_upstream_->localAddress()))) {
     ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   }
@@ -632,14 +636,14 @@ TEST_P(HdsIntegrationTest, TestUpdateMessage) {
   host_stream_->encodeData(1024, true);
 
   // Receive updates until the one we expect arrives
-  waitForEndpointHealthResponse(envoy::api::v2::core::HealthStatus::HEALTHY);
+  waitForEndpointHealthResponse(envoy::config::core::v3alpha::HEALTHY);
 
   checkCounters(1, 2, 1, 0);
 
   cleanupHostConnections();
 
   // New HealthCheckSpecifier message
-  envoy::service::discovery::v2::HealthCheckSpecifier new_message;
+  envoy::service::health::v3alpha::HealthCheckSpecifier new_message;
   new_message.mutable_interval()->set_nanos(100000000); // 0.1 seconds
 
   auto* health_check = new_message.add_cluster_health_checks();
@@ -658,7 +662,9 @@ TEST_P(HdsIntegrationTest, TestUpdateMessage) {
   health_check->mutable_health_checks(0)->mutable_unhealthy_threshold()->set_value(2);
   health_check->mutable_health_checks(0)->mutable_healthy_threshold()->set_value(2);
   health_check->mutable_health_checks(0)->mutable_grpc_health_check();
-  health_check->mutable_health_checks(0)->mutable_http_health_check()->set_use_http2(false);
+  health_check->mutable_health_checks(0)
+      ->mutable_http_health_check()
+      ->set_hidden_envoy_deprecated_use_http2(false);
   health_check->mutable_health_checks(0)->mutable_http_health_check()->set_path("/healthcheck");
 
   // Server asks for health checking with the new message
@@ -678,7 +684,7 @@ TEST_P(HdsIntegrationTest, TestUpdateMessage) {
   // Receive updates until the one we expect arrives
   ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   while (!checkEndpointHealthResponse(response_.endpoint_health_response().endpoints_health(0),
-                                      envoy::api::v2::core::HealthStatus::UNHEALTHY,
+                                      envoy::config::core::v3alpha::UNHEALTHY,
                                       host2_upstream_->localAddress())) {
     ASSERT_TRUE(hds_stream_->waitForGrpcMessage(*dispatcher_, response_));
   }
diff --git a/test/integration/header_casing_integration_test.cc b/test/integration/header_casing_integration_test.cc
index b3b4bb5d138a..df63d6379fbc 100644
--- a/test/integration/header_casing_integration_test.cc
+++ b/test/integration/header_casing_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -21,12 +21,13 @@ class HeaderCasingIntegrationTest : public testing::TestWithParam<Network::Addre
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([](envoy::config::filter::network::http_connection_manager::
-                                            v2::HttpConnectionManager& hcm) {
+    config_helper_.addConfigModifier([](envoy::extensions::filters::network::
+                                            http_connection_manager::v3alpha::HttpConnectionManager&
+                                                hcm) {
       hcm.mutable_http_protocol_options()->mutable_header_key_format()->mutable_proper_case_words();
     });
 
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       bootstrap.mutable_static_resources()
           ->mutable_clusters(0)
           ->mutable_http_protocol_options()
diff --git a/test/integration/header_integration_test.cc b/test/integration/header_integration_test.cc
index 0292571dcf75..155ddc6c7de4 100644
--- a/test/integration/header_integration_test.cc
+++ b/test/integration/header_integration_test.cc
@@ -1,10 +1,10 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/http/router/v2/router.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/api/v2/endpoint.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/config/api_version.h"
 #include "common/config/metadata.h"
@@ -31,7 +31,8 @@ std::string ipSuppressEnvoyHeadersTestParamsToString(
 }
 
 void disableHeaderValueOptionAppend(
-    Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>& header_value_options) {
+    Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>&
+        header_value_options) {
   for (auto& i : header_value_options) {
     i.mutable_append()->set_value(false);
   }
@@ -201,9 +202,9 @@ class HeaderIntegrationTest
     fake_upstreams_.clear();
   }
 
-  void addHeader(Protobuf::RepeatedPtrField<envoy::api::v2::core::HeaderValueOption>* field,
+  void addHeader(Protobuf::RepeatedPtrField<envoy::config::core::v3alpha::HeaderValueOption>* field,
                  const std::string& key, const std::string& value, bool append) {
-    envoy::api::v2::core::HeaderValueOption* header_value_option = field->Add();
+    envoy::config::core::v3alpha::HeaderValueOption* header_value_option = field->Add();
     auto* mutable_header = header_value_option->mutable_header();
     mutable_header->set_key(key);
     mutable_header->set_value(value);
@@ -211,12 +212,12 @@ class HeaderIntegrationTest
   }
 
   void prepareEDS() {
-    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* static_resources = bootstrap.mutable_static_resources();
       ASSERT(static_resources->clusters_size() == 1);
 
       static_resources->mutable_clusters(0)->CopyFrom(
-          TestUtility::parseYaml<envoy::api::v2::Cluster>(
+          TestUtility::parseYaml<envoy::config::cluster::v3alpha::Cluster>(
               R"EOF(
                   name: cluster_0
                   type: EDS
@@ -235,7 +236,7 @@ class HeaderIntegrationTest
       // host must come before the eds-cluster's host to keep the upstreams and ports in the same
       // order.
       static_resources->add_clusters()->CopyFrom(
-          TestUtility::parseYaml<envoy::api::v2::Cluster>(fmt::format(
+          TestUtility::parseYaml<envoy::config::cluster::v3alpha::Cluster>(fmt::format(
               R"EOF(
                       name: unused-cluster
                       type: STATIC
@@ -248,7 +249,7 @@ class HeaderIntegrationTest
               Network::Test::getLoopbackAddressString(version_))));
 
       static_resources->add_clusters()->CopyFrom(
-          TestUtility::parseYaml<envoy::api::v2::Cluster>(fmt::format(
+          TestUtility::parseYaml<envoy::config::cluster::v3alpha::Cluster>(fmt::format(
               R"EOF(
                       name: eds-cluster
                       type: STATIC
@@ -268,11 +269,11 @@ class HeaderIntegrationTest
 
   void initializeFilter(HeaderMode mode, bool inject_route_config_headers) {
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                hcm) {
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) {
           // Overwrite default config with our own.
           TestUtility::loadFromYaml(http_connection_mgr_config, hcm);
-          envoy::config::filter::http::router::v2::Router router_config;
+          envoy::extensions::filters::http::router::v3alpha::Router router_config;
           router_config.set_suppress_envoy_headers(routerSuppressEnvoyHeaders());
           hcm.mutable_http_filters(0)->mutable_typed_config()->PackFrom(router_config);
 
diff --git a/test/integration/header_prefix_integration_test.cc b/test/integration/header_prefix_integration_test.cc
index e8c1e31d9930..83a6b161377a 100644
--- a/test/integration/header_prefix_integration_test.cc
+++ b/test/integration/header_prefix_integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "test/integration/http_protocol_integration.h"
 #include "test/integration/server.h"
@@ -24,7 +24,7 @@ class HeaderPrefixIntegrationTest : public HttpProtocolIntegrationTest {
 };
 
 TEST_P(HeaderPrefixIntegrationTest, CustomHeaderPrefix) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     bootstrap.set_header_prefix("x-custom");
   });
   initialize();
@@ -47,7 +47,7 @@ TEST_P(HeaderPrefixIntegrationTest, CustomHeaderPrefix) {
 // singleton header prefix in SetUpTestSuite, and Envoy will RELEASE_ASSERT on
 // start-up.
 TEST_P(HeaderPrefixIntegrationTest, FailedCustomHeaderPrefix) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     bootstrap.set_header_prefix("x-custom-but-not-set");
   });
   EXPECT_DEATH(initialize(), "Attempting to change the header prefix after it has been used!");
diff --git a/test/integration/http2_integration_test.cc b/test/integration/http2_integration_test.cc
index 653619bc752b..c6a9fff5a80e 100644
--- a/test/integration/http2_integration_test.cc
+++ b/test/integration/http2_integration_test.cc
@@ -3,8 +3,9 @@
 #include <algorithm>
 #include <string>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/http/header_map_impl.h"
@@ -274,8 +275,8 @@ void verifyExpectedMetadata(Http::MetadataMap metadata_map, std::set<std::string
 TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   addFilters({response_metadata_filter});
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.set_proxy_100_continue(true); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void { hcm.set_proxy_100_continue(true); });
 
   initialize();
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -494,8 +495,8 @@ name: request-metadata-filter
 TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
   addFilters({request_metadata_filter});
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.set_proxy_100_continue(true); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void { hcm.set_proxy_100_continue(true); });
 
   initialize();
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -603,8 +604,8 @@ name: decode-headers-only
 
 void Http2MetadataIntegrationTest::runHeaderOnlyTest(bool send_request_body, size_t body_size) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.set_proxy_100_continue(true); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void { hcm.set_proxy_100_continue(true); });
 
   initialize();
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -848,8 +849,8 @@ TEST_P(Http2IntegrationTest, TrailersGiantBody) {
 
 TEST_P(Http2IntegrationTest, GrpcRequestTimeout) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* route_config = hcm.mutable_route_config();
         auto* virtual_host = route_config->mutable_virtual_hosts(0);
         auto* route = virtual_host->mutable_routes(0);
@@ -890,7 +891,7 @@ TEST_P(Http2IntegrationTest, IdleTimeoutWithSimultaneousRequests) {
   int32_t request1_bytes = 1024;
   int32_t request2_bytes = 512;
 
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
     auto* cluster = static_resources->mutable_clusters(0);
     auto* http_protocol_options = cluster->mutable_common_http_protocol_options();
@@ -968,8 +969,8 @@ TEST_P(Http2IntegrationTest, IdleTimeoutWithSimultaneousRequests) {
 // Test request mirroring / shadowing with an HTTP/2 downstream and a request with a body.
 TEST_P(Http2IntegrationTest, RequestMirrorWithBody) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* mirror_policy = hcm.mutable_route_config()
                                   ->mutable_virtual_hosts(0)
                                   ->mutable_routes(0)
@@ -1120,9 +1121,8 @@ TEST_P(Http2IntegrationTest, DelayedCloseAfterBadFrame) {
 // Test disablement of delayed close processing on downstream connections.
 TEST_P(Http2IntegrationTest, DelayedCloseDisabled) {
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_delayed_close_timeout()->set_seconds(0);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.mutable_delayed_close_timeout()->set_seconds(0); });
   initialize();
   Buffer::OwnedImpl buffer("PRI * HTTP/2.0\r\n\r\nSM\r\n\r\nhelloworldcauseanerror");
   std::string response;
@@ -1198,15 +1198,16 @@ TEST_P(Http2IntegrationTest, PauseAndResumeHeadersOnly) {
 }
 
 Http2RingHashIntegrationTest::Http2RingHashIntegrationTest() {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
-    cluster->clear_hosts();
-    cluster->set_lb_policy(envoy::api::v2::Cluster::RING_HASH);
-    for (int i = 0; i < num_upstreams_; i++) {
-      auto* socket = cluster->add_hosts()->mutable_socket_address();
-      socket->set_address(Network::Test::getLoopbackAddressString(version_));
-    }
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
+        cluster->clear_hosts();
+        cluster->set_lb_policy(envoy::config::cluster::v3alpha::Cluster::RING_HASH);
+        for (int i = 0; i < num_upstreams_; i++) {
+          auto* socket = cluster->add_hosts()->mutable_socket_address();
+          socket->set_address(Network::Test::getLoopbackAddressString(version_));
+        }
+      });
 }
 
 Http2RingHashIntegrationTest::~Http2RingHashIntegrationTest() {
@@ -1287,8 +1288,8 @@ void Http2RingHashIntegrationTest::sendMultipleRequests(
 
 TEST_P(Http2RingHashIntegrationTest, CookieRoutingNoCookieNoTtl) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* hash_policy = hcm.mutable_route_config()
                                 ->mutable_virtual_hosts(0)
                                 ->mutable_routes(0)
@@ -1319,8 +1320,8 @@ TEST_P(Http2RingHashIntegrationTest, CookieRoutingNoCookieNoTtl) {
 
 TEST_P(Http2RingHashIntegrationTest, CookieRoutingNoCookieWithNonzeroTtlSet) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* hash_policy = hcm.mutable_route_config()
                                 ->mutable_virtual_hosts(0)
                                 ->mutable_routes(0)
@@ -1350,8 +1351,8 @@ TEST_P(Http2RingHashIntegrationTest, CookieRoutingNoCookieWithNonzeroTtlSet) {
 
 TEST_P(Http2RingHashIntegrationTest, CookieRoutingNoCookieWithZeroTtlSet) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* hash_policy = hcm.mutable_route_config()
                                 ->mutable_virtual_hosts(0)
                                 ->mutable_routes(0)
@@ -1381,8 +1382,8 @@ TEST_P(Http2RingHashIntegrationTest, CookieRoutingNoCookieWithZeroTtlSet) {
 
 TEST_P(Http2RingHashIntegrationTest, CookieRoutingWithCookieNoTtl) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* hash_policy = hcm.mutable_route_config()
                                 ->mutable_virtual_hosts(0)
                                 ->mutable_routes(0)
@@ -1411,8 +1412,8 @@ TEST_P(Http2RingHashIntegrationTest, CookieRoutingWithCookieNoTtl) {
 
 TEST_P(Http2RingHashIntegrationTest, CookieRoutingWithCookieWithTtlSet) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* hash_policy = hcm.mutable_route_config()
                                 ->mutable_virtual_hosts(0)
                                 ->mutable_routes(0)
@@ -1454,12 +1455,13 @@ void Http2FloodMitigationTest::setNetworkConnectionBufferSize() {
   // SETTINGS frames is dispatched to the nghttp2 library. To prevent this from happening the
   // network connection receive buffer needs to be smaller than 90Kb (which is 10K SETTINGS frames).
   // Set it to the arbitrarily chosen value of 32K. Note that this buffer has 16K lower bound.
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    RELEASE_ASSERT(bootstrap.mutable_static_resources()->listeners_size() >= 1, "");
-    auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
+  config_helper_.addConfigModifier(
+      [](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        RELEASE_ASSERT(bootstrap.mutable_static_resources()->listeners_size() >= 1, "");
+        auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
 
-    listener->mutable_per_connection_buffer_limit_bytes()->set_value(32 * 1024);
-  });
+        listener->mutable_per_connection_buffer_limit_bytes()->set_value(32 * 1024);
+      });
 }
 
 void Http2FloodMitigationTest::beginSession() {
@@ -1601,11 +1603,10 @@ TEST_P(Http2FloodMitigationTest, Data) {
 // Verify that the server can detect flood of RST_STREAM frames.
 TEST_P(Http2FloodMitigationTest, RST_STREAM) {
   // Use invalid HTTP headers to trigger sending RST_STREAM frames.
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
-        hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) -> void {
+    hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
+  });
   beginSession();
 
   int i = 0;
@@ -1628,11 +1629,10 @@ TEST_P(Http2FloodMitigationTest, RST_STREAM) {
 
 // Verify that the server stop reading downstream connection on protocol error.
 TEST_P(Http2FloodMitigationTest, TooManyStreams) {
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
-        hcm.mutable_http2_protocol_options()->mutable_max_concurrent_streams()->set_value(2);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) -> void {
+    hcm.mutable_http2_protocol_options()->mutable_max_concurrent_streams()->set_value(2);
+  });
   autonomous_upstream_ = true;
   beginSession();
   fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
@@ -1644,8 +1644,8 @@ TEST_P(Http2FloodMitigationTest, TooManyStreams) {
 
 TEST_P(Http2FloodMitigationTest, EmptyHeaders) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_http2_protocol_options()
             ->mutable_max_consecutive_inbound_frames_with_empty_payload()
             ->set_value(0);
@@ -1769,11 +1769,10 @@ TEST_P(Http2FloodMitigationTest, ZerolenHeader) {
 
 // Verify that only the offending stream is terminated upon receiving invalid HEADERS frame.
 TEST_P(Http2FloodMitigationTest, ZerolenHeaderAllowed) {
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
-        hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) -> void {
+    hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
+  });
   autonomous_upstream_ = true;
   beginSession();
   fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
diff --git a/test/integration/http2_integration_test.h b/test/integration/http2_integration_test.h
index 57389864cd0e..840d60048853 100644
--- a/test/integration/http2_integration_test.h
+++ b/test/integration/http2_integration_test.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/common/http/http2/http2_frame.h"
 #include "test/integration/http_integration.h"
@@ -48,14 +48,16 @@ class Http2MetadataIntegrationTest : public Http2IntegrationTest {
 public:
   void SetUp() override {
     config_helper_.addConfigModifier(
-        [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           RELEASE_ASSERT(bootstrap.mutable_static_resources()->clusters_size() >= 1, "");
           auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
           cluster->mutable_http2_protocol_options()->set_allow_metadata(true);
         });
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-            -> void { hcm.mutable_http2_protocol_options()->set_allow_metadata(true); });
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) -> void {
+          hcm.mutable_http2_protocol_options()->set_allow_metadata(true);
+        });
     setDownstreamProtocol(Http::CodecClient::Type::HTTP2);
     setUpstreamProtocol(FakeHttpConnection::Type::HTTP2);
   }
diff --git a/test/integration/http2_upstream_integration_test.cc b/test/integration/http2_upstream_integration_test.cc
index 5323cac6773c..f99361c83683 100644
--- a/test/integration/http2_upstream_integration_test.cc
+++ b/test/integration/http2_upstream_integration_test.cc
@@ -2,8 +2,8 @@
 
 #include <iostream>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/http/header_map_impl.h"
 
@@ -320,8 +320,8 @@ TEST_P(Http2UpstreamIntegrationTest, UpstreamConnectionCloseWithManyStreams) {
 // Regression test for https://github.com/envoyproxy/envoy/issues/6744
 TEST_P(Http2UpstreamIntegrationTest, HittingEncoderFilterLimitForGrpc) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         const std::string access_log_name =
             TestEnvironment::temporaryPath(TestUtility::uniqueFilename());
         // Configure just enough of an upstream access log to reference the upstream headers.
@@ -400,7 +400,7 @@ TEST_P(Http2UpstreamIntegrationTest, TestManyResponseHeadersRejected) {
 // Tests bootstrap configuration of max response headers.
 TEST_P(Http2UpstreamIntegrationTest, ManyResponseHeadersAccepted) {
   // Set max response header count to 200.
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
     auto* cluster = static_resources->mutable_clusters(0);
     auto* http_protocol_options = cluster->mutable_common_http_protocol_options();
@@ -445,8 +445,8 @@ TEST_P(Http2UpstreamIntegrationTest, LargeResponseHeadersRejected) {
 // See https://github.com/envoyproxy/envoy/issues/8828.
 TEST_P(Http2UpstreamIntegrationTest, ConfigureHttpOverGrpcLogs) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         const std::string access_log_name =
             TestEnvironment::temporaryPath(TestUtility::uniqueFilename());
         // Configure just enough of an upstream access log to reference the upstream headers.
diff --git a/test/integration/http_integration.cc b/test/integration/http_integration.cc
index d97fb6e289c9..72c10d0f3457 100644
--- a/test/integration/http_integration.cc
+++ b/test/integration/http_integration.cc
@@ -8,8 +8,9 @@
 #include <vector>
 
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/network/address.h"
 #include "envoy/registry/registry.h"
@@ -39,18 +40,19 @@
 namespace Envoy {
 namespace {
 
-envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::CodecType
-typeToCodecType(Http::CodecClient::Type type) {
+envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager::
+    CodecType
+    typeToCodecType(Http::CodecClient::Type type) {
   switch (type) {
   case Http::CodecClient::Type::HTTP1:
-    return envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-        HTTP1;
+    return envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager::HTTP1;
   case Http::CodecClient::Type::HTTP2:
-    return envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-        HTTP2;
+    return envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager::HTTP2;
   case Http::CodecClient::Type::HTTP3:
-    return envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-        HTTP3;
+    return envoy::extensions::filters::network::http_connection_manager::v3alpha::
+        HttpConnectionManager::HTTP3;
   default:
     RELEASE_ASSERT(0, "");
   }
@@ -273,14 +275,14 @@ void HttpIntegrationTest::setDownstreamProtocol(Http::CodecClient::Type downstre
 }
 
 ConfigHelper::HttpModifierFunction HttpIntegrationTest::setEnableDownstreamTrailersHttp1() {
-  return
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_http_protocol_options()->set_enable_trailers(true);
-      };
+  return [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) {
+    hcm.mutable_http_protocol_options()->set_enable_trailers(true);
+  };
 }
 
 ConfigHelper::ConfigModifierFunction HttpIntegrationTest::setEnableUpstreamTrailersHttp1() {
-  return [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  return [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     RELEASE_ASSERT(bootstrap.mutable_static_resources()->clusters_size() == 1, "");
     if (fake_upstreams_[0]->httpType() == FakeHttpConnection::Type::HTTP1) {
       auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
@@ -811,8 +813,8 @@ void HttpIntegrationTest::testEnvoyProxying100Continue(bool continue_before_upst
     // Because 100-continue only affects encoder filters, make sure it plays well with one.
     config_helper_.addFilter("name: envoy.cors");
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-            -> void {
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) -> void {
           auto* route_config = hcm.mutable_route_config();
           auto* virtual_host = route_config->mutable_virtual_hosts(0);
           {
@@ -824,8 +826,8 @@ void HttpIntegrationTest::testEnvoyProxying100Continue(bool continue_before_upst
         });
   }
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.set_proxy_100_continue(true); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void { hcm.set_proxy_100_continue(true); });
   initialize();
 
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -922,8 +924,8 @@ void HttpIntegrationTest::testLargeRequestHeaders(uint32_t size, uint32_t count,
   // due to default headers.
 
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_max_request_headers_kb()->set_value(max_size);
         hcm.mutable_common_http_protocol_options()->mutable_max_headers_count()->set_value(
             max_count);
@@ -967,8 +969,10 @@ void HttpIntegrationTest::testLargeRequestTrailers(uint32_t size, uint32_t max_s
   // and other headers.
 
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.mutable_max_request_headers_kb()->set_value(max_size); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
+        hcm.mutable_max_request_headers_kb()->set_value(max_size);
+      });
   max_request_headers_kb_ = max_size;
   Http::TestHeaderMapImpl request_trailers{{"trailer", "trailer"}};
   request_trailers.addCopy("big", std::string(size * 1024, 'a'));
@@ -1011,8 +1015,8 @@ void HttpIntegrationTest::testManyRequestHeaders(std::chrono::milliseconds time)
   max_request_headers_count_ = 20005;
 
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_max_request_headers_kb()->set_value(max_request_headers_kb_);
         hcm.mutable_common_http_protocol_options()->mutable_max_headers_count()->set_value(
             max_request_headers_count_);
diff --git a/test/integration/http_subset_lb_integration_test.cc b/test/integration/http_subset_lb_integration_test.cc
index cfa063f011f1..8c5d9e6af6c7 100644
--- a/test/integration/http_subset_lb_integration_test.cc
+++ b/test/integration/http_subset_lb_integration_test.cc
@@ -1,7 +1,8 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.validate.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/http_integration.h"
 
@@ -10,26 +11,28 @@
 
 namespace Envoy {
 
-class HttpSubsetLbIntegrationTest : public testing::TestWithParam<envoy::api::v2::Cluster_LbPolicy>,
-                                    public HttpIntegrationTest {
+class HttpSubsetLbIntegrationTest
+    : public testing::TestWithParam<envoy::config::cluster::v3alpha::Cluster::LbPolicy>,
+      public HttpIntegrationTest {
 public:
   // Returns all load balancer types except ORIGINAL_DST_LB and CLUSTER_PROVIDED.
-  static std::vector<envoy::api::v2::Cluster_LbPolicy> getSubsetLbTestParams() {
-    int first = static_cast<int>(envoy::api::v2::Cluster::LbPolicy_MIN);
-    int last = static_cast<int>(envoy::api::v2::Cluster::LbPolicy_MAX);
+  static std::vector<envoy::config::cluster::v3alpha::Cluster::LbPolicy> getSubsetLbTestParams() {
+    int first = static_cast<int>(envoy::config::cluster::v3alpha::Cluster::LbPolicy_MIN);
+    int last = static_cast<int>(envoy::config::cluster::v3alpha::Cluster::LbPolicy_MAX);
     ASSERT(first < last);
 
-    std::vector<envoy::api::v2::Cluster_LbPolicy> ret;
+    std::vector<envoy::config::cluster::v3alpha::Cluster::LbPolicy> ret;
     for (int i = first; i <= last; i++) {
-      if (!envoy::api::v2::Cluster::LbPolicy_IsValid(i)) {
+      if (!envoy::config::cluster::v3alpha::Cluster::LbPolicy_IsValid(i)) {
         continue;
       }
 
-      auto policy = static_cast<envoy::api::v2::Cluster_LbPolicy>(i);
+      auto policy = static_cast<envoy::config::cluster::v3alpha::Cluster::LbPolicy>(i);
 
-      if (policy == envoy::api::v2::Cluster::ORIGINAL_DST_LB ||
-          policy == envoy::api::v2::Cluster::CLUSTER_PROVIDED ||
-          policy == envoy::api::v2::Cluster::LOAD_BALANCING_POLICY_CONFIG) {
+      if (policy ==
+              envoy::config::cluster::v3alpha::Cluster::hidden_envoy_deprecated_ORIGINAL_DST_LB ||
+          policy == envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED ||
+          policy == envoy::config::cluster::v3alpha::Cluster::LOAD_BALANCING_POLICY_CONFIG) {
         continue;
       }
 
@@ -40,9 +43,10 @@ class HttpSubsetLbIntegrationTest : public testing::TestWithParam<envoy::api::v2
   }
 
   // Converts an LbPolicy to strings suitable for test names.
-  static std::string
-  subsetLbTestParamsToString(const testing::TestParamInfo<envoy::api::v2::Cluster_LbPolicy>& p) {
-    const std::string& policy_name = envoy::api::v2::Cluster::LbPolicy_Name(p.param);
+  static std::string subsetLbTestParamsToString(
+      const testing::TestParamInfo<envoy::config::cluster::v3alpha::Cluster::LbPolicy>& p) {
+    const std::string& policy_name =
+        envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(p.param);
     return absl::StrReplaceAll(policy_name, {{"_", ""}});
   }
 
@@ -50,12 +54,13 @@ class HttpSubsetLbIntegrationTest : public testing::TestWithParam<envoy::api::v2
       : HttpIntegrationTest(Http::CodecClient::Type::HTTP1,
                             TestEnvironment::getIpVersionsForTest().front(),
                             ConfigHelper::HTTP_PROXY_CONFIG),
-        num_hosts_{4}, is_hash_lb_(GetParam() == envoy::api::v2::Cluster::RING_HASH ||
-                                   GetParam() == envoy::api::v2::Cluster::MAGLEV) {
+        num_hosts_{4},
+        is_hash_lb_(GetParam() == envoy::config::cluster::v3alpha::Cluster::RING_HASH ||
+                    GetParam() == envoy::config::cluster::v3alpha::Cluster::MAGLEV) {
     autonomous_upstream_ = true;
     setUpstreamCount(num_hosts_);
 
-    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* static_resources = bootstrap.mutable_static_resources();
       auto* cluster = static_resources->mutable_clusters(0);
 
@@ -89,8 +94,8 @@ class HttpSubsetLbIntegrationTest : public testing::TestWithParam<envoy::api::v2
     });
 
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                hcm) {
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) {
           auto* vhost = hcm.mutable_route_config()->mutable_virtual_hosts(0);
 
           // Report the host's type metadata and remote address on every response.
@@ -112,7 +117,7 @@ class HttpSubsetLbIntegrationTest : public testing::TestWithParam<envoy::api::v2
         });
   }
 
-  void configureRoute(envoy::api::v2::route::Route* route, const std::string& host_type) {
+  void configureRoute(envoy::config::route::v3alpha::Route* route, const std::string& host_type) {
     auto* match = route->mutable_match();
     match->set_prefix("/");
 
@@ -177,10 +182,12 @@ class HttpSubsetLbIntegrationTest : public testing::TestWithParam<envoy::api::v2
 
     if (is_hash_lb_) {
       EXPECT_EQ(hosts.size(), 1) << "Expected a single unique host to be selected for "
-                                 << envoy::api::v2::Cluster::LbPolicy_Name(GetParam());
+                                 << envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(
+                                        GetParam());
     } else {
       EXPECT_GT(hosts.size(), 1) << "Expected multiple hosts to be selected for "
-                                 << envoy::api::v2::Cluster::LbPolicy_Name(GetParam());
+                                 << envoy::config::cluster::v3alpha::Cluster::LbPolicy_Name(
+                                        GetParam());
     }
   }
 
diff --git a/test/integration/http_timeout_integration_test.h b/test/integration/http_timeout_integration_test.h
index 40404c2a684d..105dd3facb08 100644
--- a/test/integration/http_timeout_integration_test.h
+++ b/test/integration/http_timeout_integration_test.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/filter/http/router/v2/router.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/http/router/v3alpha/router.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/http_integration.h"
 
@@ -28,9 +28,9 @@ class HttpTimeoutIntegrationTest : public testing::TestWithParam<Network::Addres
   void initialize() override {
     if (respect_expected_rq_timeout) {
       config_helper_.addConfigModifier(
-          [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                  hcm) {
-            envoy::config::filter::http::router::v2::Router router_config;
+          [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                  HttpConnectionManager& hcm) {
+            envoy::extensions::filters::http::router::v3alpha::Router router_config;
             router_config.set_respect_expected_rq_timeout(respect_expected_rq_timeout);
             // TestUtility::jsonConvert(router_config,
             // *hcm.mutable_http_filters(0)->mutable_config());
diff --git a/test/integration/idle_timeout_integration_test.cc b/test/integration/idle_timeout_integration_test.cc
index 2cbc05466b8f..034647cca5fe 100644
--- a/test/integration/idle_timeout_integration_test.cc
+++ b/test/integration/idle_timeout_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/http_protocol_integration.h"
 #include "test/test_common/test_time.h"
@@ -14,8 +14,8 @@ class IdleTimeoutIntegrationTest : public HttpProtocolIntegrationTest {
   void initialize() override {
     useAccessLog("%RESPONSE_CODE_DETAILS%");
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-            -> void {
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) -> void {
           if (enable_global_idle_timeout_) {
             hcm.mutable_stream_idle_timeout()->set_seconds(0);
             hcm.mutable_stream_idle_timeout()->set_nanos(IdleTimeoutMs * 1000 * 1000);
@@ -91,7 +91,7 @@ INSTANTIATE_TEST_SUITE_P(Protocols, IdleTimeoutIntegrationTest,
 // Tests idle timeout behaviour with single request and validates that idle timer kicks in
 // after given timeout.
 TEST_P(IdleTimeoutIntegrationTest, TimeoutBasic) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
     auto* cluster = static_resources->mutable_clusters(0);
     auto* http_protocol_options = cluster->mutable_common_http_protocol_options();
@@ -123,7 +123,7 @@ TEST_P(IdleTimeoutIntegrationTest, TimeoutBasic) {
 // Tests idle timeout behaviour with multiple requests and validates that idle timer kicks in
 // after both the requests are done.
 TEST_P(IdleTimeoutIntegrationTest, IdleTimeoutWithTwoRequests) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
     auto* cluster = static_resources->mutable_clusters(0);
     auto* http_protocol_options = cluster->mutable_common_http_protocol_options();
diff --git a/test/integration/integration.cc b/test/integration/integration.cc
index 728c32e8a228..014981f3fc17 100644
--- a/test/integration/integration.cc
+++ b/test/integration/integration.cc
@@ -8,12 +8,12 @@
 #include <string>
 #include <vector>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/http/header_map.h"
 
 #include "common/api/api_impl.h"
@@ -322,7 +322,7 @@ void BaseIntegrationTest::createEnvoy() {
     // Before finalization, set up a real lds path, replacing the default /dev/null
     std::string lds_path = TestEnvironment::temporaryPath(TestUtility::uniqueFilename());
     config_helper_.addConfigModifier(
-        [lds_path](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [lds_path](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           bootstrap.mutable_dynamic_resources()->mutable_lds_config()->set_path(lds_path);
         });
   }
@@ -332,7 +332,7 @@ void BaseIntegrationTest::createEnvoy() {
   // config, you will need to do so *after* initialize() (which calls this function) is done.
   config_helper_.finalize(ports);
 
-  envoy::config::bootstrap::v2::Bootstrap bootstrap = config_helper_.bootstrap();
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap = config_helper_.bootstrap();
   if (use_lds_) {
     // After the config has been finalized, write the final listener config to the lds file.
     const std::string lds_path = config_helper_.bootstrap().dynamic_resources().lds_config().path();
@@ -368,7 +368,7 @@ void BaseIntegrationTest::setUpstreamProtocol(FakeHttpConnection::Type protocol)
   upstream_protocol_ = protocol;
   if (upstream_protocol_ == FakeHttpConnection::Type::HTTP2) {
     config_helper_.addConfigModifier(
-        [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           RELEASE_ASSERT(bootstrap.mutable_static_resources()->clusters_size() >= 1, "");
           auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
           cluster->mutable_http2_protocol_options();
@@ -398,8 +398,8 @@ uint32_t BaseIntegrationTest::lookupPort(const std::string& key) {
                   key));
 }
 
-void BaseIntegrationTest::setUpstreamAddress(uint32_t upstream_index,
-                                             envoy::api::v2::endpoint::LbEndpoint& endpoint) const {
+void BaseIntegrationTest::setUpstreamAddress(
+    uint32_t upstream_index, envoy::config::endpoint::v3alpha::LbEndpoint& endpoint) const {
   auto* socket_address = endpoint.mutable_endpoint()->mutable_address()->mutable_socket_address();
   socket_address->set_address(Network::Test::getLoopbackAddressString(version_));
   socket_address->set_port_value(fake_upstreams_[upstream_index]->localAddress()->ip()->port());
@@ -425,7 +425,7 @@ void BaseIntegrationTest::registerTestServerPorts(const std::vector<std::string>
 std::string getListenerDetails(Envoy::Server::Instance& server) {
   const auto& cbs_maps = server.admin().getConfigTracker().getCallbacksMap();
   ProtobufTypes::MessagePtr details = cbs_maps.at("listeners")();
-  auto listener_info = Protobuf::down_cast<envoy::admin::v2alpha::ListenersConfigDump>(*details);
+  auto listener_info = Protobuf::down_cast<envoy::admin::v3alpha::ListenersConfigDump>(*details);
   return MessageUtil::getYamlStringFromMessage(listener_info.dynamic_listeners(0).error_state());
 }
 
@@ -528,7 +528,7 @@ void BaseIntegrationTest::createXdsUpstream() {
     fake_upstreams_.emplace_back(
         new FakeUpstream(0, FakeHttpConnection::Type::HTTP2, version_, timeSystem()));
   } else {
-    envoy::api::v2::auth::DownstreamTlsContext tls_context;
+    envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
     auto* common_tls_context = tls_context.mutable_common_tls_context();
     common_tls_context->add_alpn_protocols("h2");
     auto* tls_cert = common_tls_context->add_tls_certificates();
diff --git a/test/integration/integration.h b/test/integration/integration.h
index 72b057b1ae19..0b0c12274233 100644
--- a/test/integration/integration.h
+++ b/test/integration/integration.h
@@ -6,7 +6,7 @@
 #include <vector>
 
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
 #include "envoy/server/process_context.h"
 
 #include "common/config/api_version.h"
@@ -193,7 +193,7 @@ class BaseIntegrationTest : protected Logger::Loggable<Logger::Id::testing> {
 
   // Set the endpoint's socket address to point at upstream at given index.
   void setUpstreamAddress(uint32_t upstream_index,
-                          envoy::api::v2::endpoint::LbEndpoint& endpoint) const;
+                          envoy::config::endpoint::v3alpha::LbEndpoint& endpoint) const;
 
   virtual Network::ClientConnectionPtr makeClientConnection(uint32_t port);
 
diff --git a/test/integration/integration_admin_test.cc b/test/integration/integration_admin_test.cc
index 627a323fdb3e..6a7c548344ff 100644
--- a/test/integration/integration_admin_test.cc
+++ b/test/integration/integration_admin_test.cc
@@ -2,10 +2,10 @@
 
 #include <string>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 #include "envoy/http/header_map.h"
 
 #include "common/common/fmt.h"
@@ -45,7 +45,7 @@ TEST_P(IntegrationAdminTest, HealthCheck) {
 }
 
 TEST_P(IntegrationAdminTest, HealthCheckWithoutServerStats) {
-  envoy::config::metrics::v2::StatsMatcher stats_matcher;
+  envoy::config::metrics::v3alpha::StatsMatcher stats_matcher;
   stats_matcher.mutable_exclusion_list()->add_patterns()->set_prefix("server.");
   initialize(stats_matcher);
 
@@ -343,12 +343,12 @@ TEST_P(IntegrationAdminTest, Admin) {
   json = Json::Factory::loadFromString(response->body());
   size_t index = 0;
   const std::string expected_types[] = {
-      "type.googleapis.com/envoy.admin.v2alpha.BootstrapConfigDump",
-      "type.googleapis.com/envoy.admin.v2alpha.ClustersConfigDump",
-      "type.googleapis.com/envoy.admin.v2alpha.ListenersConfigDump",
-      "type.googleapis.com/envoy.admin.v2alpha.ScopedRoutesConfigDump",
-      "type.googleapis.com/envoy.admin.v2alpha.RoutesConfigDump",
-      "type.googleapis.com/envoy.admin.v2alpha.SecretsConfigDump"};
+      "type.googleapis.com/envoy.admin.v3alpha.BootstrapConfigDump",
+      "type.googleapis.com/envoy.admin.v3alpha.ClustersConfigDump",
+      "type.googleapis.com/envoy.admin.v3alpha.ListenersConfigDump",
+      "type.googleapis.com/envoy.admin.v3alpha.ScopedRoutesConfigDump",
+      "type.googleapis.com/envoy.admin.v3alpha.RoutesConfigDump",
+      "type.googleapis.com/envoy.admin.v3alpha.SecretsConfigDump"};
 
   for (const Json::ObjectSharedPtr& obj_ptr : json->getObjectArray("configs")) {
     EXPECT_TRUE(expected_types[index].compare(obj_ptr->getString("@type")) == 0);
@@ -356,16 +356,16 @@ TEST_P(IntegrationAdminTest, Admin) {
   }
 
   // Validate we can parse as proto.
-  envoy::admin::v2alpha::ConfigDump config_dump;
+  envoy::admin::v3alpha::ConfigDump config_dump;
   TestUtility::loadFromJson(response->body(), config_dump);
   EXPECT_EQ(6, config_dump.configs_size());
 
   // .. and that we can unpack one of the entries.
-  envoy::admin::v2alpha::RoutesConfigDump route_config_dump;
+  envoy::admin::v3alpha::RoutesConfigDump route_config_dump;
   config_dump.configs(4).UnpackTo(&route_config_dump);
   EXPECT_EQ("route_config_0", route_config_dump.static_route_configs(0).route_config().name());
 
-  envoy::admin::v2alpha::SecretsConfigDump secret_config_dump;
+  envoy::admin::v3alpha::SecretsConfigDump secret_config_dump;
   config_dump.configs(5).UnpackTo(&secret_config_dump);
   EXPECT_EQ("secret_static_0", secret_config_dump.static_secrets(0).name());
 
@@ -395,11 +395,12 @@ TEST_P(IntegrationAdminTest, Admin) {
 
 // Validates that the "inboundonly" drains inbound listeners.
 TEST_P(IntegrationAdminTest, AdminDrainInboundOnly) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* inbound_listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
-    inbound_listener->set_traffic_direction(envoy::api::v2::core::TrafficDirection::INBOUND);
-    inbound_listener->set_name("inbound_0");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* inbound_listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
+        inbound_listener->set_traffic_direction(envoy::config::core::v3alpha::INBOUND);
+        inbound_listener->set_name("inbound_0");
+      });
   initialize();
 
   BufferingStreamDecoderPtr response = IntegrationUtil::makeSingleRequest(
@@ -442,10 +443,11 @@ TEST_P(IntegrationAdminTest, AdminOnDestroyCallbacks) {
 }
 
 TEST_P(IntegrationAdminTest, AdminCpuProfilerStart) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* admin = bootstrap.mutable_admin();
-    admin->set_profile_path(TestEnvironment::temporaryPath("/envoy.prof"));
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* admin = bootstrap.mutable_admin();
+        admin->set_profile_path(TestEnvironment::temporaryPath("/envoy.prof"));
+      });
 
   initialize();
   BufferingStreamDecoderPtr response;
@@ -465,7 +467,7 @@ class IntegrationAdminIpv4Ipv6Test : public testing::Test, public HttpIntegratio
 
   void initialize() override {
     config_helper_.addConfigModifier(
-        [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           auto* socket_address =
               bootstrap.mutable_admin()->mutable_address()->mutable_socket_address();
           socket_address->set_ipv4_compat(true);
@@ -505,7 +507,7 @@ class StatsMatcherIntegrationTest
 
   void initialize() override {
     config_helper_.addConfigModifier(
-        [this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           *bootstrap.mutable_stats_config()->mutable_stats_matcher() = stats_matcher_;
         });
     HttpIntegrationTest::initialize();
@@ -518,7 +520,7 @@ class StatsMatcherIntegrationTest
   }
 
   BufferingStreamDecoderPtr response_;
-  envoy::config::metrics::v2::StatsMatcher stats_matcher_;
+  envoy::config::metrics::v3alpha::StatsMatcher stats_matcher_;
 };
 INSTANTIATE_TEST_SUITE_P(IpVersions, StatsMatcherIntegrationTest,
                          testing::ValuesIn(TestEnvironment::getIpVersionsForTest()),
@@ -533,7 +535,8 @@ TEST_P(StatsMatcherIntegrationTest, ExcludePrefixServerDot) {
 }
 
 TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(ExcludeRequests)) {
-  stats_matcher_.mutable_exclusion_list()->add_patterns()->set_regex(".*requests.*");
+  stats_matcher_.mutable_exclusion_list()->add_patterns()->set_hidden_envoy_deprecated_regex(
+      ".*requests.*");
   initialize();
   makeRequest();
   EXPECT_THAT(response_->body(), Not(HasSubstr("requests")));
@@ -548,7 +551,8 @@ TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(ExcludeExact)) {
 
 TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(ExcludeMultipleExact)) {
   stats_matcher_.mutable_exclusion_list()->add_patterns()->set_exact("server.concurrency");
-  stats_matcher_.mutable_exclusion_list()->add_patterns()->set_regex(".*live");
+  stats_matcher_.mutable_exclusion_list()->add_patterns()->set_hidden_envoy_deprecated_regex(
+      ".*live");
   initialize();
   makeRequest();
   EXPECT_THAT(response_->body(), Not(HasSubstr("server.concurrency")));
diff --git a/test/integration/integration_admin_test.h b/test/integration/integration_admin_test.h
index 50922e0c16a3..79881d179fe4 100644
--- a/test/integration/integration_admin_test.h
+++ b/test/integration/integration_admin_test.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/json/json_loader.h"
 
@@ -19,9 +19,9 @@ class IntegrationAdminTest : public HttpProtocolIntegrationTest {
     HttpIntegrationTest::initialize();
   }
 
-  void initialize(envoy::config::metrics::v2::StatsMatcher stats_matcher) {
+  void initialize(envoy::config::metrics::v3alpha::StatsMatcher stats_matcher) {
     config_helper_.addConfigModifier(
-        [stats_matcher](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [stats_matcher](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           *bootstrap.mutable_stats_config()->mutable_stats_matcher() = stats_matcher;
         });
     initialize();
diff --git a/test/integration/integration_test.cc b/test/integration/integration_test.cc
index f3a8d5b90dcf..668ead5cda71 100644
--- a/test/integration/integration_test.cc
+++ b/test/integration/integration_test.cc
@@ -2,9 +2,9 @@
 
 #include <string>
 
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/http/header_map_impl.h"
 #include "common/http/headers.h"
@@ -37,12 +37,14 @@ std::string normalizeDate(const std::string& s) {
 }
 
 void setDisallowAbsoluteUrl(
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager&
+        hcm) {
   hcm.mutable_http_protocol_options()->mutable_allow_absolute_url()->set_value(false);
 };
 
 void setAllowHttp10WithDefaultHost(
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager&
+        hcm) {
   hcm.mutable_http_protocol_options()->set_accept_http_10(true);
   hcm.mutable_http_protocol_options()->set_default_host_for_http_10("default.com");
 }
@@ -56,10 +58,11 @@ INSTANTIATE_TEST_SUITE_P(IpVersions, IntegrationTest,
 // Make sure we have correctly specified per-worker performance stats.
 TEST_P(IntegrationTest, PerWorkerStatsAndBalancing) {
   concurrency_ = 2;
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
-    listener->mutable_connection_balance_config()->mutable_exact_balance();
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
+        listener->mutable_connection_balance_config()->mutable_exact_balance();
+      });
   initialize();
 
   // Per-worker listener stats.
@@ -145,8 +148,8 @@ TEST_P(IntegrationTest, RouterDirectResponse) {
   static const std::string prefix("/");
   static const Http::Code status(Http::Code::OK);
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* route_config = hcm.mutable_route_config();
         auto* header_value_option = route_config->mutable_response_headers_to_add()->Add();
         header_value_option->mutable_header()->set_key("x-additional-header");
@@ -244,7 +247,7 @@ TEST_P(IntegrationTest, EnvoyProxyingLate100ContinueWithEncoderFilter) {
 // This is a regression for https://github.com/envoyproxy/envoy/issues/2715 and validates that a
 // pending request is not sent on a connection that has been half-closed.
 TEST_P(IntegrationTest, UpstreamDisconnectWithTwoRequests) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
     auto* cluster = static_resources->mutable_clusters(0);
     // Ensure we only have one connection upstream, one request active at a time.
@@ -675,7 +678,7 @@ TEST_P(IntegrationTest, AbsolutePath) {
   // Configure www.redirect.com to send a redirect, and ensure the redirect is
   // encountered via absolute URL.
   auto host = config_helper_.createVirtualHost("www.redirect.com", "/");
-  host.set_require_tls(envoy::api::v2::route::VirtualHost::ALL);
+  host.set_require_tls(envoy::config::route::v3alpha::VirtualHost::ALL);
   config_helper_.addVirtualHost(host);
 
   initialize();
@@ -690,7 +693,7 @@ TEST_P(IntegrationTest, AbsolutePathWithPort) {
   // Configure www.namewithport.com:1234 to send a redirect, and ensure the redirect is
   // encountered via absolute URL with a port.
   auto host = config_helper_.createVirtualHost("www.namewithport.com:1234", "/");
-  host.set_require_tls(envoy::api::v2::route::VirtualHost::ALL);
+  host.set_require_tls(envoy::config::route::v3alpha::VirtualHost::ALL);
   config_helper_.addVirtualHost(host);
   initialize();
   std::string response;
@@ -706,7 +709,7 @@ TEST_P(IntegrationTest, AbsolutePathWithoutPort) {
   // Set a matcher for www.namewithport.com:1234 and verify http://www.namewithport.com does not
   // match
   auto host = config_helper_.createVirtualHost("www.namewithport.com:1234", "/");
-  host.set_require_tls(envoy::api::v2::route::VirtualHost::ALL);
+  host.set_require_tls(envoy::config::route::v3alpha::VirtualHost::ALL);
   config_helper_.addVirtualHost(host);
   initialize();
   std::string response;
@@ -719,14 +722,15 @@ TEST_P(IntegrationTest, AbsolutePathWithoutPort) {
 // Ensure that connect behaves the same with allow_absolute_url enabled and without
 TEST_P(IntegrationTest, Connect) {
   const std::string& request = "CONNECT www.somewhere.com:80 HTTP/1.1\r\nHost: host\r\n\r\n";
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    // Clone the whole listener.
-    auto static_resources = bootstrap.mutable_static_resources();
-    auto* old_listener = static_resources->mutable_listeners(0);
-    auto* cloned_listener = static_resources->add_listeners();
-    cloned_listener->CopyFrom(*old_listener);
-    old_listener->set_name("http_forward");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        // Clone the whole listener.
+        auto static_resources = bootstrap.mutable_static_resources();
+        auto* old_listener = static_resources->mutable_listeners(0);
+        auto* cloned_listener = static_resources->add_listeners();
+        cloned_listener->CopyFrom(*old_listener);
+        old_listener->set_name("http_forward");
+      });
   // Set the first listener to disallow absolute URLs.
   config_helper_.addConfigModifier(&setDisallowAbsoluteUrl);
   initialize();
@@ -879,11 +883,8 @@ TEST_P(IntegrationTest, TestFailedBind) {
 }
 
 ConfigHelper::HttpModifierFunction setVia(const std::string& via) {
-  return
-      [via](
-          envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.set_via(via);
-      };
+  return [via](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                   HttpConnectionManager& hcm) { hcm.set_via(via); };
 }
 
 // Validate in a basic header-only request we get via header insertion.
@@ -960,9 +961,8 @@ TEST_P(IntegrationTest, TestDelayedConnectionTeardownConfig) {
                            "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_delayed_close_timeout()->set_seconds(0);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.mutable_delayed_close_timeout()->set_seconds(0); });
   initialize();
 
   fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
@@ -996,11 +996,11 @@ TEST_P(IntegrationTest, TestDelayedConnectionTeardownTimeoutTrigger) {
   config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
                            "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        // 200ms.
-        hcm.mutable_delayed_close_timeout()->set_nanos(200000000);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) {
+    // 200ms.
+    hcm.mutable_delayed_close_timeout()->set_nanos(200000000);
+  });
 
   initialize();
 
@@ -1037,7 +1037,7 @@ TEST_P(IntegrationTest, TestClearingRouteCacheFilter) {
 
 // Test that if no connection pools are free, Envoy fails to establish an upstream connection.
 TEST_P(IntegrationTest, NoConnectionPoolsFree) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
     auto* cluster = static_resources->mutable_clusters(0);
 
diff --git a/test/integration/load_stats_integration_test.cc b/test/integration/load_stats_integration_test.cc
index 4921d4cd6868..e6036077511f 100644
--- a/test/integration/load_stats_integration_test.cc
+++ b/test/integration/load_stats_integration_test.cc
@@ -1,10 +1,10 @@
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/endpoint/endpoint.pb.h"
-#include "envoy/api/v2/endpoint/load_report.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/service/load_stats/v2/lrs.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint_components.pb.h"
+#include "envoy/config/endpoint/v3alpha/load_report.pb.h"
+#include "envoy/service/load_stats/v3alpha/lrs.pb.h"
 
 #include "common/config/resources.h"
 
@@ -27,7 +27,7 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
     setDeterministic();
   }
 
-  void addEndpoint(envoy::api::v2::endpoint::LocalityLbEndpoints& locality_lb_endpoints,
+  void addEndpoint(envoy::config::endpoint::v3alpha::LocalityLbEndpoints& locality_lb_endpoints,
                    uint32_t index, uint32_t& num_endpoints) {
     setUpstreamAddress(index + 1, *locality_lb_endpoints.add_lb_endpoints());
     ++num_endpoints;
@@ -53,7 +53,7 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
                                    const LocalityAssignment& p1_winter_upstreams,
                                    const LocalityAssignment& p1_dragon_upstreams) {
     uint32_t num_endpoints = 0;
-    envoy::api::v2::ClusterLoadAssignment cluster_load_assignment;
+    envoy::config::endpoint::v3alpha::ClusterLoadAssignment cluster_load_assignment;
     // EDS service_name is set in cluster_0
     cluster_load_assignment.set_cluster_name("service_name_0");
 
@@ -108,10 +108,11 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
 
   void initialize() override {
     setUpstreamCount(upstream_endpoints_);
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       // Setup load reporting and corresponding gRPC cluster.
       auto* loadstats_config = bootstrap.mutable_cluster_manager()->mutable_load_stats_config();
-      loadstats_config->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+      loadstats_config->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
       loadstats_config->add_grpc_services()->mutable_envoy_grpc()->set_cluster_name("load_report");
       auto* load_report_cluster = bootstrap.mutable_static_resources()->add_clusters();
       load_report_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
@@ -127,7 +128,7 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
       // Switch predefined cluster_0 to EDS filesystem sourcing.
       auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
       cluster_0->mutable_hosts()->Clear();
-      cluster_0->set_type(envoy::api::v2::Cluster::EDS);
+      cluster_0->set_type(envoy::config::cluster::v3alpha::Cluster::EDS);
       auto* eds_cluster_config = cluster_0->mutable_eds_cluster_config();
       eds_cluster_config->mutable_eds_config()->set_path(eds_helper_.eds_path());
       eds_cluster_config->set_service_name("service_name_0");
@@ -160,9 +161,9 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
     RELEASE_ASSERT(result, result.message());
   }
 
-  void
-  mergeLoadStats(envoy::service::load_stats::v2::LoadStatsRequest& loadstats_request,
-                 const envoy::service::load_stats::v2::LoadStatsRequest& local_loadstats_request) {
+  void mergeLoadStats(
+      envoy::service::load_stats::v3alpha::LoadStatsRequest& loadstats_request,
+      const envoy::service::load_stats::v3alpha::LoadStatsRequest& local_loadstats_request) {
     ASSERT(loadstats_request.cluster_stats_size() <= 1);
     ASSERT(local_loadstats_request.cluster_stats_size() <= 1);
 
@@ -231,9 +232,11 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
   }
 
   void waitForLoadStatsRequest(
-      const std::vector<envoy::api::v2::endpoint::UpstreamLocalityStats>& expected_locality_stats,
+      const std::vector<envoy::config::endpoint::v3alpha::UpstreamLocalityStats>&
+          expected_locality_stats,
       uint64_t dropped = 0) {
-    Protobuf::RepeatedPtrField<envoy::api::v2::endpoint::ClusterStats> expected_cluster_stats;
+    Protobuf::RepeatedPtrField<envoy::config::endpoint::v3alpha::ClusterStats>
+        expected_cluster_stats;
     if (!expected_locality_stats.empty() || dropped != 0) {
       auto* cluster_stats = expected_cluster_stats.Add();
       cluster_stats->set_cluster_name("cluster_0");
@@ -247,11 +250,11 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
           Protobuf::RepeatedPtrFieldBackInserter(cluster_stats->mutable_upstream_locality_stats()));
     }
 
-    envoy::service::load_stats::v2::LoadStatsRequest loadstats_request;
+    envoy::service::load_stats::v3alpha::LoadStatsRequest loadstats_request;
     // Because multiple load stats may be sent while load in being sent (on slow machines), loop and
     // merge until all the expected load has been reported.
     do {
-      envoy::service::load_stats::v2::LoadStatsRequest local_loadstats_request;
+      envoy::service::load_stats::v3alpha::LoadStatsRequest local_loadstats_request;
       AssertionResult result =
           loadstats_stream_->waitForGrpcMessage(*dispatcher_, local_loadstats_request);
       RELEASE_ASSERT(result, result.message());
@@ -304,7 +307,7 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
   }
 
   void requestLoadStatsResponse(const std::vector<std::string>& clusters) {
-    envoy::service::load_stats::v2::LoadStatsResponse loadstats_response;
+    envoy::service::load_stats::v3alpha::LoadStatsResponse loadstats_response;
     loadstats_response.mutable_load_reporting_interval()->MergeFrom(
         Protobuf::util::TimeUtil::MillisecondsToDuration(load_report_interval_ms_));
     for (const auto& cluster : clusters) {
@@ -315,11 +318,10 @@ class LoadStatsIntegrationTest : public testing::TestWithParam<Network::Address:
     test_server_->waitForCounterGe("load_reporter.requests", ++load_requests_);
   }
 
-  envoy::api::v2::endpoint::UpstreamLocalityStats localityStats(const std::string& sub_zone,
-                                                                uint64_t success, uint64_t error,
-                                                                uint64_t active, uint64_t issued,
-                                                                uint32_t priority = 0) {
-    envoy::api::v2::endpoint::UpstreamLocalityStats locality_stats;
+  envoy::config::endpoint::v3alpha::UpstreamLocalityStats
+  localityStats(const std::string& sub_zone, uint64_t success, uint64_t error, uint64_t active,
+                uint64_t issued, uint32_t priority = 0) {
+    envoy::config::endpoint::v3alpha::UpstreamLocalityStats locality_stats;
     auto* locality = locality_stats.mutable_locality();
     locality->set_region("some_region");
     locality->set_zone("zone_name");
@@ -595,7 +597,7 @@ TEST_P(LoadStatsIntegrationTest, InProgress) {
 
 // Validate the load reports for dropped requests make sense.
 TEST_P(LoadStatsIntegrationTest, Dropped) {
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters(0);
     auto* thresholds = cluster_0->mutable_circuit_breakers()->add_thresholds();
     thresholds->mutable_max_pending_requests()->set_value(0);
diff --git a/test/integration/overload_integration_test.cc b/test/integration/overload_integration_test.cc
index 0dd2b424b3a9..786cd8ee72e2 100644
--- a/test/integration/overload_integration_test.cc
+++ b/test/integration/overload_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/overload/v2alpha/overload.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/overload/v3alpha/overload.pb.h"
 
 #include "test/integration/http_protocol_integration.h"
 
@@ -14,8 +14,9 @@ class OverloadIntegrationTest : public HttpProtocolIntegrationTest {
         file_updater_(injected_resource_filename_) {}
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      const std::string overload_config = fmt::format(R"EOF(
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          const std::string overload_config = fmt::format(R"EOF(
         refresh_interval:
           seconds: 0
           nanos: 1000000
@@ -41,11 +42,11 @@ class OverloadIntegrationTest : public HttpProtocolIntegrationTest {
                 threshold:
                   value: 0.95
       )EOF",
-                                                      injected_resource_filename_);
-      *bootstrap.mutable_overload_manager() =
-          TestUtility::parseYaml<envoy::config::overload::v2alpha::OverloadManager>(
-              overload_config);
-    });
+                                                          injected_resource_filename_);
+          *bootstrap.mutable_overload_manager() =
+              TestUtility::parseYaml<envoy::config::overload::v3alpha::OverloadManager>(
+                  overload_config);
+        });
     updateResource(0);
     HttpIntegrationTest::initialize();
   }
diff --git a/test/integration/protocol_integration_test.cc b/test/integration/protocol_integration_test.cc
index 34c3d942466a..599acf5fbfd0 100644
--- a/test/integration/protocol_integration_test.cc
+++ b/test/integration/protocol_integration_test.cc
@@ -5,11 +5,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/route/route.pb.h"
 #include "envoy/buffer/buffer.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/http/header_map.h"
 #include "envoy/registry/registry.h"
 
@@ -42,7 +42,8 @@ using testing::HasSubstr;
 namespace Envoy {
 
 void setDoNotValidateRouteConfig(
-    envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
+    envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager&
+        hcm) {
   auto* route_config = hcm.mutable_route_config();
   route_config->mutable_validate_clusters()->set_value(false);
 };
@@ -113,7 +114,7 @@ TEST_P(DownstreamProtocolIntegrationTest, RouterClusterNotFound404) {
   config_helper_.addConfigModifier(&setDoNotValidateRouteConfig);
   auto host = config_helper_.createVirtualHost("foo.com", "/unknown", "unknown_cluster");
   host.mutable_routes(0)->mutable_route()->set_cluster_not_found_response_code(
-      envoy::api::v2::route::RouteAction::NOT_FOUND);
+      envoy::config::route::v3alpha::RouteAction::NOT_FOUND);
   config_helper_.addVirtualHost(host);
   initialize();
 
@@ -128,7 +129,7 @@ TEST_P(DownstreamProtocolIntegrationTest, RouterClusterNotFound503) {
   config_helper_.addConfigModifier(&setDoNotValidateRouteConfig);
   auto host = config_helper_.createVirtualHost("foo.com", "/unknown", "unknown_cluster");
   host.mutable_routes(0)->mutable_route()->set_cluster_not_found_response_code(
-      envoy::api::v2::route::RouteAction::SERVICE_UNAVAILABLE);
+      envoy::config::route::v3alpha::RouteAction::SERVICE_UNAVAILABLE);
   config_helper_.addVirtualHost(host);
   initialize();
 
@@ -141,7 +142,7 @@ TEST_P(DownstreamProtocolIntegrationTest, RouterClusterNotFound503) {
 // Add a route which redirects HTTP to HTTPS, and verify Envoy sends a 301
 TEST_P(ProtocolIntegrationTest, RouterRedirect) {
   auto host = config_helper_.createVirtualHost("www.redirect.com", "/");
-  host.set_require_tls(envoy::api::v2::route::VirtualHost::ALL);
+  host.set_require_tls(envoy::config::route::v3alpha::VirtualHost::ALL);
   config_helper_.addVirtualHost(host);
   initialize();
 
@@ -340,7 +341,7 @@ TEST_P(DownstreamProtocolIntegrationTest, RetryPriority) {
   config_helper_.addVirtualHost(host);
 
   // Use load assignments instead of static hosts. Necessary in order to use priorities.
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
     auto load_assignment = cluster->mutable_load_assignment();
     load_assignment->set_cluster_name(cluster->name());
@@ -415,7 +416,7 @@ TEST_P(DownstreamProtocolIntegrationTest, RetryHostPredicateFilter) {
   config_helper_.addVirtualHost(host);
 
   // We want to work with a cluster with two hosts.
-  config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* new_host = bootstrap.mutable_static_resources()->mutable_clusters(0)->add_hosts();
     new_host->MergeFrom(bootstrap.static_resources().clusters(0).hosts(0));
   });
@@ -648,8 +649,8 @@ TEST_P(DownstreamProtocolIntegrationTest, LargeCookieParsingMany) {
   // Set header count limit to 2010.
   uint32_t max_count = 2010;
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_common_http_protocol_options()->mutable_max_headers_count()->set_value(
             max_count);
       });
@@ -697,11 +698,10 @@ TEST_P(DownstreamProtocolIntegrationTest, InvalidContentLength) {
 
 // TODO(PiotrSikora): move this HTTP/2 only variant to http2_integration_test.cc.
 TEST_P(DownstreamProtocolIntegrationTest, InvalidContentLengthAllowed) {
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
-        hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) -> void {
+    hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
+  });
 
   initialize();
 
@@ -753,11 +753,10 @@ TEST_P(DownstreamProtocolIntegrationTest, MultipleContentLengths) {
 
 // TODO(PiotrSikora): move this HTTP/2 only variant to http2_integration_test.cc.
 TEST_P(DownstreamProtocolIntegrationTest, MultipleContentLengthsAllowed) {
-  config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
-        hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
-      });
+  config_helper_.addConfigModifier([](envoy::extensions::filters::network::http_connection_manager::
+                                          v3alpha::HttpConnectionManager& hcm) -> void {
+    hcm.mutable_http2_protocol_options()->set_stream_error_on_invalid_http_messaging(true);
+  });
 
   initialize();
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -989,8 +988,8 @@ TEST_P(DownstreamProtocolIntegrationTest, ManyRequestTrailersAccepted) {
   // Set header (and trailer) count limit to 200.
   uint32_t max_count = 200;
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_common_http_protocol_options()->mutable_max_headers_count()->set_value(
             max_count);
       });
@@ -1040,8 +1039,8 @@ TEST_P(DownstreamProtocolIntegrationTest, ManyTrailerHeaders) {
 
   config_helper_.addConfigModifier(setEnableDownstreamTrailersHttp1());
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_max_request_headers_kb()->set_value(max_request_headers_kb_);
         hcm.mutable_common_http_protocol_options()->mutable_max_headers_count()->set_value(
             max_request_headers_count_);
@@ -1183,8 +1182,8 @@ name: passthrough-filter
 
   // Sets initial stream window to min value to make the client sensitive to a low watermark.
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_http2_protocol_options()->mutable_initial_stream_window_size()->set_value(
             Http::Http2Settings::MIN_INITIAL_STREAM_WINDOW_SIZE);
       });
@@ -1284,8 +1283,10 @@ TEST_P(DownstreamProtocolIntegrationTest, testEncodeHeadersReturnsStopAll) {
 name: encode-headers-return-stop-all-filter
 )EOF");
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.mutable_http2_protocol_options()->set_allow_metadata(true); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
+        hcm.mutable_http2_protocol_options()->set_allow_metadata(true);
+      });
 
   initialize();
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -1316,13 +1317,15 @@ TEST_P(DownstreamProtocolIntegrationTest, testEncodeHeadersReturnsStopAllWaterma
 name: encode-headers-return-stop-all-filter
 )EOF");
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void { hcm.mutable_http2_protocol_options()->set_allow_metadata(true); });
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
+        hcm.mutable_http2_protocol_options()->set_allow_metadata(true);
+      });
 
   // Sets initial stream window to min value to make the upstream sensitive to a low watermark.
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.mutable_http2_protocol_options()->mutable_initial_stream_window_size()->set_value(
             Http::Http2Settings::MIN_INITIAL_STREAM_WINDOW_SIZE);
       });
@@ -1408,9 +1411,8 @@ TEST_P(ProtocolIntegrationTest, TestDownstreamResetIdleTimeout) {
 TEST_P(ProtocolIntegrationTest, ConnDurationTimeoutBasic) {
   config_helper_.setDownstreamMaxConnectionDuration(std::chrono::milliseconds(500));
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_drain_timeout()->set_seconds(1);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.mutable_drain_timeout()->set_seconds(1); });
   initialize();
 
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -1434,9 +1436,8 @@ TEST_P(ProtocolIntegrationTest, ConnDurationTimeoutBasic) {
 TEST_P(ProtocolIntegrationTest, ConnDurationInflightRequest) {
   config_helper_.setDownstreamMaxConnectionDuration(std::chrono::milliseconds(500));
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_drain_timeout()->set_seconds(1);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.mutable_drain_timeout()->set_seconds(1); });
   initialize();
 
   codec_client_ = makeHttpConnection(lookupPort("http"));
@@ -1463,9 +1464,8 @@ TEST_P(ProtocolIntegrationTest, ConnDurationInflightRequest) {
 TEST_P(ProtocolIntegrationTest, ConnDurationTimeoutNoHttpRequest) {
   config_helper_.setDownstreamMaxConnectionDuration(std::chrono::milliseconds(500));
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.mutable_drain_timeout()->set_seconds(1);
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.mutable_drain_timeout()->set_seconds(1); });
   initialize();
 
   codec_client_ = makeHttpConnection(lookupPort("http"));
diff --git a/test/integration/proxy_proto_integration_test.cc b/test/integration/proxy_proto_integration_test.cc
index e1d4cc67a015..45fe46936ba6 100644
--- a/test/integration/proxy_proto_integration_test.cc
+++ b/test/integration/proxy_proto_integration_test.cc
@@ -1,7 +1,7 @@
 #include "test/integration/proxy_proto_integration_test.h"
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 
@@ -96,12 +96,14 @@ TEST_P(ProxyProtoIntegrationTest, DEPRECATED_FEATURE_TEST(OriginalDst)) {
   // Change the cluster to an original destination cluster. An original destination cluster
   // ignores the configured hosts, and instead uses the restored destination address from the
   // incoming (server) connection as the destination address for the outgoing (client) connection.
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
-    cluster->mutable_hosts()->Clear();
-    cluster->set_type(envoy::api::v2::Cluster::ORIGINAL_DST);
-    cluster->set_lb_policy(envoy::api::v2::Cluster::ORIGINAL_DST_LB);
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
+        cluster->mutable_hosts()->Clear();
+        cluster->set_type(envoy::config::cluster::v3alpha::Cluster::ORIGINAL_DST);
+        cluster->set_lb_policy(
+            envoy::config::cluster::v3alpha::Cluster::hidden_envoy_deprecated_ORIGINAL_DST_LB);
+      });
 
   ConnectionCreationFunction creator = [&]() -> Network::ClientConnectionPtr {
     Network::ClientConnectionPtr conn = makeClientConnection(lookupPort("http"));
@@ -126,12 +128,13 @@ TEST_P(ProxyProtoIntegrationTest, ClusterProvided) {
   // Change the cluster to an original destination cluster. An original destination cluster
   // ignores the configured hosts, and instead uses the restored destination address from the
   // incoming (server) connection as the destination address for the outgoing (client) connection.
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
-    cluster->mutable_hosts()->Clear();
-    cluster->set_type(envoy::api::v2::Cluster::ORIGINAL_DST);
-    cluster->set_lb_policy(envoy::api::v2::Cluster::CLUSTER_PROVIDED);
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
+        cluster->mutable_hosts()->Clear();
+        cluster->set_type(envoy::config::cluster::v3alpha::Cluster::ORIGINAL_DST);
+        cluster->set_lb_policy(envoy::config::cluster::v3alpha::Cluster::CLUSTER_PROVIDED);
+      });
 
   ConnectionCreationFunction creator = [&]() -> Network::ClientConnectionPtr {
     Network::ClientConnectionPtr conn = makeClientConnection(lookupPort("http"));
diff --git a/test/integration/proxy_proto_integration_test.h b/test/integration/proxy_proto_integration_test.h
index 4b4063916264..6e52daa02501 100644
--- a/test/integration/proxy_proto_integration_test.h
+++ b/test/integration/proxy_proto_integration_test.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/http/codec_client.h"
 
@@ -16,7 +16,7 @@ class ProxyProtoIntegrationTest : public testing::TestWithParam<Network::Address
 public:
   ProxyProtoIntegrationTest() : HttpIntegrationTest(Http::CodecClient::Type::HTTP1, GetParam()) {
     config_helper_.addConfigModifier(
-        [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
           auto* filter_chain = listener->mutable_filter_chains(0);
           filter_chain->mutable_use_proxy_proto()->set_value(true);
diff --git a/test/integration/ratelimit_integration_test.cc b/test/integration/ratelimit_integration_test.cc
index 5b8ad5301d9d..74c72a65fcc1 100644
--- a/test/integration/ratelimit_integration_test.cc
+++ b/test/integration/ratelimit_integration_test.cc
@@ -1,9 +1,9 @@
-#include "envoy/api/v2/listener/listener.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.h"
-#include "envoy/config/filter/http/rate_limit/v2/rate_limit.pb.validate.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
-#include "envoy/service/ratelimit/v2/rls.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.h"
+#include "envoy/extensions/filters/http/ratelimit/v3alpha/rate_limit.pb.validate.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/service/ratelimit/v3alpha/rls.pb.h"
 
 #include "common/buffer/zero_copy_input_stream_impl.h"
 #include "common/grpc/codec.h"
@@ -35,26 +35,27 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
 
   void initialize() override {
 
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      auto* ratelimit_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      ratelimit_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
-      ratelimit_cluster->set_name("ratelimit");
-      ratelimit_cluster->mutable_http2_protocol_options();
-
-      // enhance rate limit filter config based on the configuration of test.
-      TestUtility::loadFromYaml(base_filter_config_, proto_config_);
-      proto_config_.set_failure_mode_deny(failure_mode_deny_);
-      setGrpcService(*proto_config_.mutable_rate_limit_service()->mutable_grpc_service(),
-                     "ratelimit", fake_upstreams_.back()->localAddress());
-
-      envoy::api::v2::listener::Filter ratelimit_filter;
-      ratelimit_filter.set_name("envoy.rate_limit");
-      ratelimit_filter.mutable_typed_config()->PackFrom(proto_config_);
-      config_helper_.addFilter(MessageUtil::getJsonStringFromMessage(ratelimit_filter));
-    });
     config_helper_.addConfigModifier(
-        [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-               hcm) {
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          auto* ratelimit_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          ratelimit_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
+          ratelimit_cluster->set_name("ratelimit");
+          ratelimit_cluster->mutable_http2_protocol_options();
+
+          // enhance rate limit filter config based on the configuration of test.
+          TestUtility::loadFromYaml(base_filter_config_, proto_config_);
+          proto_config_.set_failure_mode_deny(failure_mode_deny_);
+          setGrpcService(*proto_config_.mutable_rate_limit_service()->mutable_grpc_service(),
+                         "ratelimit", fake_upstreams_.back()->localAddress());
+
+          envoy::config::listener::v3alpha::Filter ratelimit_filter;
+          ratelimit_filter.set_name("envoy.rate_limit");
+          ratelimit_filter.mutable_typed_config()->PackFrom(proto_config_);
+          config_helper_.addFilter(MessageUtil::getJsonStringFromMessage(ratelimit_filter));
+        });
+    config_helper_.addConfigModifier(
+        [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+               HttpConnectionManager& hcm) {
           auto* rate_limit = hcm.mutable_route_config()
                                  ->mutable_virtual_hosts(0)
                                  ->mutable_routes(0)
@@ -80,7 +81,7 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
     RELEASE_ASSERT(result, result.message());
     result = fake_ratelimit_connection_->waitForNewStream(*dispatcher_, ratelimit_request_);
     RELEASE_ASSERT(result, result.message());
-    envoy::service::ratelimit::v2::RateLimitRequest request_msg;
+    envoy::service::ratelimit::v3alpha::RateLimitRequest request_msg;
     result = ratelimit_request_->waitForGrpcMessage(*dispatcher_, request_msg);
     RELEASE_ASSERT(result, result.message());
     result = ratelimit_request_->waitForEndStream(*dispatcher_);
@@ -91,7 +92,7 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
     EXPECT_EQ("application/grpc",
               ratelimit_request_->headers().ContentType()->value().getStringView());
 
-    envoy::service::ratelimit::v2::RateLimitRequest expected_request_msg;
+    envoy::service::ratelimit::v3alpha::RateLimitRequest expected_request_msg;
     expected_request_msg.set_domain("some_domain");
     auto* entry = expected_request_msg.add_descriptors()->add_entries();
     entry->set_key("destination_cluster");
@@ -127,17 +128,17 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
               response_->headers().Status()->value().getStringView());
   }
 
-  void sendRateLimitResponse(envoy::service::ratelimit::v2::RateLimitResponse_Code code,
+  void sendRateLimitResponse(envoy::service::ratelimit::v3alpha::RateLimitResponse::Code code,
                              const Http::HeaderMapImpl& response_headers_to_add,
                              const Http::HeaderMapImpl& request_headers_to_add) {
     ratelimit_request_->startGrpcStream();
-    envoy::service::ratelimit::v2::RateLimitResponse response_msg;
+    envoy::service::ratelimit::v3alpha::RateLimitResponse response_msg;
     response_msg.set_overall_code(code);
 
     response_headers_to_add.iterate(
         [](const Http::HeaderEntry& h, void* context) -> Http::HeaderMap::Iterate {
-          auto header = static_cast<envoy::service::ratelimit::v2::RateLimitResponse*>(context)
-                            ->mutable_headers()
+          auto header = static_cast<envoy::service::ratelimit::v3alpha::RateLimitResponse*>(context)
+                            ->mutable_response_headers_to_add()
                             ->Add();
           header->set_key(std::string(h.key().getStringView()));
           header->set_value(std::string(h.value().getStringView()));
@@ -146,7 +147,7 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
         &response_msg);
     request_headers_to_add.iterate(
         [](const Http::HeaderEntry& h, void* context) -> Http::HeaderMap::Iterate {
-          auto header = static_cast<envoy::service::ratelimit::v2::RateLimitResponse*>(context)
+          auto header = static_cast<envoy::service::ratelimit::v3alpha::RateLimitResponse*>(context)
                             ->mutable_request_headers_to_add()
                             ->Add();
           header->set_key(std::string(h.key().getStringView()));
@@ -174,7 +175,7 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
   void basicFlow() {
     initiateClientConnection();
     waitForRatelimitRequest();
-    sendRateLimitResponse(envoy::service::ratelimit::v2::RateLimitResponse::OK,
+    sendRateLimitResponse(envoy::service::ratelimit::v3alpha::RateLimitResponse::OK,
                           Http::HeaderMapImpl{}, Http::HeaderMapImpl{});
     waitForSuccessfulUpstreamResponse();
     cleanup();
@@ -191,7 +192,7 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
   const uint64_t request_size_ = 1024;
   const uint64_t response_size_ = 512;
   bool failure_mode_deny_ = false;
-  envoy::config::filter::http::rate_limit::v2::RateLimit proto_config_{};
+  envoy::extensions::filters::http::ratelimit::v3alpha::RateLimit proto_config_{};
   const std::string base_filter_config_ = R"EOF(
     domain: some_domain
     timeout: 0.5s
@@ -218,7 +219,7 @@ TEST_P(RatelimitIntegrationTest, OkWithHeaders) {
                                                      {"x-ratelimit-remaining", "500"}};
   Http::TestHeaderMapImpl request_headers_to_add{{"x-ratelimit-done", "true"}};
 
-  sendRateLimitResponse(envoy::service::ratelimit::v2::RateLimitResponse::OK,
+  sendRateLimitResponse(envoy::service::ratelimit::v3alpha::RateLimitResponse::OK,
                         ratelimit_response_headers, request_headers_to_add);
   waitForSuccessfulUpstreamResponse();
 
@@ -250,7 +251,7 @@ TEST_P(RatelimitIntegrationTest, OkWithHeaders) {
 TEST_P(RatelimitIntegrationTest, OverLimit) {
   initiateClientConnection();
   waitForRatelimitRequest();
-  sendRateLimitResponse(envoy::service::ratelimit::v2::RateLimitResponse::OVER_LIMIT,
+  sendRateLimitResponse(envoy::service::ratelimit::v3alpha::RateLimitResponse::OVER_LIMIT,
                         Http::HeaderMapImpl{}, Http::HeaderMapImpl{});
   waitForFailedUpstreamResponse(429);
   cleanup();
@@ -265,7 +266,7 @@ TEST_P(RatelimitIntegrationTest, OverLimitWithHeaders) {
   waitForRatelimitRequest();
   Http::TestHeaderMapImpl ratelimit_response_headers{
       {"x-ratelimit-limit", "1000"}, {"x-ratelimit-remaining", "0"}, {"retry-after", "33"}};
-  sendRateLimitResponse(envoy::service::ratelimit::v2::RateLimitResponse::OVER_LIMIT,
+  sendRateLimitResponse(envoy::service::ratelimit::v3alpha::RateLimitResponse::OVER_LIMIT,
                         ratelimit_response_headers, Http::HeaderMapImpl{});
   waitForFailedUpstreamResponse(429);
 
diff --git a/test/integration/redirect_integration_test.cc b/test/integration/redirect_integration_test.cc
index c95c81974a48..c9da77267099 100644
--- a/test/integration/redirect_integration_test.cc
+++ b/test/integration/redirect_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/http_protocol_integration.h"
 
@@ -8,14 +8,14 @@ namespace Envoy {
 class RedirectIntegrationTest : public HttpProtocolIntegrationTest {
 public:
   void initialize() override {
-    envoy::api::v2::route::RetryPolicy retry_policy;
+    envoy::config::route::v3alpha::RetryPolicy retry_policy;
 
     auto pass_through = config_helper_.createVirtualHost("pass.through.internal.redirect");
     config_helper_.addVirtualHost(pass_through);
 
     auto handle = config_helper_.createVirtualHost("handle.internal.redirect");
     handle.mutable_routes(0)->mutable_route()->set_internal_redirect_action(
-        envoy::api::v2::route::RouteAction::HANDLE_INTERNAL_REDIRECT);
+        envoy::config::route::v3alpha::RouteAction::HANDLE_INTERNAL_REDIRECT);
     config_helper_.addVirtualHost(handle);
 
     HttpProtocolIntegrationTest::initialize();
@@ -53,9 +53,8 @@ TEST_P(RedirectIntegrationTest, InternalRedirectPassedThrough) {
 TEST_P(RedirectIntegrationTest, BasicInternalRedirect) {
   // Validate that header sanitization is only called once.
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.set_via("via_value");
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.set_via("via_value"); });
   initialize();
   fake_upstreams_[0]->set_allow_unexpected_disconnects(true);
 
@@ -88,9 +87,8 @@ TEST_P(RedirectIntegrationTest, BasicInternalRedirect) {
 TEST_P(RedirectIntegrationTest, InternalRedirectToDestinationWithBody) {
   // Validate that header sanitization is only called once.
   config_helper_.addConfigModifier(
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.set_via("via_value");
-      });
+      [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+             HttpConnectionManager& hcm) { hcm.set_via("via_value"); });
   config_helper_.addFilter(R"EOF(
   name: pause-filter
   typed_config:
diff --git a/test/integration/rtds_integration_test.cc b/test/integration/rtds_integration_test.cc
index 13baeb7ad170..4921d821c76c 100644
--- a/test/integration/rtds_integration_test.cc
+++ b/test/integration/rtds_integration_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/service/discovery/v2/rtds.pb.h"
+#include "envoy/service/runtime/v3alpha/rtds.pb.h"
 
 #include "test/common/grpc/grpc_client_integration.h"
 #include "test/integration/http_integration.h"
@@ -126,13 +126,13 @@ TEST_P(RtdsIntegrationTest, RtdsReload) {
 
   EXPECT_TRUE(compareDiscoveryRequest(Config::TypeUrl::get().Runtime, "", {"some_rtds_layer"},
                                       {"some_rtds_layer"}, {}, true));
-  auto some_rtds_layer = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  auto some_rtds_layer = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_rtds_layer
     layer:
       foo: bar
       baz: meh
   )EOF");
-  sendDiscoveryResponse<envoy::service::discovery::v2::Runtime>(
+  sendDiscoveryResponse<envoy::service::runtime::v3alpha::Runtime>(
       Config::TypeUrl::get().Runtime, {some_rtds_layer}, {some_rtds_layer}, {}, "1");
   test_server_->waitForCounterGe("runtime.load_success", initial_load_success_ + 1);
 
@@ -147,12 +147,12 @@ TEST_P(RtdsIntegrationTest, RtdsReload) {
 
   EXPECT_TRUE(
       compareDiscoveryRequest(Config::TypeUrl::get().Runtime, "1", {"some_rtds_layer"}, {}, {}));
-  some_rtds_layer = TestUtility::parseYaml<envoy::service::discovery::v2::Runtime>(R"EOF(
+  some_rtds_layer = TestUtility::parseYaml<envoy::service::runtime::v3alpha::Runtime>(R"EOF(
     name: some_rtds_layer
     layer:
       baz: saz
   )EOF");
-  sendDiscoveryResponse<envoy::service::discovery::v2::Runtime>(
+  sendDiscoveryResponse<envoy::service::runtime::v3alpha::Runtime>(
       Config::TypeUrl::get().Runtime, {some_rtds_layer}, {some_rtds_layer}, {}, "2");
   test_server_->waitForCounterGe("runtime.load_success", initial_load_success_ + 2);
 
diff --git a/test/integration/scoped_rds_integration_test.cc b/test/integration/scoped_rds_integration_test.cc
index 81307ce10562..4f30c9fe368f 100644
--- a/test/integration/scoped_rds_integration_test.cc
+++ b/test/integration/scoped_rds_integration_test.cc
@@ -1,10 +1,10 @@
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/core/grpc_service.pb.h"
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/srds.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/scoped_route.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/config/api_version.h"
 #include "common/config/resources.h"
@@ -41,7 +41,7 @@ class ScopedRdsIntegrationTest : public HttpIntegrationTest,
     // Setup two upstream hosts, one for each cluster.
     setUpstreamCount(2);
 
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       // Add the static cluster to serve SRDS.
       auto* cluster_1 = bootstrap.mutable_static_resources()->add_clusters();
       cluster_1->MergeFrom(bootstrap.static_resources().clusters()[0]);
@@ -61,8 +61,8 @@ class ScopedRdsIntegrationTest : public HttpIntegrationTest,
     });
 
     config_helper_.addConfigModifier(
-        [this](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                   http_connection_manager) {
+        [this](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                   HttpConnectionManager& http_connection_manager) {
           const std::string& scope_key_builder_config_yaml = R"EOF(
 fragments:
   - header_value_extractor:
@@ -72,28 +72,30 @@ class ScopedRdsIntegrationTest : public HttpIntegrationTest,
         key: x-foo-key
         separator: =
 )EOF";
-          envoy::config::filter::network::http_connection_manager::v2::ScopedRoutes::ScopeKeyBuilder
-              scope_key_builder;
+          envoy::extensions::filters::network::http_connection_manager::v3alpha::ScopedRoutes::
+              ScopeKeyBuilder scope_key_builder;
           TestUtility::loadFromYaml(scope_key_builder_config_yaml, scope_key_builder);
           auto* scoped_routes = http_connection_manager.mutable_scoped_routes();
           scoped_routes->set_name(srds_config_name_);
           *scoped_routes->mutable_scope_key_builder() = scope_key_builder;
 
-          envoy::api::v2::core::ApiConfigSource* rds_api_config_source =
+          envoy::config::core::v3alpha::ApiConfigSource* rds_api_config_source =
               scoped_routes->mutable_rds_config_source()->mutable_api_config_source();
-          rds_api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
-          envoy::api::v2::core::GrpcService* grpc_service =
+          rds_api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
+          envoy::config::core::v3alpha::GrpcService* grpc_service =
               rds_api_config_source->add_grpc_services();
           setGrpcService(*grpc_service, "rds_cluster", getRdsFakeUpstream().localAddress());
 
-          envoy::api::v2::core::ApiConfigSource* srds_api_config_source =
+          envoy::config::core::v3alpha::ApiConfigSource* srds_api_config_source =
               scoped_routes->mutable_scoped_rds()
                   ->mutable_scoped_rds_config_source()
                   ->mutable_api_config_source();
           if (isDelta()) {
-            srds_api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::DELTA_GRPC);
+            srds_api_config_source->set_api_type(
+                envoy::config::core::v3alpha::ApiConfigSource::DELTA_GRPC);
           } else {
-            srds_api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+            srds_api_config_source->set_api_type(
+                envoy::config::core::v3alpha::ApiConfigSource::GRPC);
           }
           grpc_service = srds_api_config_source->add_grpc_services();
           setGrpcService(*grpc_service, "srds_cluster", getScopedRdsFakeUpstream().localAddress());
@@ -166,7 +168,7 @@ class ScopedRdsIntegrationTest : public HttpIntegrationTest,
     response.set_version_info(version);
     response.set_type_url(Config::TypeUrl::get().RouteConfiguration);
     auto route_configuration =
-        TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(route_config);
+        TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(route_config);
     response.add_resources()->PackFrom(API_DOWNGRADE(route_configuration));
     ASSERT(rds_upstream_info_.stream_by_resource_name_[route_configuration.name()] != nullptr);
     rds_upstream_info_.stream_by_resource_name_[route_configuration.name()]->sendGrpcMessage(
@@ -197,7 +199,7 @@ class ScopedRdsIntegrationTest : public HttpIntegrationTest,
       *response.add_removed_resources() = scope_name;
     }
     for (const auto& resource_proto : to_add_list) {
-      envoy::api::v2::ScopedRouteConfiguration scoped_route_proto;
+      envoy::config::route::v3alpha::ScopedRouteConfiguration scoped_route_proto;
       TestUtility::loadFromYaml(resource_proto, scoped_route_proto);
       auto resource = response.add_resources();
       resource->set_name(scoped_route_proto.name());
@@ -217,7 +219,7 @@ class ScopedRdsIntegrationTest : public HttpIntegrationTest,
     response.set_type_url(Config::TypeUrl::get().ScopedRouteConfiguration);
 
     for (const auto& resource_proto : resource_protos) {
-      envoy::api::v2::ScopedRouteConfiguration scoped_route_proto;
+      envoy::config::route::v3alpha::ScopedRouteConfiguration scoped_route_proto;
       TestUtility::loadFromYaml(resource_proto, scoped_route_proto);
       response.add_resources()->PackFrom(API_DOWNGRADE(scoped_route_proto));
     }
diff --git a/test/integration/sds_dynamic_integration_test.cc b/test/integration/sds_dynamic_integration_test.cc
index 1ea3f1bc599b..298ae17443e5 100644
--- a/test/integration/sds_dynamic_integration_test.cc
+++ b/test/integration/sds_dynamic_integration_test.cc
@@ -1,11 +1,11 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
 #include "envoy/api/v2/discovery.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/service/discovery/v2/sds.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
+#include "envoy/service/secret/v3alpha/sds.pb.h"
 
 #include "common/config/api_version.h"
 #include "common/config/resources.h"
@@ -37,7 +37,7 @@ namespace Envoy {
 namespace Ssl {
 
 // Hack to force linking of the service: https://github.com/google/protobuf/issues/4221.
-const envoy::service::discovery::v2::SdsDummy _sds_dummy;
+const envoy::service::secret::v3alpha::SdsDummy _sds_dummy;
 
 // Sds integration base class with following support:
 // * functions to create sds upstream, and send sds response
@@ -59,18 +59,19 @@ class SdsDynamicIntegrationBaseTest : public Grpc::GrpcClientIntegrationParamTes
     xds_stream_->startGrpcStream();
   }
 
-  void setUpSdsConfig(envoy::api::v2::auth::SdsSecretConfig* secret_config,
-                      const std::string& secret_name) {
+  void
+  setUpSdsConfig(envoy::extensions::transport_sockets::tls::v3alpha::SdsSecretConfig* secret_config,
+                 const std::string& secret_name) {
     secret_config->set_name(secret_name);
     auto* config_source = secret_config->mutable_sds_config();
     auto* api_config_source = config_source->mutable_api_config_source();
-    api_config_source->set_api_type(envoy::api::v2::core::ApiConfigSource::GRPC);
+    api_config_source->set_api_type(envoy::config::core::v3alpha::ApiConfigSource::GRPC);
     auto* grpc_service = api_config_source->add_grpc_services();
     setGrpcService(*grpc_service, "sds_cluster", fake_upstreams_.back()->localAddress());
   }
 
-  envoy::api::v2::auth::Secret getServerSecret() {
-    envoy::api::v2::auth::Secret secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret getServerSecret() {
+    envoy::extensions::transport_sockets::tls::v3alpha::Secret secret;
     secret.set_name(server_cert_);
     auto* tls_certificate = secret.mutable_tls_certificate();
     tls_certificate->mutable_certificate_chain()->set_filename(
@@ -80,8 +81,8 @@ class SdsDynamicIntegrationBaseTest : public Grpc::GrpcClientIntegrationParamTes
     return secret;
   }
 
-  envoy::api::v2::auth::Secret getCvcSecret() {
-    envoy::api::v2::auth::Secret secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret getCvcSecret() {
+    envoy::extensions::transport_sockets::tls::v3alpha::Secret secret;
     secret.set_name(validation_secret_);
     auto* validation_context = secret.mutable_validation_context();
     validation_context->mutable_trusted_ca()->set_filename(
@@ -90,8 +91,8 @@ class SdsDynamicIntegrationBaseTest : public Grpc::GrpcClientIntegrationParamTes
     return secret;
   }
 
-  envoy::api::v2::auth::Secret getCvcSecretWithOnlyTrustedCa() {
-    envoy::api::v2::auth::Secret secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret getCvcSecretWithOnlyTrustedCa() {
+    envoy::extensions::transport_sockets::tls::v3alpha::Secret secret;
     secret.set_name(validation_secret_);
     auto* validation_context = secret.mutable_validation_context();
     validation_context->mutable_trusted_ca()->set_filename(
@@ -99,8 +100,8 @@ class SdsDynamicIntegrationBaseTest : public Grpc::GrpcClientIntegrationParamTes
     return secret;
   }
 
-  envoy::api::v2::auth::Secret getClientSecret() {
-    envoy::api::v2::auth::Secret secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret getClientSecret() {
+    envoy::extensions::transport_sockets::tls::v3alpha::Secret secret;
     secret.set_name(client_cert_);
     auto* tls_certificate = secret.mutable_tls_certificate();
     tls_certificate->mutable_certificate_chain()->set_filename(
@@ -110,14 +111,15 @@ class SdsDynamicIntegrationBaseTest : public Grpc::GrpcClientIntegrationParamTes
     return secret;
   }
 
-  envoy::api::v2::auth::Secret getWrongSecret(const std::string& secret_name) {
-    envoy::api::v2::auth::Secret secret;
+  envoy::extensions::transport_sockets::tls::v3alpha::Secret
+  getWrongSecret(const std::string& secret_name) {
+    envoy::extensions::transport_sockets::tls::v3alpha::Secret secret;
     secret.set_name(secret_name);
     secret.mutable_tls_certificate();
     return secret;
   }
 
-  void sendSdsResponse(const envoy::api::v2::auth::Secret& secret) {
+  void sendSdsResponse(const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret) {
     API_NO_BOOST(envoy::api::v2::DiscoveryResponse) discovery_response;
     discovery_response.set_version_info("1");
     discovery_response.set_type_url(Config::TypeUrl::get().Secret);
@@ -142,33 +144,34 @@ class SdsDynamicIntegrationBaseTest : public Grpc::GrpcClientIntegrationParamTes
 class SdsDynamicDownstreamIntegrationTest : public SdsDynamicIntegrationBaseTest {
 public:
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      envoy::api::v2::auth::DownstreamTlsContext tls_context;
-      auto* common_tls_context = tls_context.mutable_common_tls_context();
-      auto* transport_socket = bootstrap.mutable_static_resources()
-                                   ->mutable_listeners(0)
-                                   ->mutable_filter_chains(0)
-                                   ->mutable_transport_socket();
-      common_tls_context->add_alpn_protocols("http/1.1");
-
-      auto* validation_context = common_tls_context->mutable_validation_context();
-      validation_context->mutable_trusted_ca()->set_filename(
-          TestEnvironment::runfilesPath("test/config/integration/certs/cacert.pem"));
-      validation_context->add_verify_certificate_hash(TEST_CLIENT_CERT_HASH);
-
-      // Modify the listener ssl cert to use SDS from sds_cluster
-      auto* secret_config = common_tls_context->add_tls_certificate_sds_secret_configs();
-      setUpSdsConfig(secret_config, "server_cert");
-
-      transport_socket->set_name("envoy.transport_sockets.tls");
-      transport_socket->mutable_typed_config()->PackFrom(tls_context);
-
-      // Add a static sds cluster
-      auto* sds_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      sds_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
-      sds_cluster->set_name("sds_cluster");
-      sds_cluster->mutable_http2_protocol_options();
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
+          auto* common_tls_context = tls_context.mutable_common_tls_context();
+          auto* transport_socket = bootstrap.mutable_static_resources()
+                                       ->mutable_listeners(0)
+                                       ->mutable_filter_chains(0)
+                                       ->mutable_transport_socket();
+          common_tls_context->add_alpn_protocols("http/1.1");
+
+          auto* validation_context = common_tls_context->mutable_validation_context();
+          validation_context->mutable_trusted_ca()->set_filename(
+              TestEnvironment::runfilesPath("test/config/integration/certs/cacert.pem"));
+          validation_context->add_verify_certificate_hash(TEST_CLIENT_CERT_HASH);
+
+          // Modify the listener ssl cert to use SDS from sds_cluster
+          auto* secret_config = common_tls_context->add_tls_certificate_sds_secret_configs();
+          setUpSdsConfig(secret_config, "server_cert");
+
+          transport_socket->set_name("envoy.transport_sockets.tls");
+          transport_socket->mutable_typed_config()->PackFrom(tls_context);
+
+          // Add a static sds cluster
+          auto* sds_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          sds_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
+          sds_cluster->set_name("sds_cluster");
+          sds_cluster->mutable_http2_protocol_options();
+        });
 
     HttpIntegrationTest::initialize();
     client_ssl_ctx_ = createClientSslTransportSocketFactory({}, context_manager_, *api_);
@@ -248,12 +251,13 @@ class SdsDynamicDownstreamCertValidationContextTest : public SdsDynamicDownstrea
   SdsDynamicDownstreamCertValidationContextTest() = default;
 
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([this](
+                                         envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* transport_socket = bootstrap.mutable_static_resources()
                                    ->mutable_listeners(0)
                                    ->mutable_filter_chains(0)
                                    ->mutable_transport_socket();
-      envoy::api::v2::auth::DownstreamTlsContext tls_context;
+      envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
       auto* common_tls_context = tls_context.mutable_common_tls_context();
       common_tls_context->add_alpn_protocols("http/1.1");
 
@@ -336,24 +340,25 @@ TEST_P(SdsDynamicDownstreamCertValidationContextTest, CombinedCertValidationCont
 class SdsDynamicUpstreamIntegrationTest : public SdsDynamicIntegrationBaseTest {
 public:
   void initialize() override {
-    config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      // add sds cluster first.
-      auto* sds_cluster = bootstrap.mutable_static_resources()->add_clusters();
-      sds_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
-      sds_cluster->set_name("sds_cluster");
-      sds_cluster->mutable_http2_protocol_options();
-
-      // change the first cluster with ssl and sds.
-      auto* transport_socket =
-          bootstrap.mutable_static_resources()->mutable_clusters(0)->mutable_transport_socket();
-      envoy::api::v2::auth::UpstreamTlsContext tls_context;
-      auto* secret_config =
-          tls_context.mutable_common_tls_context()->add_tls_certificate_sds_secret_configs();
-      setUpSdsConfig(secret_config, "client_cert");
-
-      transport_socket->set_name("envoy.transport_sockets.tls");
-      transport_socket->mutable_typed_config()->PackFrom(tls_context);
-    });
+    config_helper_.addConfigModifier(
+        [this](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+          // add sds cluster first.
+          auto* sds_cluster = bootstrap.mutable_static_resources()->add_clusters();
+          sds_cluster->MergeFrom(bootstrap.static_resources().clusters()[0]);
+          sds_cluster->set_name("sds_cluster");
+          sds_cluster->mutable_http2_protocol_options();
+
+          // change the first cluster with ssl and sds.
+          auto* transport_socket =
+              bootstrap.mutable_static_resources()->mutable_clusters(0)->mutable_transport_socket();
+          envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
+          auto* secret_config =
+              tls_context.mutable_common_tls_context()->add_tls_certificate_sds_secret_configs();
+          setUpSdsConfig(secret_config, "client_cert");
+
+          transport_socket->set_name("envoy.transport_sockets.tls");
+          transport_socket->mutable_typed_config()->PackFrom(tls_context);
+        });
 
     HttpIntegrationTest::initialize();
     registerTestServerPorts({"http"});
diff --git a/test/integration/sds_static_integration_test.cc b/test/integration/sds_static_integration_test.cc
index 534eb129ab0e..b08312439bd7 100644
--- a/test/integration/sds_static_integration_test.cc
+++ b/test/integration/sds_static_integration_test.cc
@@ -1,8 +1,8 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/event/dispatcher_impl.h"
@@ -39,12 +39,12 @@ class SdsStaticDownstreamIntegrationTest
       : HttpIntegrationTest(Http::CodecClient::Type::HTTP1, GetParam()) {}
 
   void initialize() override {
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* transport_socket = bootstrap.mutable_static_resources()
                                    ->mutable_listeners(0)
                                    ->mutable_filter_chains(0)
                                    ->mutable_transport_socket();
-      envoy::api::v2::auth::DownstreamTlsContext tls_context;
+      envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
       auto* common_tls_context = tls_context.mutable_common_tls_context();
       common_tls_context->add_alpn_protocols("http/1.1");
 
@@ -114,8 +114,8 @@ class SdsStaticUpstreamIntegrationTest : public testing::TestWithParam<Network::
       : HttpIntegrationTest(Http::CodecClient::Type::HTTP1, GetParam()) {}
 
   void initialize() override {
-    config_helper_.addConfigModifier([](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
-      envoy::api::v2::auth::UpstreamTlsContext tls_context;
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
+      envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
       tls_context.mutable_common_tls_context()->add_tls_certificate_sds_secret_configs()->set_name(
           "client_cert");
       auto* transport_socket =
diff --git a/test/integration/ssl_utility.cc b/test/integration/ssl_utility.cc
index 9a982e74ddf3..53db4898c3c5 100644
--- a/test/integration/ssl_utility.cc
+++ b/test/integration/ssl_utility.cc
@@ -1,6 +1,6 @@
 #include "test/integration/ssl_utility.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/json/json_loader.h"
 #include "common/network/utility.h"
@@ -49,7 +49,7 @@ createClientSslTransportSocketFactory(const ClientSslTransportOptions& options,
 )EOF";
   }
 
-  envoy::api::v2::auth::UpstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(yaml_plain), tls_context);
   auto* common_context = tls_context.mutable_common_tls_context();
 
@@ -58,8 +58,8 @@ createClientSslTransportSocketFactory(const ClientSslTransportOptions& options,
     common_context->add_alpn_protocols("http/1.1");
   }
   if (options.san_) {
-    common_context->mutable_validation_context()->add_verify_subject_alt_name(
-        "spiffe://lyft.com/backend-team");
+    common_context->mutable_validation_context()
+        ->add_hidden_envoy_deprecated_verify_subject_alt_name("spiffe://lyft.com/backend-team");
   }
   for (const std::string& cipher_suite : options.cipher_suites_) {
     common_context->mutable_tls_params()->add_cipher_suites(cipher_suite);
@@ -80,7 +80,7 @@ createClientSslTransportSocketFactory(const ClientSslTransportOptions& options,
 
 Network::TransportSocketFactoryPtr createUpstreamSslContext(ContextManager& context_manager,
                                                             Api::Api& api) {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   ConfigHelper::initializeTls({}, *tls_context.mutable_common_tls_context());
 
   NiceMock<Server::Configuration::MockTransportSocketFactoryContext> mock_factory_ctx;
diff --git a/test/integration/ssl_utility.h b/test/integration/ssl_utility.h
index 63774f916894..4c929320773b 100644
--- a/test/integration/ssl_utility.h
+++ b/test/integration/ssl_utility.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "envoy/api/api.h"
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/transport_socket.h"
 #include "envoy/secret/secret_manager.h"
@@ -36,8 +36,8 @@ struct ClientSslTransportOptions {
     return *this;
   }
 
-  ClientSslTransportOptions&
-  setTlsVersion(envoy::api::v2::auth::TlsParameters_TlsProtocol tls_version) {
+  ClientSslTransportOptions& setTlsVersion(
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol tls_version) {
     tls_version_ = tls_version;
     return *this;
   }
@@ -47,8 +47,8 @@ struct ClientSslTransportOptions {
   bool client_ecdsa_cert_{};
   std::vector<std::string> cipher_suites_{};
   std::string sigalgs_;
-  envoy::api::v2::auth::TlsParameters_TlsProtocol tls_version_{
-      envoy::api::v2::auth::TlsParameters::TLS_AUTO};
+  envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TlsProtocol tls_version_{
+      envoy::extensions::transport_sockets::tls::v3alpha::TlsParameters::TLS_AUTO};
 };
 
 Network::TransportSocketFactoryPtr
diff --git a/test/integration/stats_integration_test.cc b/test/integration/stats_integration_test.cc
index 7342a14adb74..d849d212f304 100644
--- a/test/integration/stats_integration_test.cc
+++ b/test/integration/stats_integration_test.cc
@@ -1,7 +1,7 @@
 #include <memory>
 
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats.h"
 
@@ -51,9 +51,10 @@ TEST_P(StatsIntegrationTest, WithDefaultConfig) {
 }
 
 TEST_P(StatsIntegrationTest, WithoutDefaultTagExtractors) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
+      });
   initialize();
 
   auto counter = test_server_->counter("http.config_test.rq_total");
@@ -61,9 +62,10 @@ TEST_P(StatsIntegrationTest, WithoutDefaultTagExtractors) {
 }
 
 TEST_P(StatsIntegrationTest, WithDefaultTagExtractors) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(true);
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(true);
+      });
   initialize();
 
   auto counter = test_server_->counter("http.config_test.rq_total");
@@ -79,12 +81,13 @@ TEST_P(StatsIntegrationTest, WithDefaultTagExtractors) {
 // specifier having use defined regex.
 TEST_P(StatsIntegrationTest, WithDefaultTagExtractorNameWithUserDefinedRegex) {
   std::string tag_name = Config::TagNames::get().HTTP_CONN_MANAGER_PREFIX;
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
-    auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
-    tag_specifier->set_tag_name(tag_name);
-    tag_specifier->set_regex("((.*))");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
+        auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
+        tag_specifier->set_tag_name(tag_name);
+        tag_specifier->set_regex("((.*))");
+      });
   initialize();
 
   auto counter = test_server_->counter("http.config_test.rq_total");
@@ -94,11 +97,12 @@ TEST_P(StatsIntegrationTest, WithDefaultTagExtractorNameWithUserDefinedRegex) {
 }
 
 TEST_P(StatsIntegrationTest, WithTagSpecifierMissingTagValue) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
-    auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
-    tag_specifier->set_tag_name("envoy.http_conn_manager_prefix");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
+        auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
+        tag_specifier->set_tag_name("envoy.http_conn_manager_prefix");
+      });
   initialize();
 
   auto counter = test_server_->counter("http.config_test.rq_total");
@@ -108,12 +112,13 @@ TEST_P(StatsIntegrationTest, WithTagSpecifierMissingTagValue) {
 }
 
 TEST_P(StatsIntegrationTest, WithTagSpecifierWithRegex) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
-    auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
-    tag_specifier->set_tag_name("my.http_conn_manager_prefix");
-    tag_specifier->set_regex(R"(^(?:|listener(?=\.).*?\.)http\.((.*?)\.))");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        bootstrap.mutable_stats_config()->mutable_use_all_default_tags()->set_value(false);
+        auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
+        tag_specifier->set_tag_name("my.http_conn_manager_prefix");
+        tag_specifier->set_regex(R"(^(?:|listener(?=\.).*?\.)http\.((.*?)\.))");
+      });
   initialize();
 
   auto counter = test_server_->counter("http.config_test.rq_total");
@@ -123,11 +128,12 @@ TEST_P(StatsIntegrationTest, WithTagSpecifierWithRegex) {
 }
 
 TEST_P(StatsIntegrationTest, WithTagSpecifierWithFixedValue) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
-    tag_specifier->set_tag_name("test.x");
-    tag_specifier->set_fixed_value("xxx");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto tag_specifier = bootstrap.mutable_stats_config()->mutable_stats_tags()->Add();
+        tag_specifier->set_tag_name("test.x");
+        tag_specifier->set_fixed_value("xxx");
+      });
   initialize();
 
   auto live = test_server_->gauge("server.live");
@@ -175,7 +181,7 @@ class ClusterMemoryTestHelper : public BaseIntegrationTest {
    */
   size_t clusterMemoryHelper(int num_clusters, int num_hosts, bool allow_stats) {
     Stats::TestUtil::MemoryTest memory_test;
-    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       if (!allow_stats) {
         bootstrap.mutable_stats_config()->mutable_stats_matcher()->set_reject_all(true);
       }
@@ -189,7 +195,7 @@ class ClusterMemoryTestHelper : public BaseIntegrationTest {
         for (int j = 0; j < num_hosts; ++j) {
           auto* host = cluster->add_hosts();
           auto* socket_address = host->mutable_socket_address();
-          socket_address->set_protocol(envoy::api::v2::core::SocketAddress::TCP);
+          socket_address->set_protocol(envoy::config::core::v3alpha::SocketAddress::TCP);
           socket_address->set_address("0.0.0.0");
           socket_address->set_port_value(80);
         }
diff --git a/test/integration/tcp_proxy_integration_test.cc b/test/integration/tcp_proxy_integration_test.cc
index e9de0fde6ff0..6044fccb3da1 100644
--- a/test/integration/tcp_proxy_integration_test.cc
+++ b/test/integration/tcp_proxy_integration_test.cc
@@ -2,11 +2,12 @@
 
 #include <memory>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/accesslog/v2/file.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.pb.h"
+#include "envoy/extensions/access_loggers/grpc/v3alpha/file.pb.h"
+#include "envoy/extensions/filters/network/tcp_proxy/v3alpha/tcp_proxy.pb.h"
 
 #include "common/config/api_version.h"
 #include "common/network/utility.h"
@@ -236,7 +237,8 @@ TEST_P(TcpProxyIntegrationTest, TcpProxyUpstreamFlushEnvoyExit) {
 TEST_P(TcpProxyIntegrationTest, AccessLog) {
   std::string access_log_path = TestEnvironment::temporaryPath(
       fmt::format("access_log{}.txt", GetParam() == Network::Address::IpVersion::v4 ? "v4" : "v6"));
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap)
+                                       -> void {
     auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
     auto* filter_chain = listener->mutable_filter_chains(0);
     auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
@@ -248,7 +250,7 @@ TEST_P(TcpProxyIntegrationTest, AccessLog) {
 
     auto* access_log = tcp_proxy_config.add_access_log();
     access_log->set_name("envoy.file_access_log");
-    envoy::config::accesslog::v2::FileAccessLog access_log_config;
+    envoy::extensions::access_loggers::grpc::v3alpha::FileAccessLog access_log_config;
     access_log_config.set_path(access_log_path);
     access_log_config.set_format(
         "upstreamlocal=%UPSTREAM_LOCAL_ADDRESS% "
@@ -300,13 +302,14 @@ TEST_P(TcpProxyIntegrationTest, AccessLog) {
 
 // Test that the server shuts down without crashing when connections are open.
 TEST_P(TcpProxyIntegrationTest, ShutdownWithOpenConnections) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* static_resources = bootstrap.mutable_static_resources();
-    for (int i = 0; i < static_resources->clusters_size(); ++i) {
-      auto* cluster = static_resources->mutable_clusters(i);
-      cluster->set_close_connections_on_host_health_failure(true);
-    }
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* static_resources = bootstrap.mutable_static_resources();
+        for (int i = 0; i < static_resources->clusters_size(); ++i) {
+          auto* cluster = static_resources->mutable_clusters(i);
+          cluster->set_close_connections_on_host_health_failure(true);
+        }
+      });
   initialize();
   IntegrationTcpClientPtr tcp_client = makeTcpConnection(lookupPort("tcp_proxy"));
   tcp_client->write("hello");
@@ -331,7 +334,8 @@ TEST_P(TcpProxyIntegrationTest, TestIdletimeoutWithNoData) {
   autonomous_upstream_ = true;
 
   enable_half_close_ = false;
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap)
+                                       -> void {
     auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
     auto* filter_chain = listener->mutable_filter_chains(0);
     auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
@@ -354,7 +358,8 @@ TEST_P(TcpProxyIntegrationTest, TestIdletimeoutWithNoData) {
 TEST_P(TcpProxyIntegrationTest, TestIdletimeoutWithLargeOutstandingData) {
   config_helper_.setBufferLimits(1024, 1024);
   enable_half_close_ = false;
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap)
+                                       -> void {
     auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
     auto* filter_chain = listener->mutable_filter_chains(0);
     auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
@@ -389,13 +394,13 @@ class TcpProxyMetadataMatchIntegrationTest : public TcpProxyIntegrationTest {
   void expectEndpointToMatchRoute();
   void expectEndpointNotToMatchRoute();
 
-  envoy::api::v2::core::Metadata lbMetadata(std::map<std::string, std::string> values);
+  envoy::config::core::v3alpha::Metadata lbMetadata(std::map<std::string, std::string> values);
 
-  envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy_;
-  envoy::api::v2::core::Metadata endpoint_metadata_;
+  envoy::extensions::filters::network::tcp_proxy::v3alpha::TcpProxy tcp_proxy_;
+  envoy::config::core::v3alpha::Metadata endpoint_metadata_;
 };
 
-envoy::api::v2::core::Metadata
+envoy::config::core::v3alpha::Metadata
 TcpProxyMetadataMatchIntegrationTest::lbMetadata(std::map<std::string, std::string> values) {
 
   ProtobufWkt::Struct map;
@@ -408,14 +413,14 @@ TcpProxyMetadataMatchIntegrationTest::lbMetadata(std::map<std::string, std::stri
     mutable_fields->insert({it->first, value});
   }
 
-  envoy::api::v2::core::Metadata metadata;
+  envoy::config::core::v3alpha::Metadata metadata;
   (*metadata.mutable_filter_metadata())[Envoy::Config::MetadataFilters::get().ENVOY_LB] = map;
   return metadata;
 }
 
 void TcpProxyMetadataMatchIntegrationTest::initialize() {
 
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
     auto* static_resources = bootstrap.mutable_static_resources();
 
     ASSERT(static_resources->listeners_size() == 1);
@@ -429,10 +434,11 @@ void TcpProxyMetadataMatchIntegrationTest::initialize() {
     auto* cluster_0 = static_resources->mutable_clusters(0);
     cluster_0->Clear();
     cluster_0->set_name("cluster_0");
-    cluster_0->set_type(envoy::api::v2::Cluster::STATIC);
-    cluster_0->set_lb_policy(envoy::api::v2::Cluster::ROUND_ROBIN);
+    cluster_0->set_type(envoy::config::cluster::v3alpha::Cluster::STATIC);
+    cluster_0->set_lb_policy(envoy::config::cluster::v3alpha::Cluster::ROUND_ROBIN);
     auto* lb_subset_config = cluster_0->mutable_lb_subset_config();
-    lb_subset_config->set_fallback_policy(envoy::api::v2::Cluster::LbSubsetConfig::NO_FALLBACK);
+    lb_subset_config->set_fallback_policy(
+        envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::NO_FALLBACK);
     auto* subset_selector = lb_subset_config->add_subset_selectors();
     subset_selector->add_keys("role");
     subset_selector->add_keys("version");
@@ -509,7 +515,8 @@ TEST_P(TcpProxyMetadataMatchIntegrationTest,
        DEPRECATED_FEATURE_TEST(EndpointShouldMatchRouteWithTopLevelMetadataMatch)) {
   tcp_proxy_.set_stat_prefix("tcp_stats");
   tcp_proxy_.set_cluster("fallback");
-  tcp_proxy_.mutable_deprecated_v1()->add_routes()->set_cluster("cluster_0");
+  tcp_proxy_.mutable_hidden_envoy_deprecated_deprecated_v1()->add_routes()->set_cluster(
+      "cluster_0");
   tcp_proxy_.mutable_metadata_match()->MergeFrom(
       lbMetadata({{"role", "master"}, {"version", "v1"}, {"stage", "prod"}}));
 
@@ -596,7 +603,8 @@ TEST_P(TcpProxyMetadataMatchIntegrationTest,
        DEPRECATED_FEATURE_TEST(EndpointShouldNotMatchRouteWithTopLevelMetadataMatch)) {
   tcp_proxy_.set_stat_prefix("tcp_stats");
   tcp_proxy_.set_cluster("fallback");
-  tcp_proxy_.mutable_deprecated_v1()->add_routes()->set_cluster("cluster_0");
+  tcp_proxy_.mutable_hidden_envoy_deprecated_deprecated_v1()->add_routes()->set_cluster(
+      "cluster_0");
   tcp_proxy_.mutable_metadata_match()->MergeFrom(
       lbMetadata({{"role", "master"}, {"version", "v1"}, {"stage", "prod"}}));
 
diff --git a/test/integration/transport_socket_match_integration_test.cc b/test/integration/transport_socket_match_integration_test.cc
index 09013235aef0..db087bc076a2 100644
--- a/test/integration/transport_socket_match_integration_test.cc
+++ b/test/integration/transport_socket_match_integration_test.cc
@@ -1,7 +1,7 @@
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "extensions/transport_sockets/tls/context_config_impl.h"
 #include "extensions/transport_sockets/tls/context_impl.h"
@@ -27,7 +27,7 @@ class TransportSockeMatchIntegrationTest : public testing::Test, public HttpInte
   }
 
   void initialize() override {
-    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+    config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) {
       auto* static_resources = bootstrap.mutable_static_resources();
       auto* cluster = static_resources->mutable_clusters(0);
       cluster->mutable_lb_subset_config()->add_subset_selectors()->add_keys(type_key_);
@@ -77,8 +77,8 @@ name: "tls_socket"
       }
     });
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager&
-                hcm) {
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) {
           auto* vhost = hcm.mutable_route_config()->mutable_virtual_hosts(0);
 
           // Report the host's type metadata and remote address on every response.
@@ -101,7 +101,7 @@ name: "tls_socket"
     HttpIntegrationTest::initialize();
   }
 
-  void configureRoute(envoy::api::v2::route::Route* route, const std::string& host_type) {
+  void configureRoute(envoy::config::route::v3alpha::Route* route, const std::string& host_type) {
     auto* match = route->mutable_match();
     match->set_prefix("/");
 
@@ -119,7 +119,7 @@ name: "tls_socket"
   };
 
   Network::TransportSocketFactoryPtr createUpstreamSslContext() {
-    envoy::api::v2::auth::DownstreamTlsContext tls_context;
+    envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
     const std::string yaml = absl::StrFormat(
         R"EOF(
 common_tls_context:
diff --git a/test/integration/uds_integration_test.cc b/test/integration/uds_integration_test.cc
index 12415e3863b7..8e87ad65ad05 100644
--- a/test/integration/uds_integration_test.cc
+++ b/test/integration/uds_integration_test.cc
@@ -1,6 +1,6 @@
 #include "uds_integration_test.h"
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/event/dispatcher_impl.h"
 #include "common/network/utility.h"
@@ -56,20 +56,21 @@ INSTANTIATE_TEST_SUITE_P(
 #endif
 
 void UdsListenerIntegrationTest::initialize() {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* admin_addr = bootstrap.mutable_admin()->mutable_address();
-    admin_addr->clear_socket_address();
-    admin_addr->mutable_pipe()->set_path(getAdminSocketName());
-
-    auto* listeners = bootstrap.mutable_static_resources()->mutable_listeners();
-    RELEASE_ASSERT(!listeners->empty(), "");
-    auto filter_chains = listeners->Get(0).filter_chains();
-    listeners->Clear();
-    auto* listener = listeners->Add();
-    listener->set_name("listener_0");
-    listener->mutable_address()->mutable_pipe()->set_path(getListenerSocketName());
-    *(listener->mutable_filter_chains()) = filter_chains;
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* admin_addr = bootstrap.mutable_admin()->mutable_address();
+        admin_addr->clear_socket_address();
+        admin_addr->mutable_pipe()->set_path(getAdminSocketName());
+
+        auto* listeners = bootstrap.mutable_static_resources()->mutable_listeners();
+        RELEASE_ASSERT(!listeners->empty(), "");
+        auto filter_chains = listeners->Get(0).filter_chains();
+        listeners->Clear();
+        auto* listener = listeners->Add();
+        listener->set_name("listener_0");
+        listener->mutable_address()->mutable_pipe()->set_path(getListenerSocketName());
+        *(listener->mutable_filter_chains()) = filter_chains;
+      });
   HttpIntegrationTest::initialize();
 }
 
diff --git a/test/integration/uds_integration_test.h b/test/integration/uds_integration_test.h
index 77ef548b4a8a..82432b29c74e 100644
--- a/test/integration/uds_integration_test.h
+++ b/test/integration/uds_integration_test.h
@@ -2,7 +2,7 @@
 
 #include <tuple>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/common/fmt.h"
 #include "common/http/codec_client.h"
@@ -30,7 +30,7 @@ class UdsUpstreamIntegrationTest
         FakeHttpConnection::Type::HTTP1, timeSystem()));
 
     config_helper_.addConfigModifier(
-        [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           auto* static_resources = bootstrap.mutable_static_resources();
           for (int i = 0; i < static_resources->clusters_size(); ++i) {
             auto* cluster = static_resources->mutable_clusters(i);
diff --git a/test/integration/vhds_integration_test.cc b/test/integration/vhds_integration_test.cc
index 767fc592151e..8bba23b788ad 100644
--- a/test/integration/vhds_integration_test.cc
+++ b/test/integration/vhds_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/grpc/status.h"
 #include "envoy/stats/scope.h"
 
@@ -167,9 +167,11 @@ class VhdsInitializationTest : public HttpIntegrationTest,
 
     EXPECT_TRUE(compareSotwDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                             {"my_route"}, true));
-    sendSotwDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+    sendSotwDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
         Config::TypeUrl::get().RouteConfiguration,
-        {TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(RdsWithoutVhdsConfig)}, "1");
+        {TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+            RdsWithoutVhdsConfig)},
+        "1");
 
     // Wait for our statically specified listener to become ready, and register its port in the
     // test framework's downstream listener port map.
@@ -194,9 +196,11 @@ TEST_P(VhdsInitializationTest, InitializeVhdsAfterRdsHasBeenInitialized) {
   codec_client_->waitForDisconnect();
 
   // Update RouteConfig, this time include VHDS config
-  sendSotwDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+  sendSotwDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
       Config::TypeUrl::get().RouteConfiguration,
-      {TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(RdsConfigWithVhosts)}, "2");
+      {TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
+          RdsConfigWithVhosts)},
+      "2");
 
   auto result = xds_connection_->waitForNewStream(*dispatcher_, vhds_stream_, true);
   RELEASE_ASSERT(result, result.message());
@@ -204,9 +208,9 @@ TEST_P(VhdsInitializationTest, InitializeVhdsAfterRdsHasBeenInitialized) {
 
   EXPECT_TRUE(
       compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
-  sendDeltaDiscoveryResponse<envoy::api::v2::route::VirtualHost>(
+  sendDeltaDiscoveryResponse<envoy::config::route::v3alpha::VirtualHost>(
       Config::TypeUrl::get().VirtualHost,
-      {TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(
+      {TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(
           fmt::format(VhostTemplate, "vhost_0", "vhost.first"))},
       {}, "1", vhds_stream_);
   EXPECT_TRUE(
@@ -236,20 +240,20 @@ class VhdsIntegrationTest : public HttpIntegrationTest,
     return fmt::format(VhostTemplate, name, domain);
   }
 
-  envoy::api::v2::route::VirtualHost buildVirtualHost() {
-    return TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(
+  envoy::config::route::v3alpha::VirtualHost buildVirtualHost() {
+    return TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(
         virtualHostYaml("vhost_0", "host"));
   }
 
-  std::vector<envoy::api::v2::route::VirtualHost> buildVirtualHost1() {
-    return {TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(
+  std::vector<envoy::config::route::v3alpha::VirtualHost> buildVirtualHost1() {
+    return {TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(
                 virtualHostYaml("vhost_1", "vhost.first")),
-            TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(
+            TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(
                 virtualHostYaml("vhost_2", "vhost.second"))};
   }
 
-  envoy::api::v2::route::VirtualHost buildVirtualHost2() {
-    return TestUtility::parseYaml<envoy::api::v2::route::VirtualHost>(
+  envoy::config::route::v3alpha::VirtualHost buildVirtualHost2() {
+    return TestUtility::parseYaml<envoy::config::route::v3alpha::VirtualHost>(
         virtualHostYaml("vhost_1", "vhost.first"));
   }
 
@@ -287,7 +291,7 @@ class VhdsIntegrationTest : public HttpIntegrationTest,
 
     EXPECT_TRUE(compareSotwDiscoveryRequest(Config::TypeUrl::get().RouteConfiguration, "",
                                             {"my_route"}, true));
-    sendSotwDiscoveryResponse<envoy::api::v2::RouteConfiguration>(
+    sendSotwDiscoveryResponse<envoy::config::route::v3alpha::RouteConfiguration>(
         Config::TypeUrl::get().RouteConfiguration, {rdsConfig()}, "1");
 
     result = xds_connection_->waitForNewStream(*dispatcher_, vhds_stream_, true);
@@ -296,7 +300,7 @@ class VhdsIntegrationTest : public HttpIntegrationTest,
 
     EXPECT_TRUE(
         compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
-    sendDeltaDiscoveryResponse<envoy::api::v2::route::VirtualHost>(
+    sendDeltaDiscoveryResponse<envoy::config::route::v3alpha::VirtualHost>(
         Config::TypeUrl::get().VirtualHost, {buildVirtualHost()}, {}, "1", vhds_stream_);
     EXPECT_TRUE(
         compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
@@ -308,8 +312,8 @@ class VhdsIntegrationTest : public HttpIntegrationTest,
   }
 
   void useRdsWithVhosts() { use_rds_with_vhosts = true; }
-  const envoy::api::v2::RouteConfiguration rdsConfig() const {
-    return TestUtility::parseYaml<envoy::api::v2::RouteConfiguration>(
+  const envoy::config::route::v3alpha::RouteConfiguration rdsConfig() const {
+    return TestUtility::parseYaml<envoy::config::route::v3alpha::RouteConfiguration>(
         use_rds_with_vhosts ? RdsConfigWithVhosts : RdsConfig);
   }
 
@@ -328,7 +332,7 @@ TEST_P(VhdsIntegrationTest, VhdsVirtualHostAddUpdateRemove) {
   codec_client_->waitForDisconnect();
 
   // A spontaneous VHDS DiscoveryResponse adds two virtual hosts
-  sendDeltaDiscoveryResponse<envoy::api::v2::route::VirtualHost>(
+  sendDeltaDiscoveryResponse<envoy::config::route::v3alpha::VirtualHost>(
       Config::TypeUrl::get().VirtualHost, buildVirtualHost1(), {}, "2", vhds_stream_);
   EXPECT_TRUE(
       compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
@@ -341,7 +345,7 @@ TEST_P(VhdsIntegrationTest, VhdsVirtualHostAddUpdateRemove) {
   codec_client_->waitForDisconnect();
 
   // A spontaneous VHDS DiscoveryResponse removes newly added virtual hosts
-  sendDeltaDiscoveryResponse<envoy::api::v2::route::VirtualHost>(
+  sendDeltaDiscoveryResponse<envoy::config::route::v3alpha::VirtualHost>(
       Config::TypeUrl::get().VirtualHost, {}, {"vhost_1", "vhost_2"}, "3", vhds_stream_);
   EXPECT_TRUE(
       compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
@@ -374,7 +378,7 @@ TEST_P(VhdsIntegrationTest, RdsWithVirtualHostsVhdsVirtualHostAddUpdateRemove) {
   codec_client_->waitForDisconnect();
 
   // A spontaneous VHDS DiscoveryResponse adds two virtual hosts
-  sendDeltaDiscoveryResponse<envoy::api::v2::route::VirtualHost>(
+  sendDeltaDiscoveryResponse<envoy::config::route::v3alpha::VirtualHost>(
       Config::TypeUrl::get().VirtualHost, buildVirtualHost1(), {}, "2", vhds_stream_);
   EXPECT_TRUE(
       compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
@@ -391,7 +395,7 @@ TEST_P(VhdsIntegrationTest, RdsWithVirtualHostsVhdsVirtualHostAddUpdateRemove) {
   codec_client_->waitForDisconnect();
 
   // A spontaneous VHDS DiscoveryResponse removes virtual hosts added via vhds
-  sendDeltaDiscoveryResponse<envoy::api::v2::route::VirtualHost>(
+  sendDeltaDiscoveryResponse<envoy::config::route::v3alpha::VirtualHost>(
       Config::TypeUrl::get().VirtualHost, {}, {"vhost_1", "vhost_2"}, "3", vhds_stream_);
   EXPECT_TRUE(
       compareDeltaDiscoveryRequest(Config::TypeUrl::get().VirtualHost, {}, {}, vhds_stream_));
diff --git a/test/integration/websocket_integration_test.cc b/test/integration/websocket_integration_test.cc
index 8fd4985f4724..c3d2b676389f 100644
--- a/test/integration/websocket_integration_test.cc
+++ b/test/integration/websocket_integration_test.cc
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "common/http/header_map_impl.h"
 #include "common/protobuf/utility.h"
@@ -110,24 +110,26 @@ INSTANTIATE_TEST_SUITE_P(Protocols, WebsocketIntegrationTest,
                          HttpProtocolIntegrationTest::protocolTestParamsToString);
 
 ConfigHelper::HttpModifierFunction setRouteUsingWebsocket() {
-  return
-      [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
-        hcm.add_upgrade_configs()->set_upgrade_type("websocket");
-      };
+  return [](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) {
+    hcm.add_upgrade_configs()->set_upgrade_type("websocket");
+  };
 }
 
 void WebsocketIntegrationTest::initialize() {
   if (upstreamProtocol() != FakeHttpConnection::Type::HTTP1) {
     config_helper_.addConfigModifier(
-        [&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
+        [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
           auto* cluster = bootstrap.mutable_static_resources()->mutable_clusters(0);
           cluster->mutable_http2_protocol_options()->set_allow_connect(true);
         });
   }
   if (downstreamProtocol() != Http::CodecClient::Type::HTTP1) {
     config_helper_.addConfigModifier(
-        [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-            -> void { hcm.mutable_http2_protocol_options()->set_allow_connect(true); });
+        [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+                HttpConnectionManager& hcm) -> void {
+          hcm.mutable_http2_protocol_options()->set_allow_connect(true);
+        });
   }
   HttpProtocolIntegrationTest::initialize();
 }
@@ -261,8 +263,8 @@ TEST_P(WebsocketIntegrationTest, EarlyData) {
 TEST_P(WebsocketIntegrationTest, WebSocketConnectionIdleTimeout) {
   config_helper_.addConfigModifier(setRouteUsingWebsocket());
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* route_config = hcm.mutable_route_config();
         auto* virtual_host = route_config->mutable_virtual_hosts(0);
         auto* route = virtual_host->mutable_routes(0)->mutable_route();
@@ -284,8 +286,8 @@ TEST_P(WebsocketIntegrationTest, WebSocketConnectionIdleTimeout) {
 // with websocket upgrades
 TEST_P(WebsocketIntegrationTest, NonWebsocketUpgrade) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* foo_upgrade = hcm.add_upgrade_configs();
         foo_upgrade->set_upgrade_type("foo");
       });
@@ -312,8 +314,8 @@ TEST_P(WebsocketIntegrationTest, NonWebsocketUpgrade) {
 
 TEST_P(WebsocketIntegrationTest, RouteSpecificUpgrade) {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* foo_upgrade = hcm.add_upgrade_configs();
         foo_upgrade->set_upgrade_type("foo");
         foo_upgrade->mutable_enabled()->set_value(false);
@@ -349,8 +351,8 @@ TEST_P(WebsocketIntegrationTest, WebsocketCustomFilterChain) {
 
   // Add a second upgrade type which goes directly to the router filter.
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         auto* foo_upgrade = hcm.add_upgrade_configs();
         foo_upgrade->set_upgrade_type("foo");
         auto* filter_list_back = foo_upgrade->add_filters();
diff --git a/test/integration/xds_integration_test.cc b/test/integration/xds_integration_test.cc
index 5cc4791c1b6f..e3f8a86f88fd 100644
--- a/test/integration/xds_integration_test.cc
+++ b/test/integration/xds_integration_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/integration/http_integration.h"
 #include "test/integration/http_protocol_integration.h"
@@ -98,7 +98,8 @@ TEST_P(LdsIntegrationTest, ReloadConfig) {
   ConfigHelper new_config_helper(version_, *api_,
                                  MessageUtil::getJsonStringFromMessage(config_helper_.bootstrap()));
   new_config_helper.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) {
         hcm.mutable_http_protocol_options()->set_accept_http_10(true);
         hcm.mutable_http_protocol_options()->set_default_host_for_http_10("default.com");
       });
@@ -115,11 +116,12 @@ TEST_P(LdsIntegrationTest, ReloadConfig) {
 
 // Sample test making sure our config framework informs on listener failure.
 TEST_P(LdsIntegrationTest, FailConfigLoad) {
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
-    auto* filter_chain = listener->mutable_filter_chains(0);
-    filter_chain->mutable_filters(0)->set_name("grewgragra");
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
+        auto* filter_chain = listener->mutable_filter_chains(0);
+        filter_chain->mutable_filters(0)->set_name("grewgragra");
+      });
   EXPECT_DEATH_LOG_TO_STDERR(initialize(),
                              "Didn't find a registered implementation for name: 'grewgragra'");
 }
diff --git a/test/integration/xfcc_integration_test.cc b/test/integration/xfcc_integration_test.cc
index 87011a01a3ec..9c2c89988790 100644
--- a/test/integration/xfcc_integration_test.cc
+++ b/test/integration/xfcc_integration_test.cc
@@ -4,9 +4,9 @@
 #include <regex>
 #include <unordered_map>
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/stats/scope.h"
 
 #include "common/event/dispatcher_impl.h"
@@ -74,7 +74,7 @@ Network::TransportSocketFactoryPtr XfccIntegrationTest::createClientSslContext(b
   } else {
     target = yaml_tls;
   }
-  envoy::api::v2::auth::UpstreamTlsContext config;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext config;
   TestUtility::loadFromYaml(TestEnvironment::substitute(target), config);
   auto cfg = std::make_unique<Extensions::TransportSockets::Tls::ClientContextConfigImpl>(
       config, factory_context_);
@@ -85,7 +85,7 @@ Network::TransportSocketFactoryPtr XfccIntegrationTest::createClientSslContext(b
 }
 
 Network::TransportSocketFactoryPtr XfccIntegrationTest::createUpstreamSslContext() {
-  envoy::api::v2::auth::DownstreamTlsContext tls_context;
+  envoy::extensions::transport_sockets::tls::v3alpha::DownstreamTlsContext tls_context;
   auto* common_tls_context = tls_context.mutable_common_tls_context();
   auto* tls_cert = common_tls_context->add_tls_certificates();
   tls_cert->mutable_certificate_chain()->set_filename(
@@ -124,23 +124,25 @@ void XfccIntegrationTest::createUpstreams() {
 
 void XfccIntegrationTest::initialize() {
   config_helper_.addConfigModifier(
-      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
-          -> void {
+      [&](envoy::extensions::filters::network::http_connection_manager::v3alpha::
+              HttpConnectionManager& hcm) -> void {
         hcm.set_forward_client_cert_details(fcc_);
         hcm.mutable_set_current_client_cert_details()->CopyFrom(sccd_);
       });
 
-  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
-    auto transport_socket =
-        bootstrap.mutable_static_resources()->mutable_clusters(0)->mutable_transport_socket();
-    envoy::api::v2::auth::UpstreamTlsContext context;
-    auto* validation_context = context.mutable_common_tls_context()->mutable_validation_context();
-    validation_context->mutable_trusted_ca()->set_filename(
-        TestEnvironment::runfilesPath("test/config/integration/certs/upstreamcacert.pem"));
-    validation_context->add_match_subject_alt_names()->set_suffix("lyft.com");
-    transport_socket->set_name("envoy.transport_sockets.tls");
-    transport_socket->mutable_typed_config()->PackFrom(context);
-  });
+  config_helper_.addConfigModifier(
+      [&](envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap) -> void {
+        auto transport_socket =
+            bootstrap.mutable_static_resources()->mutable_clusters(0)->mutable_transport_socket();
+        envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext context;
+        auto* validation_context =
+            context.mutable_common_tls_context()->mutable_validation_context();
+        validation_context->mutable_trusted_ca()->set_filename(
+            TestEnvironment::runfilesPath("test/config/integration/certs/upstreamcacert.pem"));
+        validation_context->add_match_subject_alt_names()->set_suffix("lyft.com");
+        transport_socket->set_name("envoy.transport_sockets.tls");
+        transport_socket->mutable_typed_config()->PackFrom(context);
+      });
 
   if (tls_) {
     config_helper_.addSslConfig();
@@ -192,29 +194,29 @@ INSTANTIATE_TEST_SUITE_P(IpVersions, XfccIntegrationTest,
                          TestUtility::ipTestParamsToString);
 
 TEST_P(XfccIntegrationTest, MtlsForwardOnly) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::FORWARD_ONLY;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, previous_xfcc_);
 }
 
 TEST_P(XfccIntegrationTest, MtlsAlwaysForwardOnly) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      ALWAYS_FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::ALWAYS_FORWARD_ONLY;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, previous_xfcc_);
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitize) {
-  fcc_ =
-      envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::SANITIZE;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, "");
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubject) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET;
   sccd_.mutable_subject()->set_value(true);
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_,
@@ -222,8 +224,8 @@ TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubject) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitizeSetUri) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET;
   sccd_.set_uri(true);
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_,
@@ -231,8 +233,8 @@ TEST_P(XfccIntegrationTest, MtlsSanitizeSetUri) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitizeSetDns) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET;
   sccd_.set_dns(true);
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_,
@@ -240,8 +242,8 @@ TEST_P(XfccIntegrationTest, MtlsSanitizeSetDns) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubjectUri) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET;
   sccd_.mutable_subject()->set_value(true);
   sccd_.set_uri(true);
   initialize();
@@ -250,8 +252,8 @@ TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubjectUri) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubjectDns) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET;
   sccd_.mutable_subject()->set_value(true);
   sccd_.set_dns(true);
   initialize();
@@ -260,8 +262,8 @@ TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubjectDns) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubjectUriDns) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      SANITIZE_SET;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::SANITIZE_SET;
   sccd_.mutable_subject()->set_value(true);
   sccd_.set_uri(true);
   sccd_.set_dns(true);
@@ -272,16 +274,16 @@ TEST_P(XfccIntegrationTest, MtlsSanitizeSetSubjectUriDns) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForward) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_,
                                        previous_xfcc_ + "," + current_xfcc_by_hash_);
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardSubject) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.mutable_subject()->set_value(true);
   initialize();
   testRequestAndResponseWithXfccHeader(
@@ -289,8 +291,8 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardSubject) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardUri) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.set_uri(true);
   initialize();
   testRequestAndResponseWithXfccHeader(
@@ -298,8 +300,8 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardUri) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardDns) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.set_dns(true);
   initialize();
   testRequestAndResponseWithXfccHeader(
@@ -307,8 +309,8 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardDns) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardSubjectUri) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.mutable_subject()->set_value(true);
   sccd_.set_uri(true);
   initialize();
@@ -318,8 +320,8 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardSubjectUri) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardSubjectDns) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.mutable_subject()->set_value(true);
   sccd_.set_dns(true);
   initialize();
@@ -329,8 +331,8 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardSubjectDns) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardSubjectUriDns) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.mutable_subject()->set_value(true);
   sccd_.set_uri(true);
   sccd_.set_dns(true);
@@ -341,16 +343,16 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardSubjectUriDns) {
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardUriPreviousXfccHeaderEmpty) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.set_uri(true);
   initialize();
   testRequestAndResponseWithXfccHeader("", current_xfcc_by_hash_ + ";" + client_uri_san_);
 }
 
 TEST_P(XfccIntegrationTest, MtlsAppendForwardDnsPreviousXfccHeaderEmpty) {
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      APPEND_FORWARD;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::APPEND_FORWARD;
   sccd_.set_dns(true);
   initialize();
   testRequestAndResponseWithXfccHeader("", current_xfcc_by_hash_ + ";" + client_dns_san_);
@@ -358,8 +360,8 @@ TEST_P(XfccIntegrationTest, MtlsAppendForwardDnsPreviousXfccHeaderEmpty) {
 
 TEST_P(XfccIntegrationTest, TlsAlwaysForwardOnly) {
   // The always_forward_only works regardless of whether the connection is TLS/mTLS.
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      ALWAYS_FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::ALWAYS_FORWARD_ONLY;
   tls_ = false;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, previous_xfcc_);
@@ -368,8 +370,8 @@ TEST_P(XfccIntegrationTest, TlsAlwaysForwardOnly) {
 TEST_P(XfccIntegrationTest, TlsEnforceSanitize) {
   // The forward_only, append_forward and sanitize_set options are not effective when the connection
   // is not using Mtls.
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::FORWARD_ONLY;
   tls_ = false;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, "");
@@ -377,8 +379,8 @@ TEST_P(XfccIntegrationTest, TlsEnforceSanitize) {
 
 TEST_P(XfccIntegrationTest, NonTlsAlwaysForwardOnly) {
   // The always_forward_only works regardless of whether the connection is TLS/mTLS.
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      ALWAYS_FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::ALWAYS_FORWARD_ONLY;
   tls_ = false;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, previous_xfcc_);
@@ -387,8 +389,8 @@ TEST_P(XfccIntegrationTest, NonTlsAlwaysForwardOnly) {
 TEST_P(XfccIntegrationTest, NonTlsEnforceSanitize) {
   // The forward_only, append_forward and sanitize_set options are not effective when the connection
   // is not using Mtls.
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::FORWARD_ONLY;
   tls_ = false;
   initialize();
   testRequestAndResponseWithXfccHeader(previous_xfcc_, "");
@@ -403,8 +405,8 @@ TEST_P(XfccIntegrationTest, TagExtractedNameGenerationTest) {
   // the printout needs to be copied from each test parameterization and pasted into the respective
   // case in the switch statement below.
 
-  fcc_ = envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
-      FORWARD_ONLY;
+  fcc_ = envoy::extensions::filters::network::http_connection_manager::v3alpha::
+      HttpConnectionManager::FORWARD_ONLY;
   initialize();
 
   // Commented sample code to regenerate the map literals used below in the test log if necessary:
diff --git a/test/integration/xfcc_integration_test.h b/test/integration/xfcc_integration_test.h
index e45fd6e03f9c..fdaec702add8 100644
--- a/test/integration/xfcc_integration_test.h
+++ b/test/integration/xfcc_integration_test.h
@@ -3,7 +3,7 @@
 #include <memory>
 #include <string>
 
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 
 #include "test/config/integration/certs/clientcert_hash.h"
 #include "test/integration/http_integration.h"
@@ -52,9 +52,9 @@ class XfccIntegrationTest : public testing::TestWithParam<Network::Address::IpVe
   Network::ClientConnectionPtr makeTlsClientConnection();
   Network::ClientConnectionPtr makeMtlsClientConnection();
   void testRequestAndResponseWithXfccHeader(std::string privous_xfcc, std::string expected_xfcc);
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager::
       ForwardClientCertDetails fcc_;
-  envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager::
+  envoy::extensions::filters::network::http_connection_manager::v3alpha::HttpConnectionManager::
       SetCurrentClientCertDetails sccd_;
   bool tls_ = true;
 
diff --git a/test/mocks/config/BUILD b/test/mocks/config/BUILD
index 4523b97d98fe..c544762ef3be 100644
--- a/test/mocks/config/BUILD
+++ b/test/mocks/config/BUILD
@@ -20,7 +20,8 @@ envoy_cc_mock(
         "//source/common/config:resources_lib",
         "//source/common/protobuf:utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/config/mocks.cc b/test/mocks/config/mocks.cc
index ae5053448e8e..4c9e771c247d 100644
--- a/test/mocks/config/mocks.cc
+++ b/test/mocks/config/mocks.cc
@@ -1,6 +1,6 @@
 #include "test/mocks/config/mocks.h"
 
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
 
 #include "test/test_common/utility.h"
 
@@ -9,7 +9,7 @@ namespace Config {
 
 MockSubscriptionFactory::MockSubscriptionFactory() {
   ON_CALL(*this, subscriptionFromConfigSource(_, _, _, _))
-      .WillByDefault(testing::Invoke([this](const envoy::api::v2::core::ConfigSource&,
+      .WillByDefault(testing::Invoke([this](const envoy::config::core::v3alpha::ConfigSource&,
                                             absl::string_view, Stats::Scope&,
                                             SubscriptionCallbacks& callbacks) -> SubscriptionPtr {
         auto ret = std::make_unique<testing::NiceMock<MockSubscription>>();
diff --git a/test/mocks/config/mocks.h b/test/mocks/config/mocks.h
index b54bb76d50b5..dac6015fc753 100644
--- a/test/mocks/config/mocks.h
+++ b/test/mocks/config/mocks.h
@@ -1,11 +1,11 @@
 #pragma once
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/eds.pb.h"
 #include "envoy/config/config_provider_manager.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
 #include "envoy/config/grpc_mux.h"
 #include "envoy/config/subscription.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/config/config_provider_impl.h"
 #include "common/config/resources.h"
@@ -27,7 +27,8 @@ template <class ResourceType> class MockSubscriptionCallbacks : public Subscript
         }));
   }
   ~MockSubscriptionCallbacks() override = default;
-  static std::string resourceName_(const envoy::api::v2::ClusterLoadAssignment& resource) {
+  static std::string
+  resourceName_(const envoy::config::endpoint::v3alpha::ClusterLoadAssignment& resource) {
     return resource.cluster_name();
   }
   template <class T> static std::string resourceName_(const T& resource) { return resource.name(); }
@@ -35,7 +36,8 @@ template <class ResourceType> class MockSubscriptionCallbacks : public Subscript
   MOCK_METHOD2_T(onConfigUpdate, void(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>& resources,
                                       const std::string& version_info));
   MOCK_METHOD3_T(onConfigUpdate,
-                 void(const Protobuf::RepeatedPtrField<envoy::api::v2::Resource>& added_resources,
+                 void(const Protobuf::RepeatedPtrField<
+                          envoy::service::discovery::v3alpha::Resource>& added_resources,
                       const Protobuf::RepeatedPtrField<std::string>& removed_resources,
                       const std::string& system_version_info));
   MOCK_METHOD2_T(onConfigUpdateFailed,
@@ -55,7 +57,7 @@ class MockSubscriptionFactory : public SubscriptionFactory {
   ~MockSubscriptionFactory() override;
 
   MOCK_METHOD4(subscriptionFromConfigSource,
-               SubscriptionPtr(const envoy::api::v2::core::ConfigSource& config,
+               SubscriptionPtr(const envoy::config::core::v3alpha::ConfigSource& config,
                                absl::string_view type_url, Stats::Scope& scope,
                                SubscriptionCallbacks& callbacks));
   MOCK_METHOD0(messageValidationVisitor, ProtobufMessage::ValidationVisitor&());
@@ -113,15 +115,17 @@ class MockGrpcMuxCallbacks : public GrpcMuxCallbacks {
   MOCK_METHOD1(resourceName, std::string(const ProtobufWkt::Any& resource));
 };
 
-class MockGrpcStreamCallbacks : public GrpcStreamCallbacks<envoy::api::v2::DiscoveryResponse> {
+class MockGrpcStreamCallbacks
+    : public GrpcStreamCallbacks<envoy::service::discovery::v3alpha::DiscoveryResponse> {
 public:
   MockGrpcStreamCallbacks();
   ~MockGrpcStreamCallbacks() override;
 
   MOCK_METHOD0(onStreamEstablished, void());
   MOCK_METHOD0(onEstablishmentFailure, void());
-  MOCK_METHOD1(onDiscoveryResponse,
-               void(std::unique_ptr<envoy::api::v2::DiscoveryResponse>&& message));
+  MOCK_METHOD1(
+      onDiscoveryResponse,
+      void(std::unique_ptr<envoy::service::discovery::v3alpha::DiscoveryResponse>&& message));
   MOCK_METHOD0(onWriteable, void());
 };
 
diff --git a/test/mocks/grpc/BUILD b/test/mocks/grpc/BUILD
index 445bf1b5e97b..cd7a89bac938 100644
--- a/test/mocks/grpc/BUILD
+++ b/test/mocks/grpc/BUILD
@@ -17,6 +17,6 @@ envoy_cc_mock(
         "//include/envoy/grpc:async_client_manager_interface",
         "//source/common/grpc:typed_async_client_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/grpc/mocks.h b/test/mocks/grpc/mocks.h
index 586dad907523..98de628353b2 100644
--- a/test/mocks/grpc/mocks.h
+++ b/test/mocks/grpc/mocks.h
@@ -3,7 +3,7 @@
 #include <cstdint>
 #include <string>
 
-#include "envoy/api/v2/core/grpc_service.pb.h"
+#include "envoy/config/core/v3alpha/grpc_service.pb.h"
 #include "envoy/grpc/async_client.h"
 #include "envoy/grpc/async_client_manager.h"
 #include "envoy/stats/scope.h"
@@ -98,7 +98,7 @@ class MockAsyncClientManager : public AsyncClientManager {
   ~MockAsyncClientManager() override;
 
   MOCK_METHOD3(factoryForGrpcService,
-               AsyncClientFactoryPtr(const envoy::api::v2::core::GrpcService& grpc_service,
+               AsyncClientFactoryPtr(const envoy::config::core::v3alpha::GrpcService& grpc_service,
                                      Stats::Scope& scope, bool skip_cluster_check));
 };
 
diff --git a/test/mocks/local_info/BUILD b/test/mocks/local_info/BUILD
index c302fc968595..f6f4e503220f 100644
--- a/test/mocks/local_info/BUILD
+++ b/test/mocks/local_info/BUILD
@@ -15,6 +15,6 @@ envoy_cc_mock(
     deps = [
         "//include/envoy/local_info:local_info_interface",
         "//source/common/network:address_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/local_info/mocks.h b/test/mocks/local_info/mocks.h
index 42c3d5f421fd..8f44ed490976 100644
--- a/test/mocks/local_info/mocks.h
+++ b/test/mocks/local_info/mocks.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/local_info/local_info.h"
 
 #include "gmock/gmock.h"
@@ -19,12 +19,12 @@ class MockLocalInfo : public LocalInfo {
   MOCK_CONST_METHOD0(zoneName, const std::string&());
   MOCK_CONST_METHOD0(clusterName, const std::string&());
   MOCK_CONST_METHOD0(nodeName, const std::string&());
-  MOCK_CONST_METHOD0(node, envoy::api::v2::core::Node&());
+  MOCK_CONST_METHOD0(node, envoy::config::core::v3alpha::Node&());
 
   Network::Address::InstanceConstSharedPtr address_;
   // TODO(htuch): Make this behave closer to the real implementation, with the various property
   // methods using node_ as the source of truth.
-  envoy::api::v2::core::Node node_;
+  envoy::config::core::v3alpha::Node node_;
 };
 
 } // namespace LocalInfo
diff --git a/test/mocks/network/BUILD b/test/mocks/network/BUILD
index 646a5ee1a172..6e9e3911c744 100644
--- a/test/mocks/network/BUILD
+++ b/test/mocks/network/BUILD
@@ -49,7 +49,7 @@ envoy_cc_mock(
         "//test/mocks/event:event_mocks",
         "//test/mocks/stream_info:stream_info_mocks",
         "//test/test_common:printers_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/mocks/network/mocks.h b/test/mocks/network/mocks.h
index bc7b2f76ca1d..af32458529e1 100644
--- a/test/mocks/network/mocks.h
+++ b/test/mocks/network/mocks.h
@@ -5,8 +5,8 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/drain_decision.h"
 #include "envoy/network/filter.h"
@@ -54,7 +54,7 @@ class MockAddressResolver : public Address::Resolver {
   ~MockAddressResolver() override;
 
   MOCK_METHOD1(resolve,
-               Address::InstanceConstSharedPtr(const envoy::api::v2::core::SocketAddress&));
+               Address::InstanceConstSharedPtr(const envoy::config::core::v3alpha::SocketAddress&));
   MOCK_CONST_METHOD0(name, std::string());
 };
 
@@ -232,11 +232,12 @@ class MockSocketOption : public Socket::Option {
   ~MockSocketOption() override;
 
   MOCK_CONST_METHOD2(setOption,
-                     bool(Socket&, envoy::api::v2::core::SocketOption::SocketState state));
+                     bool(Socket&, envoy::config::core::v3alpha::SocketOption::SocketState state));
   MOCK_CONST_METHOD1(hashKey, void(std::vector<uint8_t>&));
   MOCK_CONST_METHOD2(getOptionDetails,
                      absl::optional<Socket::Option::Details>(
-                         const Socket&, envoy::api::v2::core::SocketOption::SocketState state));
+                         const Socket&,
+                         envoy::config::core::v3alpha::SocketOption::SocketState state));
 };
 
 class MockConnectionSocket : public ConnectionSocket {
@@ -315,8 +316,8 @@ class MockListenerConfig : public ListenerConfig {
   MOCK_METHOD0(udpListenerFactory, const Network::ActiveUdpListenerFactory*());
   MOCK_METHOD0(connectionBalancer, ConnectionBalancer&());
 
-  envoy::api::v2::core::TrafficDirection direction() const override {
-    return envoy::api::v2::core::TrafficDirection::UNSPECIFIED;
+  envoy::config::core::v3alpha::TrafficDirection direction() const override {
+    return envoy::config::core::v3alpha::UNSPECIFIED;
   }
 
   testing::NiceMock<MockFilterChainFactory> filter_chain_factory_;
diff --git a/test/mocks/router/BUILD b/test/mocks/router/BUILD
index 63441978475a..8954941ce2f4 100644
--- a/test/mocks/router/BUILD
+++ b/test/mocks/router/BUILD
@@ -28,9 +28,9 @@ envoy_cc_mock(
         "//source/common/stats:fake_symbol_table_lib",
         "//test/mocks:common_lib",
         "//test/mocks/stats:stats_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/router/mocks.h b/test/mocks/router/mocks.h
index 7e48a28e857d..9ca6a4d53776 100644
--- a/test/mocks/router/mocks.h
+++ b/test/mocks/router/mocks.h
@@ -8,13 +8,13 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/rds.pb.h"
 #include "envoy/common/time.h"
 #include "envoy/config/config_provider.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/event/dispatcher.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
 #include "envoy/http/hash_policy.h"
 #include "envoy/local_info/local_info.h"
 #include "envoy/router/rds.h"
@@ -25,7 +25,7 @@
 #include "envoy/router/shadow_writer.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/thread_local/thread_local.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "common/stats/fake_symbol_table_impl.h"
@@ -83,13 +83,13 @@ class TestHedgePolicy : public HedgePolicy {
 public:
   // Router::HedgePolicy
   uint32_t initialRequests() const override { return initial_requests_; }
-  const envoy::type::FractionalPercent& additionalRequestChance() const override {
+  const envoy::type::v3alpha::FractionalPercent& additionalRequestChance() const override {
     return additional_request_chance_;
   }
   bool hedgeOnPerTryTimeout() const override { return hedge_on_per_try_timeout_; }
 
   uint32_t initial_requests_{};
-  envoy::type::FractionalPercent additional_request_chance_{};
+  envoy::type::v3alpha::FractionalPercent additional_request_chance_{};
   bool hedge_on_per_try_timeout_{};
 };
 
@@ -187,16 +187,18 @@ class MockRateLimitPolicy : public RateLimitPolicy {
 class TestShadowPolicy : public ShadowPolicy {
 public:
   TestShadowPolicy(absl::string_view cluster = "", absl::string_view runtime_key = "",
-                   envoy::type::FractionalPercent default_value = {})
+                   envoy::type::v3alpha::FractionalPercent default_value = {})
       : cluster_(cluster), runtime_key_(runtime_key), default_value_(default_value) {}
   // Router::ShadowPolicy
   const std::string& cluster() const override { return cluster_; }
   const std::string& runtimeKey() const override { return runtime_key_; }
-  const envoy::type::FractionalPercent& defaultValue() const override { return default_value_; }
+  const envoy::type::v3alpha::FractionalPercent& defaultValue() const override {
+    return default_value_;
+  }
 
   std::string cluster_;
   std::string runtime_key_;
-  envoy::type::FractionalPercent default_value_;
+  envoy::type::v3alpha::FractionalPercent default_value_;
 };
 
 class MockShadowWriter : public ShadowWriter {
@@ -331,7 +333,7 @@ class MockRouteEntry : public RouteEntry {
   MOCK_CONST_METHOD0(opaqueConfig, const std::multimap<std::string, std::string>&());
   MOCK_CONST_METHOD0(includeVirtualHostRateLimits, bool());
   MOCK_CONST_METHOD0(corsPolicy, const CorsPolicy*());
-  MOCK_CONST_METHOD0(metadata, const envoy::api::v2::core::Metadata&());
+  MOCK_CONST_METHOD0(metadata, const envoy::config::core::v3alpha::Metadata&());
   MOCK_CONST_METHOD0(typedMetadata, const Envoy::Config::TypedMetadata&());
   MOCK_CONST_METHOD0(pathMatchCriterion, const PathMatchCriterion&());
   MOCK_CONST_METHOD1(perFilterConfig, const RouteSpecificFilterConfig*(const std::string&));
@@ -354,7 +356,7 @@ class MockRouteEntry : public RouteEntry {
   MockTlsContextMatchCriteria tls_context_matches_criteria_;
   TestCorsPolicy cors_policy_;
   testing::NiceMock<MockPathMatchCriterion> path_match_criterion_;
-  envoy::api::v2::core::Metadata metadata_;
+  envoy::config::core::v3alpha::Metadata metadata_;
   UpgradeMap upgrade_map_;
 };
 
@@ -376,9 +378,9 @@ class MockRouteTracing : public RouteTracing {
   ~MockRouteTracing() override;
 
   // Router::RouteTracing
-  MOCK_CONST_METHOD0(getClientSampling, const envoy::type::FractionalPercent&());
-  MOCK_CONST_METHOD0(getRandomSampling, const envoy::type::FractionalPercent&());
-  MOCK_CONST_METHOD0(getOverallSampling, const envoy::type::FractionalPercent&());
+  MOCK_CONST_METHOD0(getClientSampling, const envoy::type::v3alpha::FractionalPercent&());
+  MOCK_CONST_METHOD0(getRandomSampling, const envoy::type::v3alpha::FractionalPercent&());
+  MOCK_CONST_METHOD0(getOverallSampling, const envoy::type::v3alpha::FractionalPercent&());
   MOCK_CONST_METHOD0(getCustomTags, const Tracing::CustomTagMap&());
 };
 
@@ -427,7 +429,8 @@ class MockRouteConfigProvider : public RouteConfigProvider {
   MOCK_CONST_METHOD0(configInfo, absl::optional<ConfigInfo>());
   MOCK_CONST_METHOD0(lastUpdated, SystemTime());
   MOCK_METHOD0(onConfigUpdate, void());
-  MOCK_CONST_METHOD1(validateConfig, void(const envoy::api::v2::RouteConfiguration&));
+  MOCK_CONST_METHOD1(validateConfig,
+                     void(const envoy::config::route::v3alpha::RouteConfiguration&));
 
   std::shared_ptr<NiceMock<MockConfig>> route_config_{new NiceMock<MockConfig>()};
 };
@@ -437,14 +440,16 @@ class MockRouteConfigProviderManager : public RouteConfigProviderManager {
   MockRouteConfigProviderManager();
   ~MockRouteConfigProviderManager() override;
 
-  MOCK_METHOD4(createRdsRouteConfigProvider,
-               RouteConfigProviderSharedPtr(
-                   const envoy::config::filter::network::http_connection_manager::v2::Rds& rds,
-                   Server::Configuration::FactoryContext& factory_context,
-                   const std::string& stat_prefix, Init::Manager& init_manager));
-  MOCK_METHOD2(createStaticRouteConfigProvider,
-               RouteConfigProviderPtr(const envoy::api::v2::RouteConfiguration& route_config,
-                                      Server::Configuration::FactoryContext& factory_context));
+  MOCK_METHOD4(
+      createRdsRouteConfigProvider,
+      RouteConfigProviderSharedPtr(
+          const envoy::extensions::filters::network::http_connection_manager::v3alpha::Rds& rds,
+          Server::Configuration::FactoryContext& factory_context, const std::string& stat_prefix,
+          Init::Manager& init_manager));
+  MOCK_METHOD2(
+      createStaticRouteConfigProvider,
+      RouteConfigProviderPtr(const envoy::config::route::v3alpha::RouteConfiguration& route_config,
+                             Server::Configuration::FactoryContext& factory_context));
 };
 
 class MockScopedConfig : public ScopedConfig {
diff --git a/test/mocks/runtime/BUILD b/test/mocks/runtime/BUILD
index 4b9c19ff6cbe..813f7d00404f 100644
--- a/test/mocks/runtime/BUILD
+++ b/test/mocks/runtime/BUILD
@@ -17,6 +17,6 @@ envoy_cc_mock(
         "//include/envoy/runtime:runtime_interface",
         "//include/envoy/upstream:cluster_manager_interface",
         "//test/mocks:common_lib",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/runtime/mocks.h b/test/mocks/runtime/mocks.h
index 74899865f487..8722d06824ff 100644
--- a/test/mocks/runtime/mocks.h
+++ b/test/mocks/runtime/mocks.h
@@ -5,7 +5,7 @@
 #include <unordered_map>
 
 #include "envoy/runtime/runtime.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 #include "envoy/upstream/cluster_manager.h"
 
 #include "gmock/gmock.h"
@@ -48,11 +48,13 @@ class MockSnapshot : public Snapshot {
                      bool(const std::string& key, uint64_t default_value, uint64_t random_value));
   MOCK_CONST_METHOD4(featureEnabled, bool(const std::string& key, uint64_t default_value,
                                           uint64_t random_value, uint64_t num_buckets));
-  MOCK_CONST_METHOD2(featureEnabled, bool(const std::string& key,
-                                          const envoy::type::FractionalPercent& default_value));
-  MOCK_CONST_METHOD3(featureEnabled, bool(const std::string& key,
-                                          const envoy::type::FractionalPercent& default_value,
-                                          uint64_t random_value));
+  MOCK_CONST_METHOD2(featureEnabled,
+                     bool(const std::string& key,
+                          const envoy::type::v3alpha::FractionalPercent& default_value));
+  MOCK_CONST_METHOD3(featureEnabled,
+                     bool(const std::string& key,
+                          const envoy::type::v3alpha::FractionalPercent& default_value,
+                          uint64_t random_value));
   MOCK_CONST_METHOD1(get, const std::string&(const std::string& key));
   MOCK_CONST_METHOD2(getInteger, uint64_t(const std::string& key, uint64_t default_value));
   MOCK_CONST_METHOD2(getDouble, double(const std::string& key, double default_value));
diff --git a/test/mocks/secret/BUILD b/test/mocks/secret/BUILD
index 4a452f26e27e..c6c08b6d713c 100644
--- a/test/mocks/secret/BUILD
+++ b/test/mocks/secret/BUILD
@@ -18,7 +18,7 @@ envoy_cc_mock(
         "//include/envoy/server:transport_socket_config_interface",
         "//include/envoy/ssl:tls_certificate_config_interface",
         "//source/common/secret:secret_provider_impl_lib",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/secret/mocks.cc b/test/mocks/secret/mocks.cc
index 300cd19811f4..5659a574176e 100644
--- a/test/mocks/secret/mocks.cc
+++ b/test/mocks/secret/mocks.cc
@@ -1,6 +1,6 @@
 #include "test/mocks/secret/mocks.h"
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 
 #include "common/secret/secret_provider_impl.h"
 
@@ -12,15 +12,18 @@ namespace Secret {
 
 MockSecretManager::MockSecretManager() {
   ON_CALL(*this, createInlineTlsCertificateProvider(_))
-      .WillByDefault(Invoke([](const envoy::api::v2::auth::TlsCertificate& tls_certificate) {
-        return std::make_shared<Secret::TlsCertificateConfigProviderImpl>(tls_certificate);
-      }));
+      .WillByDefault(
+          Invoke([](const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate&
+                        tls_certificate) {
+            return std::make_shared<Secret::TlsCertificateConfigProviderImpl>(tls_certificate);
+          }));
   ON_CALL(*this, createInlineCertificateValidationContextProvider(_))
-      .WillByDefault(Invoke([](const envoy::api::v2::auth::CertificateValidationContext&
-                                   certificate_validation_context) {
-        return std::make_shared<Secret::CertificateValidationContextConfigProviderImpl>(
-            certificate_validation_context);
-      }));
+      .WillByDefault(Invoke(
+          [](const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+                 certificate_validation_context) {
+            return std::make_shared<Secret::CertificateValidationContextConfigProviderImpl>(
+                certificate_validation_context);
+          }));
 }
 
 MockSecretManager::~MockSecretManager() = default;
diff --git a/test/mocks/secret/mocks.h b/test/mocks/secret/mocks.h
index 955bd1fac76f..7550b5a866cc 100644
--- a/test/mocks/secret/mocks.h
+++ b/test/mocks/secret/mocks.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/secret/secret_callbacks.h"
 #include "envoy/secret/secret_manager.h"
 #include "envoy/server/transport_socket_config.h"
@@ -18,7 +18,8 @@ class MockSecretManager : public SecretManager {
   MockSecretManager();
   ~MockSecretManager() override;
 
-  MOCK_METHOD1(addStaticSecret, void(const envoy::api::v2::auth::Secret& secret));
+  MOCK_METHOD1(addStaticSecret,
+               void(const envoy::extensions::transport_sockets::tls::v3alpha::Secret& secret));
   MOCK_CONST_METHOD1(findStaticTlsCertificateProvider,
                      TlsCertificateConfigProviderSharedPtr(const std::string& name));
   MOCK_CONST_METHOD1(findStaticCertificateValidationContextProvider,
@@ -27,26 +28,29 @@ class MockSecretManager : public SecretManager {
                      TlsSessionTicketKeysConfigProviderSharedPtr(const std::string& name));
   MOCK_METHOD1(createInlineTlsCertificateProvider,
                TlsCertificateConfigProviderSharedPtr(
-                   const envoy::api::v2::auth::TlsCertificate& tls_certificate));
-  MOCK_METHOD1(createInlineCertificateValidationContextProvider,
-               CertificateValidationContextConfigProviderSharedPtr(
-                   const envoy::api::v2::auth::CertificateValidationContext&
-                       certificate_validation_context));
+                   const envoy::extensions::transport_sockets::tls::v3alpha::TlsCertificate&
+                       tls_certificate));
+  MOCK_METHOD1(
+      createInlineCertificateValidationContextProvider,
+      CertificateValidationContextConfigProviderSharedPtr(
+          const envoy::extensions::transport_sockets::tls::v3alpha::CertificateValidationContext&
+              certificate_validation_context));
   MOCK_METHOD1(createInlineTlsSessionTicketKeysProvider,
                TlsSessionTicketKeysConfigProviderSharedPtr(
-                   const envoy::api::v2::auth::TlsSessionTicketKeys& tls_session_ticket_keys));
+                   const envoy::extensions::transport_sockets::tls::v3alpha::TlsSessionTicketKeys&
+                       tls_session_ticket_keys));
   MOCK_METHOD3(findOrCreateTlsCertificateProvider,
                TlsCertificateConfigProviderSharedPtr(
-                   const envoy::api::v2::core::ConfigSource&, const std::string&,
+                   const envoy::config::core::v3alpha::ConfigSource&, const std::string&,
                    Server::Configuration::TransportSocketFactoryContext&));
   MOCK_METHOD3(findOrCreateCertificateValidationContextProvider,
                CertificateValidationContextConfigProviderSharedPtr(
-                   const envoy::api::v2::core::ConfigSource& config_source,
+                   const envoy::config::core::v3alpha::ConfigSource& config_source,
                    const std::string& config_name,
                    Server::Configuration::TransportSocketFactoryContext& secret_provider_context));
   MOCK_METHOD3(findOrCreateTlsSessionTicketKeysContextProvider,
                TlsSessionTicketKeysConfigProviderSharedPtr(
-                   const envoy::api::v2::core::ConfigSource&, const std::string&,
+                   const envoy::config::core::v3alpha::ConfigSource&, const std::string&,
                    Server::Configuration::TransportSocketFactoryContext&));
 };
 
diff --git a/test/mocks/server/BUILD b/test/mocks/server/BUILD
index 6025697ac585..501adc63bd84 100644
--- a/test/mocks/server/BUILD
+++ b/test/mocks/server/BUILD
@@ -46,10 +46,9 @@ envoy_cc_mock(
         "//test/mocks/tracing:tracing_mocks",
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:test_time_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/server/mocks.cc b/test/mocks/server/mocks.cc
index 7c87416d6550..39088d3d7b6d 100644
--- a/test/mocks/server/mocks.cc
+++ b/test/mocks/server/mocks.cc
@@ -2,8 +2,8 @@
 
 #include <string>
 
-#include "envoy/admin/v2alpha/server_info.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/singleton/manager_impl.h"
 
@@ -44,7 +44,7 @@ MockOptions::MockOptions(const std::string& config_path) : config_path_(config_p
   ON_CALL(*this, cpusetThreadsEnabled()).WillByDefault(ReturnPointee(&cpuset_threads_enabled_));
   ON_CALL(*this, disabledExtensions()).WillByDefault(ReturnRef(disabled_extensions_));
   ON_CALL(*this, toCommandLineOptions()).WillByDefault(Invoke([] {
-    return std::make_unique<envoy::admin::v2alpha::CommandLineOptions>();
+    return std::make_unique<envoy::admin::v3alpha::CommandLineOptions>();
   }));
 }
 MockOptions::~MockOptions() = default;
@@ -99,8 +99,8 @@ MockListenerComponentFactory::MockListenerComponentFactory()
           Invoke([&](Network::Address::InstanceConstSharedPtr, Network::Address::SocketType,
                      const Network::Socket::OptionsSharedPtr& options,
                      const ListenSocketCreationParams&) -> Network::SocketSharedPtr {
-            if (!Network::Socket::applyOptions(options, *socket_,
-                                               envoy::api::v2::core::SocketOption::STATE_PREBIND)) {
+            if (!Network::Socket::applyOptions(
+                    options, *socket_, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND)) {
               throw EnvoyException("MockListenerComponentFactory: Setting socket options failed");
             }
             return socket_;
diff --git a/test/mocks/server/mocks.h b/test/mocks/server/mocks.h
index 93d9c60e58c8..be20b57dbfb1 100644
--- a/test/mocks/server/mocks.h
+++ b/test/mocks/server/mocks.h
@@ -5,12 +5,12 @@
 #include <list>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
 #include "envoy/common/mutex_tracer.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/protobuf/message_validator.h"
 #include "envoy/server/admin.h"
 #include "envoy/server/configuration.h"
@@ -70,7 +70,7 @@ class MockOptions : public Options {
   MOCK_CONST_METHOD0(baseId, uint64_t());
   MOCK_CONST_METHOD0(concurrency, uint32_t());
   MOCK_CONST_METHOD0(configPath, const std::string&());
-  MOCK_CONST_METHOD0(configProto, const envoy::config::bootstrap::v2::Bootstrap&());
+  MOCK_CONST_METHOD0(configProto, const envoy::config::bootstrap::v3alpha::Bootstrap&());
   MOCK_CONST_METHOD0(configYaml, const std::string&());
   MOCK_CONST_METHOD0(allowUnknownStaticFields, bool());
   MOCK_CONST_METHOD0(rejectUnknownDynamicFields, bool());
@@ -99,7 +99,7 @@ class MockOptions : public Options {
   MOCK_CONST_METHOD0(toCommandLineOptions, Server::CommandLineOptionsPtr());
 
   std::string config_path_;
-  envoy::config::bootstrap::v2::Bootstrap config_proto_;
+  envoy::config::bootstrap::v3alpha::Bootstrap config_proto_;
   std::string config_yaml_;
   bool allow_unknown_static_fields_{};
   bool reject_unknown_dynamic_fields_{};
@@ -241,32 +241,38 @@ class MockListenerComponentFactory : public ListenerComponentFactory {
   MockListenerComponentFactory();
   ~MockListenerComponentFactory() override;
 
-  DrainManagerPtr createDrainManager(envoy::api::v2::Listener::DrainType drain_type) override {
+  DrainManagerPtr
+  createDrainManager(envoy::config::listener::v3alpha::Listener::DrainType drain_type) override {
     return DrainManagerPtr{createDrainManager_(drain_type)};
   }
-  LdsApiPtr createLdsApi(const envoy::api::v2::core::ConfigSource& lds_config) override {
+  LdsApiPtr createLdsApi(const envoy::config::core::v3alpha::ConfigSource& lds_config) override {
     return LdsApiPtr{createLdsApi_(lds_config)};
   }
 
-  MOCK_METHOD1(createLdsApi_, LdsApi*(const envoy::api::v2::core::ConfigSource& lds_config));
-  MOCK_METHOD2(createNetworkFilterFactoryList,
-               std::vector<Network::FilterFactoryCb>(
-                   const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
-                   Configuration::FactoryContext& context));
-  MOCK_METHOD2(createListenerFilterFactoryList,
-               std::vector<Network::ListenerFilterFactoryCb>(
-                   const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>&,
-                   Configuration::ListenerFactoryContext& context));
-  MOCK_METHOD2(createUdpListenerFilterFactoryList,
-               std::vector<Network::UdpListenerFilterFactoryCb>(
-                   const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>&,
-                   Configuration::ListenerFactoryContext& context));
+  MOCK_METHOD1(createLdsApi_,
+               LdsApi*(const envoy::config::core::v3alpha::ConfigSource& lds_config));
+  MOCK_METHOD2(
+      createNetworkFilterFactoryList,
+      std::vector<Network::FilterFactoryCb>(
+          const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
+          Configuration::FactoryContext& context));
+  MOCK_METHOD2(
+      createListenerFilterFactoryList,
+      std::vector<Network::ListenerFilterFactoryCb>(
+          const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>&,
+          Configuration::ListenerFactoryContext& context));
+  MOCK_METHOD2(
+      createUdpListenerFilterFactoryList,
+      std::vector<Network::UdpListenerFilterFactoryCb>(
+          const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>&,
+          Configuration::ListenerFactoryContext& context));
   MOCK_METHOD4(createListenSocket,
                Network::SocketSharedPtr(Network::Address::InstanceConstSharedPtr address,
                                         Network::Address::SocketType socket_type,
                                         const Network::Socket::OptionsSharedPtr& options,
                                         const ListenSocketCreationParams& params));
-  MOCK_METHOD1(createDrainManager_, DrainManager*(envoy::api::v2::Listener::DrainType drain_type));
+  MOCK_METHOD1(createDrainManager_,
+               DrainManager*(envoy::config::listener::v3alpha::Listener::DrainType drain_type));
   MOCK_METHOD0(nextListenerTag, uint64_t());
 
   std::shared_ptr<Network::MockListenSocket> socket_;
@@ -277,9 +283,9 @@ class MockListenerManager : public ListenerManager {
   MockListenerManager();
   ~MockListenerManager() override;
 
-  MOCK_METHOD3(addOrUpdateListener, bool(const envoy::api::v2::Listener& config,
+  MOCK_METHOD3(addOrUpdateListener, bool(const envoy::config::listener::v3alpha::Listener& config,
                                          const std::string& version_info, bool modifiable));
-  MOCK_METHOD1(createLdsApi, void(const envoy::api::v2::core::ConfigSource& lds_config));
+  MOCK_METHOD1(createLdsApi, void(const envoy::config::core::v3alpha::ConfigSource& lds_config));
   MOCK_METHOD0(listeners, std::vector<std::reference_wrapper<Network::ListenerConfig>>());
   MOCK_METHOD0(numConnections, uint64_t());
   MOCK_METHOD1(removeListener, bool(const std::string& listener_name));
@@ -517,8 +523,8 @@ class MockFactoryContext : public virtual FactoryContext {
   MOCK_METHOD0(admin, Server::Admin&());
   MOCK_METHOD0(listenerScope, Stats::Scope&());
   MOCK_CONST_METHOD0(localInfo, const LocalInfo::LocalInfo&());
-  MOCK_CONST_METHOD0(listenerMetadata, const envoy::api::v2::core::Metadata&());
-  MOCK_CONST_METHOD0(direction, envoy::api::v2::core::TrafficDirection());
+  MOCK_CONST_METHOD0(listenerMetadata, const envoy::config::core::v3alpha::Metadata&());
+  MOCK_CONST_METHOD0(direction, envoy::config::core::v3alpha::TrafficDirection());
   MOCK_METHOD0(timeSource, TimeSource&());
   Event::TestTimeSystem& timeSystem() { return time_system_; }
   Grpc::Context& grpcContext() override { return grpc_context_; }
diff --git a/test/mocks/ssl/BUILD b/test/mocks/ssl/BUILD
index a185eb5c3ed0..5cdc4a9afa45 100644
--- a/test/mocks/ssl/BUILD
+++ b/test/mocks/ssl/BUILD
@@ -20,6 +20,6 @@ envoy_cc_mock(
         "//include/envoy/ssl:context_manager_interface",
         "//include/envoy/stats:stats_interface",
         "//test/mocks/secret:secret_mocks",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/ssl/mocks.h b/test/mocks/ssl/mocks.h
index af666a3d6ca5..f6678137445c 100644
--- a/test/mocks/ssl/mocks.h
+++ b/test/mocks/ssl/mocks.h
@@ -3,7 +3,7 @@
 #include <functional>
 #include <string>
 
-#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/ssl/certificate_validation_context_config.h"
 #include "envoy/ssl/connection.h"
 #include "envoy/ssl/context.h"
@@ -115,10 +115,11 @@ class MockPrivateKeyMethodManager : public PrivateKeyMethodManager {
   MockPrivateKeyMethodManager();
   ~MockPrivateKeyMethodManager() override;
 
-  MOCK_METHOD2(createPrivateKeyMethodProvider,
-               PrivateKeyMethodProviderSharedPtr(
-                   const envoy::api::v2::auth::PrivateKeyProvider& config,
-                   Envoy::Server::Configuration::TransportSocketFactoryContext& factory_context));
+  MOCK_METHOD2(
+      createPrivateKeyMethodProvider,
+      PrivateKeyMethodProviderSharedPtr(
+          const envoy::extensions::transport_sockets::tls::v3alpha::PrivateKeyProvider& config,
+          Envoy::Server::Configuration::TransportSocketFactoryContext& factory_context));
 };
 
 class MockPrivateKeyMethodProvider : public PrivateKeyMethodProvider {
diff --git a/test/mocks/stream_info/BUILD b/test/mocks/stream_info/BUILD
index ec5c382b09f0..fa8c453bd1b6 100644
--- a/test/mocks/stream_info/BUILD
+++ b/test/mocks/stream_info/BUILD
@@ -16,6 +16,6 @@ envoy_cc_mock(
         "//include/envoy/stream_info:stream_info_interface",
         "//include/envoy/upstream:upstream_interface",
         "//test/mocks/upstream:host_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/stream_info/mocks.h b/test/mocks/stream_info/mocks.h
index 1c4ab45f9ae2..ef937decd198 100644
--- a/test/mocks/stream_info/mocks.h
+++ b/test/mocks/stream_info/mocks.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/stream_info/stream_info.h"
 
 #include "common/stream_info/filter_state_impl.h"
@@ -72,8 +72,8 @@ class MockStreamInfo : public StreamInfo {
   MOCK_METHOD1(setUpstreamSslConnection, void(const Ssl::ConnectionInfoConstSharedPtr&));
   MOCK_CONST_METHOD0(upstreamSslConnection, Ssl::ConnectionInfoConstSharedPtr());
   MOCK_CONST_METHOD0(routeEntry, const Router::RouteEntry*());
-  MOCK_METHOD0(dynamicMetadata, envoy::api::v2::core::Metadata&());
-  MOCK_CONST_METHOD0(dynamicMetadata, const envoy::api::v2::core::Metadata&());
+  MOCK_METHOD0(dynamicMetadata, envoy::config::core::v3alpha::Metadata&());
+  MOCK_CONST_METHOD0(dynamicMetadata, const envoy::config::core::v3alpha::Metadata&());
   MOCK_METHOD2(setDynamicMetadata, void(const std::string&, const ProtobufWkt::Struct&));
   MOCK_METHOD3(setDynamicMetadata,
                void(const std::string&, const std::string&, const std::string&));
@@ -101,7 +101,7 @@ class MockStreamInfo : public StreamInfo {
   absl::optional<Http::Protocol> protocol_;
   absl::optional<uint32_t> response_code_;
   absl::optional<std::string> response_code_details_;
-  envoy::api::v2::core::Metadata metadata_;
+  envoy::config::core::v3alpha::Metadata metadata_;
   FilterStateImpl filter_state_;
   uint64_t bytes_received_{};
   uint64_t bytes_sent_{};
diff --git a/test/mocks/upstream/BUILD b/test/mocks/upstream/BUILD
index 08a250c0672c..c5fc7ff52822 100644
--- a/test/mocks/upstream/BUILD
+++ b/test/mocks/upstream/BUILD
@@ -22,8 +22,8 @@ envoy_cc_mock(
         "//source/common/upstream:upstream_lib",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/stats:stats_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -37,7 +37,7 @@ envoy_cc_mock(
         "//source/common/network:utility_lib",
         "//source/common/stats:stats_lib",
         "//test/mocks/network:transport_socket_mocks",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/data/cluster/v2alpha:pkg_cc_proto",
     ],
 )
@@ -50,7 +50,7 @@ envoy_cc_mock(
         "//include/envoy/upstream:upstream_interface",
         "//source/common/network:raw_buffer_socket_lib",
         "//source/common/stats:isolated_store_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -86,9 +86,9 @@ envoy_cc_mock(
         "//test/mocks/secret:secret_mocks",
         "//test/mocks/stats:stats_mocks",
         "//test/mocks/tcp:tcp_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/data/core/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/data/core/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/mocks/upstream/cluster_info.cc b/test/mocks/upstream/cluster_info.cc
index a230c0a0a2c7..d58a91a9b5fb 100644
--- a/test/mocks/upstream/cluster_info.cc
+++ b/test/mocks/upstream/cluster_info.cc
@@ -2,7 +2,7 @@
 
 #include <limits>
 
-#include "envoy/api/v2/cds.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
 #include "envoy/upstream/host_description.h"
 #include "envoy/upstream/upstream.h"
 
@@ -22,7 +22,8 @@ namespace Upstream {
 MockLoadBalancerSubsetInfo::MockLoadBalancerSubsetInfo() {
   ON_CALL(*this, isEnabled()).WillByDefault(Return(false));
   ON_CALL(*this, fallbackPolicy())
-      .WillByDefault(Return(envoy::api::v2::Cluster::LbSubsetConfig::ANY_ENDPOINT));
+      .WillByDefault(
+          Return(envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::ANY_ENDPOINT));
   ON_CALL(*this, defaultSubset()).WillByDefault(ReturnRef(ProtobufWkt::Struct::default_instance()));
   ON_CALL(*this, subsetSelectors()).WillByDefault(ReturnRef(subset_selectors_));
 }
diff --git a/test/mocks/upstream/cluster_info.h b/test/mocks/upstream/cluster_info.h
index d4937156f074..05038a00d2f3 100644
--- a/test/mocks/upstream/cluster_info.h
+++ b/test/mocks/upstream/cluster_info.h
@@ -5,8 +5,8 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/config/typed_metadata.h"
 #include "envoy/stats/scope.h"
 #include "envoy/upstream/cluster_manager.h"
@@ -33,8 +33,9 @@ class MockLoadBalancerSubsetInfo : public LoadBalancerSubsetInfo {
 
   // Upstream::LoadBalancerSubsetInfo
   MOCK_CONST_METHOD0(isEnabled, bool());
-  MOCK_CONST_METHOD0(fallbackPolicy,
-                     envoy::api::v2::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy());
+  MOCK_CONST_METHOD0(
+      fallbackPolicy,
+      envoy::config::cluster::v3alpha::Cluster::LbSubsetConfig::LbSubsetFallbackPolicy());
   MOCK_CONST_METHOD0(defaultSubset, const ProtobufWkt::Struct&());
   MOCK_CONST_METHOD0(subsetSelectors, const std::vector<SubsetSelectorPtr>&());
   MOCK_CONST_METHOD0(localityWeightAware, bool());
@@ -82,17 +83,21 @@ class MockClusterInfo : public ClusterInfo {
   MOCK_CONST_METHOD0(http2Settings, const Http::Http2Settings&());
   MOCK_CONST_METHOD1(extensionProtocolOptions,
                      ProtocolOptionsConfigConstSharedPtr(const std::string&));
-  MOCK_CONST_METHOD0(lbConfig, const envoy::api::v2::Cluster::CommonLbConfig&());
+  MOCK_CONST_METHOD0(lbConfig, const envoy::config::cluster::v3alpha::Cluster::CommonLbConfig&());
   MOCK_CONST_METHOD0(lbType, LoadBalancerType());
-  MOCK_CONST_METHOD0(type, envoy::api::v2::Cluster::DiscoveryType());
-  MOCK_CONST_METHOD0(clusterType,
-                     const absl::optional<envoy::api::v2::Cluster::CustomClusterType>&());
-  MOCK_CONST_METHOD0(lbRingHashConfig,
-                     const absl::optional<envoy::api::v2::Cluster::RingHashLbConfig>&());
-  MOCK_CONST_METHOD0(lbLeastRequestConfig,
-                     const absl::optional<envoy::api::v2::Cluster::LeastRequestLbConfig>&());
-  MOCK_CONST_METHOD0(lbOriginalDstConfig,
-                     const absl::optional<envoy::api::v2::Cluster::OriginalDstLbConfig>&());
+  MOCK_CONST_METHOD0(type, envoy::config::cluster::v3alpha::Cluster::DiscoveryType());
+  MOCK_CONST_METHOD0(
+      clusterType,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType>&());
+  MOCK_CONST_METHOD0(
+      lbRingHashConfig,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig>&());
+  MOCK_CONST_METHOD0(
+      lbLeastRequestConfig,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::LeastRequestLbConfig>&());
+  MOCK_CONST_METHOD0(
+      lbOriginalDstConfig,
+      const absl::optional<envoy::config::cluster::v3alpha::Cluster::OriginalDstLbConfig>&());
   MOCK_CONST_METHOD0(maintenanceMode, bool());
   MOCK_CONST_METHOD0(maxResponseHeadersCount, uint32_t());
   MOCK_CONST_METHOD0(maxRequestsPerConnection, uint64_t());
@@ -104,7 +109,7 @@ class MockClusterInfo : public ClusterInfo {
   MOCK_CONST_METHOD0(loadReportStats, ClusterLoadReportStats&());
   MOCK_CONST_METHOD0(sourceAddress, const Network::Address::InstanceConstSharedPtr&());
   MOCK_CONST_METHOD0(lbSubsetInfo, const LoadBalancerSubsetInfo&());
-  MOCK_CONST_METHOD0(metadata, const envoy::api::v2::core::Metadata&());
+  MOCK_CONST_METHOD0(metadata, const envoy::config::core::v3alpha::Metadata&());
   MOCK_CONST_METHOD0(typedMetadata, const Envoy::Config::TypedMetadata&());
   MOCK_CONST_METHOD0(clusterSocketOptions, const Network::ConnectionSocket::OptionsSharedPtr&());
   MOCK_CONST_METHOD0(drainConnectionsOnHostRemoval, bool());
@@ -130,14 +135,16 @@ class MockClusterInfo : public ClusterInfo {
   std::unique_ptr<Upstream::ResourceManager> resource_manager_;
   Network::Address::InstanceConstSharedPtr source_address_;
   LoadBalancerType lb_type_{LoadBalancerType::RoundRobin};
-  envoy::api::v2::Cluster::DiscoveryType type_{envoy::api::v2::Cluster::STRICT_DNS};
-  absl::optional<envoy::api::v2::Cluster::CustomClusterType> cluster_type_;
+  envoy::config::cluster::v3alpha::Cluster::DiscoveryType type_{
+      envoy::config::cluster::v3alpha::Cluster::STRICT_DNS};
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::CustomClusterType> cluster_type_;
   NiceMock<MockLoadBalancerSubsetInfo> lb_subset_;
-  absl::optional<envoy::api::v2::Cluster::RingHashLbConfig> lb_ring_hash_config_;
-  absl::optional<envoy::api::v2::Cluster::OriginalDstLbConfig> lb_original_dst_config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::RingHashLbConfig> lb_ring_hash_config_;
+  absl::optional<envoy::config::cluster::v3alpha::Cluster::OriginalDstLbConfig>
+      lb_original_dst_config_;
   Network::ConnectionSocket::OptionsSharedPtr cluster_socket_options_;
-  envoy::api::v2::Cluster::CommonLbConfig lb_config_;
-  envoy::api::v2::core::Metadata metadata_;
+  envoy::config::cluster::v3alpha::Cluster::CommonLbConfig lb_config_;
+  envoy::config::core::v3alpha::Metadata metadata_;
   std::unique_ptr<Envoy::Config::TypedMetadata> typed_metadata_;
 };
 
diff --git a/test/mocks/upstream/host.h b/test/mocks/upstream/host.h
index 0c555a605d4e..e378130aa95e 100644
--- a/test/mocks/upstream/host.h
+++ b/test/mocks/upstream/host.h
@@ -5,7 +5,7 @@
 #include <list>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/data/cluster/v2alpha/outlier_detection_event.pb.h"
 #include "envoy/upstream/upstream.h"
 
@@ -86,15 +86,15 @@ class MockHostDescription : public HostDescription {
   MOCK_CONST_METHOD0(healthCheckAddress, Network::Address::InstanceConstSharedPtr());
   MOCK_CONST_METHOD0(canary, bool());
   MOCK_METHOD1(canary, void(bool new_canary));
-  MOCK_CONST_METHOD0(metadata, const std::shared_ptr<envoy::api::v2::core::Metadata>());
-  MOCK_METHOD1(metadata, void(const envoy::api::v2::core::Metadata&));
+  MOCK_CONST_METHOD0(metadata, const std::shared_ptr<envoy::config::core::v3alpha::Metadata>());
+  MOCK_METHOD1(metadata, void(const envoy::config::core::v3alpha::Metadata&));
   MOCK_CONST_METHOD0(cluster, const ClusterInfo&());
   MOCK_CONST_METHOD0(outlierDetector, Outlier::DetectorHostMonitor&());
   MOCK_CONST_METHOD0(healthChecker, HealthCheckHostMonitor&());
   MOCK_CONST_METHOD0(hostname, const std::string&());
   MOCK_CONST_METHOD0(transportSocketFactory, Network::TransportSocketFactory&());
   MOCK_CONST_METHOD0(stats, HostStats&());
-  MOCK_CONST_METHOD0(locality, const envoy::api::v2::core::Locality&());
+  MOCK_CONST_METHOD0(locality, const envoy::config::core::v3alpha::Locality&());
   MOCK_CONST_METHOD0(priority, uint32_t());
   MOCK_METHOD1(priority, void(uint32_t));
   Stats::StatName localityZoneStatName() const override {
@@ -155,8 +155,8 @@ class MockHost : public Host {
   MOCK_CONST_METHOD0(healthCheckAddress, Network::Address::InstanceConstSharedPtr());
   MOCK_CONST_METHOD0(canary, bool());
   MOCK_METHOD1(canary, void(bool new_canary));
-  MOCK_CONST_METHOD0(metadata, const std::shared_ptr<envoy::api::v2::core::Metadata>());
-  MOCK_METHOD1(metadata, void(const envoy::api::v2::core::Metadata&));
+  MOCK_CONST_METHOD0(metadata, const std::shared_ptr<envoy::config::core::v3alpha::Metadata>());
+  MOCK_METHOD1(metadata, void(const envoy::config::core::v3alpha::Metadata&));
   MOCK_CONST_METHOD0(cluster, const ClusterInfo&());
   MOCK_CONST_METHOD0(counters,
                      std::vector<std::pair<absl::string_view, Stats::PrimitiveCounterReference>>());
@@ -183,7 +183,7 @@ class MockHost : public Host {
   MOCK_METHOD1(weight, void(uint32_t new_weight));
   MOCK_CONST_METHOD0(used, bool());
   MOCK_METHOD1(used, void(bool new_used));
-  MOCK_CONST_METHOD0(locality, const envoy::api::v2::core::Locality&());
+  MOCK_CONST_METHOD0(locality, const envoy::config::core::v3alpha::Locality&());
   MOCK_CONST_METHOD0(priority, uint32_t());
   MOCK_METHOD1(priority, void(uint32_t));
   MOCK_CONST_METHOD0(warmed, bool());
diff --git a/test/mocks/upstream/mocks.h b/test/mocks/upstream/mocks.h
index d653f754b34f..bd0cf5735109 100644
--- a/test/mocks/upstream/mocks.h
+++ b/test/mocks/upstream/mocks.h
@@ -6,11 +6,11 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/data/core/v2alpha/health_check_event.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/data/core/v3alpha/health_check_event.pb.h"
 #include "envoy/http/async_client.h"
 #include "envoy/upstream/cluster_manager.h"
 #include "envoy/upstream/health_checker.h"
@@ -254,7 +254,7 @@ class MockClusterManagerFactory : public ClusterManagerFactory {
   Secret::MockSecretManager& secretManager() override { return secret_manager_; };
 
   MOCK_METHOD1(clusterManagerFromProto,
-               ClusterManagerPtr(const envoy::config::bootstrap::v2::Bootstrap& bootstrap));
+               ClusterManagerPtr(const envoy::config::bootstrap::v3alpha::Bootstrap& bootstrap));
 
   MOCK_METHOD6(allocateConnPool,
                Http::ConnectionPool::InstancePtr(
@@ -271,11 +271,11 @@ class MockClusterManagerFactory : public ClusterManagerFactory {
 
   MOCK_METHOD4(clusterFromProto,
                std::pair<ClusterSharedPtr, ThreadAwareLoadBalancerPtr>(
-                   const envoy::api::v2::Cluster& cluster, ClusterManager& cm,
+                   const envoy::config::cluster::v3alpha::Cluster& cluster, ClusterManager& cm,
                    Outlier::EventLoggerSharedPtr outlier_event_logger, bool added_via_api));
 
-  MOCK_METHOD2(createCds,
-               CdsApiPtr(const envoy::api::v2::core::ConfigSource& cds_config, ClusterManager& cm));
+  MOCK_METHOD2(createCds, CdsApiPtr(const envoy::config::core::v3alpha::ConfigSource& cds_config,
+                                    ClusterManager& cm));
 
 private:
   NiceMock<Secret::MockSecretManager> secret_manager_;
@@ -307,8 +307,8 @@ class MockClusterManager : public ClusterManager {
   ClusterManagerFactory& clusterManagerFactory() override { return cluster_manager_factory_; }
 
   // Upstream::ClusterManager
-  MOCK_METHOD2(addOrUpdateCluster,
-               bool(const envoy::api::v2::Cluster& cluster, const std::string& version_info));
+  MOCK_METHOD2(addOrUpdateCluster, bool(const envoy::config::cluster::v3alpha::Cluster& cluster,
+                                        const std::string& version_info));
   MOCK_METHOD1(setInitializedCb, void(std::function<void()>));
   MOCK_METHOD0(clusters, ClusterInfoMap());
   MOCK_METHOD1(get, ThreadLocalCluster*(absl::string_view cluster));
@@ -325,7 +325,7 @@ class MockClusterManager : public ClusterManager {
   MOCK_METHOD1(httpAsyncClientForCluster, Http::AsyncClient&(const std::string& cluster));
   MOCK_METHOD1(removeCluster, bool(const std::string& cluster));
   MOCK_METHOD0(shutdown, void());
-  MOCK_CONST_METHOD0(bindConfig, const envoy::api::v2::core::BindConfig&());
+  MOCK_CONST_METHOD0(bindConfig, const envoy::config::core::v3alpha::BindConfig&());
   MOCK_METHOD0(adsMux, Config::GrpcMuxSharedPtr());
   MOCK_METHOD0(grpcAsyncClientManager, Grpc::AsyncClientManager&());
   MOCK_CONST_METHOD0(versionInfo, const std::string());
@@ -338,7 +338,7 @@ class MockClusterManager : public ClusterManager {
   NiceMock<Http::MockAsyncClient> async_client_;
   NiceMock<Tcp::ConnectionPool::MockInstance> tcp_conn_pool_;
   NiceMock<MockThreadLocalCluster> thread_local_cluster_;
-  envoy::api::v2::core::BindConfig bind_config_;
+  envoy::config::core::v3alpha::BindConfig bind_config_;
   std::shared_ptr<NiceMock<Config::MockGrpcMux>> ads_mux_;
   NiceMock<Grpc::MockAsyncClientManager> async_client_manager_;
   absl::optional<std::string> local_cluster_name_;
@@ -365,17 +365,17 @@ class MockHealthChecker : public HealthChecker {
 
 class MockHealthCheckEventLogger : public HealthCheckEventLogger {
 public:
-  MOCK_METHOD3(logEjectUnhealthy, void(envoy::data::core::v2alpha::HealthCheckerType,
+  MOCK_METHOD3(logEjectUnhealthy, void(envoy::data::core::v3alpha::HealthCheckerType,
                                        const HostDescriptionConstSharedPtr&,
-                                       envoy::data::core::v2alpha::HealthCheckFailureType));
-  MOCK_METHOD3(logAddHealthy, void(envoy::data::core::v2alpha::HealthCheckerType,
+                                       envoy::data::core::v3alpha::HealthCheckFailureType));
+  MOCK_METHOD3(logAddHealthy, void(envoy::data::core::v3alpha::HealthCheckerType,
                                    const HostDescriptionConstSharedPtr&, bool));
-  MOCK_METHOD4(logUnhealthy, void(envoy::data::core::v2alpha::HealthCheckerType,
+  MOCK_METHOD4(logUnhealthy, void(envoy::data::core::v3alpha::HealthCheckerType,
                                   const HostDescriptionConstSharedPtr&,
-                                  envoy::data::core::v2alpha::HealthCheckFailureType, bool));
-  MOCK_METHOD2(logDegraded, void(envoy::data::core::v2alpha::HealthCheckerType,
+                                  envoy::data::core::v3alpha::HealthCheckFailureType, bool));
+  MOCK_METHOD2(logDegraded, void(envoy::data::core::v3alpha::HealthCheckerType,
                                  const HostDescriptionConstSharedPtr&));
-  MOCK_METHOD2(logNoLongerDegraded, void(envoy::data::core::v2alpha::HealthCheckerType,
+  MOCK_METHOD2(logNoLongerDegraded, void(envoy::data::core::v3alpha::HealthCheckerType,
                                          const HostDescriptionConstSharedPtr&));
 };
 
diff --git a/test/mocks/upstream/transport_socket_match.h b/test/mocks/upstream/transport_socket_match.h
index 80acd532fa8d..decd62ac9a9f 100644
--- a/test/mocks/upstream/transport_socket_match.h
+++ b/test/mocks/upstream/transport_socket_match.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 #include "envoy/upstream/upstream.h"
 
 #include "common/stats/isolated_store_impl.h"
@@ -17,8 +17,8 @@ class MockTransportSocketMatcher : public TransportSocketMatcher {
   MockTransportSocketMatcher();
   MockTransportSocketMatcher(Network::TransportSocketFactoryPtr default_factory);
   ~MockTransportSocketMatcher() override;
-  MOCK_CONST_METHOD1(resolve,
-                     TransportSocketMatcher::MatchData(const envoy::api::v2::core::Metadata&));
+  MOCK_CONST_METHOD1(
+      resolve, TransportSocketMatcher::MatchData(const envoy::config::core::v3alpha::Metadata&));
 
 private:
   Network::TransportSocketFactoryPtr socket_factory_;
diff --git a/test/server/BUILD b/test/server/BUILD
index 8c4c13f19ea3..38e8c276b8ef 100644
--- a/test/server/BUILD
+++ b/test/server/BUILD
@@ -46,9 +46,9 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
-        "@envoy_api//envoy/config/metrics/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/metrics/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -66,8 +66,8 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:network_utility_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -77,6 +77,7 @@ envoy_cc_test(
     deps = [
         "//source/server:drain_manager_lib",
         "//test/mocks/server:server_mocks",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -134,8 +135,8 @@ envoy_cc_test(
         "//test/test_common:logging_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -152,7 +153,7 @@ envoy_cc_test(
         "//test/mocks/thread_local:thread_local_mocks",
         "//test/test_common:registry_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/overload/v2alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/overload/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -170,8 +171,9 @@ envoy_cc_test(
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -187,10 +189,9 @@ envoy_cc_test_library(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -217,9 +218,9 @@ envoy_cc_test(
         "//source/server:active_raw_udp_listener_config",
         "//test/test_common:network_utility_lib",
         "//test/test_common:registry_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -235,8 +236,8 @@ envoy_cc_test(
         "//source/extensions/quic_listeners/quiche:quic_transport_socket_factory_lib",
         "//source/extensions/transport_sockets/raw_buffer:config",
         "//test/test_common:threadsafe_singleton_injector_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -266,7 +267,7 @@ envoy_cc_test(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:threadsafe_singleton_injector_lib",
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -342,7 +343,7 @@ envoy_cc_test(
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_time_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -364,7 +365,7 @@ envoy_cc_test_library(
     deps = [
         "//source/common/protobuf:utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -390,8 +391,7 @@ envoy_cc_test_binary(
         "googletest",
     ],
     deps = [
-        "@envoy_api//envoy/api/v2/listener:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
         "//source/server:filter_chain_manager_lib",
         "//test/test_common:environment_lib",
         "//test/mocks/network:network_mocks",
diff --git a/test/server/config_validation/BUILD b/test/server/config_validation/BUILD
index 734f2635936b..593f47b799d5 100644
--- a/test/server/config_validation/BUILD
+++ b/test/server/config_validation/BUILD
@@ -46,7 +46,7 @@ envoy_cc_test(
         "//test/mocks/upstream:upstream_mocks",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/server/config_validation/cluster_manager_test.cc b/test/server/config_validation/cluster_manager_test.cc
index b9159181c3b9..855156aded4d 100644
--- a/test/server/config_validation/cluster_manager_test.cc
+++ b/test/server/config_validation/cluster_manager_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 #include "envoy/upstream/resource_manager.h"
 #include "envoy/upstream/upstream.h"
 
@@ -51,7 +51,7 @@ TEST(ValidationClusterManagerTest, MockedMethods) {
                                           secret_manager, validation_context, *api, http_context,
                                           log_manager, singleton_manager, time_system);
 
-  const envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  const envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
   ClusterManagerPtr cluster_manager = factory.clusterManagerFromProto(bootstrap);
   EXPECT_EQ(nullptr, cluster_manager->httpConnPoolForCluster("cluster", ResourcePriority::Default,
                                                              Http::Protocol::Http11, nullptr));
diff --git a/test/server/config_validation/config_fuzz_test.cc b/test/server/config_validation/config_fuzz_test.cc
index 7112a6838b01..df8e6fb54f75 100644
--- a/test/server/config_validation/config_fuzz_test.cc
+++ b/test/server/config_validation/config_fuzz_test.cc
@@ -1,6 +1,6 @@
 #include <fstream>
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/common/thread.h"
 #include "common/network/address_impl.h"
@@ -19,7 +19,7 @@ namespace {
 
 // Derived from //test/server:server_fuzz_test.cc, but starts the server in configuration validation
 // mode (quits upon validation of the given config)
-DEFINE_PROTO_FUZZER(const envoy::config::bootstrap::v2::Bootstrap& input) {
+DEFINE_PROTO_FUZZER(const envoy::config::bootstrap::v3alpha::Bootstrap& input) {
   testing::NiceMock<MockOptions> options;
   TestComponentFactory component_factory;
   Fuzz::PerTestEnvironment test_env;
diff --git a/test/server/configuration_impl_test.cc b/test/server/configuration_impl_test.cc
index e591c4197f5e..21c877bb4959 100644
--- a/test/server/configuration_impl_test.cc
+++ b/test/server/configuration_impl_test.cc
@@ -2,9 +2,9 @@
 #include <list>
 #include <string>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
-#include "envoy/config/metrics/v2/stats.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/metrics/v3alpha/stats.pb.h"
 
 #include "common/api/api_impl.h"
 #include "common/config/well_known_names.h"
@@ -70,7 +70,7 @@ class ConfigurationImplTest : public testing::Test {
 };
 
 TEST_F(ConfigurationImplTest, DefaultStatsFlushInterval) {
-  envoy::config::bootstrap::v2::Bootstrap bootstrap;
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
 
   MainImpl config;
   config.initialize(bootstrap, server_, cluster_manager_factory_);
@@ -299,7 +299,7 @@ TEST_F(ConfigurationImplTest, ProtoSpecifiedStatsSink) {
 
   auto& sink = *bootstrap.mutable_stats_sinks()->Add();
   sink.set_name(Extensions::StatSinks::StatsSinkNames::get().Statsd);
-  auto& field_map = *sink.mutable_config()->mutable_fields();
+  auto& field_map = *sink.mutable_hidden_envoy_deprecated_config()->mutable_fields();
   field_map["tcp_cluster_name"].set_string_value("fake_cluster");
 
   MainImpl config;
@@ -329,9 +329,9 @@ TEST_F(ConfigurationImplTest, StatsSinkWithInvalidName) {
 
   auto bootstrap = Upstream::parseBootstrapFromV2Json(json);
 
-  envoy::config::metrics::v2::StatsSink& sink = *bootstrap.mutable_stats_sinks()->Add();
+  envoy::config::metrics::v3alpha::StatsSink& sink = *bootstrap.mutable_stats_sinks()->Add();
   sink.set_name("envoy.invalid");
-  auto& field_map = *sink.mutable_config()->mutable_fields();
+  auto& field_map = *sink.mutable_hidden_envoy_deprecated_config()->mutable_fields();
   field_map["tcp_cluster_name"].set_string_value("fake_cluster");
 
   MainImpl config;
@@ -362,7 +362,7 @@ TEST_F(ConfigurationImplTest, StatsSinkWithNoName) {
   auto bootstrap = Upstream::parseBootstrapFromV2Json(json);
 
   auto& sink = *bootstrap.mutable_stats_sinks()->Add();
-  auto& field_map = *sink.mutable_config()->mutable_fields();
+  auto& field_map = *sink.mutable_hidden_envoy_deprecated_config()->mutable_fields();
   field_map["tcp_cluster_name"].set_string_value("fake_cluster");
 
   MainImpl config;
@@ -388,7 +388,7 @@ TEST(InitialImplTest, LayeredRuntime) {
     - name: admin
       admin_layer: {}
   )EOF";
-  const auto bootstrap = TestUtility::parseYaml<envoy::config::bootstrap::v2::Bootstrap>(yaml);
+  const auto bootstrap = TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::Bootstrap>(yaml);
   InitialImpl config(bootstrap);
   EXPECT_THAT(config.runtime(), ProtoEq(bootstrap.layered_runtime()));
 }
@@ -399,7 +399,7 @@ TEST(InitialImplTest, EmptyLayeredRuntime) {
   layered_runtime: {}
   )EOF";
   const auto bootstrap =
-      TestUtility::parseYaml<envoy::config::bootstrap::v2::Bootstrap>(bootstrap_yaml);
+      TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::Bootstrap>(bootstrap_yaml);
   InitialImpl config(bootstrap);
 
   const std::string expected_yaml = R"EOF(
@@ -407,13 +407,13 @@ TEST(InitialImplTest, EmptyLayeredRuntime) {
   - admin_layer: {}
   )EOF";
   const auto expected_runtime =
-      TestUtility::parseYaml<envoy::config::bootstrap::v2::LayeredRuntime>(expected_yaml);
+      TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::LayeredRuntime>(expected_yaml);
   EXPECT_THAT(config.runtime(), ProtoEq(expected_runtime));
 }
 
 // An empty deprecated Runtime has an empty static and admin layer injected.
 TEST(InitialImplTest, EmptyDeprecatedRuntime) {
-  const auto bootstrap = TestUtility::parseYaml<envoy::config::bootstrap::v2::Bootstrap>("{}");
+  const auto bootstrap = TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::Bootstrap>("{}");
   InitialImpl config(bootstrap);
 
   const std::string expected_yaml = R"EOF(
@@ -424,7 +424,7 @@ TEST(InitialImplTest, EmptyDeprecatedRuntime) {
     admin_layer: {}
   )EOF";
   const auto expected_runtime =
-      TestUtility::parseYaml<envoy::config::bootstrap::v2::LayeredRuntime>(expected_yaml);
+      TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::LayeredRuntime>(expected_yaml);
   EXPECT_THAT(config.runtime(), ProtoEq(expected_runtime));
 }
 
@@ -440,7 +440,7 @@ TEST(InitialImplTest, DeprecatedRuntimeTranslation) {
         min_interval: 5
   )EOF";
   const auto bootstrap =
-      TestUtility::parseYaml<envoy::config::bootstrap::v2::Bootstrap>(bootstrap_yaml);
+      TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::Bootstrap>(bootstrap_yaml);
   InitialImpl config(bootstrap);
 
   const std::string expected_yaml = R"EOF(
@@ -457,7 +457,7 @@ TEST(InitialImplTest, DeprecatedRuntimeTranslation) {
     admin_layer: {}
   )EOF";
   const auto expected_runtime =
-      TestUtility::parseYaml<envoy::config::bootstrap::v2::LayeredRuntime>(expected_yaml);
+      TestUtility::parseYaml<envoy::config::bootstrap::v3alpha::LayeredRuntime>(expected_yaml);
   EXPECT_THAT(config.runtime(), ProtoEq(expected_runtime));
 }
 
@@ -496,11 +496,11 @@ TEST_F(ConfigurationImplTest, AdminSocketOptions) {
 
   ASSERT_EQ(config.admin().socketOptions()->size(), 2);
   auto detail = config.admin().socketOptions()->at(0)->getOptionDetails(
-      socket_mock, envoy::api::v2::core::SocketOption::STATE_PREBIND);
+      socket_mock, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND);
   ASSERT_NE(detail, absl::nullopt);
   EXPECT_EQ(detail->name_, Envoy::Network::SocketOptionName(1, 2, "1/2"));
   detail = config.admin().socketOptions()->at(1)->getOptionDetails(
-      socket_mock, envoy::api::v2::core::SocketOption::STATE_BOUND);
+      socket_mock, envoy::config::core::v3alpha::SocketOption::STATE_BOUND);
   ASSERT_NE(detail, absl::nullopt);
   EXPECT_EQ(detail->name_, Envoy::Network::SocketOptionName(4, 5, "4/5"));
 }
diff --git a/test/server/connection_handler_test.cc b/test/server/connection_handler_test.cc
index f8cc85fafeb7..e711e184062b 100644
--- a/test/server/connection_handler_test.cc
+++ b/test/server/connection_handler_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/listener/udp_listener_config.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/listener/v3alpha/udp_listener_config.pb.h"
 #include "envoy/server/active_udp_listener_config.h"
 #include "envoy/stats/scope.h"
 
@@ -57,7 +57,7 @@ class ConnectionHandlerTest : public testing::Test, protected Logger::Loggable<L
           name_(name), listener_filters_timeout_(listener_filters_timeout),
           continue_on_listener_filters_timeout_(continue_on_listener_filters_timeout),
           connection_balancer_(std::make_unique<Network::NopConnectionBalancerImpl>()) {
-      envoy::api::v2::listener::UdpListenerConfig dummy;
+      envoy::config::listener::v3alpha::UdpListenerConfig dummy;
       std::string listener_name("raw_udp_listener");
       dummy.set_udp_listener_name(listener_name);
       udp_listener_factory_ =
@@ -87,8 +87,8 @@ class ConnectionHandlerTest : public testing::Test, protected Logger::Loggable<L
     const Network::ActiveUdpListenerFactory* udpListenerFactory() override {
       return udp_listener_factory_.get();
     }
-    envoy::api::v2::core::TrafficDirection direction() const override {
-      return envoy::api::v2::core::TrafficDirection::UNSPECIFIED;
+    envoy::config::core::v3alpha::TrafficDirection direction() const override {
+      return envoy::config::core::v3alpha::UNSPECIFIED;
     }
     Network::ConnectionBalancer& connectionBalancer() override { return *connection_balancer_; }
 
diff --git a/test/server/drain_manager_impl_test.cc b/test/server/drain_manager_impl_test.cc
index e5d2a7818a1f..858119a7e287 100644
--- a/test/server/drain_manager_impl_test.cc
+++ b/test/server/drain_manager_impl_test.cc
@@ -1,5 +1,7 @@
 #include <chrono>
 
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+
 #include "server/drain_manager_impl.h"
 
 #include "test/mocks/server/mocks.h"
@@ -28,7 +30,7 @@ class DrainManagerImplTest : public testing::Test {
 
 TEST_F(DrainManagerImplTest, Default) {
   InSequence s;
-  DrainManagerImpl drain_manager(server_, envoy::api::v2::Listener::DEFAULT);
+  DrainManagerImpl drain_manager(server_, envoy::config::listener::v3alpha::Listener::DEFAULT);
 
   // Test parent shutdown.
   Event::MockTimer* shutdown_timer = new Event::MockTimer(&server_.dispatcher_);
@@ -66,7 +68,7 @@ TEST_F(DrainManagerImplTest, Default) {
 
 TEST_F(DrainManagerImplTest, ModifyOnly) {
   InSequence s;
-  DrainManagerImpl drain_manager(server_, envoy::api::v2::Listener::MODIFY_ONLY);
+  DrainManagerImpl drain_manager(server_, envoy::config::listener::v3alpha::Listener::MODIFY_ONLY);
 
   EXPECT_CALL(server_, healthCheckFailed()).Times(0);
   EXPECT_FALSE(drain_manager.drainClose());
diff --git a/test/server/filter_chain_benchmark_test.cc b/test/server/filter_chain_benchmark_test.cc
index e3a983c30374..767ed6a20621 100644
--- a/test/server/filter_chain_benchmark_test.cc
+++ b/test/server/filter_chain_benchmark_test.cc
@@ -1,8 +1,8 @@
 #include <iostream>
 #include <unordered_map>
 
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/network/connection.h"
 #include "envoy/network/listen_socket.h"
 #include "envoy/protobuf/message_validator.h"
@@ -29,7 +29,7 @@ namespace {
 
 class MockFilterChainFactoryBuilder : public FilterChainFactoryBuilder {
   std::unique_ptr<Network::FilterChain>
-  buildFilterChain(const ::envoy::api::v2::listener::FilterChain&) const override {
+  buildFilterChain(const envoy::config::listener::v3alpha::FilterChain&) const override {
     // A place holder to be found
     return std::make_unique<Network::MockFilterChain>();
   }
@@ -175,9 +175,9 @@ class FilterChainBenchmarkFixture : public benchmark::Fixture {
     TestUtility::loadFromYaml(listener_yaml_config_, listener_config_);
     filter_chains_ = listener_config_.filter_chains();
   }
-  absl::Span<const envoy::api::v2::listener::FilterChain* const> filter_chains_;
+  absl::Span<const envoy::config::listener::v3alpha::FilterChain* const> filter_chains_;
   std::string listener_yaml_config_;
-  envoy::api::v2::Listener listener_config_;
+  envoy::config::listener::v3alpha::Listener listener_config_;
   MockFilterChainFactoryBuilder dummy_builder_;
   FilterChainManagerImpl filter_chain_manager_{
       std::make_shared<Network::Address::Ipv4Instance>("127.0.0.1", 1234)};
diff --git a/test/server/filter_chain_manager_impl_test.cc b/test/server/filter_chain_manager_impl_test.cc
index 0742b3146757..c59021e4f734 100644
--- a/test/server/filter_chain_manager_impl_test.cc
+++ b/test/server/filter_chain_manager_impl_test.cc
@@ -4,7 +4,7 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 
@@ -46,7 +46,7 @@ namespace Server {
 class MockFilterChainFactoryBuilder : public FilterChainFactoryBuilder {
 
   std::unique_ptr<Network::FilterChain>
-  buildFilterChain(const ::envoy::api::v2::listener::FilterChain&) const override {
+  buildFilterChain(const envoy::config::listener::v3alpha::FilterChain&) const override {
     // Won't dereference but requires not nullptr.
     return std::make_unique<Network::MockFilterChain>();
   }
@@ -94,9 +94,10 @@ class FilterChainManagerImplTest : public testing::Test {
     return filter_chain_manager_.findFilterChain(*mock_socket);
   }
 
-  void addSingleFilterChainHelper(const envoy::api::v2::listener::FilterChain& filter_chain) {
+  void
+  addSingleFilterChainHelper(const envoy::config::listener::v3alpha::FilterChain& filter_chain) {
     filter_chain_manager_.addFilterChain(
-        std::vector<const envoy::api::v2::listener::FilterChain*>{&filter_chain},
+        std::vector<const envoy::config::listener::v3alpha::FilterChain*>{&filter_chain},
         filter_chain_factory_builder_);
   }
 
@@ -121,7 +122,7 @@ class FilterChainManagerImplTest : public testing::Test {
             keys:
             - filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/test_data/ticket_key_a"
   )EOF";
-  envoy::api::v2::listener::FilterChain filter_chain_template_;
+  envoy::config::listener::v3alpha::FilterChain filter_chain_template_;
   MockFilterChainFactoryBuilder filter_chain_factory_builder_;
 
   // Test target.
diff --git a/test/server/http/BUILD b/test/server/http/BUILD
index 05c95287443d..8da8326b625f 100644
--- a/test/server/http/BUILD
+++ b/test/server/http/BUILD
@@ -29,10 +29,10 @@ envoy_cc_test(
         "//test/test_common:logging_lib",
         "//test/test_common:network_utility_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/admin/v2alpha:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/auth:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/config/filter/network/http_connection_manager/v2:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/server/http/admin_test.cc b/test/server/http/admin_test.cc
index a8b84e0920d0..f2921f77fe9b 100644
--- a/test/server/http/admin_test.cc
+++ b/test/server/http/admin_test.cc
@@ -3,12 +3,13 @@
 #include <regex>
 #include <unordered_map>
 
-#include "envoy/admin/v2alpha/clusters.pb.h"
-#include "envoy/admin/v2alpha/memory.pb.h"
-#include "envoy/admin/v2alpha/server_info.pb.h"
-#include "envoy/api/v2/auth/cert.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.pb.h"
+#include "envoy/admin/v3alpha/clusters.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/admin/v3alpha/memory.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/extensions/filters/network/http_connection_manager/v3alpha/http_connection_manager.pb.h"
+#include "envoy/extensions/transport_sockets/tls/v3alpha/cert.pb.h"
 #include "envoy/json/json_object.h"
 #include "envoy/runtime/runtime.h"
 #include "envoy/stats/stats.h"
@@ -942,7 +943,7 @@ TEST_P(AdminInstanceTest, ConfigDumpFiltersByResource) {
   Buffer::OwnedImpl response;
   Http::HeaderMapImpl header_map;
   auto listeners = admin_.getConfigTracker().add("listeners", [] {
-    auto msg = std::make_unique<envoy::admin::v2alpha::ListenersConfigDump>();
+    auto msg = std::make_unique<envoy::admin::v3alpha::ListenersConfigDump>();
     auto dyn_listener = msg->add_dynamic_listeners();
     dyn_listener->set_name("foo");
     auto stat_listener = msg->add_static_listeners();
@@ -953,7 +954,7 @@ TEST_P(AdminInstanceTest, ConfigDumpFiltersByResource) {
   const std::string expected_json = R"EOF({
  "configs": [
   {
-   "@type": "type.googleapis.com/envoy.admin.v2alpha.ListenersConfigDump.DynamicListener",
+   "@type": "type.googleapis.com/envoy.admin.v3alpha.ListenersConfigDump.DynamicListener",
    "name": "foo"
   }
  ]
@@ -972,7 +973,7 @@ TEST_P(AdminInstanceTest, ConfigDumpFiltersByMask) {
   Buffer::OwnedImpl response;
   Http::HeaderMapImpl header_map;
   auto listeners = admin_.getConfigTracker().add("listeners", [] {
-    auto msg = std::make_unique<envoy::admin::v2alpha::ListenersConfigDump>();
+    auto msg = std::make_unique<envoy::admin::v3alpha::ListenersConfigDump>();
     auto dyn_listener = msg->add_dynamic_listeners();
     dyn_listener->set_name("foo");
     auto stat_listener = msg->add_static_listeners();
@@ -983,7 +984,7 @@ TEST_P(AdminInstanceTest, ConfigDumpFiltersByMask) {
   const std::string expected_json = R"EOF({
  "configs": [
   {
-   "@type": "type.googleapis.com/envoy.admin.v2alpha.ListenersConfigDump",
+   "@type": "type.googleapis.com/envoy.admin.v3alpha.ListenersConfigDump",
    "dynamic_listeners": [
     {
      "name": "foo"
@@ -1000,11 +1001,11 @@ TEST_P(AdminInstanceTest, ConfigDumpFiltersByMask) {
 }
 
 ProtobufTypes::MessagePtr testDumpClustersConfig() {
-  auto msg = std::make_unique<envoy::admin::v2alpha::ClustersConfigDump>();
+  auto msg = std::make_unique<envoy::admin::v3alpha::ClustersConfigDump>();
   auto static_cluster = msg->add_static_clusters();
   auto inner_cluster = static_cluster->mutable_cluster();
   inner_cluster->set_name("foo");
-  inner_cluster->set_drain_connections_on_host_removal(true);
+  inner_cluster->set_ignore_health_on_host_removal(true);
 
   auto dyn_cluster = msg->add_dynamic_active_clusters();
   auto inner_dyn_cluster = dyn_cluster->mutable_cluster();
@@ -1021,7 +1022,7 @@ TEST_P(AdminInstanceTest, ConfigDumpFiltersByResourceAndMask) {
   const std::string expected_json = R"EOF({
  "configs": [
   {
-   "@type": "type.googleapis.com/envoy.admin.v2alpha.ClustersConfigDump.StaticCluster",
+   "@type": "type.googleapis.com/envoy.admin.v3alpha.ClustersConfigDump.StaticCluster",
    "cluster": {
     "name": "foo"
    }
@@ -1044,7 +1045,7 @@ TEST_P(AdminInstanceTest, ConfigDumpNonExistentMask) {
   const std::string expected_json = R"EOF({
  "configs": [
   {
-   "@type": "type.googleapis.com/envoy.admin.v2alpha.ClustersConfigDump.StaticCluster"
+   "@type": "type.googleapis.com/envoy.admin.v3alpha.ClustersConfigDump.StaticCluster"
   }
  ]
 }
@@ -1074,7 +1075,7 @@ TEST_P(AdminInstanceTest, ConfigDumpResourceNotRepeated) {
   Buffer::OwnedImpl response;
   Http::HeaderMapImpl header_map;
   auto clusters = admin_.getConfigTracker().add("clusters", [] {
-    auto msg = std::make_unique<envoy::admin::v2alpha::ClustersConfigDump>();
+    auto msg = std::make_unique<envoy::admin::v3alpha::ClustersConfigDump>();
     msg->set_version_info("foo");
     return msg;
   });
@@ -1087,14 +1088,14 @@ TEST_P(AdminInstanceTest, Memory) {
   Buffer::OwnedImpl response;
   EXPECT_EQ(Http::Code::OK, getCallback("/memory", header_map, response));
   const std::string output_json = response.toString();
-  envoy::admin::v2alpha::Memory output_proto;
+  envoy::admin::v3alpha::Memory output_proto;
   TestUtility::loadFromJson(output_json, output_proto);
   EXPECT_THAT(output_proto,
-              AllOf(Property(&envoy::admin::v2alpha::Memory::allocated, Ge(0)),
-                    Property(&envoy::admin::v2alpha::Memory::heap_size, Ge(0)),
-                    Property(&envoy::admin::v2alpha::Memory::pageheap_unmapped, Ge(0)),
-                    Property(&envoy::admin::v2alpha::Memory::pageheap_free, Ge(0)),
-                    Property(&envoy::admin::v2alpha::Memory::total_thread_cache, Ge(0))));
+              AllOf(Property(&envoy::admin::v3alpha::Memory::allocated, Ge(0)),
+                    Property(&envoy::admin::v3alpha::Memory::heap_size, Ge(0)),
+                    Property(&envoy::admin::v3alpha::Memory::pageheap_unmapped, Ge(0)),
+                    Property(&envoy::admin::v3alpha::Memory::pageheap_free, Ge(0)),
+                    Property(&envoy::admin::v3alpha::Memory::total_thread_cache, Ge(0))));
 }
 
 TEST_P(AdminInstanceTest, ContextThatReturnsNullCertDetails) {
@@ -1103,7 +1104,7 @@ TEST_P(AdminInstanceTest, ContextThatReturnsNullCertDetails) {
 
   // Setup a context that returns null cert details.
   testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context;
-  envoy::api::v2::auth::UpstreamTlsContext config;
+  envoy::extensions::transport_sockets::tls::v3alpha::UpstreamTlsContext config;
   Extensions::TransportSockets::Tls::ClientContextConfigImpl cfg(config, factory_context);
   Stats::IsolatedStoreImpl store;
   Envoy::Ssl::ClientContextSharedPtr client_ctx(
@@ -1264,7 +1265,7 @@ TEST_P(AdminInstanceTest, ClustersJson) {
   Upstream::MockHostSet* host_set = cluster.priority_set_.getMockHostSet(0);
   auto host = std::make_shared<NiceMock<Upstream::MockHost>>();
 
-  envoy::api::v2::core::Locality locality;
+  envoy::config::core::v3alpha::Locality locality;
   locality.set_region("test_region");
   locality.set_zone("test_zone");
   locality.set_sub_zone("test_sub_zone");
@@ -1327,7 +1328,7 @@ TEST_P(AdminInstanceTest, ClustersJson) {
   Http::HeaderMapImpl header_map;
   EXPECT_EQ(Http::Code::OK, getCallback("/clusters?format=json", header_map, response));
   std::string output_json = response.toString();
-  envoy::admin::v2alpha::Clusters output_proto;
+  envoy::admin::v3alpha::Clusters output_proto;
   TestUtility::loadFromJson(output_json, output_proto);
 
   const std::string expected_json = R"EOF({
@@ -1400,7 +1401,7 @@ TEST_P(AdminInstanceTest, ClustersJson) {
 }
 )EOF";
 
-  envoy::admin::v2alpha::Clusters expected_proto;
+  envoy::admin::v3alpha::Clusters expected_proto;
   TestUtility::loadFromJson(expected_json, expected_proto);
 
   // Ensure the protos created from each JSON are equivalent.
@@ -1444,7 +1445,7 @@ fake_cluster::1.2.3.4:80::local_origin_success_rate::93.2
 TEST_P(AdminInstanceTest, GetRequest) {
   EXPECT_CALL(server_.options_, toCommandLineOptions()).WillRepeatedly(Invoke([] {
     Server::CommandLineOptionsPtr command_line_options =
-        std::make_unique<envoy::admin::v2alpha::CommandLineOptions>();
+        std::make_unique<envoy::admin::v3alpha::CommandLineOptions>();
     command_line_options->set_restart_epoch(2);
     command_line_options->set_service_cluster("cluster");
     return command_line_options;
@@ -1459,14 +1460,14 @@ TEST_P(AdminInstanceTest, GetRequest) {
 
     ON_CALL(initManager, state()).WillByDefault(Return(Init::Manager::State::Initialized));
     EXPECT_EQ(Http::Code::OK, admin_.request("/server_info", "GET", response_headers, body));
-    envoy::admin::v2alpha::ServerInfo server_info_proto;
+    envoy::admin::v3alpha::ServerInfo server_info_proto;
     EXPECT_THAT(std::string(response_headers.ContentType()->value().getStringView()),
                 HasSubstr("application/json"));
 
     // We only test that it parses as the proto and that some fields are correct, since
     // values such as timestamps + Envoy version are tricky to test for.
     TestUtility::loadFromJson(body, server_info_proto);
-    EXPECT_EQ(server_info_proto.state(), envoy::admin::v2alpha::ServerInfo::LIVE);
+    EXPECT_EQ(server_info_proto.state(), envoy::admin::v3alpha::ServerInfo::LIVE);
     EXPECT_EQ(server_info_proto.hot_restart_version(), "foo_version");
     EXPECT_EQ(server_info_proto.command_line_options().restart_epoch(), 2);
     EXPECT_EQ(server_info_proto.command_line_options().service_cluster(), "cluster");
@@ -1478,14 +1479,14 @@ TEST_P(AdminInstanceTest, GetRequest) {
 
     ON_CALL(initManager, state()).WillByDefault(Return(Init::Manager::State::Uninitialized));
     EXPECT_EQ(Http::Code::OK, admin_.request("/server_info", "GET", response_headers, body));
-    envoy::admin::v2alpha::ServerInfo server_info_proto;
+    envoy::admin::v3alpha::ServerInfo server_info_proto;
     EXPECT_THAT(std::string(response_headers.ContentType()->value().getStringView()),
                 HasSubstr("application/json"));
 
     // We only test that it parses as the proto and that some fields are correct, since
     // values such as timestamps + Envoy version are tricky to test for.
     TestUtility::loadFromJson(body, server_info_proto);
-    EXPECT_EQ(server_info_proto.state(), envoy::admin::v2alpha::ServerInfo::PRE_INITIALIZING);
+    EXPECT_EQ(server_info_proto.state(), envoy::admin::v3alpha::ServerInfo::PRE_INITIALIZING);
     EXPECT_EQ(server_info_proto.command_line_options().restart_epoch(), 2);
     EXPECT_EQ(server_info_proto.command_line_options().service_cluster(), "cluster");
   }
@@ -1495,14 +1496,14 @@ TEST_P(AdminInstanceTest, GetRequest) {
 
   ON_CALL(initManager, state()).WillByDefault(Return(Init::Manager::State::Initializing));
   EXPECT_EQ(Http::Code::OK, admin_.request("/server_info", "GET", response_headers, body));
-  envoy::admin::v2alpha::ServerInfo server_info_proto;
+  envoy::admin::v3alpha::ServerInfo server_info_proto;
   EXPECT_THAT(std::string(response_headers.ContentType()->value().getStringView()),
               HasSubstr("application/json"));
 
   // We only test that it parses as the proto and that some fields are correct, since
   // values such as timestamps + Envoy version are tricky to test for.
   TestUtility::loadFromJson(body, server_info_proto);
-  EXPECT_EQ(server_info_proto.state(), envoy::admin::v2alpha::ServerInfo::INITIALIZING);
+  EXPECT_EQ(server_info_proto.state(), envoy::admin::v3alpha::ServerInfo::INITIALIZING);
   EXPECT_EQ(server_info_proto.command_line_options().restart_epoch(), 2);
   EXPECT_EQ(server_info_proto.command_line_options().service_cluster(), "cluster");
 }
diff --git a/test/server/lds_api_test.cc b/test/server/lds_api_test.cc
index 6e0016947312..a941d5d5c0b9 100644
--- a/test/server/lds_api_test.cc
+++ b/test/server/lds_api_test.cc
@@ -1,8 +1,8 @@
 #include <memory>
 
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -35,7 +35,7 @@ class LdsApiTest : public testing::Test {
   }
 
   void setup() {
-    envoy::api::v2::core::ConfigSource lds_config;
+    envoy::config::core::v3alpha::ConfigSource lds_config;
     EXPECT_CALL(init_manager_, add(_));
     lds_ = std::make_unique<LdsApiImpl>(lds_config, cluster_manager_, init_manager_, store_,
                                         listener_manager_, validation_visitor_);
@@ -48,18 +48,20 @@ class LdsApiTest : public testing::Test {
                  bool updated) {
     if (!version) {
       EXPECT_CALL(listener_manager_, addOrUpdateListener(_, _, true))
-          .WillOnce(Invoke([listener_name, updated](const envoy::api::v2::Listener& config,
-                                                    const std::string&, bool) -> bool {
-            EXPECT_EQ(listener_name, config.name());
-            return updated;
-          }));
+          .WillOnce(Invoke(
+              [listener_name, updated](const envoy::config::listener::v3alpha::Listener& config,
+                                       const std::string&, bool) -> bool {
+                EXPECT_EQ(listener_name, config.name());
+                return updated;
+              }));
     } else {
       EXPECT_CALL(listener_manager_, addOrUpdateListener(_, version.value(), true))
-          .WillOnce(Invoke([listener_name, updated](const envoy::api::v2::Listener& config,
-                                                    const std::string&, bool) -> bool {
-            EXPECT_EQ(listener_name, config.name());
-            return updated;
-          }));
+          .WillOnce(Invoke(
+              [listener_name, updated](const envoy::config::listener::v3alpha::Listener& config,
+                                       const std::string&, bool) -> bool {
+                EXPECT_EQ(listener_name, config.name());
+                return updated;
+              }));
     }
   }
 
@@ -77,7 +79,7 @@ class LdsApiTest : public testing::Test {
 
   void addListener(Protobuf::RepeatedPtrField<ProtobufWkt::Any>& listeners,
                    const std::string& listener_name) {
-    envoy::api::v2::Listener listener;
+    envoy::config::listener::v3alpha::Listener listener;
     listener.set_name(listener_name);
     auto socket_address = listener.mutable_address()->mutable_socket_address();
     socket_address->set_address(listener_name);
@@ -108,7 +110,7 @@ TEST_F(LdsApiTest, ValidateFail) {
   setup();
 
   Protobuf::RepeatedPtrField<ProtobufWkt::Any> listeners;
-  envoy::api::v2::Listener listener;
+  envoy::config::listener::v3alpha::Listener listener;
   listeners.Add()->PackFrom(listener);
   std::vector<std::reference_wrapper<Network::ListenerConfig>> existing_listeners;
   EXPECT_CALL(listener_manager_, listeners()).WillOnce(Return(existing_listeners));
@@ -136,7 +138,7 @@ TEST_F(LdsApiTest, MisconfiguredListenerNameIsPresentInException) {
   std::vector<std::reference_wrapper<Network::ListenerConfig>> existing_listeners;
 
   // Construct a minimal listener that would pass proto validation.
-  envoy::api::v2::Listener listener;
+  envoy::config::listener::v3alpha::Listener listener;
   listener.set_name("invalid-listener");
   auto socket_address = listener.mutable_address()->mutable_socket_address();
   socket_address->set_address("invalid-address");
@@ -254,7 +256,8 @@ TEST_F(LdsApiTest, Basic) {
   ]
 }
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   makeListenersAndExpectCall({});
   expectAdd("listener1", "0", true);
@@ -284,7 +287,8 @@ TEST_F(LdsApiTest, Basic) {
   ]
 }
   )EOF";
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_json);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_json);
 
   makeListenersAndExpectCall({"listener1", "listener2"});
   EXPECT_CALL(listener_manager_, removeListener("listener2")).WillOnce(Return(true));
@@ -315,7 +319,8 @@ TEST_F(LdsApiTest, UpdateVersionOnListenerRemove) {
   ]
 }
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   makeListenersAndExpectCall({});
   expectAdd("listener1", "0", true);
@@ -331,7 +336,8 @@ TEST_F(LdsApiTest, UpdateVersionOnListenerRemove) {
   "resources": []
 }
   )EOF";
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_json);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_json);
 
   makeListenersAndExpectCall({"listener1"});
   EXPECT_CALL(listener_manager_, removeListener("listener1")).WillOnce(Return(true));
@@ -359,7 +365,8 @@ version_info: '1'
   filter_chains:
   - filters: 
   )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_yaml);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_yaml);
 
   makeListenersAndExpectCall({"listener0"});
   expectAdd("listener0", {}, true);
@@ -393,7 +400,8 @@ version_info: '1'
       fmt::format(response2_basic,
                   TestEnvironment::runfilesPath("test/config/integration/certs/servercert.pem"),
                   TestEnvironment::runfilesPath("test/config/integration/certs/serverkey.pem"));
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_json);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_json);
 
   makeListenersAndExpectCall({
       "listener-8080",
@@ -423,7 +431,8 @@ TEST_F(LdsApiTest, FailureInvalidConfig) {
   ]
 }
   )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   std::vector<std::reference_wrapper<Network::ListenerConfig>> existing_listeners;
   EXPECT_CALL(listener_manager_, listeners()).WillOnce(Return(existing_listeners));
@@ -470,7 +479,8 @@ TEST_F(LdsApiTest, ReplacingListenerWithSameAddress) {
   ]
 }
 )EOF";
-  auto response1 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response1_json);
+  auto response1 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response1_json);
 
   makeListenersAndExpectCall({});
   expectAdd("listener1", "0", true);
@@ -500,7 +510,8 @@ TEST_F(LdsApiTest, ReplacingListenerWithSameAddress) {
   ]
 }
 )EOF";
-  auto response2 = TestUtility::parseYaml<envoy::api::v2::DiscoveryResponse>(response2_json);
+  auto response2 =
+      TestUtility::parseYaml<envoy::service::discovery::v3alpha::DiscoveryResponse>(response2_json);
 
   makeListenersAndExpectCall({"listener1", "listener2"});
   EXPECT_CALL(listener_manager_, removeListener("listener2")).WillOnce(Return(true));
diff --git a/test/server/listener_manager_impl_quic_only_test.cc b/test/server/listener_manager_impl_quic_only_test.cc
index e780e46dff3f..5524b3e9ec51 100644
--- a/test/server/listener_manager_impl_quic_only_test.cc
+++ b/test/server/listener_manager_impl_quic_only_test.cc
@@ -1,5 +1,5 @@
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 
 #include "extensions/quic_listeners/quiche/quic_transport_socket_factory.h"
 
@@ -45,9 +45,9 @@ reuse_port: true
   )EOF",
                                                        Network::Address::IpVersion::v4);
 
-  envoy::api::v2::Listener listener_proto = parseListenerFromV2Yaml(yaml);
+  envoy::config::listener::v3alpha::Listener listener_proto = parseListenerFromV2Yaml(yaml);
   EXPECT_CALL(server_.random_, uuid());
-  expectCreateListenSocket(envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  expectCreateListenSocket(envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
 #ifdef SO_RXQ_OVFL
                            /* expected_num_options */ 3, // SO_REUSEPORT is on as configured
 #else
diff --git a/test/server/listener_manager_impl_test.cc b/test/server/listener_manager_impl_test.cc
index 18722fdeab6b..49367e87b08b 100644
--- a/test/server/listener_manager_impl_test.cc
+++ b/test/server/listener_manager_impl_test.cc
@@ -6,11 +6,11 @@
 #include <utility>
 #include <vector>
 
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/core/config_source.pb.h"
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/core/v3alpha/config_source.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 #include "envoy/registry/registry.h"
 #include "envoy/server/filter_config.h"
 #include "envoy/server/listener_manager.h"
@@ -46,8 +46,8 @@ class ListenerManagerImplWithRealFiltersTest : public ListenerManagerImplTest {
   /**
    * Create an IPv4 listener with a given name.
    */
-  envoy::api::v2::Listener createIPv4Listener(const std::string& name) {
-    envoy::api::v2::Listener listener = parseListenerFromV2Yaml(R"EOF(
+  envoy::config::listener::v3alpha::Listener createIPv4Listener(const std::string& name) {
+    envoy::config::listener::v3alpha::Listener listener = parseListenerFromV2Yaml(R"EOF(
       address:
         socket_address: { address: 127.0.0.1, port_value: 1111 }
       filter_chains:
@@ -62,11 +62,12 @@ class ListenerManagerImplWithRealFiltersTest : public ListenerManagerImplTest {
    * and set in the Listener, it should result in a call to setsockopt() with the appropriate
    * values.
    */
-  void testSocketOption(const envoy::api::v2::Listener& listener,
-                        const envoy::api::v2::core::SocketOption::SocketState& expected_state,
-                        const Network::SocketOptionName& expected_option, int expected_value,
-                        uint32_t expected_num_options = 1,
-                        ListenSocketCreationParams expected_creation_params = {true, true}) {
+  void
+  testSocketOption(const envoy::config::listener::v3alpha::Listener& listener,
+                   const envoy::config::core::v3alpha::SocketOption::SocketState& expected_state,
+                   const Network::SocketOptionName& expected_option, int expected_value,
+                   uint32_t expected_num_options = 1,
+                   ListenSocketCreationParams expected_creation_params = {true, true}) {
     if (expected_option.has_value()) {
       expectCreateListenSocket(expected_state, expected_num_options, expected_creation_params);
       expectSetsockopt(os_sys_calls_, expected_option.level(), expected_option.option(),
@@ -255,7 +256,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, UdpAddress) {
     }
     filter_chains: {}
   )EOF";
-  envoy::api::v2::Listener listener_proto;
+  envoy::config::listener::v3alpha::Listener listener_proto;
   EXPECT_TRUE(Protobuf::TextFormat::ParseFromString(proto_text, &listener_proto));
 
   EXPECT_CALL(server_.random_, uuid());
@@ -321,7 +322,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, BadFilterConfig) {
 - filters:
   - foo: type
     name: name
-    config: {}
+    typed_config: {}
   )EOF";
 
   EXPECT_THROW_WITH_REGEX(manager_->addOrUpdateListener(parseListenerFromV2Yaml(yaml), "", true),
@@ -477,7 +478,7 @@ TEST_F(ListenerManagerImplTest, ModifyOnlyDrainType) {
   )EOF";
 
   ListenerHandle* listener_foo =
-      expectListenerCreate(false, true, envoy::api::v2::Listener::MODIFY_ONLY);
+      expectListenerCreate(false, true, envoy::config::listener::v3alpha::Listener::MODIFY_ONLY);
   EXPECT_CALL(listener_factory_, createListenSocket(_, _, _, {true}));
   EXPECT_TRUE(manager_->addOrUpdateListener(parseListenerFromV2Yaml(listener_foo_yaml), "", true));
   checkStats(1, 0, 0, 0, 1, 0);
@@ -519,7 +520,7 @@ drain_type: modify_only
   )EOF";
 
   ListenerHandle* listener_foo_different_address =
-      expectListenerCreate(false, true, envoy::api::v2::Listener::MODIFY_ONLY);
+      expectListenerCreate(false, true, envoy::config::listener::v3alpha::Listener::MODIFY_ONLY);
   EXPECT_CALL(*listener_foo_different_address, onDestroy());
   EXPECT_THROW_WITH_MESSAGE(
       manager_->addOrUpdateListener(parseListenerFromV2Yaml(listener_foo_different_address_yaml),
@@ -663,7 +664,7 @@ TEST_F(ListenerManagerImplTest, AddOrUpdateListener) {
 
   auto* lds_api = new MockLdsApi();
   EXPECT_CALL(listener_factory_, createLdsApi_(_)).WillOnce(Return(lds_api));
-  envoy::api::v2::core::ConfigSource lds_config;
+  envoy::config::core::v3alpha::ConfigSource lds_config;
   manager_->createLdsApi(lds_config);
 
   EXPECT_CALL(*lds_api, versionInfo()).WillOnce(Return(""));
@@ -1166,7 +1167,7 @@ name: foo
   - name: foo
     error_state:
       failed_configuration:
-        "@type": type.googleapis.com/envoy.api.v2.Listener
+        "@type": type.googleapis.com/envoy.config.listener.v3alpha.Listener
         name: foo
         address:
           socket_address:
@@ -1208,7 +1209,7 @@ TEST_F(ListenerManagerImplTest, ConfigDumpWithExternalError) {
 
   // Now have an external update with errors and make sure it gets dumped.
   ListenerManager::FailureStates non_empty_failure_state;
-  non_empty_failure_state.push_back(std::make_unique<envoy::admin::v2alpha::UpdateFailureState>());
+  non_empty_failure_state.push_back(std::make_unique<envoy::admin::v3alpha::UpdateFailureState>());
   auto& state = non_empty_failure_state.back();
   state->set_details("foo");
   manager_->beginListenerUpdate();
@@ -3091,7 +3092,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, Metadata) {
   EXPECT_EQ("test_value",
             Config::Metadata::metadataValue(context->listenerMetadata(), "com.bar.foo", "baz")
                 .string_value());
-  EXPECT_EQ(envoy::api::v2::core::TrafficDirection::INBOUND, context->direction());
+  EXPECT_EQ(envoy::config::core::v3alpha::INBOUND, context->direction());
 }
 
 TEST_F(ListenerManagerImplWithRealFiltersTest, OriginalDstFilter) {
@@ -3314,7 +3315,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, TransparentFreebindListenerDisabl
 TEST_F(ListenerManagerImplWithRealFiltersTest, TransparentListenerEnabled) {
   auto listener = createIPv4Listener("TransparentListener");
   listener.mutable_transparent()->set_value(true);
-  testSocketOption(listener, envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  testSocketOption(listener, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
                    ENVOY_SOCKET_IP_TRANSPARENT, /* expected_value */ 1,
                    /* expected_num_options */ 2);
 }
@@ -3329,7 +3330,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, FreebindListenerEnabled) {
   auto listener = createIPv4Listener("FreebindListener");
   listener.mutable_freebind()->set_value(true);
 
-  testSocketOption(listener, envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  testSocketOption(listener, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
                    ENVOY_SOCKET_IP_FREEBIND, /* expected_value */ 1);
 }
 
@@ -3343,7 +3344,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, FastOpenListenerEnabled) {
   auto listener = createIPv4Listener("FastOpenListener");
   listener.mutable_tcp_fast_open_queue_length()->set_value(1);
 
-  testSocketOption(listener, envoy::api::v2::core::SocketOption::STATE_LISTENING,
+  testSocketOption(listener, envoy::config::core::v3alpha::SocketOption::STATE_LISTENING,
                    ENVOY_SOCKET_TCP_FASTOPEN, /* expected_value */ 1);
 }
 
@@ -3355,7 +3356,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerEnabledForTcp) {
   // when reuse_port is true, port should be 0 for creating the shared socket,
   // otherwise socket creation will be done on worker thread.
   listener.mutable_address()->mutable_socket_address()->set_port_value(0);
-  testSocketOption(listener, envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  testSocketOption(listener, envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
                    ENVOY_SOCKET_SO_REUSEPORT, /* expected_value */ 1,
                    /* expected_num_options */ 1,
                    /* expected_creation_params */ {true, false});
@@ -3365,7 +3366,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerDisabled) {
 
   auto listener = createIPv4Listener("UdpListener");
   listener.mutable_address()->mutable_socket_address()->set_protocol(
-      envoy::api::v2::core::SocketAddress::UDP);
+      envoy::config::core::v3alpha::SocketAddress::UDP);
   // For UDP, reuse_port is set to true forcibly, even it's set to false explicitly in config
   listener.set_reuse_port(false);
 
@@ -3374,7 +3375,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerDisabled) {
   listener.mutable_address()->mutable_socket_address()->set_port_value(0);
 
   // IpPacketInfo and RxQueueOverFlow are always set if supported
-  expectCreateListenSocket(envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  expectCreateListenSocket(envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
 #ifdef SO_RXQ_OVFL
                            /* expected_num_options */ 2,
 #else
@@ -3401,7 +3402,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, ReusePortListenerDisabled) {
 }
 
 TEST_F(ListenerManagerImplWithRealFiltersTest, LiteralSockoptListenerEnabled) {
-  const envoy::api::v2::Listener listener = parseListenerFromV2Yaml(R"EOF(
+  const envoy::config::listener::v3alpha::Listener listener = parseListenerFromV2Yaml(R"EOF(
     name: SockoptsListener
     address:
       socket_address: { address: 127.0.0.1, port_value: 1111 }
@@ -3416,7 +3417,7 @@ TEST_F(ListenerManagerImplWithRealFiltersTest, LiteralSockoptListenerEnabled) {
     ]
   )EOF");
 
-  expectCreateListenSocket(envoy::api::v2::core::SocketOption::STATE_PREBIND,
+  expectCreateListenSocket(envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
                            /* expected_num_options */ 3);
   expectSetsockopt(os_sys_calls_,
                    /* expected_sockopt_level */ 1,
diff --git a/test/server/listener_manager_impl_test.h b/test/server/listener_manager_impl_test.h
index d00986014a87..44c1581b496b 100644
--- a/test/server/listener_manager_impl_test.h
+++ b/test/server/listener_manager_impl_test.h
@@ -1,7 +1,7 @@
-#include "envoy/admin/v2alpha/config_dump.pb.h"
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/listener/listener.pb.h"
+#include "envoy/admin/v3alpha/config_dump.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/listener/v3alpha/listener_components.pb.h"
 
 #include "common/network/listen_socket_impl.h"
 #include "common/network/socket_option_impl.h"
@@ -49,14 +49,15 @@ class ListenerManagerImplTest : public testing::Test {
     // Use real filter loading by default.
     ON_CALL(listener_factory_, createNetworkFilterFactoryList(_, _))
         .WillByDefault(Invoke(
-            [](const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>& filters,
+            [](const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>& filters,
                Configuration::FactoryContext& context) -> std::vector<Network::FilterFactoryCb> {
               return ProdListenerComponentFactory::createNetworkFilterFactoryList_(filters,
                                                                                    context);
             }));
     ON_CALL(listener_factory_, createListenerFilterFactoryList(_, _))
         .WillByDefault(Invoke(
-            [](const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+            [](const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>&
+                   filters,
                Configuration::ListenerFactoryContext& context)
                 -> std::vector<Network::ListenerFilterFactoryCb> {
               return ProdListenerComponentFactory::createListenerFilterFactoryList_(filters,
@@ -64,7 +65,8 @@ class ListenerManagerImplTest : public testing::Test {
             }));
     ON_CALL(listener_factory_, createUdpListenerFilterFactoryList(_, _))
         .WillByDefault(Invoke(
-            [](const Protobuf::RepeatedPtrField<envoy::api::v2::listener::ListenerFilter>& filters,
+            [](const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::ListenerFilter>&
+                   filters,
                Configuration::ListenerFactoryContext& context)
                 -> std::vector<Network::UdpListenerFilterFactoryCb> {
               return ProdListenerComponentFactory::createUdpListenerFilterFactoryList_(filters,
@@ -87,9 +89,10 @@ class ListenerManagerImplTest : public testing::Test {
    * 3) Stores the factory context for later use.
    * 4) Creates a mock local drain manager for the listener.
    */
-  ListenerHandle* expectListenerCreate(
-      bool need_init, bool added_via_api,
-      envoy::api::v2::Listener::DrainType drain_type = envoy::api::v2::Listener::DEFAULT) {
+  ListenerHandle*
+  expectListenerCreate(bool need_init, bool added_via_api,
+                       envoy::config::listener::v3alpha::Listener::DrainType drain_type =
+                           envoy::config::listener::v3alpha::Listener::DEFAULT) {
     if (added_via_api) {
       EXPECT_CALL(server_.validation_context_, staticValidationVisitor()).Times(0);
       EXPECT_CALL(server_.validation_context_, dynamicValidationVisitor());
@@ -103,7 +106,7 @@ class ListenerManagerImplTest : public testing::Test {
     EXPECT_CALL(listener_factory_, createNetworkFilterFactoryList(_, _))
         .WillOnce(Invoke(
             [raw_listener, need_init](
-                const Protobuf::RepeatedPtrField<envoy::api::v2::listener::Filter>&,
+                const Protobuf::RepeatedPtrField<envoy::config::listener::v3alpha::Filter>&,
                 Configuration::FactoryContext& context) -> std::vector<Network::FilterFactoryCb> {
               std::shared_ptr<ListenerHandle> notifier(raw_listener);
               raw_listener->context_ = &context;
@@ -148,10 +151,10 @@ class ListenerManagerImplTest : public testing::Test {
   /**
    * Validate that createListenSocket is called once with the expected options.
    */
-  void
-  expectCreateListenSocket(const envoy::api::v2::core::SocketOption::SocketState& expected_state,
-                           Network::Socket::Options::size_type expected_num_options,
-                           ListenSocketCreationParams expected_creation_params = {true, true}) {
+  void expectCreateListenSocket(
+      const envoy::config::core::v3alpha::SocketOption::SocketState& expected_state,
+      Network::Socket::Options::size_type expected_num_options,
+      ListenSocketCreationParams expected_creation_params = {true, true}) {
     EXPECT_CALL(listener_factory_, createListenSocket(_, _, _, expected_creation_params))
         .WillOnce(Invoke([this, expected_num_options, &expected_state](
                              const Network::Address::InstanceConstSharedPtr&,
@@ -204,9 +207,9 @@ class ListenerManagerImplTest : public testing::Test {
   void checkConfigDump(const std::string& expected_dump_yaml) {
     auto message_ptr = server_.admin_.config_tracker_.config_tracker_callbacks_["listeners"]();
     const auto& listeners_config_dump =
-        dynamic_cast<const envoy::admin::v2alpha::ListenersConfigDump&>(*message_ptr);
+        dynamic_cast<const envoy::admin::v3alpha::ListenersConfigDump&>(*message_ptr);
 
-    envoy::admin::v2alpha::ListenersConfigDump expected_listeners_config_dump;
+    envoy::admin::v3alpha::ListenersConfigDump expected_listeners_config_dump;
     TestUtility::loadFromYaml(expected_dump_yaml, expected_listeners_config_dump);
     EXPECT_EQ(expected_listeners_config_dump.DebugString(), listeners_config_dump.DebugString());
   }
diff --git a/test/server/options_impl_test.cc b/test/server/options_impl_test.cc
index 859ee88005f5..80efeed3140c 100644
--- a/test/server/options_impl_test.cc
+++ b/test/server/options_impl_test.cc
@@ -5,9 +5,9 @@
 #include <string>
 #include <vector>
 
-#include "envoy/admin/v2alpha/server_info.pb.h"
+#include "envoy/admin/v3alpha/server_info.pb.h"
 #include "envoy/common/exception.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/common/utility.h"
 
@@ -130,7 +130,7 @@ TEST_F(OptionsImplTest, SetAll) {
   options->setBaseId(109876);
   options->setConcurrency(42);
   options->setConfigPath("foo");
-  envoy::config::bootstrap::v2::Bootstrap bootstrap_foo{};
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap_foo{};
   bootstrap_foo.mutable_node()->set_id("foo");
   options->setConfigProto(bootstrap_foo);
   options->setConfigYaml("bogus:");
@@ -157,7 +157,7 @@ TEST_F(OptionsImplTest, SetAll) {
   EXPECT_EQ(109876, options->baseId());
   EXPECT_EQ(42U, options->concurrency());
   EXPECT_EQ("foo", options->configPath());
-  envoy::config::bootstrap::v2::Bootstrap bootstrap_bar{};
+  envoy::config::bootstrap::v3alpha::Bootstrap bootstrap_bar{};
   bootstrap_bar.mutable_node()->set_id("foo");
   EXPECT_TRUE(TestUtility::protoEqual(bootstrap_bar, options->configProto()));
   EXPECT_EQ("bogus:", options->configYaml());
@@ -189,7 +189,7 @@ TEST_F(OptionsImplTest, SetAll) {
   EXPECT_EQ(options->configPath(), command_line_options->config_path());
   EXPECT_EQ(options->configYaml(), command_line_options->config_yaml());
   EXPECT_EQ(options->adminAddressPath(), command_line_options->admin_address_path());
-  EXPECT_EQ(envoy::admin::v2alpha::CommandLineOptions::v6,
+  EXPECT_EQ(envoy::admin::v3alpha::CommandLineOptions::v6,
             command_line_options->local_address_ip_version());
   EXPECT_EQ(options->drainTime().count(), command_line_options->drain_time().seconds());
   EXPECT_EQ(spdlog::level::to_string_view(options->logLevel()), command_line_options->log_level());
@@ -200,7 +200,7 @@ TEST_F(OptionsImplTest, SetAll) {
   EXPECT_EQ(options->restartEpoch(), command_line_options->restart_epoch());
   EXPECT_EQ(options->fileFlushIntervalMsec().count() / 1000,
             command_line_options->file_flush_interval().seconds());
-  EXPECT_EQ(envoy::admin::v2alpha::CommandLineOptions::Validate, command_line_options->mode());
+  EXPECT_EQ(envoy::admin::v3alpha::CommandLineOptions::Validate, command_line_options->mode());
   EXPECT_EQ(options->serviceClusterName(), command_line_options->service_cluster());
   EXPECT_EQ(options->serviceNodeName(), command_line_options->service_node());
   EXPECT_EQ(options->serviceZone(), command_line_options->service_zone());
@@ -225,9 +225,9 @@ TEST_F(OptionsImplTest, DefaultParams) {
   EXPECT_EQ(600, command_line_options->drain_time().seconds());
   EXPECT_EQ(900, command_line_options->parent_shutdown_time().seconds());
   EXPECT_EQ("", command_line_options->admin_address_path());
-  EXPECT_EQ(envoy::admin::v2alpha::CommandLineOptions::v4,
+  EXPECT_EQ(envoy::admin::v3alpha::CommandLineOptions::v4,
             command_line_options->local_address_ip_version());
-  EXPECT_EQ(envoy::admin::v2alpha::CommandLineOptions::Serve, command_line_options->mode());
+  EXPECT_EQ(envoy::admin::v3alpha::CommandLineOptions::Serve, command_line_options->mode());
   EXPECT_FALSE(command_line_options->disable_hot_restart());
   EXPECT_FALSE(command_line_options->cpuset_threads());
   EXPECT_FALSE(command_line_options->allow_unknown_static_fields());
diff --git a/test/server/overload_manager_impl_test.cc b/test/server/overload_manager_impl_test.cc
index 15ca5f17d8c5..b3d7b4cc4a41 100644
--- a/test/server/overload_manager_impl_test.cc
+++ b/test/server/overload_manager_impl_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/config/overload/v2alpha/overload.pb.h"
+#include "envoy/config/overload/v3alpha/overload.pb.h"
 #include "envoy/server/resource_monitor.h"
 #include "envoy/server/resource_monitor_config.h"
 
@@ -86,8 +86,8 @@ class OverloadManagerImplTest : public testing::Test {
     }));
   }
 
-  envoy::config::overload::v2alpha::OverloadManager parseConfig(const std::string& config) {
-    envoy::config::overload::v2alpha::OverloadManager proto;
+  envoy::config::overload::v3alpha::OverloadManager parseConfig(const std::string& config) {
+    envoy::config::overload::v3alpha::OverloadManager proto;
     bool success = Protobuf::TextFormat::ParseFromString(config, &proto);
     ASSERT(success);
     return proto;
diff --git a/test/server/server_fuzz_test.cc b/test/server/server_fuzz_test.cc
index 8fef2d8ebc7b..c00876caad6b 100644
--- a/test/server/server_fuzz_test.cc
+++ b/test/server/server_fuzz_test.cc
@@ -1,7 +1,7 @@
 #include <fstream>
 
-#include "envoy/api/v2/core/address.pb.h"
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
+#include "envoy/config/core/v3alpha/address.pb.h"
 
 #include "common/network/address_impl.h"
 #include "common/thread_local/thread_local_impl.h"
@@ -22,7 +22,8 @@ namespace Envoy {
 namespace Server {
 namespace {
 
-void makePortHermetic(Fuzz::PerTestEnvironment& test_env, envoy::api::v2::core::Address& address) {
+void makePortHermetic(Fuzz::PerTestEnvironment& test_env,
+                      envoy::config::core::v3alpha::Address& address) {
   if (address.has_socket_address()) {
     address.mutable_socket_address()->set_port_value(0);
   } else if (address.has_pipe()) {
@@ -30,10 +31,10 @@ void makePortHermetic(Fuzz::PerTestEnvironment& test_env, envoy::api::v2::core::
   }
 }
 
-envoy::config::bootstrap::v2::Bootstrap
+envoy::config::bootstrap::v3alpha::Bootstrap
 makeHermeticPathsAndPorts(Fuzz::PerTestEnvironment& test_env,
-                          const envoy::config::bootstrap::v2::Bootstrap& input) {
-  envoy::config::bootstrap::v2::Bootstrap output(input);
+                          const envoy::config::bootstrap::v3alpha::Bootstrap& input) {
+  envoy::config::bootstrap::v3alpha::Bootstrap output(input);
   // This is not a complete list of places where we need to zero out ports or sanitize paths, so we
   // should adapt it as we go and encounter places that we need to stabilize server test flakes.
   // config_validation_fuzz_test doesn't need to do this sanitization, so should pickup the coverage
@@ -43,8 +44,8 @@ makeHermeticPathsAndPorts(Fuzz::PerTestEnvironment& test_env,
   // The header_prefix is a write-once then read-only singleton that persists across tests. We clear
   // this field so that fuzz tests don't fail over multiple iterations.
   output.clear_header_prefix();
-  if (output.has_runtime()) {
-    output.mutable_runtime()->set_symlink_root(test_env.temporaryPath(""));
+  if (output.has_hidden_envoy_deprecated_runtime()) {
+    output.mutable_hidden_envoy_deprecated_runtime()->set_symlink_root(test_env.temporaryPath(""));
   }
   for (auto& listener : *output.mutable_static_resources()->mutable_listeners()) {
     if (listener.has_address()) {
@@ -68,7 +69,7 @@ class AllFeaturesHooks : public DefaultListenerHooks {
   void onRuntimeCreated() override { Runtime::RuntimeFeaturesPeer::setAllFeaturesAllowed(); }
 };
 
-DEFINE_PROTO_FUZZER(const envoy::config::bootstrap::v2::Bootstrap& input) {
+DEFINE_PROTO_FUZZER(const envoy::config::bootstrap::v3alpha::Bootstrap& input) {
   testing::NiceMock<MockOptions> options;
   AllFeaturesHooks hooks;
   testing::NiceMock<MockHotRestart> restart;
diff --git a/test/server/server_test.cc b/test/server/server_test.cc
index 877c884e8c8f..4f8fd1ff9c9f 100644
--- a/test/server/server_test.cc
+++ b/test/server/server_test.cc
@@ -1,6 +1,6 @@
 #include <memory>
 
-#include "envoy/api/v2/core/base.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
 
 #include "common/common/assert.h"
 #include "common/common/version.h"
@@ -737,7 +737,7 @@ TEST_P(ServerInstanceImplTest, BootstrapNodeWithSocketOptions) {
   // both of them use SO_REUSEPORT socket option.
   auto options = std::make_shared<Network::Socket::Options>();
   options->emplace_back(std::make_shared<Network::SocketOptionImpl>(
-      envoy::api::v2::core::SocketOption::STATE_PREBIND,
+      envoy::config::core::v3alpha::SocketOption::STATE_PREBIND,
       ENVOY_MAKE_SOCKET_OPTION_NAME(SOL_SOCKET, SO_REUSEPORT), 1));
   EXPECT_NO_THROW(bindAndListenTcpSocket(address, options));
 }
diff --git a/test/server/utility.h b/test/server/utility.h
index 6c780973ab67..c3b7956ee3f3 100644
--- a/test/server/utility.h
+++ b/test/server/utility.h
@@ -2,7 +2,7 @@
 
 #include <string>
 
-#include "envoy/api/v2/lds.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
 
 #include "common/protobuf/utility.h"
 
@@ -12,8 +12,8 @@ namespace Envoy {
 namespace Server {
 namespace {
 
-inline envoy::api::v2::Listener parseListenerFromV2Yaml(const std::string& yaml) {
-  envoy::api::v2::Listener listener;
+inline envoy::config::listener::v3alpha::Listener parseListenerFromV2Yaml(const std::string& yaml) {
+  envoy::config::listener::v3alpha::Listener listener;
   TestUtility::loadFromYaml(yaml, listener);
   return listener;
 }
diff --git a/test/test_common/BUILD b/test/test_common/BUILD
index ce42a79dd7dc..8c87e2b91e33 100644
--- a/test/test_common/BUILD
+++ b/test/test_common/BUILD
@@ -115,11 +115,13 @@ envoy_cc_test_library(
         "//source/common/stats:fake_symbol_table_lib",
         "//source/common/stats:stats_lib",
         "//test/mocks/stats:stats_mocks",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
-        "@envoy_api//envoy/service/discovery/v2:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
-        "@envoy_api//envoy/type/matcher:pkg_cc_proto",
+        "@envoy_api//envoy/config/cluster/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/listener/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/runtime/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/matcher/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -135,7 +137,7 @@ envoy_cc_test_library(
         "//test/mocks/protobuf:protobuf_mocks",
         "//test/mocks/runtime:runtime_mocks",
         "//test/mocks/thread_local:thread_local_mocks",
-        "@envoy_api//envoy/config/bootstrap/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3alpha:pkg_cc_proto",
     ],
 )
 
@@ -164,7 +166,7 @@ envoy_cc_test(
     srcs = ["utility_test.cc"],
     deps = [
         ":utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
 
diff --git a/test/test_common/test_runtime.h b/test/test_common/test_runtime.h
index 3b8f87129d45..b18d54cf217e 100644
--- a/test/test_common/test_runtime.h
+++ b/test/test_common/test_runtime.h
@@ -11,7 +11,7 @@
 
 #pragma once
 
-#include "envoy/config/bootstrap/v2/bootstrap.pb.h"
+#include "envoy/config/bootstrap/v3alpha/bootstrap.pb.h"
 
 #include "common/runtime/runtime_impl.h"
 #include "common/stats/isolated_store_impl.h"
@@ -30,7 +30,7 @@ namespace Envoy {
 class TestScopedRuntime {
 public:
   TestScopedRuntime() : api_(Api::createApiForTest()) {
-    envoy::config::bootstrap::v2::LayeredRuntime config;
+    envoy::config::bootstrap::v3alpha::LayeredRuntime config;
     // The existence of an admin layer is required for mergeValues() to work.
     config.add_layers()->mutable_admin_layer();
 
diff --git a/test/test_common/utility.cc b/test/test_common/utility.cc
index a841bf47b2fa..cc15a6087c61 100644
--- a/test/test_common/utility.cc
+++ b/test/test_common/utility.cc
@@ -10,15 +10,15 @@
 #include <string>
 #include <vector>
 
-#include "envoy/api/v2/cds.pb.h"
-#include "envoy/api/v2/eds.pb.h"
-#include "envoy/api/v2/lds.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route/route.pb.h"
 #include "envoy/buffer/buffer.h"
 #include "envoy/common/platform.h"
+#include "envoy/config/cluster/v3alpha/cluster.pb.h"
+#include "envoy/config/endpoint/v3alpha/endpoint.pb.h"
+#include "envoy/config/listener/v3alpha/listener.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route_components.pb.h"
 #include "envoy/http/codec.h"
-#include "envoy/service/discovery/v2/rtds.pb.h"
+#include "envoy/service/runtime/v3alpha/rtds.pb.h"
 
 #include "common/api/api_impl.h"
 #include "common/common/empty_string.h"
@@ -202,22 +202,25 @@ std::vector<std::string> TestUtility::listFiles(const std::string& path, bool re
 
 std::string TestUtility::xdsResourceName(const ProtobufWkt::Any& resource) {
   if (resource.type_url() == Config::TypeUrl::get().Listener) {
-    return TestUtility::anyConvert<envoy::api::v2::Listener>(resource).name();
+    return TestUtility::anyConvert<envoy::config::listener::v3alpha::Listener>(resource).name();
   }
   if (resource.type_url() == Config::TypeUrl::get().RouteConfiguration) {
-    return TestUtility::anyConvert<envoy::api::v2::RouteConfiguration>(resource).name();
+    return TestUtility::anyConvert<envoy::config::route::v3alpha::RouteConfiguration>(resource)
+        .name();
   }
   if (resource.type_url() == Config::TypeUrl::get().Cluster) {
-    return TestUtility::anyConvert<envoy::api::v2::Cluster>(resource).name();
+    return TestUtility::anyConvert<envoy::config::cluster::v3alpha::Cluster>(resource).name();
   }
   if (resource.type_url() == Config::TypeUrl::get().ClusterLoadAssignment) {
-    return TestUtility::anyConvert<envoy::api::v2::ClusterLoadAssignment>(resource).cluster_name();
+    return TestUtility::anyConvert<envoy::config::endpoint::v3alpha::ClusterLoadAssignment>(
+               resource)
+        .cluster_name();
   }
   if (resource.type_url() == Config::TypeUrl::get().VirtualHost) {
-    return TestUtility::anyConvert<envoy::api::v2::route::VirtualHost>(resource).name();
+    return TestUtility::anyConvert<envoy::config::route::v3alpha::VirtualHost>(resource).name();
   }
   if (resource.type_url() == Config::TypeUrl::get().Runtime) {
-    return TestUtility::anyConvert<envoy::service::discovery::v2::Runtime>(resource).name();
+    return TestUtility::anyConvert<envoy::service::runtime::v3alpha::Runtime>(resource).name();
   }
   throw EnvoyException(
       fmt::format("xdsResourceName does not know about type URL {}", resource.type_url()));
diff --git a/test/test_common/utility.h b/test/test_common/utility.h
index 6af0c2042fe6..b7f2087e8581 100644
--- a/test/test_common/utility.h
+++ b/test/test_common/utility.h
@@ -12,8 +12,8 @@
 #include "envoy/stats/stats.h"
 #include "envoy/stats/store.h"
 #include "envoy/thread/thread.h"
-#include "envoy/type/matcher/string.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/type/matcher/v3alpha/string.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/buffer/buffer_impl.h"
 #include "common/common/c_smart_ptr.h"
@@ -469,8 +469,8 @@ class TestUtility {
    * @param string prefix.
    * @return Object StringMatcher.
    */
-  static const envoy::type::matcher::StringMatcher createPrefixMatcher(std::string str) {
-    envoy::type::matcher::StringMatcher matcher;
+  static const envoy::type::matcher::v3alpha::StringMatcher createPrefixMatcher(std::string str) {
+    envoy::type::matcher::v3alpha::StringMatcher matcher;
     matcher.set_prefix(str);
     return matcher;
   }
@@ -480,8 +480,8 @@ class TestUtility {
    * @param string exact.
    * @return Object StringMatcher.
    */
-  static const envoy::type::matcher::StringMatcher createExactMatcher(std::string str) {
-    envoy::type::matcher::StringMatcher matcher;
+  static const envoy::type::matcher::v3alpha::StringMatcher createExactMatcher(std::string str) {
+    envoy::type::matcher::v3alpha::StringMatcher matcher;
     matcher.set_exact(str);
     return matcher;
   }
@@ -491,9 +491,9 @@ class TestUtility {
    * @param string exact.
    * @return Object StringMatcher.
    */
-  static const envoy::type::matcher::StringMatcher createRegexMatcher(std::string str) {
-    envoy::type::matcher::StringMatcher matcher;
-    matcher.set_regex(str);
+  static const envoy::type::matcher::v3alpha::StringMatcher createRegexMatcher(std::string str) {
+    envoy::type::matcher::v3alpha::StringMatcher matcher;
+    matcher.set_hidden_envoy_deprecated_regex(str);
     return matcher;
   }
 
@@ -754,9 +754,9 @@ MATCHER_P(RepeatedProtoEq, expected, "") {
 }
 
 MATCHER_P(Percent, rhs, "") {
-  envoy::type::FractionalPercent expected;
+  envoy::type::v3alpha::FractionalPercent expected;
   expected.set_numerator(rhs);
-  expected.set_denominator(envoy::type::FractionalPercent::HUNDRED);
+  expected.set_denominator(envoy::type::v3alpha::FractionalPercent::HUNDRED);
   return TestUtility::protoEqual(expected, arg, /*ignore_repeated_field_ordering=*/false);
 }
 
diff --git a/test/test_common/utility_test.cc b/test/test_common/utility_test.cc
index cb911489d179..900912f208f5 100644
--- a/test/test_common/utility_test.cc
+++ b/test/test_common/utility_test.cc
@@ -1,4 +1,4 @@
-#include "envoy/api/v2/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
 
 #include "test/test_common/utility.h"
 
@@ -30,7 +30,7 @@ TEST(HeaderMapEqualIgnoreOrder, NotEqual) {
 TEST(ProtoEqIgnoreField, ActuallyEqual) {
   // Ignored field equal
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     lhs.set_response_nonce("nonce");
     rhs.set_response_nonce("nonce");
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
@@ -39,7 +39,7 @@ TEST(ProtoEqIgnoreField, ActuallyEqual) {
   }
   // Ignored field not equal
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     lhs.set_response_nonce("nonce");
     rhs.set_response_nonce("noncense");
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
@@ -48,14 +48,14 @@ TEST(ProtoEqIgnoreField, ActuallyEqual) {
   }
   // Ignored field not present
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
     rhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
     EXPECT_TRUE(TestUtility::protoEqualIgnoringField(lhs, rhs, "response_nonce"));
   }
   // Ignored field only present in one
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     rhs.set_response_nonce("noncense");
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
     rhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
@@ -66,7 +66,7 @@ TEST(ProtoEqIgnoreField, ActuallyEqual) {
 TEST(ProtoEqIgnoreField, NotEqual) {
   // Ignored field equal
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     lhs.set_response_nonce("nonce");
     rhs.set_response_nonce("nonce");
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.Listener");
@@ -75,7 +75,7 @@ TEST(ProtoEqIgnoreField, NotEqual) {
   }
   // Ignored field not equal
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     lhs.set_response_nonce("nonce");
     rhs.set_response_nonce("noncense");
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.Listener");
@@ -84,14 +84,14 @@ TEST(ProtoEqIgnoreField, NotEqual) {
   }
   // Ignored field not present
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.Listener");
     rhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
     EXPECT_FALSE(TestUtility::protoEqualIgnoringField(lhs, rhs, "response_nonce"));
   }
   // Ignored field only present in one
   {
-    envoy::api::v2::DeltaDiscoveryRequest lhs, rhs;
+    envoy::service::discovery::v3alpha::DeltaDiscoveryRequest lhs, rhs;
     rhs.set_response_nonce("noncense");
     lhs.set_type_url("type.googleapis.com/envoy.api.v2.Listener");
     rhs.set_type_url("type.googleapis.com/envoy.api.v2.ClusterLoadAssignment");
diff --git a/test/tools/router_check/BUILD b/test/tools/router_check/BUILD
index a37239b02fd9..616e6069236b 100644
--- a/test/tools/router_check/BUILD
+++ b/test/tools/router_check/BUILD
@@ -38,14 +38,14 @@ envoy_cc_test_library(
         "//test/test_common:printers_lib",
         "//test/test_common:utility_lib",
         "//test/tools/router_check/json:tool_config_schemas_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
-        "@envoy_api//envoy/api/v2/core:pkg_cc_proto",
-        "@envoy_api//envoy/type:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
 
 envoy_proto_library(
     name = "validation_proto",
     srcs = ["validation.proto"],
-    deps = ["@envoy_api//envoy/api/v2/core:pkg"],
+    deps = ["@envoy_api//envoy/config/core/v3alpha:pkg"],
 )
diff --git a/test/tools/router_check/coverage.h b/test/tools/router_check/coverage.h
index a9671afce00f..6594afea45c6 100644
--- a/test/tools/router_check/coverage.h
+++ b/test/tools/router_check/coverage.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "envoy/api/v2/rds.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
 #include "envoy/router/router.h"
 
 #include "test/mocks/server/mocks.h"
@@ -41,7 +41,7 @@ class RouteCoverage : Logger::Loggable<Logger::Id::testing> {
 
 class Coverage : Logger::Loggable<Logger::Id::testing> {
 public:
-  Coverage(envoy::api::v2::RouteConfiguration config) : route_config_(config){};
+  Coverage(envoy::config::route::v3alpha::RouteConfiguration config) : route_config_(config){};
   void markClusterCovered(const Envoy::Router::Route& route);
   void markVirtualClusterCovered(const Envoy::Router::Route& route);
   void markVirtualHostCovered(const Envoy::Router::Route& route);
@@ -56,6 +56,6 @@ class Coverage : Logger::Loggable<Logger::Id::testing> {
   void printMissingTests(const std::set<std::string>& all_route_names,
                          const std::set<std::string>& covered_route_names);
   std::vector<std::unique_ptr<RouteCoverage>> covered_routes_;
-  const envoy::api::v2::RouteConfiguration route_config_;
+  const envoy::config::route::v3alpha::RouteConfiguration route_config_;
 };
 } // namespace Envoy
diff --git a/test/tools/router_check/router.cc b/test/tools/router_check/router.cc
index ac23bfff95bb..c6d799faed21 100644
--- a/test/tools/router_check/router.cc
+++ b/test/tools/router_check/router.cc
@@ -5,9 +5,9 @@
 #include <string>
 #include <unordered_map>
 
-#include "envoy/api/v2/core/base.pb.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/core/v3alpha/base.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/network/utility.h"
 #include "common/protobuf/message_validator_impl.h"
@@ -56,7 +56,7 @@ ToolConfig ToolConfig::create(const envoy::RouterCheckToolSchema::ValidationItem
   }
 
   if (check_config.input().additional_headers().data()) {
-    for (const envoy::api::v2::core::HeaderValue& header_config :
+    for (const envoy::config::core::v3alpha::HeaderValue& header_config :
          check_config.input().additional_headers()) {
       headers->addCopy(header_config.key(), header_config.value());
     }
@@ -72,7 +72,7 @@ ToolConfig::ToolConfig(std::unique_ptr<Http::TestHeaderMapImpl> headers, int ran
 RouterCheckTool RouterCheckTool::create(const std::string& router_config_file,
                                         const bool disable_deprecation_check) {
   // TODO(hennna): Allow users to load a full config and extract the route configuration from it.
-  envoy::api::v2::RouteConfiguration route_config;
+  envoy::config::route::v3alpha::RouteConfiguration route_config;
   auto stats = std::make_unique<Stats::IsolatedStoreImpl>();
   auto api = Api::createApiForTest(*stats);
   TestUtility::loadFromFile(router_config_file, route_config, *api);
@@ -92,7 +92,8 @@ RouterCheckTool RouterCheckTool::create(const std::string& router_config_file,
                          std::move(api), Coverage(route_config));
 }
 
-void RouterCheckTool::assignUniqueRouteNames(envoy::api::v2::RouteConfiguration& route_config) {
+void RouterCheckTool::assignUniqueRouteNames(
+    envoy::config::route::v3alpha::RouteConfiguration& route_config) {
   Runtime::RandomGeneratorImpl random;
   for (auto& host : *route_config.mutable_virtual_hosts()) {
     for (auto& route : *host.mutable_routes()) {
@@ -101,7 +102,8 @@ void RouterCheckTool::assignUniqueRouteNames(envoy::api::v2::RouteConfiguration&
   }
 }
 
-void RouterCheckTool::assignRuntimeFraction(envoy::api::v2::RouteConfiguration& route_config) {
+void RouterCheckTool::assignRuntimeFraction(
+    envoy::config::route::v3alpha::RouteConfiguration& route_config) {
   for (auto& host : *route_config.mutable_virtual_hosts()) {
     for (auto& route : *host.mutable_routes()) {
       if (route.match().has_runtime_fraction() &&
@@ -120,7 +122,7 @@ RouterCheckTool::RouterCheckTool(
     : factory_context_(std::move(factory_context)), config_(std::move(config)),
       stats_(std::move(stats)), api_(std::move(api)), coverage_(std::move(coverage)) {
   ON_CALL(factory_context_->runtime_loader_.snapshot_,
-          featureEnabled(_, testing::An<const envoy::type::FractionalPercent&>(),
+          featureEnabled(_, testing::An<const envoy::type::v3alpha::FractionalPercent&>(),
                          testing::An<uint64_t>()))
       .WillByDefault(testing::Invoke(this, &RouterCheckTool::runtimeMock));
 }
@@ -411,7 +413,7 @@ bool RouterCheckTool::compareHeaderField(
     ToolConfig& tool_config, const envoy::RouterCheckToolSchema::ValidationAssert& expected) {
   bool no_failures = true;
   if (expected.header_fields().data()) {
-    for (const envoy::api::v2::core::HeaderValue& header : expected.header_fields()) {
+    for (const envoy::config::core::v3alpha::HeaderValue& header : expected.header_fields()) {
       if (!compareHeaderField(tool_config, header.key(), header.value())) {
         no_failures = false;
       }
@@ -444,7 +446,8 @@ bool RouterCheckTool::compareCustomHeaderField(
     ToolConfig& tool_config, const envoy::RouterCheckToolSchema::ValidationAssert& expected) {
   bool no_failures = true;
   if (expected.custom_header_fields().data()) {
-    for (const envoy::api::v2::core::HeaderValue& header : expected.custom_header_fields()) {
+    for (const envoy::config::core::v3alpha::HeaderValue& header :
+         expected.custom_header_fields()) {
       if (!compareCustomHeaderField(tool_config, header.key(), header.value())) {
         no_failures = false;
       }
@@ -481,7 +484,7 @@ void RouterCheckTool::printResults() {
 // The Mock for runtime value checks.
 // This is a simple implementation to mimic the actual runtime checks in Snapshot.featureEnabled
 bool RouterCheckTool::runtimeMock(const std::string& key,
-                                  const envoy::type::FractionalPercent& default_value,
+                                  const envoy::type::v3alpha::FractionalPercent& default_value,
                                   uint64_t random_value) {
   return !active_runtime_.empty() && active_runtime_.compare(key) == 0 &&
          ProtobufPercentHelper::evaluateFractionalPercent(default_value, random_value);
diff --git a/test/tools/router_check/router.h b/test/tools/router_check/router.h
index d56f7c25536f..2896b76dc415 100644
--- a/test/tools/router_check/router.h
+++ b/test/tools/router_check/router.h
@@ -3,8 +3,8 @@
 #include <memory>
 #include <string>
 
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/type/percent.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/type/v3alpha/percent.pb.h"
 
 #include "common/common/logger.h"
 #include "common/common/utility.h"
@@ -110,12 +110,14 @@ class RouterCheckTool : Logger::Loggable<Logger::Id::testing> {
   /**
    * Set UUID as the name for each route for detecting missing tests during the coverage check.
    */
-  static void assignUniqueRouteNames(envoy::api::v2::RouteConfiguration& route_config);
+  static void
+  assignUniqueRouteNames(envoy::config::route::v3alpha::RouteConfiguration& route_config);
   /**
    * For each route with runtime fraction 0%, set the numerator to a nonzero value so the
    * route can be tested as enabled or disabled.
    */
-  static void assignRuntimeFraction(envoy::api::v2::RouteConfiguration& route_config);
+  static void
+  assignRuntimeFraction(envoy::config::route::v3alpha::RouteConfiguration& route_config);
 
   bool compareCluster(ToolConfig& tool_config, const std::string& expected);
   bool compareCluster(ToolConfig& tool_config,
@@ -155,7 +157,8 @@ class RouterCheckTool : Logger::Loggable<Logger::Id::testing> {
 
   void printResults();
 
-  bool runtimeMock(const std::string& key, const envoy::type::FractionalPercent& default_value,
+  bool runtimeMock(const std::string& key,
+                   const envoy::type::v3alpha::FractionalPercent& default_value,
                    uint64_t random_value);
 
   bool headers_finalized_{false};
diff --git a/test/tools/router_check/validation.proto b/test/tools/router_check/validation.proto
index 4ff3ab35f434..d5edf4b567c3 100644
--- a/test/tools/router_check/validation.proto
+++ b/test/tools/router_check/validation.proto
@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package envoy.RouterCheckToolSchema;
 
-import "envoy/api/v2/core/base.proto";
+import "envoy/config/core/v3alpha/base.proto";
 import "google/protobuf/wrappers.proto";
 import "validate/validate.proto";
 
@@ -65,7 +65,7 @@ message ValidationInput {
   // Additional headers to be added as input for route determination.
   // The “:authority”, “:path”, “:method”, “x-forwarded-proto”, and “x-envoy-internal” fields are
   // specified by the other config options and should not be set here.
-  repeated envoy.api.v2.core.HeaderValue additional_headers = 8;
+  repeated envoy.config.core.v3alpha.HeaderValue additional_headers = 8;
 
   // Runtime setting key to enable for the test case.
   // If a route depends on the runtime, the route will be enabled based on the random_value defined
@@ -101,6 +101,6 @@ message ValidationAssert {
   // The header fields are checked after all other test cases.
   // Thus, the header fields checked will be those of the redirected or rewritten routes when
   // applicable.
-  repeated envoy.api.v2.core.HeaderValue header_fields = 7;
-  repeated envoy.api.v2.core.HeaderValue custom_header_fields = 8;
+  repeated envoy.config.core.v3alpha.HeaderValue header_fields = 7;
+  repeated envoy.config.core.v3alpha.HeaderValue custom_header_fields = 8;
 }
diff --git a/test/tools/schema_validator/BUILD b/test/tools/schema_validator/BUILD
index e55b8df0be28..b7cfd99db594 100644
--- a/test/tools/schema_validator/BUILD
+++ b/test/tools/schema_validator/BUILD
@@ -29,6 +29,7 @@ envoy_cc_test_library(
         "//source/common/protobuf:utility_lib",
         "//source/common/stats:isolated_store_lib",
         "//test/test_common:utility_lib",
-        "@envoy_api//envoy/api/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/tools/schema_validator/validator.cc b/test/tools/schema_validator/validator.cc
index 06eaded027a9..3ebfac5233e1 100644
--- a/test/tools/schema_validator/validator.cc
+++ b/test/tools/schema_validator/validator.cc
@@ -1,9 +1,9 @@
 #include "test/tools/schema_validator/validator.h"
 
-#include "envoy/api/v2/discovery.pb.h"
-#include "envoy/api/v2/discovery.pb.validate.h"
-#include "envoy/api/v2/rds.pb.h"
-#include "envoy/api/v2/route.pb.validate.h"
+#include "envoy/config/route/v3alpha/route.pb.h"
+#include "envoy/config/route/v3alpha/route.pb.validate.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.h"
+#include "envoy/service/discovery/v3alpha/discovery.pb.validate.h"
 
 #include "common/protobuf/utility.h"
 
@@ -57,13 +57,13 @@ void Validator::validate(const std::string& config_path, Schema::Type schema_typ
 
   switch (schema_type) {
   case Schema::Type::DiscoveryResponse: {
-    envoy::api::v2::DiscoveryResponse discovery_response_config;
+    envoy::service::discovery::v3alpha::DiscoveryResponse discovery_response_config;
     TestUtility::loadFromFile(config_path, discovery_response_config, *api_);
     TestUtility::validate(discovery_response_config);
     break;
   }
   case Schema::Type::Route: {
-    envoy::api::v2::RouteConfiguration route_config;
+    envoy::config::route::v3alpha::RouteConfiguration route_config;
     TestUtility::loadFromFile(config_path, route_config, *api_);
     TestUtility::validate(route_config);
     break;