Repository: envoyproxy/gateway

Issue:
Topology-aware routing causes envoy proxy crashloops
*Description*:

On Azure, some regions don't have availability zones, so AKS annotates nodes with `topology.kubernetes.io/zone: 0` (see [docs](https://docs.azure.cn/en-us/aks/availability-zones-overview#regional-not-using-availability-zones)).

In envoy-gateway v1.4.0, topolgy-aware routing starts to use these pod annotations to populate the envoy bootstrap config. But envoy considers the value of zero to be invalid.

```
ENVOY_SERVICE_ZONE:        (v1:metadata.annotations['topology.kubernetes.io/zone'])                                                                                                                                                                                                                                   
```

As a result, envoy proxy pods crashloop on upgrade to envoy-gateway v1.4.0. 

```
envoy  ': Unable to parse JSON as proto (INVALID_ARGUMENT: invalid JSON in envoy.config.bootstrap.v3.Bootstrap @ static_resources.clusters[1].load_assignment.endpoints[0].locality.zone:  string, near   1:1020   (offset 1019): unexpected  character: '0'; expected  '"'): {"cluster_manager":{"local_cluster_name":"loc │
│ envoy [2025-05-19 17:34:15.677][1][info][main] [source/server/server.cc:1072] exiting                                                                                                                                                                                                                                       │
│ envoy Unable to parse JSON as proto (INVALID_ARGUMENT: invalid JSON in envoy.config.bootstrap.v3.Bootstrap @ static_resources.clusters[1].load_assignment.endpoints[0].locality.zone:  string, near   1:1020   (offset 1019): unexpected  character: '0'; expected  '"'): {"cluster_manager":{"local_cluster_name":"local_cluster...
```

Rolling back to v1.4.0-rc.2 (which I was testing previously) resolves the issue, because the release candidate does not have the change that added this behavior it seems.


>What issue is being seen? Describe what should be happening instead of
the bug, for example: The expected value isn't returned, etc.

*Repro steps*:

Annotate the envoy proxy pods with `topology.kubernetes.io/zone: 0`.


> Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.

>**Note**:

I believe stringifying the value to "0" (in quotes) could be a solution potentially. But I'm not that familiar with this new feature being added.

*Environment*:
>Include the environment like gateway version, envoy version and so on.

Azure AKS

*Logs*:
>Include the access logs and the Envoy logs.


Discussion:
@arkodg: thanks for flagging this

a workaround until this is fixed is to disable this feature in Helm using `topologyInjector.enabled=false`
https://gateway.envoyproxy.io/docs/install/gateway-helm-api/

cc @jukie @jukie: @dghubble could you share the raw label value from an example node? Node labels are parsed as `map[string]string` and would already be injecting quotes which should result in `topology.kubernetes.io/zone: "0"` or an error upon creating the node. When annotating pods there should be a similar result with the quoted value.

I don't doubt that you're hitting an issue here but I'm having trouble with reproducing. Could you include additional log output from the proxy pods and your rendered proxy bootstrap config with any sensitive data removed?

The [create-cluster.sh](https://github.com/envoyproxy/gateway/blob/main/tools/hack/create-cluster.sh#L33) applies the same integer based zone names so I would've expected to see this bug there.@jukie: The only way I've been able to reproduce this is by _removing_ the existing quotes in the bootstrap template: https://github.com/envoyproxy/gateway/blob/eb7266c042f4573d7e67c9ea02a19e0deff6e17f/internal/xds/bootstrap/bootstrap.yaml.tpl#L189@owenhaynes: Upgraded to 1.4.0 from 1.3.0 and now the roll out of pods for the new envoy version has stopped working because of the addition of the zonal work, i am not sure if this issue is related but i have tried turning zonal mode on and off and get the same error message in the controller.


Log message form the gateway pod:
```
2025-05-21T14:45:09.811Z	ERROR	watchable	message/watchutil.go:82	observed an error	{"runner": "infrastructure", "error": "failed to create or update deployment envoy-gateway-system/envoy-public-ea09f8eb: failed to create/update resource with server-side apply for obj &Deployment{ObjectMeta:{envoy-public-ea09f8eb  envoy-gateway-system    0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[app.kubernetes.io/component:proxy app.kubernetes.io/managed-by:envoy-gateway app.kubernetes.io/name:envoy gateway.envoyproxy.io/owning-gatewayclass:envoy-public team:team] map[] [] [] []},Spec:DeploymentSpec{Replicas:nil,Selector:&v1.LabelSelector{MatchLabels:map[string]string{app.kubernetes.io/component: proxy,app.kubernetes.io/managed-by: envoy-gateway,app.kubernetes.io/name: envoy,gateway.envoyproxy.io/owning-gatewayclass: envoy-public,},MatchExpressions:[]LabelSelectorRequirement{},},Template:{{      0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[app.kubernetes.io/component:proxy app.kubernetes.io/managed-by:envoy-gateway app.kubernetes.io/name:envoy gateway.envoyproxy.io/owning-gatewayclass:envoy-public team:team] map[prometheus.io/path:/stats/prometheus prometheus.io/port:19001 prometheus.io/scrape:true] [] [] []} {[{certs {nil nil nil nil nil SecretVolumeSource{SecretName:envoy,Items:[]KeyToPath{},DefaultMode:*420,Optional:nil,} nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil}} {sds {nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil &ConfigMapVolumeSource{LocalObjectReference:LocalObjectReference{Name:envoy-public-ea09f8eb,},Items:[]KeyToPath{KeyToPath{Key:xds-trusted-ca.json,Path:xds-trusted-ca.json,Mode:nil,},KeyToPath{Key:xds-certificate.json,Path:xds-certificate.json,Mode:nil,},},DefaultMode:*420,Optional:*false,} nil nil nil nil nil nil nil nil nil nil nil}}] [] [{envoy docker.io/envoyproxy/envoy:distroless-v1.34.1 [envoy] [--service-cluster envoy-public --service-node $(ENVOY_POD_NAME) --config-yaml admin:\n  access_log:\n  - name: envoy.access_loggers.file\n    typed_config:\n      \"@type\": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog\n      path: /dev/null\n  address:\n    socket_address:\n      address: 127.0.0.1\n      port_value: 19000\ncluster_manager:\n  local_cluster_name: local_cluster\nnode:\n  locality:\n    zone: \"$(ENVOY_SERVICE_ZONE)\"\nlayered_runtime:\n  layers:\n  - name: global_config\n    static_layer:\n      envoy.restart_features.use_eds_cache_for_ads: true\n      re2.max_program_size.error_level: 4294967295\n      re2.max_program_size.warn_level: 1000\ndynamic_resources:\n  ads_config:\n    api_type: DELTA_GRPC\n    transport_api_version: V3\n    grpc_services:\n    - envoy_grpc:\n        cluster_name: xds_cluster\n    set_node_on_first_message_only: true\n  lds_config:\n    ads: {}\n    resource_api_version: V3\n  cds_config:\n    ads: {}\n    resource_api_version: V3\nstatic_resources:\n  listeners:\n  - name: envoy-gateway-proxy-stats-0.0.0.0-19001\n    address:\n      socket_address:\n        address: '0.0.0.0'\n        port_value: 19001\n        protocol: TCP\n    bypass_overload_manager: true\n    filter_chains:\n    - filters:\n      - name: envoy.filters.network.http_connection_manager\n        typed_config:\n          \"@type\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n          stat_prefix: eg-stats-http\n          normalize_path: true\n          route_config:\n            name: local_route\n            virtual_hosts:\n            - name: prometheus_stats\n              domains:\n              - \"*\"\n              routes:\n              - match:\n                  path: /stats/prometheus\n                  headers:\n                  - name: \":method\"\n                    string_match:\n                      exact: GET\n                route:\n                  cluster: prometheus_stats\n          http_filters:\n          - name: envoy.filters.http.router\n            typed_config:\n              \"@type\": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\n  clusters:\n  - name: prometheus_stats\n    connect_timeout: 0.250s\n    type: STATIC\n    lb_policy: ROUND_ROBIN\n    load_assignment:\n      cluster_name: prometheus_stats\n      endpoints:\n      - lb_endpoints:\n        - endpoint:\n            address:\n              socket_address:\n                address: 127.0.0.1\n                port_value: 19000\n  - connect_timeout: 10s\n    lb_policy: ROUND_ROBIN\n    load_assignment:\n      cluster_name: local_cluster\n      endpoints:\n      - lb_endpoints:\n        - endpoint:\n            address:\n              socket_address:\n                address: 127.0.0.1\n                port_value: 10080\n          load_balancing_weight: 1\n        load_balancing_weight: 1\n        locality:\n          zone: \"$(ENVOY_SERVICE_ZONE)\"\n    name: local_cluster\n    type: STATIC\n  - connect_timeout: 10s\n    load_assignment:\n      cluster_name: xds_cluster\n      endpoints:\n      - load_balancing_weight: 1\n        lb_endpoints:\n        - load_balancing_weight: 1\n          endpoint:\n            address:\n              socket_address:\n                address: envoy-gateway.envoy-gateway-system.svc.cluster.local\n                port_value: 18000\n    typed_extension_protocol_options:\n      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n        \"@type\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n        explicit_http_config:\n          http2_protocol_options:\n            connection_keepalive:\n              interval: 30s\n              timeout: 5s\n    name: xds_cluster\n    type: STRICT_DNS\n    transport_socket:\n      name: envoy.transport_sockets.tls\n      typed_config:\n        \"@type\": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext\n        common_tls_context:\n          tls_params:\n            tls_maximum_protocol_version: TLSv1_3\n          tls_certificate_sds_secret_configs:\n          - name: xds_certificate\n            sds_config:\n              path_config_source:\n                path: /sds/xds-certificate.json\n              resource_api_version: V3\n          validation_context_sds_secret_config:\n            name: xds_trusted_ca\n            sds_config:\n              path_config_source:\n                path: /sds/xds-trusted-ca.json\n              resource_api_version: V3\n  - name: wasm_cluster\n    type: STRICT_DNS\n    connect_timeout: 10s\n    load_assignment:\n      cluster_name: wasm_cluster\n      endpoints:\n      - load_balancing_weight: 1\n        lb_endpoints:\n        - load_balancing_weight: 1\n          endpoint:\n            address:\n              socket_address:\n                address: envoy-gateway\n                port_value: 18002\n    typed_extension_protocol_options:\n      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n        \"@type\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n        explicit_http_config:\n          http2_protocol_options: {}\n    transport_socket:\n      name: envoy.transport_sockets.tls\n      typed_config:\n        \"@type\": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext\n        common_tls_context:\n          tls_params:\n            tls_maximum_protocol_version: TLSv1_3\n          tls_certificate_sds_secret_configs:\n          - name: xds_certificate\n            sds_config:\n              path_config_source:\n                path: /sds/xds-certificate.json\n              resource_api_version: V3\n          validation_context_sds_secret_config:\n            name: xds_trusted_ca\n            sds_config:\n              path_config_source:\n                path: /sds/xds-trusted-ca.json\n              resource_api_version: V3\noverload_manager:\n  refresh_interval: 0.25s\n  resource_monitors:\n  - name: \"envoy.resource_monitors.global_downstream_max_connections\"\n    typed_config:\n      \"@type\": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\n      max_active_downstream_connections: 50000\n  - name: \"envoy.resource_monitors.fixed_heap\"\n    typed_config:\n      \"@type\": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig\n      max_heap_size_bytes: 858993459\n  actions:\n  - name: \"envoy.overload_actions.shrink_heap\"\n    triggers:\n    - name: \"envoy.resource_monitors.fixed_heap\"\n      threshold:\n        value: 0.95\n  - name: \"envoy.overload_actions.stop_accepting_requests\"\n    triggers:\n    - name: \"envoy.resource_monitors.fixed_heap\"\n      threshold:\n        value: 0.98\n --log-level warn --cpuset-threads --drain-strategy immediate --drain-time-s 60]  [{https 0 10443 TCP } {metrics 0 19001 TCP } {readiness 0 19003 TCP }] [] [{ENVOY_GATEWAY_NAMESPACE envoy-gateway-system nil} {ENVOY_SERVICE_ZONE  &EnvVarSource{FieldRef:&ObjectFieldSelector{APIVersion:v1,FieldPath:metadata.annotations['topology.kubernetes.io/zone'],},ResourceFieldRef:nil,ConfigMapKeyRef:nil,SecretKeyRef:nil,}} {ENVOY_POD_NAME  &EnvVarSource{FieldRef:&ObjectFieldSelector{APIVersion:v1,FieldPath:metadata.name,},ResourceFieldRef:nil,ConfigMapKeyRef:nil,SecretKeyRef:nil,}}] {map[cpu:{{1 0} {<nil>} 1 DecimalSI} memory:{{1073741824 0} {<nil>} 1Gi BinarySI}] map[cpu:{{100 -3} {<nil>} 100m DecimalSI} memory:{{553648128 0} {<nil>}  BinarySI}] []} [] <nil> [{certs true <nil> /certs  <nil> } {sds false <nil> /sds  <nil> }] [] &Probe{ProbeHandler:ProbeHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/ready,Port:{0 19003 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,GRPC:nil,},InitialDelaySeconds:0,TimeoutSeconds:1,PeriodSeconds:10,SuccessThreshold:1,FailureThreshold:3,TerminationGracePeriodSeconds:nil,} &Probe{ProbeHandler:ProbeHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/ready,Port:{0 19003 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,GRPC:nil,},InitialDelaySeconds:0,TimeoutSeconds:1,PeriodSeconds:5,SuccessThreshold:1,FailureThreshold:1,TerminationGracePeriodSeconds:nil,} &Probe{ProbeHandler:ProbeHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/ready,Port:{0 19003 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,GRPC:nil,},InitialDelaySeconds:0,TimeoutSeconds:1,PeriodSeconds:10,SuccessThreshold:1,FailureThreshold:30,TerminationGracePeriodSeconds:nil,} &Lifecycle{PostStart:nil,PreStop:&LifecycleHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/shutdown/ready,Port:{0 19002 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,Sleep:nil,},StopSignal:nil,} /dev/termination-log File IfNotPresent &SecurityContext{Capabilities:&Capabilities{Add:[],Drop:[ALL],},Privileged:*false,SELinuxOptions:nil,RunAsUser:*65532,RunAsNonRoot:*true,ReadOnlyRootFilesystem:nil,AllowPrivilegeEscalation:*false,RunAsGroup:*65532,ProcMount:nil,WindowsOptions:nil,SeccompProfile:&SeccompProfile{Type:RuntimeDefault,LocalhostProfile:nil,},AppArmorProfile:nil,} false false false} {shutdown-manager docker.io/envoyproxy/gateway:v1.4.0 [envoy-gateway] [envoy shutdown-manager]  [] [] [{ENVOY_GATEWAY_NAMESPACE envoy-gateway-system nil} {ENVOY_SERVICE_ZONE  &EnvVarSource{FieldRef:&ObjectFieldSelector{APIVersion:v1,FieldPath:metadata.annotations['topology.kubernetes.io/zone'],},ResourceFieldRef:nil,ConfigMapKeyRef:nil,SecretKeyRef:nil,}} {ENVOY_POD_NAME  &EnvVarSource{FieldRef:&ObjectFieldSelector{APIVersion:v1,FieldPath:metadata.name,},ResourceFieldRef:nil,ConfigMapKeyRef:nil,SecretKeyRef:nil,}}] {map[] map[cpu:{{10 -3} {<nil>} 10m DecimalSI} memory:{{33554432 0} {<nil>}  BinarySI}] []} [] <nil> [] [] &Probe{ProbeHandler:ProbeHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/healthz,Port:{0 19002 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,GRPC:nil,},InitialDelaySeconds:0,TimeoutSeconds:1,PeriodSeconds:10,SuccessThreshold:1,FailureThreshold:10,TerminationGracePeriodSeconds:nil,} &Probe{ProbeHandler:ProbeHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/healthz,Port:{0 19002 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,GRPC:nil,},InitialDelaySeconds:0,TimeoutSeconds:1,PeriodSeconds:10,SuccessThreshold:1,FailureThreshold:10,TerminationGracePeriodSeconds:nil,} &Probe{ProbeHandler:ProbeHandler{Exec:nil,HTTPGet:&HTTPGetAction{Path:/healthz,Port:{0 19002 },Host:,Scheme:HTTP,HTTPHeaders:[]HTTPHeader{},},TCPSocket:nil,GRPC:nil,},InitialDelaySeconds:0,TimeoutSeconds:1,PeriodSeconds:10,SuccessThreshold:1,FailureThreshold:30,TerminationGracePeriodSeconds:nil,} &Lifecycle{PostStart:nil,PreStop:&LifecycleHandler{Exec:&ExecAction{Command:[envoy-gateway envoy shutdown],},HTTPGet:nil,TCPSocket:nil,Sleep:nil,},StopSignal:nil,} /dev/termination-log File IfNotPresent &SecurityContext{Capabilities:&Capabilities{Add:[],Drop:[ALL],},Privileged:*false,SELinuxOptions:nil,RunAsUser:*65532,RunAsNonRoot:*true,ReadOnlyRootFilesystem:nil,AllowPrivilegeEscalation:*false,RunAsGroup:*65532,ProcMount:nil,WindowsOptions:nil,SeccompProfile:&SeccompProfile{Type:RuntimeDefault,LocalhostProfile:nil,},AppArmorProfile:nil,} false false false}] [] Always 0xc007182388 <nil> ClusterFirst map[] envoy-public-ea09f8eb  <nil>  false false false <nil> nil []   &Affinity{NodeAffinity:nil,PodAffinity:nil,PodAntiAffinity:&PodAntiAffinity{RequiredDuringSchedulingIgnoredDuringExecution:[]PodAffinityTerm{PodAffinityTerm{LabelSelector:&v1.LabelSelector{MatchLabels:map[string]string{},MatchExpressions:[]LabelSelectorRequirement{LabelSelectorRequirement{Key:app.kubernetes.io/name,Operator:In,Values:[envoy],},LabelSelectorRequirement{Key:app.kubernetes.io/component,Operator:In,Values:[proxy],},LabelSelectorRequirement{Key:gateway.envoyproxy.io/owning-gatewayclass,Operator:In,Values:[envoy-public],},},},Namespaces:[],TopologyKey:kubernetes.io/hostname,NamespaceSelector:nil,MatchLabelKeys:[],MismatchLabelKeys:[],},},PreferredDuringSchedulingIgnoredDuringExecution:[]WeightedPodAffinityTerm{},},} default-scheduler [] []  <nil> nil [] <nil> <nil> <nil> map[] [] <nil> nil <nil> [] [] nil}},Strategy:DeploymentStrategy{Type:RollingUpdate,RollingUpdate:nil,},MinReadySeconds:0,RevisionHistoryLimit:*10,Paused:false,ProgressDeadlineSeconds:*600,},Status:DeploymentStatus{ObservedGeneration:0,Replicas:0,UpdatedReplicas:0,AvailableReplicas:0,UnavailableReplicas:0,Conditions:[]DeploymentCondition{},ReadyReplicas:0,CollisionCount:nil,TerminatingReplicas:nil,},}: Deployment.apps \"envoy-public-ea09f8eb\" is invalid: [spec.template.spec.containers[0].env[0].valueFrom: Invalid value: \"\": may not be specified when `value` is not empty, spec.template.spec.containers[1].env[0].valueFrom: Invalid value: \"\": may not be specified when `value` is not empty]"}
```@jukie: Could you please share the rendered proxy pod? Does `spec.template.spec.containers[1].env[0].valueFrom` point to the `ENVOY_SERVICE_ZONE` var?@owenhaynes: @jukie do I have to enable a debug flag to get that? As this is when envoy is trying to update its managed deployment, so unsure how to get it@jukie: I misunderstood and the logs you've shown should be enough in this case but I've got a few follow-ups.
1. What Kubernetes version are you using?
2. Where is your cluster running? E.g. Bare metal, EKS, GKE, AKS, etc
3. What is your installation/upgrade tooling? E.g. Helm, ArgoCD, Kustomize, etc
4. Please describe the steps you took when performing the upgrade and confirm the version you upgraded from@jukie: I've tried with a few different K8s versions in kind with `0` applied as the topology zone label and am still unable to reproduce this but I don't doubt that it's happening. Here's what I'm using:
* `NUM_WORKERS=2 make create-cluster`
* `helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.3.0 -n envoy-gateway-system --create-namespace`
* `kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.3.0/quickstart.yaml -n default`
* `helm upgrade -i eg oci://docker.io/envoyproxy/gateway-helm --version v1.4.0 -n envoy-gateway-system`

@dghubble could you also include what image version you're using for the proxy pods? I'm curious if there's been a parsing change there that would've broken in earlier versions.@owenhaynes: @jukie 

1. 1.32.3
2. GKE
3. ArgoCD
4. Upgraded via argocd which  was just updaing tag from 1.3.0 to 1.4.0. 


So one of out other clusters this is working fine and some are not. fun times@owenhaynes: @jukie I found the bug 

So in 1.3.0 it was
```
        - name: ENVOY_GATEWAY_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
```

in 1.4.0 this is now 

```
        - name: ENVOY_GATEWAY_NAMESPACE
          value: envoy-gateway-system
````

when the merge happens  both value, and valueFrom  are set. 

so something like this

```
- name: ENVOY_GATEWAY_NAMESPACE 
  value: envoy-gateway-system
  valueFrom: null
```

I see then happen before in other things before

so the manual fix for me was to manually edit  each deployment to set
```
        - name: ENVOY_GATEWAY_NAMESPACE
          value: envoy-gateway-system
```

and then restart envoy-gateway to roll out the new envoy config 

The cluster which had no problems was a fresh install of 1.3.0 the other week. So no idea why this is not having the same issues, i assume some strange k8s state issue on the older clusters.


I have Made separate ticket as unrelated to topology #6155


Solution patch:
diff --git a/api/v1alpha1/envoyproxy_helpers.go b/api/v1alpha1/envoyproxy_helpers.go
index ec69147e6..b141f179c 100644
--- a/api/v1alpha1/envoyproxy_helpers.go
+++ b/api/v1alpha1/envoyproxy_helpers.go
@@ -143,6 +143,11 @@ func (logging *ProxyLogging) GetEnvoyProxyComponentLevel() string {
 		}
 	}
 
+	if len(args) == 0 {
+		// use "misc:error" as default
+		args = []string{"misc:error"}
+	}
+
 	sort.Strings(args)
 
 	return strings.Join(args, ",")
diff --git a/internal/infrastructure/common/proxy_args.go b/internal/infrastructure/common/proxy_args.go
index 78544b636..98a7e22cd 100644
--- a/internal/infrastructure/common/proxy_args.go
+++ b/internal/infrastructure/common/proxy_args.go
@@ -72,9 +72,6 @@ func BuildProxyArgs(
 
 	if componentsLogLevel := logging.GetEnvoyProxyComponentLevel(); componentsLogLevel != "" {
 		args = append(args, fmt.Sprintf("--component-log-level %s", componentsLogLevel))
-	} else {
-		// Default to error level for misc components if not set.
-		args = append(args, fmt.Sprintf("--component-log-level %s", "misc:error"))
 	}
 
 	// Default drain timeout.
diff --git a/internal/provider/kubernetes/topology_injector.go b/internal/provider/kubernetes/topology_injector.go
index b0569e5aa..9a4edea22 100644
--- a/internal/provider/kubernetes/topology_injector.go
+++ b/internal/provider/kubernetes/topology_injector.go
@@ -80,7 +80,7 @@ func (m *ProxyTopologyInjector) Handle(ctx context.Context, req admission.Reques
 		if binding.Annotations == nil {
 			binding.Annotations = map[string]string{}
 		}
-		binding.Annotations[corev1.LabelTopologyZone] = zone
+		binding.Annotations[corev1.LabelTopologyZone] = fmt.Sprintf("%q", zone)
 	} else {
 		logger.V(1).Info("Skipping injection due to missing topology label on node")
 		return admission.Allowed("Skipping injection due to missing topology label on node")
diff --git a/internal/xds/bootstrap/bootstrap.yaml.tpl b/internal/xds/bootstrap/bootstrap.yaml.tpl
index dafb277d9..c6956fe86 100644
--- a/internal/xds/bootstrap/bootstrap.yaml.tpl
+++ b/internal/xds/bootstrap/bootstrap.yaml.tpl
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 {{- if .StatsMatcher  }}
 stats_config:
   stats_matcher:
@@ -186,7 +186,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index 2e74fd8d7..decd1f725 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -18,6 +18,7 @@ new features: |
   Added support for configuring hostname in active HTTP healthchecks.
 
 bug fixes: |
+  Handle integer zone annotation values
   Fixed issue where WASM cache init failure caused routes with WASM-less EnvoyExtensionPolicies to have 500 direct responses.
 
 # Enhancements that improve performance.
diff --git a/tools/hack/create-cluster.sh b/tools/hack/create-cluster.sh
index 6c2a93f51..6b440b084 100755
--- a/tools/hack/create-cluster.sh
+++ b/tools/hack/create-cluster.sh
@@ -30,14 +30,14 @@ networking:
 nodes:
 - role: control-plane
   labels:
-    "topology.kubernetes.io/zone": "0"
+    "topology.kubernetes.io/zone": 0
 EOM
 )
 
 # https://kind.sigs.k8s.io/docs/user/quick-start/#multi-node-clusters
 if [[ -n "${NUM_WORKERS}" ]]; then
 for i in $(seq 1 "${NUM_WORKERS}"); do
-  KIND_CFG+=$(printf "\n- role: worker\n  labels:\n    \"topology.kubernetes.io/zone\": \"%s\"" "$i")
+  KIND_CFG+=$(printf "\n- role: worker\n  labels:\n    \"topology.kubernetes.io/zone\": %s" "$i")
 done
 fi
 



Test patch:
diff --git a/api/v1alpha1/validation/envoyproxy_validate_test.go b/api/v1alpha1/validation/envoyproxy_validate_test.go
index 9c96792f5..f6ff1c6b2 100644
--- a/api/v1alpha1/validation/envoyproxy_validate_test.go
+++ b/api/v1alpha1/validation/envoyproxy_validate_test.go
@@ -847,7 +847,7 @@ func TestGetEnvoyProxyComponentLevelArgs(t *testing.T) {
 	}{
 		{
 			logging:  egv1a1.ProxyLogging{},
-			expected: "",
+			expected: "misc:error",
 		},
 		{
 			logging: egv1a1.ProxyLogging{
@@ -855,7 +855,7 @@ func TestGetEnvoyProxyComponentLevelArgs(t *testing.T) {
 					egv1a1.LogComponentDefault: egv1a1.LogLevelInfo,
 				},
 			},
-			expected: "",
+			expected: "misc:error",
 		},
 		{
 			logging: egv1a1.ProxyLogging{
diff --git a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
index d32896c2c..cefeca7d5 100644
--- a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
@@ -23,7 +23,7 @@ envoyProxyForGatewayClass:
           local_cluster_name: local_cluster
         node:
           locality:
-            zone: "$(ENVOY_SERVICE_ZONE)"
+            zone: $(ENVOY_SERVICE_ZONE)
         layered_runtime:
           layers:
           - name: global_config
@@ -108,7 +108,7 @@ envoyProxyForGatewayClass:
                   load_balancing_weight: 1
                 load_balancing_weight: 1
                 locality:
-                  zone: "$(ENVOY_SERVICE_ZONE)"
+                  zone: $(ENVOY_SERVICE_ZONE)
             name: local_cluster
             type: STATIC
           - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
index 490b8516f..4603f7247 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
@@ -52,7 +52,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -137,7 +137,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
index f2a9ac4af..a1a4d9bf9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
index e76912906..b4e83c6d4 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
index 9d28c2438..aec6f5336 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
@@ -47,7 +47,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -85,7 +85,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
index 47d98de04..f6a59ef15 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
index 336705faa..9cc6bf73e 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
index 335af4134..ddefe90b0 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
index 0a3df16c8..fdb1cd926 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
index 320588761..0cedfdb14 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
index 5d228dc1a..42fb53cf6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
index 6a0ccedd3..7495912ed 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
index 82766a0ce..590835459 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
index ffaeaf550..279b03285 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
index 3c54978e5..5b461e56d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
index a0f53dd75..0e8705737 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
index 1548efa17..0fb322439 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -136,7 +136,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
index 1f09bd450..b93281c30 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -57,7 +57,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -142,7 +142,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
index b646e3740..99d3b24f2 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -57,7 +57,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -142,7 +142,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
index bee965059..b338506c9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
index 538a83777..fa52c6862 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
index 762d42e5f..e32820f4c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -51,7 +51,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -89,7 +89,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
index 41f290234..8b2443e75 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
index 034697656..631aba61f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
index c32da9e94..969057ace 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
index 37d053e03..ae2405c92 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
index 460174656..4200837e6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -64,7 +64,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -149,7 +149,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
index 1586d258a..fe7d322b8 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
index 90cfd5c37..c87d95c8b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
index d2df4f785..6eecc815b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -56,7 +56,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -141,7 +141,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
index ae5d29392..f88b710cf 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
index 0e4d831cd..31f98d5e0 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
index 589bbb911..5d8cb792a 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
index c723c4f0b..9fd95327a 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
index 212acfc74..a514ea8cf 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
index 81479bbd4..7748279a7 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
index 182b1407a..fcda05eeb 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -55,7 +55,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -140,7 +140,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
index 0483bd7fd..710787b20 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
@@ -60,7 +60,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -145,7 +145,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
@@ -464,7 +464,7 @@ spec:
             local_cluster_name: local_cluster
           node:
             locality:
-              zone: "$(ENVOY_SERVICE_ZONE)"
+              zone: $(ENVOY_SERVICE_ZONE)
           layered_runtime:
             layers:
             - name: global_config
@@ -549,7 +549,7 @@ spec:
                     load_balancing_weight: 1
                   load_balancing_weight: 1
                   locality:
-                    zone: "$(ENVOY_SERVICE_ZONE)"
+                    zone: $(ENVOY_SERVICE_ZONE)
               name: local_cluster
               type: STATIC
             - connect_timeout: 10s
diff --git a/internal/provider/kubernetes/topology_injector_test.go b/internal/provider/kubernetes/topology_injector_test.go
index 6128214a8..399229c4a 100644
--- a/internal/provider/kubernetes/topology_injector_test.go
+++ b/internal/provider/kubernetes/topology_injector_test.go
@@ -41,7 +41,7 @@ func TestProxyTopologyInjector_Handle(t *testing.T) {
 	defaultNode := &corev1.Node{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   "node-A",
-			Labels: map[string]string{corev1.LabelTopologyZone: "zone1"},
+			Labels: map[string]string{corev1.LabelTopologyZone: "0"},
 		},
 	}
 
@@ -67,7 +67,7 @@ func TestProxyTopologyInjector_Handle(t *testing.T) {
 				Operation: "add",
 				Path:      "/metadata/annotations",
 				Value: map[string]interface{}{
-					"topology.kubernetes.io/zone": "zone1",
+					"topology.kubernetes.io/zone": "\"0\"",
 				},
 			}},
 		},
diff --git a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
index ab036892e..94586a1f0 100644
--- a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
+++ b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -97,7 +97,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
index 525ad200a..a0cef5eb6 100644
--- a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
+++ b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 stats_config:
   stats_matcher:
     inclusion_list:
@@ -108,7 +108,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
index 0ae906b71..00f493acc 100644
--- a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
+++ b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -50,7 +50,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
index 0866561b9..936b6b520 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -113,7 +113,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
index 00c0230d6..b4e898497 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -113,7 +113,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
index b32ad36fe..a974728e6 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -97,7 +97,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/ipv6.yaml b/internal/xds/bootstrap/testdata/render/ipv6.yaml
index 436710a88..ce56cc6ab 100644
--- a/internal/xds/bootstrap/testdata/render/ipv6.yaml
+++ b/internal/xds/bootstrap/testdata/render/ipv6.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -98,7 +98,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
index dcd84799b..b3b2f9b53 100644
--- a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
+++ b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -75,7 +75,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
index dcd84799b..b3b2f9b53 100644
--- a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
+++ b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -75,7 +75,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s
diff --git a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
index 26e54e4e7..33b2a460c 100644
--- a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
+++ b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
@@ -12,7 +12,7 @@ cluster_manager:
   local_cluster_name: local_cluster
 node:
   locality:
-    zone: "$(ENVOY_SERVICE_ZONE)"
+    zone: $(ENVOY_SERVICE_ZONE)
 layered_runtime:
   layers:
   - name: global_config
@@ -97,7 +97,7 @@ static_resources:
           load_balancing_weight: 1
         load_balancing_weight: 1
         locality:
-          zone: "$(ENVOY_SERVICE_ZONE)"
+          zone: $(ENVOY_SERVICE_ZONE)
     name: local_cluster
     type: STATIC
   - connect_timeout: 10s