diff --git a/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html b/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
index 4d144436f4a..3afec5755f8 100644
--- a/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
+++ b/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
@@ -353,7 +353,7 @@ <h2 id="Policy">Policy</h2>
 <pre><code class="language-yaml">apiVersion: authentication.istio.io/v1alpha1
 kind: Policy
 metadata:
-  name: productpage_mTLS_disable
+  name: productpage-mTLS-disable
   namespace: frod
 spec:
   targets:
@@ -366,7 +366,7 @@ <h2 id="Policy">Policy</h2>
 <pre><code class="language-yaml">apiVersion: authentication.istio.io/v1alpha1
 kind: Policy
 metadata:
-  name: productpage_mTLS_with_JWT
+  name: productpage-mTLS-with-JWT
   namespace: frod
 spec:
   target:
diff --git a/authentication/v1alpha1/policy.pb.go b/authentication/v1alpha1/policy.pb.go
index 9dd5783f153..d9d92c3f200 100644
--- a/authentication/v1alpha1/policy.pb.go
+++ b/authentication/v1alpha1/policy.pb.go
@@ -838,7 +838,7 @@ func (m *OriginAuthenticationMethod) GetJwt() *Jwt {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_disable
+//   name: productpage-mTLS-disable
 //   namespace: frod
 // spec:
 //   targets:
@@ -851,7 +851,7 @@ func (m *OriginAuthenticationMethod) GetJwt() *Jwt {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_with_JWT
+//   name: productpage-mTLS-with-JWT
 //   namespace: frod
 // spec:
 //   target:
diff --git a/authentication/v1alpha1/policy.proto b/authentication/v1alpha1/policy.proto
index f9156eb75be..42638a542d2 100644
--- a/authentication/v1alpha1/policy.proto
+++ b/authentication/v1alpha1/policy.proto
@@ -274,7 +274,7 @@ enum PrincipalBinding {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_disable
+//   name: productpage-mTLS-disable
 //   namespace: frod
 // spec:
 //   targets:
@@ -287,7 +287,7 @@ enum PrincipalBinding {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_with_JWT
+//   name: productpage-mTLS-with-JWT
 //   namespace: frod
 // spec:
 //   target:
diff --git a/networking/v1alpha3/gateway.pb.go b/networking/v1alpha3/gateway.pb.go
index 5764c93c261..16a2c07e4b7 100644
--- a/networking/v1alpha3/gateway.pb.go
+++ b/networking/v1alpha3/gateway.pb.go
@@ -35,7 +35,7 @@
 //       httpsRedirect: true # sends 301 redirect for http requests
 //   - port:
 //       number: 443
-//       name: https
+//       name: https-443
 //       protocol: HTTPS
 //     hosts:
 //     - uk.bookinfo.com
@@ -46,7 +46,7 @@
 //       privateKey: /etc/certs/privatekey.pem
 //   - port:
 //       number: 9443
-//       name: https
+//       name: https-9443
 //       protocol: HTTPS
 //     hosts:
 //     - "bookinfo-namespace/*.bookinfo.com"
@@ -100,19 +100,19 @@
 //   - match:
 //     - headers:
 //         cookie:
-//           user: dev-123
+//           exact: "user=dev-123"
 //     route:
 //     - destination:
 //         port:
 //           number: 7777
 //         host: reviews.qa.svc.cluster.local
 //   - match:
-//       uri:
+//     - uri:
 //         prefix: /reviews/
 //     route:
 //     - destination:
 //         port:
-//           number: 9080 # can be omitted if its the only port for reviews
+//           number: 9080 # can be omitted if it's the only port for reviews
 //         host: reviews.prod.svc.cluster.local
 //       weight: 80
 //     - destination:
diff --git a/networking/v1alpha3/gateway.pb.html b/networking/v1alpha3/gateway.pb.html
index 670df0918ea..d47131deaf7 100644
--- a/networking/v1alpha3/gateway.pb.html
+++ b/networking/v1alpha3/gateway.pb.html
@@ -39,7 +39,7 @@
       httpsRedirect: true # sends 301 redirect for http requests
   - port:
       number: 443
-      name: https
+      name: https-443
       protocol: HTTPS
     hosts:
     - uk.bookinfo.com
@@ -50,7 +50,7 @@
       privateKey: /etc/certs/privatekey.pem
   - port:
       number: 9443
-      name: https
+      name: https-9443
       protocol: HTTPS
     hosts:
     - &quot;bookinfo-namespace/*.bookinfo.com&quot;
@@ -103,19 +103,19 @@
   - match:
     - headers:
         cookie:
-          user: dev-123
+          exact: &quot;user=dev-123&quot;
     route:
     - destination:
         port:
           number: 7777
         host: reviews.qa.svc.cluster.local
   - match:
-      uri:
+    - uri:
         prefix: /reviews/
     route:
     - destination:
         port:
-          number: 9080 # can be omitted if its the only port for reviews
+          number: 9080 # can be omitted if it's the only port for reviews
         host: reviews.prod.svc.cluster.local
       weight: 80
     - destination:
diff --git a/networking/v1alpha3/gateway.proto b/networking/v1alpha3/gateway.proto
index 4ae5e7983c6..838863d60db 100644
--- a/networking/v1alpha3/gateway.proto
+++ b/networking/v1alpha3/gateway.proto
@@ -52,7 +52,7 @@ syntax = "proto3";
 //       httpsRedirect: true # sends 301 redirect for http requests
 //   - port:
 //       number: 443
-//       name: https
+//       name: https-443
 //       protocol: HTTPS
 //     hosts:
 //     - uk.bookinfo.com
@@ -63,7 +63,7 @@ syntax = "proto3";
 //       privateKey: /etc/certs/privatekey.pem
 //   - port:
 //       number: 9443
-//       name: https
+//       name: https-9443
 //       protocol: HTTPS
 //     hosts:
 //     - "bookinfo-namespace/*.bookinfo.com"
@@ -117,19 +117,19 @@ syntax = "proto3";
 //   - match:
 //     - headers:
 //         cookie:
-//           user: dev-123
+//           exact: "user=dev-123"
 //     route:
 //     - destination:
 //         port:
 //           number: 7777
 //         host: reviews.qa.svc.cluster.local
 //   - match:
-//       uri:
+//     - uri:
 //         prefix: /reviews/
 //     route:
 //     - destination:
 //         port:
-//           number: 9080 # can be omitted if its the only port for reviews
+//           number: 9080 # can be omitted if it's the only port for reviews
 //         host: reviews.prod.svc.cluster.local
 //       weight: 80
 //     - destination:
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index e6f416e3490..e6e308c54c4 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -2090,7 +2090,7 @@ func (m *HTTPRetry) GetRetryOn() string {
 //       allowCredentials: false
 //       allowHeaders:
 //       - X-Foo-Bar
-//       maxAge: "1d"
+//       maxAge: "24h"
 // ```
 //
 type CorsPolicy struct {
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index 553bd484ee6..ab9cb8215c5 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -123,7 +123,7 @@ <h2 id="CorsPolicy">CorsPolicy</h2>
       allowCredentials: false
       allowHeaders:
       - X-Foo-Bar
-      maxAge: &quot;1d&quot;
+      maxAge: &quot;24h&quot;
 </code></pre>
 
 <table class="message-fields">
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index f69937399ed..29562447e49 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -951,7 +951,7 @@ message HTTPRetry {
 //       allowCredentials: false
 //       allowHeaders:
 //       - X-Foo-Bar
-//       maxAge: "1d"
+//       maxAge: "24h"
 // ```
 //
 message CorsPolicy {
diff --git a/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html b/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
index ed198265932..a7ef8cbbbef 100644
--- a/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
+++ b/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
@@ -4,7 +4,7 @@
 location: https://istio.io/docs/reference/config/authorization/istio.rbac.v1alpha1.html
 layout: protoc-gen-docs
 generator: protoc-gen-docs
-number_of_entries: 9
+number_of_entries: 8
 ---
 <p>Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding
 objects.</p>
@@ -37,7 +37,7 @@
     methods: [&quot;GET&quot;, &quot;HEAD&quot;]
     constraints:
     - key: &quot;destination.labels[version]&quot;
-      value: [&quot;v1&quot;, &quot;v2&quot;]
+      values: [&quot;v1&quot;, &quot;v2&quot;]
 </code></pre>
 
 <p>A ServiceRoleBinding specification includes two parts:</p>
@@ -164,66 +164,6 @@ <h2 id="AccessRule-Constraint">AccessRule.Constraint</h2>
 For example, the value &ldquo;v1alpha2&rdquo; matches &ldquo;v1alpha2&rdquo; (exact match),
 or &ldquo;v1<em>&rdquo; (prefix match), or &ldquo;</em>alpha2&rdquo; (suffix match).</p>
 
-</td>
-</tr>
-</tbody>
-</table>
-</section>
-<h2 id="RbacConfig">RbacConfig</h2>
-<section>
-<p>RbacConfig defines the global config to control Istio RBAC behavior.
-This Custom Resource is a singleton where only one Custom Resource should be created globally in
-the mesh and the namespace should be the same to other Istio components, which usually is <code>istio-system</code>.
-Note: This is enforced in both <code>istioctl</code> and server side, new Custom Resource will be rejected if found any
-existing one, the user should either delete the existing one or change the existing one directly.</p>
-
-<p>Below is an example of an <code>RbacConfig</code> resource called <code>istio-rbac-config</code> which enables Istio RBAC for all
-services in the default namespace.</p>
-
-<pre><code class="language-yaml">apiVersion: &quot;rbac.istio.io/v1alpha1&quot;
-kind: RbacConfig
-metadata:
-  name: default
-  namespace: istio-system
-spec:
-  mode: ON_WITH_INCLUSION
-  inclusion:
-    namespaces: [ &quot;default&quot; ]
-</code></pre>
-
-<table class="message-fields">
-<thead>
-<tr>
-<th>Field</th>
-<th>Type</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr id="RbacConfig-mode">
-<td><code>mode</code></td>
-<td><code><a href="#RbacConfig-Mode">RbacConfig.Mode</a></code></td>
-<td>
-<p>Istio RBAC mode.</p>
-
-</td>
-</tr>
-<tr id="RbacConfig-inclusion">
-<td><code>inclusion</code></td>
-<td><code><a href="#RbacConfig-Target">RbacConfig.Target</a></code></td>
-<td>
-<p>A list of services or namespaces that should be enforced by Istio RBAC policies. Note: This field have
-effect only when mode is ON<em>WITH</em>INCLUSION and will be ignored for any other modes.</p>
-
-</td>
-</tr>
-<tr id="RbacConfig-exclusion">
-<td><code>exclusion</code></td>
-<td><code><a href="#RbacConfig-Target">RbacConfig.Target</a></code></td>
-<td>
-<p>A list of services or namespaces that should not be enforced by Istio RBAC policies. Note: This field have
-effect only when mode is ON<em>WITH</em>EXCLUSION and will be ignored for any other modes.</p>
-
 </td>
 </tr>
 </tbody>
diff --git a/rbac/v1alpha1/rbac.pb.go b/rbac/v1alpha1/rbac.pb.go
index dc346f1214e..cce0b6f94b6 100644
--- a/rbac/v1alpha1/rbac.pb.go
+++ b/rbac/v1alpha1/rbac.pb.go
@@ -31,7 +31,7 @@
 //     methods: ["GET", "HEAD"]
 //     constraints:
 //     - key: "destination.labels[version]"
-//       value: ["v1", "v2"]
+//       values: ["v1", "v2"]
 // ```
 //
 // A ServiceRoleBinding specification includes two parts:
@@ -834,7 +834,8 @@ func (m *RoleRef) GetName() string {
 	return ""
 }
 
-// RbacConfig defines the global config to control Istio RBAC behavior.
+// $hide_from_docs
+// RbacConfig is deprecated.  RbacConfig defined the global config to control Istio RBAC behavior.
 // This Custom Resource is a singleton where only one Custom Resource should be created globally in
 // the mesh and the namespace should be the same to other Istio components, which usually is `istio-system`.
 // Note: This is enforced in both `istioctl` and server side, new Custom Resource will be rejected if found any
diff --git a/rbac/v1alpha1/rbac.proto b/rbac/v1alpha1/rbac.proto
index a5a30608ec5..292e9b8a47e 100644
--- a/rbac/v1alpha1/rbac.proto
+++ b/rbac/v1alpha1/rbac.proto
@@ -48,7 +48,7 @@ syntax = "proto3";
 //     methods: ["GET", "HEAD"]
 //     constraints:
 //     - key: "destination.labels[version]"
-//       value: ["v1", "v2"]
+//       values: ["v1", "v2"]
 // ```
 //
 // A ServiceRoleBinding specification includes two parts:
@@ -294,7 +294,8 @@ message RoleRef {
   string name = 2;
 }
 
-// RbacConfig defines the global config to control Istio RBAC behavior.
+// $hide_from_docs
+// RbacConfig is deprecated.  RbacConfig defined the global config to control Istio RBAC behavior.
 // This Custom Resource is a singleton where only one Custom Resource should be created globally in
 // the mesh and the namespace should be the same to other Istio components, which usually is `istio-system`.
 // Note: This is enforced in both `istioctl` and server side, new Custom Resource will be rejected if found any