Repository: kumahq/kuma
Pull request #12716 (2025-01-30 20:17:16)

test(e2e): speedup universal tests
## Motivation
```
 name="[It] Retry should retry on HTTP connection failure"
 time="147.866843109"

 name="[It] MeshRetry should retry on GRPC connection failure"
 time="72.991908787"
```
## Implementation information

Used fault injection and different assertions 

Now tests should last around 15-30 seconds depends on the config delivery delay

needs: https://github.com/kumahq/kuma/pull/12715

```
 name="[It] Retry should retry on HTTP connection failure"
 time="20.901990869"
 name="[It] MeshRetry should retry on GRPC connection failure"
 time="15.239195927"
```

github-actions[bot]: ## Reviewer Checklist
:mag: Each of these sections need to be checked by the reviewer of the PR :mag::
If something doesn't apply please check the box and add a justification if the reason is non obvious.
- [ ] Is the PR title satisfactory? Is this part of a larger feature and should be grouped using `> Changelog`?
- [ ] PR description is clear and complete. It [Links to relevant issue](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword) as well as docs and UI issues
- [ ] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
- [ ] IPv6 is taken into account (.e.g: no string concatenation of host port)
- [ ] Tests (Unit test, E2E tests, manual test on universal and k8s)
    - Don't forget `ci/` labels to run additional/fewer tests
- [ ] Does this contain a change that needs to be notified to users? In this case, [`UPGRADE.md`](../blob/master/UPGRADE.md) should be updated.
- [ ] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label)
<!-- Sticky Pull Request CommentPR reviewer checklist -->

Patch:
diff --git a/deployments/charts/kuma/README.md b/deployments/charts/kuma/README.md
index 224873ea7..88a9c51f2 100644
--- a/deployments/charts/kuma/README.md
+++ b/deployments/charts/kuma/README.md
@@ -40,6 +40,7 @@ A Helm chart for the Kuma Control Plane
 | controlPlane.podDisruptionBudget.maxUnavailable | int | `1` | The maximum number of unavailable pods allowed by the budget |
 | controlPlane.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["{{ include \"kuma.name\" . }}"]},{"key":"app.kubernetes.io/instance","operator":"In","values":["{{ .Release.Name }}"]},{"key":"app","operator":"In","values":["{{ include \"kuma.name\" . }}-control-plane"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity placement rule for the Kuma Control Plane pods. This is rendered as a template, so you can reference other helm variables or includes. |
 | controlPlane.topologySpreadConstraints | string | `nil` | Topology spread constraints rule for the Kuma Control Plane pods. This is rendered as a template, so you can use variables to generate match labels. |
+| controlPlane.priorityClassName | string | `""` | Priority Class Name of the Kuma Control Plane |
 | controlPlane.injectorFailurePolicy | string | `"Fail"` | Failure policy of the mutating webhook implemented by the Kuma Injector component |
 | controlPlane.service.apiServer.http.nodePort | int | `30681` | Port on which Http api server Service is exposed on Node for service of type NodePort |
 | controlPlane.service.apiServer.https.nodePort | int | `30682` | Port on which Https api server Service is exposed on Node for service of type NodePort |
@@ -157,6 +158,7 @@ A Helm chart for the Kuma Control Plane
 | ingress.podDisruptionBudget.maxUnavailable | int | `1` | The maximum number of unavailable pods allowed by the budget |
 | ingress.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["{{ include \"kuma.name\" . }}"]},{"key":"app.kubernetes.io/instance","operator":"In","values":["{{ .Release.Name }}"]},{"key":"app","operator":"In","values":["kuma-ingress"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity placement rule for the Kuma Ingress pods This is rendered as a template, so you can reference other helm variables or includes. |
 | ingress.topologySpreadConstraints | string | `nil` | Topology spread constraints rule for the Kuma Mesh Ingress pods. This is rendered as a template, so you can use variables to generate match labels. |
+| ingress.priorityClassName | string | `""` | Priority Class Name of the ingress |
 | ingress.podSecurityContext | object | `{"runAsGroup":5678,"runAsNonRoot":true,"runAsUser":5678}` | Security context at the pod level for ingress |
 | ingress.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for ingress |
 | ingress.serviceAccountAnnotations | object | `{}` | Annotations to add for Control Plane's Service Account |
@@ -194,6 +196,7 @@ A Helm chart for the Kuma Control Plane
 | egress.podDisruptionBudget.maxUnavailable | int | `1` | The maximum number of unavailable pods allowed by the budget |
 | egress.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["{{ include \"kuma.name\" . }}"]},{"key":"app.kubernetes.io/instance","operator":"In","values":["{{ .Release.Name }}"]},{"key":"app","operator":"In","values":["kuma-egress"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity placement rule for the Kuma Egress pods. This is rendered as a template, so you can reference other helm variables or includes. |
 | egress.topologySpreadConstraints | string | `nil` | Topology spread constraints rule for the Kuma Egress pods. This is rendered as a template, so you can use variables to generate match labels. |
+| egress.priorityClassName | string | `""` | Priority Class Name of the egress |
 | egress.podSecurityContext | object | `{"runAsGroup":5678,"runAsNonRoot":true,"runAsUser":5678}` | Security context at the pod level for egress |
 | egress.containerSecurityContext | object | `{"readOnlyRootFilesystem":true}` | Security context at the container level for egress |
 | egress.serviceAccountAnnotations | object | `{}` | Annotations to add for Control Plane's Service Account |
diff --git a/deployments/charts/kuma/templates/cp-deployment.yaml b/deployments/charts/kuma/templates/cp-deployment.yaml
index 1111b149b..6e6329688 100644
--- a/deployments/charts/kuma/templates/cp-deployment.yaml
+++ b/deployments/charts/kuma/templates/cp-deployment.yaml
@@ -97,6 +97,9 @@ spec:
       {{- with .Values.controlPlane.topologySpreadConstraints }}
       topologySpreadConstraints: {{ tpl (toYaml . | nindent 8) $ }}
       {{- end }}
+      {{- with .Values.controlPlane.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
       securityContext:
       {{- toYaml .Values.controlPlane.podSecurityContext | trim | nindent 8 }}
       serviceAccountName: {{ include "kuma.name" . }}-control-plane
diff --git a/deployments/charts/kuma/templates/egress-deployment.yaml b/deployments/charts/kuma/templates/egress-deployment.yaml
index 3b6617eee..1f6ccd2d7 100644
--- a/deployments/charts/kuma/templates/egress-deployment.yaml
+++ b/deployments/charts/kuma/templates/egress-deployment.yaml
@@ -33,6 +33,9 @@ spec:
       {{- with .Values.egress.topologySpreadConstraints }}
       topologySpreadConstraints: {{ tpl (toYaml . | nindent 8) $ }}
       {{- end }}
+      {{- with .Values.egress.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
       securityContext:
       {{- toYaml .Values.egress.podSecurityContext | trim | nindent 8 }}
       serviceAccountName: {{ include "kuma.name" . }}-egress
diff --git a/deployments/charts/kuma/templates/ingress-deployment.yaml b/deployments/charts/kuma/templates/ingress-deployment.yaml
index fcefeaac6..5a31584db 100644
--- a/deployments/charts/kuma/templates/ingress-deployment.yaml
+++ b/deployments/charts/kuma/templates/ingress-deployment.yaml
@@ -33,6 +33,9 @@ spec:
       {{- with .Values.ingress.topologySpreadConstraints }}
       topologySpreadConstraints: {{ tpl (toYaml . | nindent 8) $ }}
       {{- end }}
+      {{- with .Values.ingress.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
       securityContext:
       {{- toYaml .Values.ingress.podSecurityContext | trim | nindent 8 }}
       serviceAccountName: {{ include "kuma.name" . }}-ingress
diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
index e765d6137..07e2bd710 100644
--- a/deployments/charts/kuma/values.yaml
+++ b/deployments/charts/kuma/values.yaml
@@ -119,6 +119,9 @@ controlPlane:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the Kuma Control Plane
+  priorityClassName: ""
+
   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
   injectorFailurePolicy: Fail
 
@@ -532,6 +535,9 @@ ingress:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the ingress
+  priorityClassName: ""
+
   # -- Security context at the pod level for ingress
   podSecurityContext:
     runAsNonRoot: true
@@ -655,6 +661,9 @@ egress:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the egress
+  priorityClassName: ""
+
   # -- Security context at the pod level for egress
   podSecurityContext:
     runAsNonRoot: true
diff --git a/docs/generated/openapi.yaml b/docs/generated/openapi.yaml
index c7c6ffd34..c2e85191f 100644
--- a/docs/generated/openapi.yaml
+++ b/docs/generated/openapi.yaml
@@ -3810,11 +3810,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -5035,11 +5037,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -5554,11 +5558,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -6046,11 +6052,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -6857,11 +6865,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -7625,11 +7635,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -7961,11 +7973,13 @@ components:
               type: object
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -8150,11 +8164,13 @@ components:
               type: object
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -8871,11 +8887,13 @@ components:
             - default
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -9464,11 +9482,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -10115,11 +10135,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -10461,11 +10483,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -11037,11 +11061,13 @@ components:
               type: array
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -11322,11 +11348,13 @@ components:
               type: object
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -11676,11 +11704,13 @@ components:
               type: object
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -11922,11 +11952,13 @@ components:
               type: object
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -12742,11 +12774,13 @@ components:
               type: string
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -12999,11 +13033,13 @@ components:
             - match
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -13111,6 +13147,7 @@ components:
                   type: string
               type: object
           type: object
+          readOnly: true
     MeshExternalServiceCreateOrUpdateSuccessResponse:
       type: object
       properties:
@@ -13195,11 +13232,13 @@ components:
             - selector
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -13327,6 +13366,7 @@ components:
                 type: object
               type: array
           type: object
+          readOnly: true
     MeshMultiZoneServiceCreateOrUpdateSuccessResponse:
       type: object
       properties:
@@ -13437,11 +13477,13 @@ components:
               type: string
           type: object
         creationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was created
           format: date-time
           example: '0001-01-01T00:00:00Z'
         modificationTime:
+          readOnly: true
           type: string
           description: Time at which the resource was updated
           format: date-time
@@ -13569,6 +13611,7 @@ components:
                 type: object
               type: array
           type: object
+          readOnly: true
     MeshServiceCreateOrUpdateSuccessResponse:
       type: object
       properties:
diff --git a/docs/generated/raw/helm-values.yaml b/docs/generated/raw/helm-values.yaml
index e765d6137..07e2bd710 100644
--- a/docs/generated/raw/helm-values.yaml
+++ b/docs/generated/raw/helm-values.yaml
@@ -119,6 +119,9 @@ controlPlane:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the Kuma Control Plane
+  priorityClassName: ""
+
   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
   injectorFailurePolicy: Fail
 
@@ -532,6 +535,9 @@ ingress:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the ingress
+  priorityClassName: ""
+
   # -- Security context at the pod level for ingress
   podSecurityContext:
     runAsNonRoot: true
@@ -655,6 +661,9 @@ egress:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the egress
+  priorityClassName: ""
+
   # -- Security context at the pod level for egress
   podSecurityContext:
     runAsNonRoot: true
diff --git a/go.mod b/go.mod
index 9db1a68b7..41c2d44eb 100644
--- a/go.mod
+++ b/go.mod
@@ -50,7 +50,7 @@ require (
 	github.com/shopspring/decimal v1.4.0
 	github.com/slok/go-http-metrics v0.13.0
 	github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag v1.0.5
+	github.com/spf13/pflag v1.0.6
 	github.com/spiffe/go-spiffe/v2 v2.5.0
 	github.com/testcontainers/testcontainers-go v0.35.0
 	github.com/tonglil/opentelemetry-go-datadog-propagator v0.1.3
diff --git a/go.sum b/go.sum
index 044796813..585507270 100644
--- a/go.sum
+++ b/go.sum
@@ -440,8 +440,9 @@ github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
diff --git a/pkg/core/resources/apis/core/interfaces.go b/pkg/core/resources/apis/core/interfaces.go
new file mode 100644
index 000000000..3dc8c42ed
--- /dev/null
+++ b/pkg/core/resources/apis/core/interfaces.go
@@ -0,0 +1,6 @@
+package core
+
+type Port interface {
+	GetName() string
+	GetValue() uint32
+}
diff --git a/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1/schema.yaml b/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1/schema.yaml
index 464707db4..875ebb44b 100644
--- a/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1/schema.yaml
+++ b/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1/schema.yaml
@@ -45,11 +45,13 @@ properties:
         type: string
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/schema.yaml b/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/schema.yaml
index 13d32f8f6..1b1dd0718 100644
--- a/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/schema.yaml
+++ b/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/schema.yaml
@@ -197,11 +197,13 @@ properties:
       - match
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
@@ -291,3 +293,4 @@ properties:
             type: string
         type: object
     type: object
+    readOnly: true
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
index f6cb43302..ce1a2d5cb 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
@@ -3,6 +3,7 @@ package v1alpha1
 import (
 	"fmt"
 
+	"github.com/kumahq/kuma/pkg/core/resources/apis/core"
 	core_vip "github.com/kumahq/kuma/pkg/core/resources/apis/core/vip"
 	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/resources/model"
@@ -37,7 +38,7 @@ func (m *MeshMultiZoneServiceResource) findPort(port uint32) (Port, bool) {
 
 func (m *MeshMultiZoneServiceResource) FindSectionNameByPort(port uint32) (string, bool) {
 	if port, found := m.findPort(port); found {
-		return port.GetName(), true
+		return port.GetNameOrStringifyPort(), true
 	}
 	return "", false
 }
@@ -66,7 +67,7 @@ func (m *MeshMultiZoneServiceResource) AsOutbounds() xds_types.Outbounds {
 			outbounds = append(outbounds, &xds_types.Outbound{
 				Address:  vip.IP,
 				Port:     port.Port,
-				Resource: pointer.To(model.NewTypedResourceIdentifier(m, model.WithSectionName(port.GetName()))),
+				Resource: pointer.To(model.NewTypedResourceIdentifier(m, model.WithSectionName(port.GetNameOrStringifyPort()))),
 			})
 		}
 	}
@@ -86,3 +87,26 @@ func (t *MeshMultiZoneServiceResource) Domains() *xds_types.VIPDomains {
 	}
 	return nil
 }
+
+func (t *MeshMultiZoneServiceResource) GetPorts() []core.Port {
+	var ports []core.Port
+	for _, port := range t.Spec.Ports {
+		ports = append(ports, core.Port(port))
+	}
+	return ports
+}
+
+func (p Port) GetNameOrStringifyPort() string {
+	if p.Name != "" {
+		return p.Name
+	}
+	return fmt.Sprintf("%d", p.Port)
+}
+
+func (p Port) GetName() string {
+	return p.Name
+}
+
+func (p Port) GetValue() uint32 {
+	return p.Port
+}
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go
index c5af2ddff..2388ad89d 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go
@@ -31,13 +31,6 @@ type Port struct {
 	AppProtocol core_mesh.Protocol `json:"appProtocol,omitempty"`
 }
 
-func (p *Port) GetName() string {
-	if p.Name != "" {
-		return p.Name
-	}
-	return fmt.Sprintf("%d", p.Port)
-}
-
 type Selector struct {
 	// MeshService selects MeshServices
 	MeshService MeshServiceSelector `json:"meshService"`
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml
index feddc3129..9f92669a9 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml
@@ -60,11 +60,13 @@ properties:
       - selector
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
@@ -176,3 +178,4 @@ properties:
           type: object
         type: array
     type: object
+    readOnly: true
diff --git a/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go b/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go
index 1374fc946..d37582ba6 100644
--- a/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go
+++ b/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/core/resources/apis/core"
 	core_vip "github.com/kumahq/kuma/pkg/core/resources/apis/core/vip"
 	"github.com/kumahq/kuma/pkg/core/resources/model"
 	xds_types "github.com/kumahq/kuma/pkg/core/xds/types"
@@ -26,7 +27,7 @@ func (m *MeshServiceResource) findPort(port uint32) (Port, bool) {
 
 func (m *MeshServiceResource) FindSectionNameByPort(port uint32) (string, bool) {
 	if port, found := m.findPort(port); found {
-		return port.GetName(), true
+		return port.GetNameOrStringifyPort(), true
 	}
 	return "", false
 }
@@ -107,7 +108,7 @@ func (t *MeshServiceResource) AsOutbounds() xds_types.Outbounds {
 			outbounds = append(outbounds, &xds_types.Outbound{
 				Address:  vip.IP,
 				Port:     port.Port,
-				Resource: pointer.To(model.NewTypedResourceIdentifier(t, model.WithSectionName(port.GetName()))),
+				Resource: pointer.To(model.NewTypedResourceIdentifier(t, model.WithSectionName(port.GetNameOrStringifyPort()))),
 			})
 		}
 	}
@@ -128,9 +129,25 @@ func (t *MeshServiceResource) Domains() *xds_types.VIPDomains {
 	return nil
 }
 
-func (p *Port) GetName() string {
+func (t *MeshServiceResource) GetPorts() []core.Port {
+	var ports []core.Port
+	for _, port := range t.Spec.Ports {
+		ports = append(ports, core.Port(port))
+	}
+	return ports
+}
+
+func (p Port) GetNameOrStringifyPort() string {
 	if p.Name != "" {
 		return p.Name
 	}
 	return fmt.Sprintf("%d", p.Port)
 }
+
+func (p Port) GetName() string {
+	return p.Name
+}
+
+func (p Port) GetValue() uint32 {
+	return p.Port
+}
diff --git a/pkg/core/resources/apis/meshservice/api/v1alpha1/schema.yaml b/pkg/core/resources/apis/meshservice/api/v1alpha1/schema.yaml
index ca70a202d..acd6c8336 100644
--- a/pkg/core/resources/apis/meshservice/api/v1alpha1/schema.yaml
+++ b/pkg/core/resources/apis/meshservice/api/v1alpha1/schema.yaml
@@ -82,11 +82,13 @@ properties:
         type: string
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
@@ -196,3 +198,4 @@ properties:
           type: object
         type: array
     type: object
+    readOnly: true
diff --git a/pkg/plugins/policies/core/rules/common/resolvetargetref.go b/pkg/plugins/policies/core/rules/common/resolvetargetref.go
index d1e0e404f..710898c87 100644
--- a/pkg/plugins/policies/core/rules/common/resolvetargetref.go
+++ b/pkg/plugins/policies/core/rules/common/resolvetargetref.go
@@ -8,6 +8,7 @@ import (
 
 	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/core/resources/apis/core"
 	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/plugins/policies/core/rules/subsetutils"
@@ -30,6 +31,10 @@ func UniqueKey(r core_model.Resource, sectionName string) core_model.TypedResour
 	}
 }
 
+type ResourceWithPorts interface {
+	GetPorts() []core.Port
+}
+
 func ResolveTargetRef(targetRef common_api.TargetRef, tMeta core_model.ResourceMeta, reader ResourceReader) []*ResourceSection {
 	if !targetRef.Kind.IsRealResource() {
 		return nil
@@ -80,14 +85,40 @@ func ResolveTargetRef(targetRef common_api.TargetRef, tMeta core_model.ResourceM
 	}
 
 	ri := core_model.TargetRefToResourceIdentifier(tMeta, targetRef)
-	if resource := reader.Get(rtype, ri); resource != nil {
-		return []*ResourceSection{{
-			Resource:    resource,
-			SectionName: targetRef.SectionName,
-		}}
+	resolvedResource := reader.Get(rtype, ri)
+	if resolvedResource == nil {
+		return nil
 	}
 
-	return nil
+	if resourceWithPorts, ok := resolvedResource.(ResourceWithPorts); ok && targetRef.SectionName != "" {
+		for _, port := range resourceWithPorts.GetPorts() {
+			if port.GetName() == targetRef.SectionName {
+				return []*ResourceSection{{
+					Resource:    resolvedResource,
+					SectionName: port.GetName(),
+				}}
+			}
+			if targetRefPort, ok := tryParsePort(targetRef.SectionName); ok && port.GetName() == "" && port.GetValue() == targetRefPort {
+				return []*ResourceSection{{
+					Resource:    resolvedResource,
+					SectionName: targetRef.SectionName,
+				}}
+			}
+		}
+		return []*ResourceSection{}
+	}
+
+	return []*ResourceSection{{
+		Resource: resolvedResource,
+	}}
+}
+
+func tryParsePort(s string) (uint32, bool) {
+	u, err := strconv.ParseUint(s, 10, 32)
+	if err != nil {
+		return 0, false
+	}
+	return uint32(u), true
 }
 
 func parseService(host string) (string, string, uint32, error) {
diff --git a/pkg/plugins/policies/core/rules/outbound/resourcerules.go b/pkg/plugins/policies/core/rules/outbound/resourcerules.go
index 6a094e25e..e356051e3 100644
--- a/pkg/plugins/policies/core/rules/outbound/resourcerules.go
+++ b/pkg/plugins/policies/core/rules/outbound/resourcerules.go
@@ -169,7 +169,7 @@ type withResolvedResource[T any] struct {
 	rs    *common.ResourceSection
 }
 
-// isRelevant returns true if the resolvedWrapper's resource is relevant to the other resource or section of the resource
+// isRelevant returns true if the rs.resource is relevant to the other resource or section of the resource
 func (rw *withResolvedResource[T]) isRelevant(other core_model.Resource, sectionName string) bool {
 	switch itemDescriptorName := rw.rs.Resource.Descriptor().Name; itemDescriptorName {
 	case core_mesh.MeshType:
diff --git a/pkg/plugins/policies/meshaccesslog/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshaccesslog/api/v1alpha1/schema.yaml
index 191c9be49..cd56869ad 100644
--- a/pkg/plugins/policies/meshaccesslog/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshaccesslog/api/v1alpha1/schema.yaml
@@ -518,11 +518,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/schema.yaml
index 368efeb85..2aa6c4ac3 100644
--- a/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/schema.yaml
@@ -702,11 +702,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/schema.yaml
index 1e473bd87..777610b15 100644
--- a/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/schema.yaml
@@ -376,11 +376,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/schema.yaml
index 2935d6790..74bf406c5 100644
--- a/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/schema.yaml
@@ -345,11 +345,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshhttproute/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshhttproute/api/v1alpha1/schema.yaml
index ac071e8a1..b73874219 100644
--- a/pkg/plugins/policies/meshhttproute/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshhttproute/api/v1alpha1/schema.yaml
@@ -625,11 +625,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/schema.yaml
index 90668e701..3d0c3d47b 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/schema.yaml
@@ -520,11 +520,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshmetric/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshmetric/api/v1alpha1/schema.yaml
index 7927990d8..f886cafe0 100644
--- a/pkg/plugins/policies/meshmetric/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshmetric/api/v1alpha1/schema.yaml
@@ -245,11 +245,13 @@ properties:
         type: object
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshpassthrough/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshpassthrough/api/v1alpha1/schema.yaml
index 42fd6c259..cf0b850fb 100644
--- a/pkg/plugins/policies/meshpassthrough/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshpassthrough/api/v1alpha1/schema.yaml
@@ -130,11 +130,13 @@ properties:
         type: object
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshproxypatch/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshproxypatch/api/v1alpha1/schema.yaml
index f47c54f88..832677e80 100644
--- a/pkg/plugins/policies/meshproxypatch/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshproxypatch/api/v1alpha1/schema.yaml
@@ -487,11 +487,13 @@ properties:
       - default
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshratelimit/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshratelimit/api/v1alpha1/schema.yaml
index 42f759e01..cc46d2184 100644
--- a/pkg/plugins/policies/meshratelimit/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshratelimit/api/v1alpha1/schema.yaml
@@ -450,11 +450,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshretry/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshretry/api/v1alpha1/schema.yaml
index dca317e11..3b536a4e4 100644
--- a/pkg/plugins/policies/meshretry/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshretry/api/v1alpha1/schema.yaml
@@ -465,11 +465,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshtcproute/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshtcproute/api/v1alpha1/schema.yaml
index 3e24b94e5..1ab64d335 100644
--- a/pkg/plugins/policies/meshtcproute/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshtcproute/api/v1alpha1/schema.yaml
@@ -249,11 +249,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml
index 833951553..b064f755f 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml
@@ -385,11 +385,13 @@ properties:
         type: array
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshtls/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshtls/api/v1alpha1/schema.yaml
index 628bb2e74..46ca97e4f 100644
--- a/pkg/plugins/policies/meshtls/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshtls/api/v1alpha1/schema.yaml
@@ -204,11 +204,13 @@ properties:
         type: object
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshtrace/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshtrace/api/v1alpha1/schema.yaml
index 3ea02b2b5..457d389ce 100644
--- a/pkg/plugins/policies/meshtrace/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshtrace/api/v1alpha1/schema.yaml
@@ -251,11 +251,13 @@ properties:
         type: object
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1/schema.yaml
index 526e940d9..6e43699ef 100644
--- a/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1/schema.yaml
@@ -169,11 +169,13 @@ properties:
         type: object
     type: object
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/tools/openapi/templates/schema.yaml b/tools/openapi/templates/schema.yaml
index cc9bf91a3..f9d4570d6 100644
--- a/tools/openapi/templates/schema.yaml
+++ b/tools/openapi/templates/schema.yaml
@@ -21,11 +21,13 @@ properties:
     type: object
   spec: {}
   creationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was created'
     format: date-time
     example: '0001-01-01T00:00:00Z'
   modificationTime:
+    readOnly: true
     type: string
     description: 'Time at which the resource was updated'
     format: date-time
diff --git a/tools/policy-gen/generator/cmd/openapi.go b/tools/policy-gen/generator/cmd/openapi.go
index e0d5b046d..0e2f12e18 100644
--- a/tools/policy-gen/generator/cmd/openapi.go
+++ b/tools/policy-gen/generator/cmd/openapi.go
@@ -62,7 +62,17 @@ func newOpenAPI(rootArgs *args) *cobra.Command {
 
 			yqExec := exec.CommandContext(cmd.Context(), // nolint: gosec
 				localArgs.yqBin, "e", "-i",
-				fmt.Sprintf(`.properties *= (load(%q)| ((.spec.versions[0] | .schema.openAPIV3Schema.properties | del(.apiVersion) | del(.metadata) | del(.kind)) * {"type": {"enum": [.spec.names.kind]}}))`, crdPath),
+				fmt.Sprintf(`.properties *= (
+    load(%q)
+    | (
+        .spec.versions[0]
+        | .schema.openAPIV3Schema.properties
+        | del(.apiVersion)
+        | del(.metadata)
+        | del(.kind)
+      ) * {"type": {"enum": [.spec.names.kind]}}
+  )
+  | (.properties | select(has("status")).status) |= . + {"readOnly": true}`, crdPath),
 				schemaOutPath,
 			)
 			yqExec.Stderr = cmd.ErrOrStderr()


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
index e765d6137..07e2bd710 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
@@ -119,6 +119,9 @@ controlPlane:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the Kuma Control Plane
+  priorityClassName: ""
+
   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
   injectorFailurePolicy: Fail
 
@@ -532,6 +535,9 @@ ingress:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the ingress
+  priorityClassName: ""
+
   # -- Security context at the pod level for ingress
   podSecurityContext:
     runAsNonRoot: true
@@ -655,6 +661,9 @@ egress:
   # This is rendered as a template, so you can use variables to generate match labels.
   topologySpreadConstraints:
 
+  # -- Priority Class Name of the egress
+  priorityClassName: ""
+
   # -- Security context at the pod level for egress
   podSecurityContext:
     runAsNonRoot: true
diff --git a/pkg/plugins/policies/core/rules/common/resolvetargetref_test.go b/pkg/plugins/policies/core/rules/common/resolvetargetref_test.go
new file mode 100644
index 000000000..80c17b076
--- /dev/null
+++ b/pkg/plugins/policies/core/rules/common/resolvetargetref_test.go
@@ -0,0 +1,314 @@
+package common_test
+
+import (
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
+	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
+	"github.com/kumahq/kuma/pkg/core/resources/registry"
+	"github.com/kumahq/kuma/pkg/plugins/policies/core/rules/common"
+	"github.com/kumahq/kuma/pkg/test/resources/builders"
+	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
+	"github.com/kumahq/kuma/pkg/xds/context"
+)
+
+var _ = Describe("ResolveTargetRef", func() {
+	var resources context.Resources
+	BeforeEach(func() {
+		resources = context.NewResources()
+	})
+
+	addResource := func(resource core_model.Resource) {
+		if _, ok := resources.MeshLocalResources[resource.Descriptor().Name]; !ok {
+			list, err := registry.Global().NewList(resource.Descriptor().Name)
+			Expect(err).ToNot(HaveOccurred())
+			resources.MeshLocalResources[resource.Descriptor().Name] = list
+		}
+		Expect(resources.MeshLocalResources[resource.Descriptor().Name].AddItem(resource)).To(Succeed())
+	}
+
+	It("should resolve MeshService targetRef", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind:      common_api.MeshService,
+			Name:      "backend",
+			Namespace: "kuma-demo",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPortWithName(8080, 8081, mesh.ProtocolTCP, "tcp-port").
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshservice:mesh/mesh-1:namespace/kuma-demo:name/backend"))
+	})
+
+	It("should resolve MeshService targetRef with section name", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind:        common_api.MeshService,
+			Name:        "backend",
+			Namespace:   "kuma-demo",
+			SectionName: "tcp-port",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPortWithName(8080, 8081, mesh.ProtocolTCP, "tcp-port").
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshservice:mesh/mesh-1:namespace/kuma-demo:name/backend:section/tcp-port"))
+	})
+
+	It("should not resolve MeshService targetRef with section name that doesn't exist", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind:        common_api.MeshService,
+			Name:        "backend",
+			Namespace:   "kuma-demo",
+			SectionName: "tcp-port",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPort(8080, 8081, mesh.ProtocolTCP).
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(BeEmpty())
+	})
+
+	It("should not resolve MeshService targetRef with section name being a port value and MeshService's port name is set", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind:        common_api.MeshService,
+			Name:        "backend",
+			Namespace:   "kuma-demo",
+			SectionName: "8080",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPortWithName(8080, 8081, mesh.ProtocolTCP, "tcp-port").
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(BeEmpty())
+	})
+
+	It("should resolve MeshService targetRef with section name being a port value and MeshService's port name is unset", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind:        common_api.MeshService,
+			Name:        "backend",
+			Namespace:   "kuma-demo",
+			SectionName: "8080",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPort(8080, 8081, mesh.ProtocolTCP).
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshservice:mesh/mesh-1:namespace/kuma-demo:name/backend:section/8080"))
+	})
+
+	It("should resolve legacy MeshService targetRef", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend_kuma-demo_svc_8080'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind: common_api.MeshService,
+			Name: "backend_kuma-demo_svc_8080",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPortWithName(8080, 8081, mesh.ProtocolTCP, "tcp-port").
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshservice:mesh/mesh-1:namespace/kuma-demo:name/backend:section/tcp-port"))
+	})
+
+	It("should resolve legacy MeshService targetRef, MeshService's port without name", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend_kuma-demo_svc_8080'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind: common_api.MeshService,
+			Name: "backend_kuma-demo_svc_8080",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPort(8080, 8081, mesh.ProtocolTCP).
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshservice:mesh/mesh-1:namespace/kuma-demo:name/backend"))
+	})
+
+	It("should resolve legacy MeshService targetRef for service less", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend_kuma-demo_svc'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind: common_api.MeshService,
+			Name: "backend_kuma-demo_svc",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshService().
+			WithName("backend").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend",
+			}).
+			AddIntPort(8080, 8081, mesh.ProtocolTCP).
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshservice:mesh/mesh-1:namespace/kuma-demo:name/backend"))
+	})
+
+	It("should resolve MeshMultiZoneService targetRef with section name", func() {
+		// given 'policy-1' with targetRef (somewhere in its spec) to 'backend-mzsvc'
+		policyMeta := &test_model.ResourceMeta{
+			Name: "policy-1",
+			Mesh: "mesh-1",
+		}
+		targetRef := common_api.TargetRef{
+			Kind:        common_api.MeshMultiZoneService,
+			Name:        "backend-mzsvc",
+			Namespace:   "kuma-demo",
+			SectionName: "tcp-port",
+		}
+		// given actual MeshService 'backend' in 'kuma-demo' namespace with port 8080
+		addResource(builders.MeshMultiZoneService().
+			WithName("backend-mzsvc").
+			WithMesh("mesh-1").
+			WithLabels(map[string]string{
+				"k8s.kuma.io/namespace": "kuma-demo",
+				"kuma.io/display-name":  "backend-mzsvc",
+			}).
+			WithServiceLabelSelector(map[string]string{
+				mesh_proto.DisplayName: "backend",
+			}).
+			AddIntPortWithName(8080, mesh.ProtocolTCP, "tcp-port").
+			Build(),
+		)
+
+		// when
+		resolved := common.ResolveTargetRef(targetRef, policyMeta, resources)
+
+		// then
+		Expect(resolved).To(HaveLen(1))
+		Expect(resolved[0].Identifier().String()).To(Equal("meshmultizoneservice:mesh/mesh-1:namespace/kuma-demo:name/backend-mzsvc:section/tcp-port"))
+	})
+})
diff --git a/pkg/plugins/policies/core/rules/common/suite_test.go b/pkg/plugins/policies/core/rules/common/suite_test.go
new file mode 100644
index 000000000..9037033f9
--- /dev/null
+++ b/pkg/plugins/policies/core/rules/common/suite_test.go
@@ -0,0 +1,11 @@
+package common_test
+
+import (
+	"testing"
+
+	"github.com/kumahq/kuma/pkg/test"
+)
+
+func TestRulesCommon(t *testing.T) {
+	test.RunSpecs(t, "Rules Common Suite")
+}
diff --git a/pkg/test/resources/builders/meshmultizoneservice_builder.go b/pkg/test/resources/builders/meshmultizoneservice_builder.go
index 4c58b2e5d..8671923d1 100644
--- a/pkg/test/resources/builders/meshmultizoneservice_builder.go
+++ b/pkg/test/resources/builders/meshmultizoneservice_builder.go
@@ -70,6 +70,15 @@ func (m *MeshMultiZoneServiceBuilder) AddIntPort(port uint32, protocol core_mesh
 	return m
 }
 
+func (m *MeshMultiZoneServiceBuilder) AddIntPortWithName(port uint32, protocol core_mesh.Protocol, name string) *MeshMultiZoneServiceBuilder {
+	m.res.Spec.Ports = append(m.res.Spec.Ports, meshmzservice_api.Port{
+		Port:        port,
+		AppProtocol: protocol,
+		Name:        name,
+	})
+	return m
+}
+
 func (m *MeshMultiZoneServiceBuilder) Build() *meshmzservice_api.MeshMultiZoneServiceResource {
 	if err := m.res.Validate(); err != nil {
 		panic(err)
diff --git a/pkg/test/resources/builders/meshservice_builder.go b/pkg/test/resources/builders/meshservice_builder.go
index b1f6c00f9..10e83b84c 100644
--- a/pkg/test/resources/builders/meshservice_builder.go
+++ b/pkg/test/resources/builders/meshservice_builder.go
@@ -76,6 +76,19 @@ func (m *MeshServiceBuilder) AddIntPort(port, target uint32, protocol core_mesh.
 	return m
 }
 
+func (m *MeshServiceBuilder) AddIntPortWithName(port, target uint32, protocol core_mesh.Protocol, name string) *MeshServiceBuilder {
+	m.res.Spec.Ports = append(m.res.Spec.Ports, v1alpha1.Port{
+		Port: port,
+		TargetPort: intstr.IntOrString{
+			Type:   intstr.Int,
+			IntVal: int32(target),
+		},
+		AppProtocol: protocol,
+		Name:        name,
+	})
+	return m
+}
+
 func (m *MeshServiceBuilder) AddServiceTagIdentity(identity string) *MeshServiceBuilder {
 	m.res.Spec.Identities = append(m.res.Spec.Identities, v1alpha1.MeshServiceIdentity{
 		Type:  v1alpha1.MeshServiceIdentityServiceTagType,
diff --git a/test/e2e_env/kubernetes/gateway/cross-mesh.go b/test/e2e_env/kubernetes/gateway/cross-mesh.go
index 1a6cfa201..cc29724f8 100644
--- a/test/e2e_env/kubernetes/gateway/cross-mesh.go
+++ b/test/e2e_env/kubernetes/gateway/cross-mesh.go
@@ -138,7 +138,7 @@ func CrossMeshGatewayOnKubernetes() {
 				kubernetes.Cluster,
 				gatewayAddr,
 				gatewayClientOutsideMesh,
-			), "1m", "1s").Should(Succeed())
+			), "10s", "1s").Should(Succeed())
 		})
 
 		It("HTTP requests to a non-crossMesh gateway should still be proxied", func() {
diff --git a/test/e2e_env/kubernetes/gateway/delegated/meshpassthrough.go b/test/e2e_env/kubernetes/gateway/delegated/meshpassthrough.go
index d817861e1..4ed0c5cdd 100644
--- a/test/e2e_env/kubernetes/gateway/delegated/meshpassthrough.go
+++ b/test/e2e_env/kubernetes/gateway/delegated/meshpassthrough.go
@@ -137,7 +137,7 @@ spec:
 				)
 				g.Expect(err).ToNot(HaveOccurred())
 				g.Expect(resp.ResponseCode).To(Equal(502))
-			}, "30s", "1s", MustPassRepeatedly(3)).Should(Succeed())
+			}, "10s", "1s").Should(Succeed())
 		})
 	}
 }
diff --git a/test/e2e_env/kubernetes/gateway/gateway.go b/test/e2e_env/kubernetes/gateway/gateway.go
index a351f80c7..09732d6cd 100644
--- a/test/e2e_env/kubernetes/gateway/gateway.go
+++ b/test/e2e_env/kubernetes/gateway/gateway.go
@@ -470,7 +470,7 @@ spec:
 
 					g.Expect(err).ToNot(HaveOccurred())
 					g.Expect(status.ResponseCode).To(Equal(404))
-				}, "30s", "1s").Should(Succeed())
+				}, "10s", "1s").Should(Succeed())
 			})
 		})
 	}
@@ -730,7 +730,7 @@ spec:
 					client.FromKubernetesPod(clientNamespace, "demo-client"),
 				)
 				g.Expect(err).ToNot(HaveOccurred())
-			}, "30s", "1s", MustPassRepeatedly(5)).Should(Succeed())
+			}, "10s", "1s").Should(Succeed())
 		})
 	})
 
diff --git a/test/e2e_env/kubernetes/meshmetric/meshmetric.go b/test/e2e_env/kubernetes/meshmetric/meshmetric.go
index f85dcb7b4..bffd1ac9f 100644
--- a/test/e2e_env/kubernetes/meshmetric/meshmetric.go
+++ b/test/e2e_env/kubernetes/meshmetric/meshmetric.go
@@ -357,28 +357,29 @@ func MeshMetric() {
 					otelcollector.WithIPv6(Config.IPV6),
 				),
 				democlient.Install(democlient.WithNamespace(secondaryOpenTelemetryCollectorNamespace)),
-			)).
-			Setup(kubernetes.Cluster)
-		Expect(err).To(Succeed())
-
-		for i := 0; i < 2; i++ {
-			Expect(
-				kubernetes.Cluster.Install(testserver.Install(
-					testserver.WithName(fmt.Sprintf("test-server-%d", i)),
+				testserver.Install(
+					testserver.WithName("test-server-0"),
 					testserver.WithMesh(mainMesh),
 					testserver.WithNamespace(namespace),
-				)),
-			).To(Succeed())
-		}
-		for i := 2; i < 4; i++ {
-			Expect(
-				kubernetes.Cluster.Install(testserver.Install(
-					testserver.WithName(fmt.Sprintf("test-server-%d", i)),
+				),
+				testserver.Install(
+					testserver.WithName("test-server-1"),
+					testserver.WithMesh(mainMesh),
+					testserver.WithNamespace(namespace),
+				),
+				testserver.Install(
+					testserver.WithName("test-server-2"),
 					testserver.WithMesh(secondaryMesh),
 					testserver.WithNamespace(namespace),
-				)),
-			).To(Succeed())
-		}
+				),
+				testserver.Install(
+					testserver.WithName("test-server-3"),
+					testserver.WithMesh(secondaryMesh),
+					testserver.WithNamespace(namespace),
+				),
+			)).
+			Setup(kubernetes.Cluster)
+		Expect(err).To(Succeed())
 	})
 
 	AfterEachFailure(func() {
diff --git a/test/e2e_env/universal/meshretry/grpc.go b/test/e2e_env/universal/meshretry/grpc.go
index 156555338..fb501f0a7 100644
--- a/test/e2e_env/universal/meshretry/grpc.go
+++ b/test/e2e_env/universal/meshretry/grpc.go
@@ -28,8 +28,6 @@ func GrpcRetry() {
 				WithProtocol("grpc"),
 				WithTransparentProxy(true),
 			)).
-			// remove default policies after https://github.com/kumahq/kuma/issues/3325
-			Install(TrafficRouteUniversal(meshName)).
 			Setup(universal.Cluster)
 		Expect(err).ToNot(HaveOccurred())
 
@@ -45,23 +43,27 @@ func GrpcRetry() {
 
 	E2EAfterAll(func() {
 		Expect(universal.Cluster.DeleteMeshApps(meshName)).To(Succeed())
-		Expect(universal.Cluster.GetKumactlOptions().RunKumactl("delete", "dataplane", "fake-echo-server", "-m", meshName)).To(Succeed())
 		Expect(universal.Cluster.DeleteMesh(meshName)).To(Succeed())
 	})
 
 	It("should retry on GRPC connection failure", func() {
-		echoServerDataplane := fmt.Sprintf(`
-type: Dataplane
+		faultInjection := fmt.Sprintf(`
+type: MeshFaultInjection
 mesh: "%s"
-name: fake-echo-server
-networking:
-  address:  241.0.0.1
-  inbound:
-  - port: 7777
-    servicePort: 7777
-    tags:
-      kuma.io/service: test-server
-      kuma.io/protocol: grpc
+name: mesh-fault-injecton-500-grpc
+spec:
+  targetRef:
+    kind: MeshService
+    name: test-server
+  from:
+    - targetRef:
+        kind: MeshService
+        name: test-client
+      default:
+        http:
+          - abort:
+              httpStatus: 503
+              percentage: "50.0"
 `, meshName)
 		meshRetryPolicy := fmt.Sprintf(`
 type: MeshRetry
@@ -100,8 +102,8 @@ spec:
 			g.Expect(grpcSuccessStats(g)).To(stats.BeGreaterThanZero())
 		}, "30s", "1s").Should(Succeed())
 
-		By("Adding a faulty dataplane")
-		Expect(universal.Cluster.Install(YamlUniversal(echoServerDataplane))).To(Succeed())
+		By("Adding a fault injection")
+		Expect(universal.Cluster.Install(YamlUniversal(faultInjection))).To(Succeed())
 
 		By("Clean counters")
 		Expect(admin.ResetCounters()).To(Succeed())
@@ -112,7 +114,7 @@ spec:
 			defer func() { lastFailureStats = failureStats.Stats[0] }()
 			g.Expect(failureStats).To(stats.BeGreaterThanZero())
 			g.Expect(failureStats).To(stats.BeGreaterThan(lastFailureStats))
-		}, "60s", "5s").MustPassRepeatedly(3).Should(Succeed())
+		}, "30s", "5s").Should(Succeed())
 
 		By("Apply a MeshRetry policy")
 		Expect(universal.Cluster.Install(YamlUniversal(meshRetryPolicy))).To(Succeed())
@@ -127,6 +129,6 @@ spec:
 			defer func() { lastFailureStats = failureStats.Stats[0] }()
 			g.Expect(failureStats).To(Not(stats.BeGreaterThan(lastFailureStats)))
 			g.Expect(grpcSuccessStats(g)).To(stats.BeGreaterThanZero())
-		}, "30s", "5s").MustPassRepeatedly(3).Should(Succeed())
+		}, "30s", "5s").Should(Succeed())
 	})
 }
diff --git a/test/e2e_env/universal/retry/retry.go b/test/e2e_env/universal/retry/retry.go
index 32f84b53d..b191be104 100644
--- a/test/e2e_env/universal/retry/retry.go
+++ b/test/e2e_env/universal/retry/retry.go
@@ -2,7 +2,6 @@ package retry
 
 import (
 	"fmt"
-	"time"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -36,24 +35,25 @@ func Policy() {
 
 	E2EAfterAll(func() {
 		Expect(universal.Cluster.DeleteMeshApps(meshName)).To(Succeed())
-		Expect(universal.Cluster.GetKumactlOptions().RunKumactl("delete", "dataplane", "fake-echo-server", "-m", meshName)).To(Succeed())
 		Expect(universal.Cluster.DeleteMesh(meshName)).To(Succeed())
 	})
 
 	It("should retry on HTTP connection failure", func() {
-		echoServerDataplane := fmt.Sprintf(`
-type: Dataplane
+		fiPolicy := fmt.Sprintf(`
+type: FaultInjection
 mesh: "%s"
-name: fake-echo-server
-networking:
-  address:  241.0.0.1
-  inbound:
-  - port: 7777
-    servicePort: 7777
-    tags:
-      kuma.io/service: test-server
-      kuma.io/protocol: http
-`, meshName)
+name: fi-retry
+sources:
+   - match:
+       kuma.io/service: demo-client
+destinations:
+   - match:
+       kuma.io/service: test-server
+       kuma.io/protocol: http
+conf:
+   abort:
+     httpStatus: 500
+     percentage: 50`, meshName)
 		retryPolicy := fmt.Sprintf(`
 type: Retry
 mesh: "%s"
@@ -75,32 +75,22 @@ conf:
 				universal.Cluster, "demo-client", "test-server.mesh",
 			)
 			g.Expect(err).ToNot(HaveOccurred())
-		}).Should(Succeed())
-		Consistently(func(g Gomega) {
-			// -m 8 to wait for 8 seconds to beat the default 5s connect timeout
-			_, err := client.CollectEchoResponse(
-				universal.Cluster, "demo-client", "test-server.mesh",
-				client.WithMaxTime(8),
-			)
-			g.Expect(err).ToNot(HaveOccurred())
-		}).Should(Succeed())
+		}, "30s", "1s").MustPassRepeatedly(3).Should(Succeed())
 
-		By("Adding a faulty dataplane")
-		Expect(universal.Cluster.Install(YamlUniversal(echoServerDataplane))).To(Succeed())
+		By("Adding a fault injection")
+		Expect(universal.Cluster.Install(YamlUniversal(fiPolicy))).To(Succeed())
 
 		By("Check some errors happen")
-		var errs []error
-		for i := 0; i < 50; i++ {
-			time.Sleep(time.Millisecond * 100)
-			_, err := client.CollectEchoResponse(
+		Eventually(func(g Gomega) {
+			response, err := client.CollectFailure(
 				universal.Cluster, "demo-client", "test-server.mesh",
-				client.WithMaxTime(8),
+				client.NoFail(),
+				client.OutputFormat(`{ "received": { "status": %{response_code} } }`),
 			)
-			if err != nil {
-				errs = append(errs, err)
-			}
-		}
-		Expect(errs).ToNot(BeEmpty())
+
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(response.ResponseCode).To(Equal(500))
+		}, "30s", "100ms").Should(Succeed())
 
 		By("Apply a retry policy")
 		Expect(universal.Cluster.Install(YamlUniversal(retryPolicy))).To(Succeed())
@@ -109,9 +99,8 @@ conf:
 		Eventually(func(g Gomega) {
 			_, err := client.CollectEchoResponse(
 				universal.Cluster, "demo-client", "test-server.mesh",
-				client.WithMaxTime(8),
 			)
 			g.Expect(err).ToNot(HaveOccurred())
-		}, "1m", "1s", MustPassRepeatedly(3)).Should(Succeed())
+		}, "60s", "1s").MustPassRepeatedly(3).Should(Succeed())
 	})
 }