Repository: kumahq/kuma
Pull request #11399 (2024-09-12 11:11:14)

fix(k8s): always authenticate with latest service account token
### Checklist prior to review

<!--
Each of these sections need to be filled by the author when opening the PR.

If something doesn't apply please check the box and add a justification after the `--`
-->

- [x] [Link to relevant issue][1] as well as docs and UI issues --
- [x] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS --
- [x] Tests (Unit test, E2E tests, manual test on universal and k8s) --
  - Don't forget `ci/` labels to run additional/fewer tests
- [x] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)? --
- [x] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label) --

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword



Patch:
diff --git a/app/kumactl/cmd/install/install_transparent_proxy.go b/app/kumactl/cmd/install/install_transparent_proxy.go
index d25c13a01..a7c20cf92 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy.go
@@ -25,6 +25,8 @@ const (
 	flagTransparentProxyConfig     = "config"
 	flagTransparentProxyConfigFile = "config-file"
 	flagIptablesExecutables        = "iptables-executables"
+	flagRedirectDNS                = "redirect-dns"
+	flagRedirectAllDNSTraffic      = "redirect-all-dns-traffic"
 )
 
 const (
@@ -113,7 +115,8 @@ runuser -u kuma-dp -- \
 
 			parseConfigFlags := func(flag *pflag.Flag, value string) error {
 				switch flag.Name {
-				case flagHelp, flagDryRun, flagTransparentProxyConfig, flagTransparentProxyConfigFile:
+				case flagHelp, flagDryRun, flagTransparentProxyConfig, flagTransparentProxyConfigFile,
+					flagRedirectDNS, flagRedirectAllDNSTraffic:
 					return flag.Value.Set(value)
 				default:
 					return nil
@@ -153,6 +156,14 @@ runuser -u kuma-dp -- \
 				)
 			}
 
+			if cfg.Redirect.DNS.Enabled && cfg.Redirect.DNS.CaptureAll {
+				return errors.Errorf(
+					"only one of '--%s' or '--%s' should be specified",
+					flagRedirectDNS,
+					flagRedirectAllDNSTraffic,
+				)
+			}
+
 			// After parsing the config flags, we load the configuration, which involves parsing
 			// the provided YAML or JSON, and including environment variables if present
 			if err := cfgLoader.Load(cmd.InOrStdin(), []byte(configValue), configFile); err != nil {
@@ -166,10 +177,6 @@ runuser -u kuma-dp -- \
 				return err
 			}
 
-			if cfg.Redirect.DNS.CaptureAll && cfg.Redirect.DNS.Enabled {
-				return errors.Errorf("one of --redirect-dns or --redirect-all-dns-traffic should be specified")
-			}
-
 			if cfg.Redirect.DNS.CaptureAll {
 				cfg.Redirect.DNS.Enabled = true
 			}
@@ -227,8 +234,8 @@ runuser -u kuma-dp -- \
 	cmd.Flags().Var(&cfg.Redirect.Outbound.ExcludePorts, "exclude-outbound-ports", "a comma separated list of outbound ports to exclude from redirect to Envoy")
 	cmd.Flags().StringVar(&cfg.KumaDPUser, "kuma-dp-user", cfg.KumaDPUser, fmt.Sprintf("the username or UID of the user that will run kuma-dp. If not provided, the system will search for a user with the default UID ('%s') or the default username ('%s')", consts.OwnerDefaultUID, consts.OwnerDefaultUsername))
 	cmd.Flags().StringVar(&cfg.KumaDPUser, "kuma-dp-uid", cfg.KumaDPUser, "the uid of the user that will run kuma-dp")
-	cmd.Flags().BoolVar(&cfg.Redirect.DNS.Enabled, "redirect-dns", cfg.Redirect.DNS.Enabled, "redirect only DNS requests targeted to the servers listed in /etc/resolv.conf to a specified port")
-	cmd.Flags().BoolVar(&cfg.Redirect.DNS.CaptureAll, "redirect-all-dns-traffic", cfg.Redirect.DNS.CaptureAll, "redirect all DNS traffic to a specified port, unlike --redirect-dns this will not be limited to the dns servers identified in /etc/resolve.conf")
+	cmd.Flags().BoolVar(&cfg.Redirect.DNS.Enabled, flagRedirectDNS, cfg.Redirect.DNS.Enabled, "redirect only DNS requests targeted to the servers listed in /etc/resolv.conf to a specified port")
+	cmd.Flags().BoolVar(&cfg.Redirect.DNS.CaptureAll, flagRedirectAllDNSTraffic, cfg.Redirect.DNS.CaptureAll, "redirect all DNS traffic to a specified port, unlike --redirect-dns this will not be limited to the dns servers identified in /etc/resolve.conf")
 	cmd.Flags().Var(&cfg.Redirect.DNS.Port, "redirect-dns-port", "the port where the DNS agent is listening")
 	cmd.Flags().StringVar(&cfg.Redirect.DNS.UpstreamTargetChain, "redirect-dns-upstream-target-chain", cfg.Redirect.DNS.UpstreamTargetChain, "(optional) the iptables chain where the upstream DNS requests should be directed to. It is only applied for IP V4. Use with care.")
 	cmd.Flags().BoolVar(&cfg.StoreFirewalld, "store-firewalld", cfg.StoreFirewalld, "store the iptables changes with firewalld")
diff --git a/pkg/api-server/resource_endpoints.go b/pkg/api-server/resource_endpoints.go
index 182d68fb7..8f8941a9f 100644
--- a/pkg/api-server/resource_endpoints.go
+++ b/pkg/api-server/resource_endpoints.go
@@ -397,7 +397,11 @@ func (r *resourceEndpoints) createResource(
 		_ = res.SetStatus(resRest.GetStatus())
 	}
 
-	labels := model.ComputeLabels(res, r.mode, false, r.systemNamespace, r.zoneName)
+	labels, err := model.ComputeLabels(res, r.mode, false, r.systemNamespace, r.zoneName)
+	if err != nil {
+		rest_errors.HandleError(ctx, response, err, "Could not compute labels for a resource")
+		return
+	}
 
 	if err := r.resManager.Create(ctx, res, store.CreateByKey(name, meshName), store.CreateWithLabels(labels)); err != nil {
 		rest_errors.HandleError(ctx, response, err, "Could not create a resource")
diff --git a/pkg/config/dp-server/config.go b/pkg/config/dp-server/config.go
index 8f02c1887..8c07d4dd7 100644
--- a/pkg/config/dp-server/config.go
+++ b/pkg/config/dp-server/config.go
@@ -88,6 +88,7 @@ type DpServerAuthnConfig struct {
 	// Configuration for zone proxy authentication.
 	ZoneProxy ZoneProxyAuthnConfig `json:"zoneProxy"`
 	// If true then Envoy uses Google gRPC instead of Envoy gRPC which lets a proxy reload the auth data (service account token, dp token etc.) from path without proxy restart.
+	// This is enabled on Kubernetes.
 	EnableReloadableTokens bool `json:"enableReloadableTokens" envconfig:"kuma_dp_server_authn_enable_reloadable_tokens"`
 }
 
diff --git a/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/helpers.go b/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/helpers.go
index 55b61749d..9a4213631 100644
--- a/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/helpers.go
+++ b/pkg/core/resources/apis/meshexternalservice/api/v1alpha1/helpers.go
@@ -1,6 +1,8 @@
 package v1alpha1
 
 import (
+	"fmt"
+
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/core/vip"
 	"github.com/kumahq/kuma/pkg/core/resources/model"
@@ -9,7 +11,11 @@ import (
 )
 
 func (m *MeshExternalServiceResource) DestinationName(port uint32) string {
-	return m.GetMeta().GetName()
+	id := model.NewResourceIdentifier(m)
+	if port == 0 {
+		port = uint32(m.Spec.Match.Port)
+	}
+	return fmt.Sprintf("%s_%s_%s_%s_extsvc_%d", id.Mesh, id.Name, id.Namespace, id.Zone, port)
 }
 
 func (m *MeshExternalServiceResource) IsReachableFromZone(zone string) bool {
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
index 8fdceceaf..3ec32196a 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
@@ -2,7 +2,6 @@ package v1alpha1
 
 import (
 	"fmt"
-	"strings"
 
 	core_vip "github.com/kumahq/kuma/pkg/core/resources/apis/core/vip"
 	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
@@ -49,7 +48,8 @@ func (m *MeshMultiZoneServiceResource) FindPortByName(name string) (meshservice_
 }
 
 func (m *MeshMultiZoneServiceResource) DestinationName(port uint32) string {
-	return fmt.Sprintf("%s_mzsvc_%d", strings.ReplaceAll(m.GetMeta().GetName(), ".", "_"), port)
+	id := model.NewResourceIdentifier(m)
+	return fmt.Sprintf("%s_%s_%s_%s_mzsvc_%d", id.Mesh, id.Name, id.Namespace, id.Zone, port)
 }
 
 func (m *MeshMultiZoneServiceResource) AsOutbounds() xds_types.Outbounds {
diff --git a/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go b/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go
index c84676f47..920c865ce 100644
--- a/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go
+++ b/pkg/core/resources/apis/meshservice/api/v1alpha1/helpers.go
@@ -2,7 +2,6 @@ package v1alpha1
 
 import (
 	"fmt"
-	"strings"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_vip "github.com/kumahq/kuma/pkg/core/resources/apis/core/vip"
@@ -12,7 +11,8 @@ import (
 )
 
 func (m *MeshServiceResource) DestinationName(port uint32) string {
-	return fmt.Sprintf("%s_msvc_%d", strings.ReplaceAll(m.GetMeta().GetName(), ".", "_"), port)
+	id := model.NewResourceIdentifier(m)
+	return fmt.Sprintf("%s_%s_%s_%s_msvc_%d", id.Mesh, id.Name, id.Namespace, id.Zone, port)
 }
 
 func (m *MeshServiceResource) FindPort(port uint32) (Port, bool) {
diff --git a/pkg/core/resources/model/resource.go b/pkg/core/resources/model/resource.go
index 49a58e192..c765e84cd 100644
--- a/pkg/core/resources/model/resource.go
+++ b/pkg/core/resources/model/resource.go
@@ -14,6 +14,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	config_core "github.com/kumahq/kuma/pkg/config/core"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/metadata"
+	"github.com/kumahq/kuma/pkg/util/pointer"
 )
 
 const (
@@ -455,7 +456,7 @@ func resourceOrigin(labels map[string]string) (mesh_proto.ResourceOrigin, bool)
 	return "", false
 }
 
-func ComputeLabels(r Resource, mode config_core.CpMode, isK8s bool, systemNamespace string, localZone string) map[string]string {
+func ComputeLabels(r Resource, mode config_core.CpMode, isK8s bool, systemNamespace string, localZone string) (map[string]string, error) {
 	labels := r.GetMeta().GetLabels()
 	if len(labels) == 0 {
 		labels = map[string]string{}
@@ -497,21 +498,25 @@ func ComputeLabels(r Resource, mode config_core.CpMode, isK8s bool, systemNamesp
 		}
 	}
 
-	if ns, ok := r.GetMeta().GetNameExtensions()[mesh_proto.KubeNamespaceTag]; ok && r.Descriptor().IsPolicy && r.Descriptor().IsPluginOriginated {
+	if ns, ok := r.GetMeta().GetNameExtensions()[mesh_proto.KubeNamespaceTag]; ok && r.Descriptor().IsPolicy && r.Descriptor().IsPluginOriginated && IsLocallyOriginated(mode, labels) {
 		var role mesh_proto.PolicyRole
 		switch ns {
 		case systemNamespace:
 			role = mesh_proto.SystemPolicyRole
 		default:
-			role = ComputePolicyRole(r.GetSpec().(Policy))
+			var err error
+			role, err = ComputePolicyRole(r.GetSpec().(Policy), ns)
+			if err != nil {
+				return nil, err
+			}
 		}
-		setIfNotExist(mesh_proto.PolicyRoleLabel, string(role))
+		labels[mesh_proto.PolicyRoleLabel] = string(role)
 	}
 
-	return labels
+	return labels, nil
 }
 
-func ComputePolicyRole(p Policy) mesh_proto.PolicyRole {
+func ComputePolicyRole(p Policy, ns string) (mesh_proto.PolicyRole, error) {
 	hasTo := false
 	if pwtl, ok := p.(PolicyWithToList); ok && len(pwtl.GetToList()) > 0 {
 		hasTo = true
@@ -522,11 +527,29 @@ func ComputePolicyRole(p Policy) mesh_proto.PolicyRole {
 		hasFrom = true
 	}
 
-	if hasTo && !hasFrom {
-		// todo(lobkovilya): detect if the policy is a producer policy when they're supported
-		return mesh_proto.ConsumerPolicyRole
-	} else {
-		return mesh_proto.WorkloadOwnerPolicyRole
+	if hasFrom || !(hasTo || hasFrom) {
+		// if there is 'from' or neither (single item)
+		return mesh_proto.WorkloadOwnerPolicyRole, nil
+	}
+
+	isProducerItem := func(tr common_api.TargetRef) bool {
+		return tr.Kind == common_api.MeshService && tr.Name != "" && (tr.Namespace == "" || tr.Namespace == ns)
+	}
+
+	producerItems := 0
+	for _, item := range p.(PolicyWithToList).GetToList() {
+		if isProducerItem(item.GetTargetRef()) {
+			producerItems++
+		}
+	}
+
+	switch {
+	case producerItems == len(p.(PolicyWithToList).GetToList()):
+		return mesh_proto.ProducerPolicyRole, nil
+	case producerItems == 0:
+		return mesh_proto.ConsumerPolicyRole, nil
+	default:
+		return "", errors.New("it's not allowed to mix producer and consumer items in the same policy")
 	}
 }
 
@@ -718,6 +741,18 @@ func TargetRefToResourceIdentifier(meta ResourceMeta, tr common_api.TargetRef) R
 	}
 }
 
+func ResourceToBackendRef(r Resource, resType ResourceType, port uint32) common_api.BackendRef {
+	id := NewResourceIdentifier(r)
+	return common_api.BackendRef{
+		TargetRef: common_api.TargetRef{
+			Kind:      common_api.TargetRefKind(resType),
+			Name:      id.Name,
+			Namespace: id.Namespace,
+		},
+		Port: pointer.To(port),
+	}
+}
+
 type LabelResourceIdentifierResolver func(ResourceType, map[string]string) *ResourceIdentifier
 
 func ResolveBackendRef(meta ResourceMeta, br common_api.BackendRef, resolver LabelResourceIdentifierResolver) *ResolvedBackendRef {
diff --git a/pkg/kds/context/context.go b/pkg/kds/context/context.go
index 5d0af7176..519092cac 100644
--- a/pkg/kds/context/context.go
+++ b/pkg/kds/context/context.go
@@ -13,6 +13,7 @@ import (
 	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
+	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	system_proto "github.com/kumahq/kuma/api/system/v1alpha1"
 	kuma_cp "github.com/kumahq/kuma/pkg/config/app/kuma-cp"
@@ -266,7 +267,36 @@ func GlobalProvidedFilter(rm manager.ResourceManager, configs map[string]bool) r
 			return util.ResourceNameHasAtLeastOneOfPrefixes(resName, []string{
 				zone_tokens.SigningKeyPrefix,
 			}...)
-		case r.Descriptor().KDSFlags.Has(core_model.GlobalToAllButOriginalZoneFlag):
+		}
+
+		isGlobal := core_model.IsLocallyOriginated(config_core.Global, r.GetMeta().GetLabels())
+
+		switch {
+		case isGlobal && r.Descriptor().KDSFlags.Has(core_model.GlobalToAllZonesFlag):
+			return true
+		case !isGlobal && r.Descriptor().KDSFlags.Has(core_model.GlobalToAllButOriginalZoneFlag):
+			if r.Descriptor().IsPluginOriginated && r.Descriptor().IsPolicy {
+				if !features.HasFeature(kds.FeatureProducerPolicyFlow) {
+					return false
+				}
+				policy := r.GetSpec().(core_model.Policy)
+				role, err := core_model.ComputePolicyRole(policy, r.GetMeta().GetLabels()[mesh_proto.KubeNamespaceTag])
+				if err != nil {
+					ri := core_model.NewResourceIdentifier(r)
+					log.V(1).Info(err.Error(), "name", ri.Name, "mesh", ri.Mesh, "zone", ri.Zone, "namespace", ri.Namespace)
+					return false
+				}
+				if role != mesh_proto.ProducerPolicyRole {
+					return false
+				}
+				if policy.GetTargetRef().Kind == common_api.MeshSubset {
+					// if top-level targetRef has 'kuma.io/zone' then we can sync it only to required zone
+					if targetZone, ok := policy.GetTargetRef().Tags[mesh_proto.ZoneTag]; ok && targetZone != clusterID {
+						return false
+					}
+				}
+			}
+
 			// TODO (Icarus9913): replace the function by model.ZoneOfResource(r)
 			// Reference: https://github.com/kumahq/kuma/issues/10952
 			zoneTag := util.ZoneTag(r)
@@ -283,11 +313,10 @@ func GlobalProvidedFilter(rm manager.ResourceManager, configs map[string]bool) r
 				// make any strong decisions which might affect connectivity
 				return true
 			}
-
 			return zone.Spec.IsEnabled()
-		default:
-			return core_model.IsLocallyOriginated(config_core.Global, r.GetMeta().GetLabels())
 		}
+
+		return false
 	}
 }
 
diff --git a/pkg/kds/features.go b/pkg/kds/features.go
index 0c5f88f90..60bf78eb8 100644
--- a/pkg/kds/features.go
+++ b/pkg/kds/features.go
@@ -34,6 +34,9 @@ const FeatureHashSuffix string = "hash-suffix"
 // Otherwise, the zone control plane would reject all hostname generators
 const FeatureHostnameGeneratorMzSelector string = "hg-mz-selector"
 
+// FeatureProducerPolicyFlow means that the zone control plane supports the producer policy flow.
+const FeatureProducerPolicyFlow string = "producer-policy-flow"
+
 func ContextHasFeature(ctx context.Context, feature string) bool {
 	md, _ := metadata.FromIncomingContext(ctx)
 	features := md.Get(FeaturesMetadataKey)
diff --git a/pkg/kds/v2/client/stream.go b/pkg/kds/v2/client/stream.go
index cd7f6b485..d15153cab 100644
--- a/pkg/kds/v2/client/stream.go
+++ b/pkg/kds/v2/client/stream.go
@@ -78,6 +78,7 @@ func (s *stream) DeltaDiscoveryRequest(resourceType core_model.ResourceType) err
 							{Kind: &structpb.Value_StringValue{StringValue: kds.FeatureZoneToken}},
 							{Kind: &structpb.Value_StringValue{StringValue: kds.FeatureHashSuffix}},
 							{Kind: &structpb.Value_StringValue{StringValue: kds.FeatureHostnameGeneratorMzSelector}},
+							{Kind: &structpb.Value_StringValue{StringValue: kds.FeatureProducerPolicyFlow}},
 						},
 					}}},
 				},
diff --git a/pkg/plugins/policies/core/xds/meshroute/clusters.go b/pkg/plugins/policies/core/xds/meshroute/clusters.go
index c656be9ef..bc4f6aa0b 100644
--- a/pkg/plugins/policies/core/xds/meshroute/clusters.go
+++ b/pkg/plugins/policies/core/xds/meshroute/clusters.go
@@ -15,7 +15,6 @@ import (
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_clusters "github.com/kumahq/kuma/pkg/xds/envoy/clusters"
-	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
 	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 	"github.com/kumahq/kuma/pkg/xds/generator"
@@ -39,7 +38,6 @@ func GenerateClusters(
 			edsClusterBuilder := envoy_clusters.NewClusterBuilder(proxy.APIVersion, clusterName)
 
 			clusterTags := []envoy_tags.Tags{cluster.Tags()}
-
 			if meshCtx.IsExternalService(serviceName) {
 				if meshCtx.Resource.ZoneEgressEnabled() {
 					endpoints := meshCtx.EndpointMap[serviceName]
@@ -71,7 +69,7 @@ func GenerateClusters(
 					edsClusterBuilder.
 						Configure(envoy_clusters.ProvidedCustomEndpointCluster(isIPv6, isMeshExternalService(endpoints), endpoints...))
 					if isMeshExternalService(endpoints) {
-						edsClusterBuilder.WithName(envoy_names.GetMeshExternalServiceName(serviceName))
+						edsClusterBuilder.WithName(serviceName)
 						edsClusterBuilder.Configure(
 							envoy_clusters.MeshExternalServiceClientSideTLS(endpoints, proxy.Metadata.SystemCaPath, true),
 						)
diff --git a/pkg/plugins/policies/core/xds/meshroute/listeners.go b/pkg/plugins/policies/core/xds/meshroute/listeners.go
index b293e8a09..c22b6bea8 100644
--- a/pkg/plugins/policies/core/xds/meshroute/listeners.go
+++ b/pkg/plugins/policies/core/xds/meshroute/listeners.go
@@ -13,7 +13,6 @@ import (
 	"github.com/kumahq/kuma/pkg/util/pointer"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
-	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
 	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
@@ -138,14 +137,18 @@ func collectMeshExternalService(
 	if !mesOk {
 		return nil
 	}
+	protocol := core_mesh.Protocol(core_mesh.ProtocolTCP)
+	if mes.Spec.Match.Protocol != "" {
+		protocol = mes.Spec.Match.Protocol
+	}
 	return &DestinationService{
+		Protocol: protocol,
 		OutboundInterface: mesh_proto.OutboundInterface{
 			DataplaneIP:   outbound.GetAddress(),
 			DataplanePort: outbound.GetPort(),
 		},
 		Tags:        outbound.LegacyOutbound.GetTags(),
 		Resource:    outbound.Resource,
-		Protocol:    mes.Spec.Match.Protocol,
 		ServiceName: mes.DestinationName(uint32(mes.Spec.Match.Port)),
 		BackendRef: common_api.BackendRef{
 			TargetRef: common_api.TargetRef{
@@ -227,6 +230,10 @@ func GetServiceAndProtocolFromRef(
 			return "", "", false
 		}
 		port := pointer.Deref(ref.LegacyBackendRef.Port)
+		// if backendRef has no port, get the one from MeshExternalService since match allows only 1 port
+		if port == 0 {
+			port = uint32(mes.Spec.Match.Port)
+		}
 		service := mes.DestinationName(port)
 		protocol := meshCtx.GetServiceProtocol(service)
 		return service, protocol, true
@@ -293,7 +300,7 @@ func makeSplit(
 		var clusterName string
 		switch ref.LegacyBackendRef.Kind {
 		case common_api.MeshExternalService:
-			clusterName = envoy_names.GetMeshExternalServiceName(ref.LegacyBackendRef.Name) // todo shouldn't this be in destination name?
+			clusterName = meshCtx.MeshExternalServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(pointer.Deref(ref.LegacyBackendRef.Port))
 		case common_api.MeshMultiZoneService:
 			clusterName = meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(*ref.LegacyBackendRef.Port)
 		case common_api.MeshService:
diff --git a/pkg/plugins/policies/donothingpolicy/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/donothingpolicy/api/v1alpha1/zz_generated.resource.go
index adbe26435..ac8ef0682 100644
--- a/pkg/plugins/policies/donothingpolicy/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/donothingpolicy/api/v1alpha1/zz_generated.resource.go
@@ -136,7 +136,7 @@ var DoNothingPolicyResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewDoNothingPolicyResource(),
 	ResourceList:                 &DoNothingPolicyResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "donothingpolicies",
 	KumactlArg:                   "donothingpolicy",
 	KumactlListArg:               "donothingpolicies",
diff --git a/pkg/plugins/policies/meshaccesslog/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshaccesslog/api/v1alpha1/zz_generated.resource.go
index 5b274aebc..4532c51d4 100644
--- a/pkg/plugins/policies/meshaccesslog/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshaccesslog/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshAccessLogResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshAccessLogResource(),
 	ResourceList:                 &MeshAccessLogResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshaccesslogs",
 	KumactlArg:                   "meshaccesslog",
 	KumactlListArg:               "meshaccesslogs",
diff --git a/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/zz_generated.resource.go
index c13935bc3..2fb4ba482 100644
--- a/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshCircuitBreakerResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshCircuitBreakerResource(),
 	ResourceList:                 &MeshCircuitBreakerResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshcircuitbreakers",
 	KumactlArg:                   "meshcircuitbreaker",
 	KumactlListArg:               "meshcircuitbreakers",
diff --git a/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin.go
index d2ff58d02..5e8896562 100644
--- a/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin.go
@@ -186,7 +186,8 @@ func applyToEgressRealResources(rs *core_xds.ResourceSet, proxy *core_xds.Proxy)
 	for _, meshResources := range proxy.ZoneEgressProxy.MeshResourcesList {
 		meshExternalServices := meshResources.ListOrEmpty(meshexternalservice_api.MeshExternalServiceType)
 		for _, mes := range meshExternalServices.GetItems() {
-			policies, ok := meshResources.Dynamic[mes.GetMeta().GetName()]
+			meshExtSvc := mes.(*meshexternalservice_api.MeshExternalServiceResource)
+			policies, ok := meshResources.Dynamic[meshExtSvc.DestinationName(uint32(meshExtSvc.Spec.Match.Port))]
 			if !ok {
 				continue
 			}
diff --git a/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/zz_generated.resource.go
index 78b4c24a0..6d481291d 100644
--- a/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshfaultinjection/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshFaultInjectionResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshFaultInjectionResource(),
 	ResourceList:                 &MeshFaultInjectionResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshfaultinjections",
 	KumactlArg:                   "meshfaultinjection",
 	KumactlListArg:               "meshfaultinjections",
diff --git a/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/zz_generated.resource.go
index 8da7d722e..32fb69265 100644
--- a/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshhealthcheck/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshHealthCheckResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshHealthCheckResource(),
 	ResourceList:                 &MeshHealthCheckResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshhealthchecks",
 	KumactlArg:                   "meshhealthcheck",
 	KumactlListArg:               "meshhealthchecks",
diff --git a/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin.go
index 4f9c93294..fa56378ab 100644
--- a/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin.go
@@ -171,7 +171,8 @@ func applyToEgressRealResources(rs *core_xds.ResourceSet, proxy *core_xds.Proxy)
 	for _, meshResources := range proxy.ZoneEgressProxy.MeshResourcesList {
 		meshExternalServices := meshResources.ListOrEmpty(meshexternalservice_api.MeshExternalServiceType)
 		for _, mes := range meshExternalServices.GetItems() {
-			policies, ok := meshResources.Dynamic[mes.GetMeta().GetName()]
+			meshExtSvc := mes.(*meshexternalservice_api.MeshExternalServiceResource)
+			policies, ok := meshResources.Dynamic[meshExtSvc.DestinationName(uint32(meshExtSvc.Spec.Match.Port))]
 			if !ok {
 				continue
 			}
diff --git a/pkg/plugins/policies/meshhttproute/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshhttproute/api/v1alpha1/zz_generated.resource.go
index 0be543e02..fbc63b98c 100644
--- a/pkg/plugins/policies/meshhttproute/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshhttproute/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshHTTPRouteResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshHTTPRouteResource(),
 	ResourceList:                 &MeshHTTPRouteResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshhttproutes",
 	KumactlArg:                   "meshhttproute",
 	KumactlListArg:               "meshhttproutes",
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go
index 495a1516e..3c6d920fc 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go
@@ -20,7 +20,6 @@ import (
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_listeners "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
 	envoy_listeners_v3 "github.com/kumahq/kuma/pkg/xds/envoy/listeners/v3"
-	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
 	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/generator"
 )
@@ -38,13 +37,7 @@ func generateFromService(
 		Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
 		Configure(envoy_listeners.TagsMetadata(envoy_tags.Tags(tags).WithoutTags(mesh_proto.MeshTag)))
 
-	var resourceName string
-	if svc.BackendRef.Kind == common_api.MeshExternalService {
-		resourceName = envoy_names.GetMeshExternalServiceName(svc.BackendRef.Name)
-		listenerBuilder.WithOverwriteName(resourceName)
-	} else {
-		resourceName = svc.ServiceName
-	}
+	resourceName := svc.ServiceName
 
 	filterChainBuilder := envoy_listeners.NewFilterChainBuilder(proxy.APIVersion, envoy_common.AnonymousResource).
 		Configure(envoy_listeners.AddFilterChainConfigurer(&envoy_listeners_v3.HttpConnectionManagerConfigurer{
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/zz_generated.resource.go
index 1dc6af139..58da0fae0 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshLoadBalancingStrategyResourceTypeDescriptor = model.ResourceTypeDescript
 	Resource:                     NewMeshLoadBalancingStrategyResource(),
 	ResourceList:                 &MeshLoadBalancingStrategyResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshloadbalancingstrategies",
 	KumactlArg:                   "meshloadbalancingstrategy",
 	KumactlListArg:               "meshloadbalancingstrategies",
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go
index f9ec45961..8ad486dd7 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go
@@ -26,7 +26,6 @@ import (
 	"github.com/kumahq/kuma/pkg/util/pointer"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/listeners/v3"
-	"github.com/kumahq/kuma/pkg/xds/envoy/names"
 	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
 	"github.com/kumahq/kuma/pkg/xds/generator"
 	"github.com/kumahq/kuma/pkg/xds/generator/egress"
@@ -193,6 +192,9 @@ func configureEndpoints(
 	egressEnabled bool,
 	origin string,
 ) error {
+	if cluster == nil {
+		return nil
+	}
 	if cluster.LoadAssignment != nil {
 		if err := ConfigureStaticEndpointsLocalityAware(tags, endpoints, cluster, conf, serviceName, localZone, apiVersion, egressEnabled, origin); err != nil {
 			return err
@@ -319,7 +321,9 @@ func (p plugin) configureEgress(rs *core_xds.ResourceSet, proxy *core_xds.Proxy)
 
 		meshExternalServices := meshResources.ListOrEmpty(meshexternalservice_api.MeshExternalServiceType)
 		for _, mes := range meshExternalServices.GetItems() {
-			policies, ok := meshResources.Dynamic[mes.GetMeta().GetName()]
+			meshExtSvc := mes.(*meshexternalservice_api.MeshExternalServiceResource)
+			destinationName := meshExtSvc.DestinationName(uint32(meshExtSvc.Spec.Match.Port))
+			policies, ok := meshResources.Dynamic[destinationName]
 			if !ok {
 				continue
 			}
@@ -344,7 +348,7 @@ func (p plugin) configureEgress(rs *core_xds.ResourceSet, proxy *core_xds.Proxy)
 						}
 					}
 				}
-				err := p.configureEgressListener(listeners.Egress, conf.Conf[0].(api.Conf), mesID.Name, mesID.Mesh)
+				err := p.configureEgressListener(listeners.Egress, conf.Conf[0].(api.Conf), destinationName)
 				if err != nil {
 					return err
 				}
@@ -427,8 +431,7 @@ func (p plugin) configureListener(
 func (p plugin) configureEgressListener(
 	l *envoy_listener.Listener,
 	conf api.Conf,
-	name string,
-	meshName string,
+	filterChainName string,
 ) error {
 	if conf.LoadBalancer == nil {
 		return nil
@@ -456,7 +459,7 @@ func (p plugin) configureEgressListener(
 	}
 
 	for _, chain := range l.FilterChains {
-		if chain.Name != names.GetEgressFilterChainName(name, meshName) {
+		if chain.Name != filterChainName {
 			continue
 		}
 		err := v3.UpdateHTTPConnectionManager(chain, func(hcm *envoy_hcm.HttpConnectionManager) error {
diff --git a/pkg/plugins/policies/meshratelimit/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshratelimit/api/v1alpha1/zz_generated.resource.go
index 279e032b8..1ee5f14ee 100644
--- a/pkg/plugins/policies/meshratelimit/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshratelimit/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshRateLimitResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshRateLimitResource(),
 	ResourceList:                 &MeshRateLimitResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshratelimits",
 	KumactlArg:                   "meshratelimit",
 	KumactlListArg:               "meshratelimits",
diff --git a/pkg/plugins/policies/meshretry/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshretry/api/v1alpha1/zz_generated.resource.go
index e09629b0f..6ac501af3 100644
--- a/pkg/plugins/policies/meshretry/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshretry/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshRetryResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshRetryResource(),
 	ResourceList:                 &MeshRetryResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshretries",
 	KumactlArg:                   "meshretry",
 	KumactlListArg:               "meshretries",
diff --git a/pkg/plugins/policies/meshtcproute/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshtcproute/api/v1alpha1/zz_generated.resource.go
index aaa6e6137..2c046d672 100644
--- a/pkg/plugins/policies/meshtcproute/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshtcproute/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshTCPRouteResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshTCPRouteResource(),
 	ResourceList:                 &MeshTCPRouteResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshtcproutes",
 	KumactlArg:                   "meshtcproute",
 	KumactlListArg:               "meshtcproutes",
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.resource.go
index b1e38d295..f06f3ad27 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.resource.go
@@ -137,7 +137,7 @@ var MeshTimeoutResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	Resource:                     NewMeshTimeoutResource(),
 	ResourceList:                 &MeshTimeoutResourceList{},
 	Scope:                        model.ScopeMesh,
-	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag,
+	KDSFlags:                     model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag,
 	WsPath:                       "meshtimeouts",
 	KumactlArg:                   "meshtimeout",
 	KumactlListArg:               "meshtimeouts",
diff --git a/pkg/plugins/policies/meshtrafficpermission/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshtrafficpermission/plugin/v1alpha1/plugin.go
index 5c2fa7b5b..2f2af9f75 100644
--- a/pkg/plugins/policies/meshtrafficpermission/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshtrafficpermission/plugin/v1alpha1/plugin.go
@@ -142,10 +142,9 @@ func (p plugin) configureEgress(rs *core_xds.ResourceSet, proxy *core_xds.Proxy)
 		}
 		// egress is configured for all meshes so we cannot use mesh context in this case
 		mesNames := []string{}
-		if _, found := resource.Resources[meshexternalservice_api.MeshExternalServiceType]; found {
-			for _, mes := range resource.Resources[meshexternalservice_api.MeshExternalServiceType].GetItems() {
-				mesNames = append(mesNames, mes.GetMeta().GetName())
-			}
+		for _, mes := range resource.ListOrEmpty(meshexternalservice_api.MeshExternalServiceType).GetItems() {
+			meshExtSvc := mes.(*meshexternalservice_api.MeshExternalServiceResource)
+			mesNames = append(mesNames, meshExtSvc.DestinationName(uint32(meshExtSvc.Spec.Match.Port)))
 		}
 
 		for _, esName := range esNames {
@@ -201,7 +200,7 @@ func (p plugin) configureEgress(rs *core_xds.ResourceSet, proxy *core_xds.Proxy)
 					Mesh:      meshName,
 				}
 				for _, filterChain := range listeners.Egress.FilterChains {
-					if filterChain.Name == names.GetEgressFilterChainName(mesName, meshName) {
+					if filterChain.Name == mesName {
 						if err := configurer.Configure(filterChain); err != nil {
 							return err
 						}
diff --git a/pkg/plugins/runtime/k8s/controllers/gateway_converter.go b/pkg/plugins/runtime/k8s/controllers/gateway_converter.go
index 3b00dc84f..19c88bc7d 100644
--- a/pkg/plugins/runtime/k8s/controllers/gateway_converter.go
+++ b/pkg/plugins/runtime/k8s/controllers/gateway_converter.go
@@ -11,6 +11,7 @@ import (
 	kube_controllerutil "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	mesh_k8s "github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/metadata"
 	k8s_util "github.com/kumahq/kuma/pkg/plugins/runtime/k8s/util"
@@ -54,6 +55,14 @@ func (r *PodReconciler) createorUpdateBuiltinGatewayDataplane(ctx context.Contex
 	}
 
 	operationResult, err := kube_controllerutil.CreateOrUpdate(ctx, r.Client, dataplane, func() error {
+		currentSpec, err := dataplane.GetSpec()
+		if err != nil {
+			return errors.Wrap(err, "unable to get current Dataplane's spec")
+		}
+		if model.Equal(currentSpec, dataplaneProto) {
+			return k8s_util.UnchangedResourceError
+		}
+
 		dataplane.SetSpec(dataplaneProto)
 
 		if err := kube_controllerutil.SetControllerReference(pod, dataplane, r.Scheme); err != nil {
@@ -64,6 +73,10 @@ func (r *PodReconciler) createorUpdateBuiltinGatewayDataplane(ctx context.Contex
 
 	log := r.Log.WithValues("pod", kube_types.NamespacedName{Namespace: pod.Namespace, Name: pod.Name})
 	if err != nil {
+		if errors.Is(err, k8s_util.UnchangedResourceError) {
+			log.V(1).Info("resource hasn't changed, skip")
+			return nil
+		}
 		log.Error(err, "unable to create/update Dataplane", "operationResult", operationResult)
 		r.EventRecorder.Eventf(pod, kube_core.EventTypeWarning, FailedToGenerateKumaDataplaneReason, "Failed to generate Kuma Dataplane: %s", err.Error())
 		return err
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_controller.go b/pkg/plugins/runtime/k8s/controllers/pod_controller.go
index ba22616ae..10dce1791 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_controller.go
@@ -334,6 +334,10 @@ func (r *PodReconciler) createOrUpdateDataplane(
 	})
 	log := r.Log.WithValues("pod", kube_types.NamespacedName{Namespace: pod.Namespace, Name: pod.Name})
 	if err != nil {
+		if errors.Is(err, util_k8s.UnchangedResourceError) {
+			log.V(1).Info("resource hasn't changed, skip")
+			return nil
+		}
 		if !errors.Is(err, context.Canceled) {
 			log.Error(err, "unable to create/update Dataplane", "operationResult", operationResult)
 			r.EventRecorder.Eventf(pod, kube_core.EventTypeWarning, FailedToGenerateKumaDataplaneReason, "Failed to generate Kuma Dataplane: %s", err.Error())
@@ -371,6 +375,10 @@ func (r *PodReconciler) createOrUpdateIngress(ctx context.Context, pod *kube_cor
 	})
 	log := r.Log.WithValues("pod", kube_types.NamespacedName{Namespace: pod.Namespace, Name: pod.Name})
 	if err != nil {
+		if errors.Is(err, util_k8s.UnchangedResourceError) {
+			log.V(1).Info("resource hasn't changed, skip")
+			return nil
+		}
 		log.Error(err, "unable to create/update Ingress", "operationResult", operationResult)
 		r.EventRecorder.Eventf(pod, kube_core.EventTypeWarning, FailedToGenerateKumaDataplaneReason, "Failed to generate Kuma Ingress: %s", err.Error())
 		return err
@@ -405,6 +413,10 @@ func (r *PodReconciler) createOrUpdateEgress(ctx context.Context, pod *kube_core
 	})
 	log := r.Log.WithValues("pod", kube_types.NamespacedName{Namespace: pod.Namespace, Name: pod.Name})
 	if err != nil {
+		if errors.Is(err, util_k8s.UnchangedResourceError) {
+			log.V(1).Info("resource hasn't changed, skip")
+			return nil
+		}
 		log.Error(err, "unable to create/update Egress", "operationResult", operationResult)
 		r.EventRecorder.Eventf(pod, kube_core.EventTypeWarning, FailedToGenerateKumaDataplaneReason, "Failed to generate Kuma Egress: %s", err.Error())
 		return err
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_converter.go b/pkg/plugins/runtime/k8s/controllers/pod_converter.go
index 0c6bf49b8..877a84470 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_converter.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_converter.go
@@ -13,6 +13,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	k8s_common "github.com/kumahq/kuma/pkg/plugins/common/k8s"
 	mesh_k8s "github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/metadata"
@@ -43,11 +44,20 @@ func (p *PodConverter) PodToDataplane(
 	services []*kube_core.Service,
 	others []*mesh_k8s.Dataplane,
 ) error {
+	previousMesh := dataplane.Mesh
 	dataplane.Mesh = util_k8s.MeshOfByAnnotation(pod, ns)
 	dataplaneProto, err := p.dataplaneFor(ctx, pod, services, others)
 	if err != nil {
 		return err
 	}
+	currentSpec, err := dataplane.GetSpec()
+	if err != nil {
+		return err
+	}
+
+	if model.Equal(currentSpec, dataplaneProto) && previousMesh == dataplane.Mesh {
+		return util_k8s.UnchangedResourceError
+	}
 	dataplane.SetSpec(dataplaneProto)
 	return nil
 }
@@ -65,6 +75,13 @@ func (p *PodConverter) PodToIngress(ctx context.Context, zoneIngress *mesh_k8s.Z
 		return err
 	}
 
+	currentSpec, err := zoneIngress.GetSpec()
+	if err != nil {
+		return err
+	}
+	if model.Equal(currentSpec, zoneIngressRes.Spec) {
+		return util_k8s.UnchangedResourceError
+	}
 	zoneIngress.SetSpec(zoneIngressRes.Spec)
 	return nil
 }
@@ -81,6 +98,13 @@ func (p *PodConverter) PodToEgress(ctx context.Context, zoneEgress *mesh_k8s.Zon
 	if err := p.EgressFor(ctx, zoneEgressRes.Spec, pod, services); err != nil {
 		return err
 	}
+	currentSpec, err := zoneEgress.GetSpec()
+	if err != nil {
+		return err
+	}
+	if model.Equal(currentSpec, zoneEgressRes.Spec) {
+		return util_k8s.UnchangedResourceError
+	}
 
 	zoneEgress.SetSpec(zoneEgressRes.Spec)
 	return nil
diff --git a/pkg/plugins/runtime/k8s/util/errors.go b/pkg/plugins/runtime/k8s/util/errors.go
new file mode 100644
index 000000000..79028f25e
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/util/errors.go
@@ -0,0 +1,5 @@
+package util
+
+import "fmt"
+
+var UnchangedResourceError = fmt.Errorf("resource hasn't changed")
diff --git a/pkg/plugins/runtime/k8s/webhooks/defaulter.go b/pkg/plugins/runtime/k8s/webhooks/defaulter.go
index 95f529e97..2bf9d0a70 100644
--- a/pkg/plugins/runtime/k8s/webhooks/defaulter.go
+++ b/pkg/plugins/runtime/k8s/webhooks/defaulter.go
@@ -65,10 +65,13 @@ func (h *defaultingHandler) Handle(_ context.Context, req admission.Request) adm
 	if resp := h.IsOperationAllowed(req.UserInfo, resource, req.Namespace); !resp.Allowed {
 		return resp
 	}
-	labels, annotations := k8s.SplitLabelsAndAnnotations(
-		core_model.ComputeLabels(resource, h.Mode, true, h.SystemNamespace, h.ZoneName),
-		obj.GetAnnotations(),
-	)
+
+	computed, err := core_model.ComputeLabels(resource, h.Mode, true, h.SystemNamespace, h.ZoneName)
+	if err != nil {
+		return admission.Errored(http.StatusInternalServerError, err)
+	}
+	labels, annotations := k8s.SplitLabelsAndAnnotations(computed, obj.GetAnnotations())
+
 	obj.SetLabels(labels)
 	obj.SetAnnotations(annotations)
 
diff --git a/pkg/plugins/runtime/k8s/webhooks/resourceadmissionchecker.go b/pkg/plugins/runtime/k8s/webhooks/resourceadmissionchecker.go
index e9c0bd25d..91fc1c3e5 100644
--- a/pkg/plugins/runtime/k8s/webhooks/resourceadmissionchecker.go
+++ b/pkg/plugins/runtime/k8s/webhooks/resourceadmissionchecker.go
@@ -38,7 +38,7 @@ func (c *ResourceAdmissionChecker) IsOperationAllowed(userInfo authenticationv1.
 	}
 
 	if !c.isResourceTypeAllowed(r.Descriptor()) {
-		return c.resourceTypeIsNotAllowedResponse(r.Descriptor().Name)
+		return *forbiddenResponse(resourceTypeNotAllowedMsg(r.Descriptor().Name, c.Mode))
 	}
 
 	if errResponse := c.isResourceAllowed(r, ns); errResponse != nil {
@@ -103,36 +103,17 @@ func (c *ResourceAdmissionChecker) validateLabels(r core_model.Resource, ns stri
 		if originPresent && resourceOrigin != mesh_proto.GlobalResourceOrigin {
 			zoneTag, ok := r.GetMeta().GetLabels()[mesh_proto.ZoneTag]
 			if ok && zoneTag != c.ZoneName {
-				return resourceLabelsNotAllowedResponse(mesh_proto.ZoneTag, c.ZoneName, zoneTag)
+				return forbiddenResponse(labelsNotAllowedMsg(mesh_proto.ZoneTag, c.ZoneName, zoneTag))
 			}
 		}
 	}
 
 	if r.Descriptor().IsPluginOriginated && r.Descriptor().IsPolicy {
-		return c.validatePolicyRole(r, ns)
-	}
-
-	return nil
-}
-
-func (c *ResourceAdmissionChecker) validatePolicyRole(r core_model.Resource, ns string) *admission.Response {
-	policy, ok := r.GetSpec().(core_model.Policy)
-	if !ok {
-		return nil
-	}
-	policyRole, ok := r.GetMeta().GetLabels()[mesh_proto.PolicyRoleLabel]
-	if !ok {
-		return nil
-	}
-	if ns == c.SystemNamespace {
-		if policyRole != string(mesh_proto.SystemPolicyRole) {
-			return resourceLabelsNotAllowedResponse(mesh_proto.PolicyRoleLabel, string(mesh_proto.SystemPolicyRole), policyRole)
+		if _, err := core_model.ComputePolicyRole(r.GetSpec().(core_model.Policy), ns); err != nil {
+			return forbiddenResponse(err.Error())
 		}
-		return nil
-	}
-	if policyRole != string(core_model.ComputePolicyRole(policy)) {
-		return resourceLabelsNotAllowedResponse(mesh_proto.PolicyRoleLabel, string(core_model.ComputePolicyRole(policy)), policyRole)
 	}
+
 	return nil
 }
 
@@ -159,54 +140,30 @@ func (c *ResourceAdmissionChecker) resourceIsNotAllowedResponse() *admission.Res
 	}
 }
 
-func (c *ResourceAdmissionChecker) resourceTypeIsNotAllowedResponse(resType core_model.ResourceType) admission.Response {
+func labelsNotAllowedMsg(label, correctValue, actual string) string {
+	return fmt.Sprintf("Operation not allowed. %s label should have %s value, got %s", label, correctValue, actual)
+}
+
+func resourceTypeNotAllowedMsg(resType core_model.ResourceType, mode core.CpMode) string {
 	otherCpMode := ""
-	if c.Mode == core.Zone {
+	if mode == core.Zone {
 		otherCpMode = core.Global
-	} else if c.Mode == core.Global {
+	} else if mode == core.Global {
 		otherCpMode = core.Zone
 	}
-	return admission.Response{
-		AdmissionResponse: v1.AdmissionResponse{
-			Allowed: false,
-			Result: &metav1.Status{
-				Status: "Failure",
-				Message: fmt.Sprintf("Operation not allowed. %s resources like %s can be updated or deleted only "+
-					"from the %s control plane and not from a %s control plane.", version.Product, resType, strings.ToUpper(otherCpMode), strings.ToUpper(c.Mode)),
-				Reason: "Forbidden",
-				Code:   403,
-				Details: &metav1.StatusDetails{
-					Causes: []metav1.StatusCause{
-						{
-							Type:    "FieldValueInvalid",
-							Message: "cannot be empty",
-							Field:   "metadata.annotations[kuma.io/synced]",
-						},
-					},
-				},
-			},
-		},
-	}
+	return fmt.Sprintf("Operation not allowed. %s resources like %s can be updated or deleted only "+
+		"from the %s control plane and not from a %s control plane.", version.Product, resType, strings.ToUpper(otherCpMode), strings.ToUpper(mode))
 }
 
-func resourceLabelsNotAllowedResponse(label string, correctValue string, actual string) *admission.Response {
+func forbiddenResponse(msg string) *admission.Response {
 	return &admission.Response{
 		AdmissionResponse: v1.AdmissionResponse{
 			Allowed: false,
 			Result: &metav1.Status{
 				Status:  "Failure",
-				Message: fmt.Sprintf("Operation not allowed. %s label should have %s value, got %s", label, correctValue, actual),
+				Message: msg,
 				Reason:  "Forbidden",
 				Code:    403,
-				Details: &metav1.StatusDetails{
-					Causes: []metav1.StatusCause{
-						{
-							Type:    "FieldValueInvalid",
-							Message: "cannot be set",
-							Field:   "metadata.annotations[kuma.io/synced]",
-						},
-					},
-				},
 			},
 		},
 	}
diff --git a/pkg/xds/bootstrap/components.go b/pkg/xds/bootstrap/components.go
index 64dcc4919..797bc062e 100644
--- a/pkg/xds/bootstrap/components.go
+++ b/pkg/xds/bootstrap/components.go
@@ -2,6 +2,7 @@ package bootstrap
 
 import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/config/core/resources/store"
 	dp_server "github.com/kumahq/kuma/pkg/config/dp-server"
 	core_runtime "github.com/kumahq/kuma/pkg/core/runtime"
 )
@@ -17,7 +18,7 @@ func RegisterBootstrap(rt core_runtime.Runtime) error {
 			string(mesh_proto.IngressProxyType):   rt.Config().DpServer.Authn.ZoneProxy.Type != dp_server.DpServerAuthNone,
 			string(mesh_proto.EgressProxyType):    rt.Config().DpServer.Authn.ZoneProxy.Type != dp_server.DpServerAuthNone,
 		},
-		rt.Config().DpServer.Authn.EnableReloadableTokens,
+		rt.Config().DpServer.Authn.EnableReloadableTokens || rt.Config().Store.Type == store.KubernetesStore,
 		rt.Config().DpServer.Hds.Enabled,
 		rt.Config().GetEnvoyAdminPort(),
 	)
diff --git a/pkg/xds/envoy/names/resource_names.go b/pkg/xds/envoy/names/resource_names.go
index 2f361a175..30e6dd0da 100644
--- a/pkg/xds/envoy/names/resource_names.go
+++ b/pkg/xds/envoy/names/resource_names.go
@@ -142,11 +142,3 @@ func GetSecretName(category string, scope string, identifier string) string {
 func GetEgressFilterChainName(serviceName string, meshName string) string {
 	return fmt.Sprintf("%s_%s", serviceName, meshName)
 }
-
-func GetMeshExternalServiceName(resourceName string) string {
-	return fmt.Sprintf("meshexternalservice_%s", resourceName)
-}
-
-func GetEgressMeshExternalServiceName(meshName, resourceName string) string {
-	return GetMeshClusterName(meshName, GetMeshExternalServiceName(resourceName))
-}
diff --git a/pkg/xds/generator/egress/external_services_generator.go b/pkg/xds/generator/egress/external_services_generator.go
index 1179bd3fe..3f5ac9d09 100644
--- a/pkg/xds/generator/egress/external_services_generator.go
+++ b/pkg/xds/generator/egress/external_services_generator.go
@@ -40,6 +40,7 @@ func (g *ExternalServicesGenerator) Generate(
 		nil,
 		localResources.MeshExternalServices().Items,
 		"",
+		xdsCtx.Mesh.ResolveResourceIdentifier,
 	)
 	services := g.buildServices(endpointMap, zone, meshResources)
 
@@ -97,7 +98,7 @@ func (*ExternalServicesGenerator) generateCDS(
 		isMes := isMeshExternalService(endpoints)
 
 		if isMes {
-			clusterBuilder.WithName(envoy_names.GetEgressMeshExternalServiceName(meshName, serviceName))
+			clusterBuilder.WithName(serviceName)
 			clusterBuilder.
 				Configure(envoy_clusters.ProvidedCustomEndpointCluster(isIPV6, isMes, endpoints...)).
 				Configure(
@@ -171,7 +172,6 @@ func (g *ExternalServicesGenerator) addFilterChains(
 ) {
 	meshName := meshResources.Mesh.GetMeta().GetName()
 	sniUsed := map[string]bool{}
-
 	esNames := []string{}
 	for _, es := range meshResources.ExternalServices {
 		esNames = append(esNames, es.Spec.GetService())
@@ -184,7 +184,6 @@ func (g *ExternalServicesGenerator) addFilterChains(
 		endpoints := endpointMap[esName]
 		destinations := meshDestinations.KumaIoServices[esName]
 		destinations = append(destinations, meshDestinations.KumaIoServices[mesh_proto.MatchAllTag]...)
-
 		for _, destination := range destinations {
 			meshDestination := destination.
 				WithTags(mesh_proto.ServiceTag, esName).
@@ -196,7 +195,6 @@ func (g *ExternalServicesGenerator) addFilterChains(
 			}
 
 			sniUsed[sni] = true
-
 			g.configureFilterChain(
 				apiVersion,
 				esName,
@@ -249,11 +247,9 @@ func (*ExternalServicesGenerator) configureFilterChain(
 	// There is a case where multiple meshes contain services with
 	// the same names, so we cannot use just "serviceName" as a cluster
 	// name as we would overwrite some clusters with the latest one
-	var clusterName string
+	clusterName := envoy_names.GetMeshClusterName(meshName, esName)
 	if isMeshExternalService(endpoints) {
-		clusterName = envoy_names.GetEgressMeshExternalServiceName(meshName, esName)
-	} else {
-		clusterName = envoy_names.GetMeshClusterName(meshName, esName)
+		clusterName = esName
 	}
 
 	cluster := envoy_common.NewCluster(
@@ -263,7 +259,12 @@ func (*ExternalServicesGenerator) configureFilterChain(
 		envoy_common.WithExternalService(true),
 	)
 
-	filterChainBuilder := envoy_listeners.NewFilterChainBuilder(apiVersion, names.GetEgressFilterChainName(esName, meshName)).Configure(
+	filterChainName := names.GetEgressFilterChainName(esName, meshName)
+	if isMeshExternalService(endpoints) {
+		filterChainName = esName
+	}
+
+	filterChainBuilder := envoy_listeners.NewFilterChainBuilder(apiVersion, filterChainName).Configure(
 		envoy_listeners.ServerSideMTLS(meshResources.Mesh, secretsTracker, nil, nil),
 		envoy_listeners.MatchTransportProtocol("tls"),
 		envoy_listeners.MatchServerNames(sni),
@@ -296,11 +297,9 @@ func (*ExternalServicesGenerator) configureFilterChain(
 		// Add the default fall-back route
 		routes = append(routes, envoy_common.NewRoute(envoy_common.WithCluster(cluster)))
 
-		var routeConfigName string
+		routeConfigName := envoy_names.GetOutboundRouteName(esName)
 		if isMeshExternalService(endpoints) {
-			routeConfigName = envoy_names.GetEgressMeshExternalServiceName(meshName, esName)
-		} else {
-			routeConfigName = envoy_names.GetOutboundRouteName(esName)
+			routeConfigName = esName
 		}
 
 		filterChainBuilder.
diff --git a/pkg/xds/generator/egress/internal_services_generator.go b/pkg/xds/generator/egress/internal_services_generator.go
index 254d01c6c..301873d5d 100644
--- a/pkg/xds/generator/egress/internal_services_generator.go
+++ b/pkg/xds/generator/egress/internal_services_generator.go
@@ -36,6 +36,7 @@ func (g *InternalServicesGenerator) Generate(
 		nil, // todo(jakubdyszkiewicz) add support for MeshService + egress
 		nil,
 		"",
+		xdsCtx.Mesh.ResolveResourceIdentifier,
 	)
 
 	services := zoneproxy.AddFilterChains(availableServices, proxy.APIVersion, listenerBuilder, destinations, meshResources.EndpointMap)
diff --git a/pkg/xds/generator/ingress_generator.go b/pkg/xds/generator/ingress_generator.go
index 65608c913..2fab4cc2c 100644
--- a/pkg/xds/generator/ingress_generator.go
+++ b/pkg/xds/generator/ingress_generator.go
@@ -58,6 +58,7 @@ func (i IngressGenerator) Generate(
 			meshResources.MeshMultiZoneServices().Items,
 			nil,
 			xdsCtx.ControlPlane.SystemNamespace,
+			xdsCtx.Mesh.ResolveResourceIdentifier,
 		)
 
 		services := zoneproxy.AddFilterChains(availableSvcsByMesh[meshName], proxy.APIVersion, listenerBuilder, dest, mr.EndpointMap)
diff --git a/pkg/xds/generator/zoneproxy/destinations.go b/pkg/xds/generator/zoneproxy/destinations.go
index 9c4475362..ccb40ce71 100644
--- a/pkg/xds/generator/zoneproxy/destinations.go
+++ b/pkg/xds/generator/zoneproxy/destinations.go
@@ -10,6 +10,7 @@ import (
 	meshexternalservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshexternalservice/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1"
 	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/dns"
 	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
@@ -31,6 +32,7 @@ type BackendRefDestination struct {
 	// DestinationName is a string to reference Type+Name+Mesh+Port. Effectively an Envoy Cluster name
 	DestinationName string
 	SNI             string
+	Resource        *model.ResolvedBackendRef
 }
 
 func BuildMeshDestinations(
@@ -40,12 +42,13 @@ func BuildMeshDestinations(
 	meshMzSvc []*v1alpha1.MeshMultiZoneServiceResource,
 	mesServices []*meshexternalservice_api.MeshExternalServiceResource,
 	systemNamespace string,
+	resolveResourceIdentifier model.LabelResourceIdentifierResolver,
 ) MeshDestinations {
 	return MeshDestinations{
 		KumaIoServices: buildKumaIoServiceDestinations(availableServices, res),
 		BackendRefs: append(
-			append(buildMeshServiceDestinations(meshServices, systemNamespace), buildMeshMultiZoneServiceDestinations(meshMzSvc)...),
-			buildMeshExternalServiceDestinations(mesServices)...,
+			append(buildMeshServiceDestinations(meshServices, systemNamespace, resolveResourceIdentifier), buildMeshMultiZoneServiceDestinations(meshMzSvc, resolveResourceIdentifier)...),
+			buildMeshExternalServiceDestinations(mesServices, resolveResourceIdentifier)...,
 		),
 	}
 }
@@ -53,6 +56,7 @@ func BuildMeshDestinations(
 func buildMeshServiceDestinations(
 	meshServices []*meshservice_api.MeshServiceResource,
 	systemNamespace string,
+	resolveResourceIdentifier model.LabelResourceIdentifierResolver,
 ) []BackendRefDestination {
 	var msDestinations []BackendRefDestination
 	for _, ms := range meshServices {
@@ -68,6 +72,11 @@ func buildMeshServiceDestinations(
 				Mesh:            ms.GetMeta().GetMesh(),
 				DestinationName: ms.DestinationName(port.Port),
 				SNI:             sni,
+				Resource: model.ResolveBackendRef(
+					ms.Meta,
+					model.ResourceToBackendRef(ms, meshservice_api.MeshServiceType, port.Port),
+					resolveResourceIdentifier,
+				),
 			})
 		}
 	}
@@ -76,6 +85,7 @@ func buildMeshServiceDestinations(
 
 func buildMeshExternalServiceDestinations(
 	meshExternalServices []*meshexternalservice_api.MeshExternalServiceResource,
+	resolveResourceIdentifier model.LabelResourceIdentifierResolver,
 ) []BackendRefDestination {
 	var mesDestinations []BackendRefDestination
 	for _, mes := range meshExternalServices {
@@ -90,6 +100,11 @@ func buildMeshExternalServiceDestinations(
 			Mesh:            mes.GetMeta().GetMesh(),
 			DestinationName: mes.DestinationName(uint32(mes.Spec.Match.Port)),
 			SNI:             sni,
+			Resource: model.ResolveBackendRef(
+				mes.Meta,
+				model.ResourceToBackendRef(mes, meshexternalservice_api.MeshExternalServiceType, uint32(mes.Spec.Match.Port)),
+				resolveResourceIdentifier,
+			),
 		})
 	}
 	return mesDestinations
@@ -97,6 +112,7 @@ func buildMeshExternalServiceDestinations(
 
 func buildMeshMultiZoneServiceDestinations(
 	meshMzSvc []*v1alpha1.MeshMultiZoneServiceResource,
+	resolveResourceIdentifier model.LabelResourceIdentifierResolver,
 ) []BackendRefDestination {
 	var msDestinations []BackendRefDestination
 	for _, ms := range meshMzSvc {
@@ -104,6 +120,11 @@ func buildMeshMultiZoneServiceDestinations(
 			msDestinations = append(msDestinations, BackendRefDestination{
 				Mesh:            ms.GetMeta().GetMesh(),
 				DestinationName: ms.DestinationName(port.Port),
+				Resource: model.ResolveBackendRef(
+					ms.Meta,
+					model.ResourceToBackendRef(ms, meshexternalservice_api.MeshExternalServiceType, port.Port),
+					resolveResourceIdentifier,
+				),
 				SNI: tls.SNIForResource(
 					core_model.GetDisplayName(ms.GetMeta()),
 					ms.GetMeta().GetMesh(),
diff --git a/pkg/xds/generator/zoneproxy/generator.go b/pkg/xds/generator/zoneproxy/generator.go
index 5bad4d22d..195a1ed01 100644
--- a/pkg/xds/generator/zoneproxy/generator.go
+++ b/pkg/xds/generator/zoneproxy/generator.go
@@ -5,6 +5,7 @@ import (
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
+	"github.com/kumahq/kuma/pkg/util/pointer"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_clusters "github.com/kumahq/kuma/pkg/xds/envoy/clusters"
 	envoy_endpoints "github.com/kumahq/kuma/pkg/xds/envoy/endpoints"
@@ -36,8 +37,10 @@ func GenerateCDS(
 		tagKeySlice := tagSlice.ToTagKeysSlice().Transform(
 			envoy_tags.Without(mesh_proto.ServiceTag),
 		)
-
 		clusterName := envoy_names.GetMeshClusterName(meshName, service)
+		if clusters.BackendRef().LegacyBackendRef != nil && clusters.BackendRef().LegacyBackendRef.ReferencesRealObject() {
+			clusterName = service
+		}
 		edsCluster, err := envoy_clusters.NewClusterBuilder(apiVersion, clusterName).
 			Configure(envoy_clusters.EdsCluster()).
 			Configure(envoy_clusters.LbSubset(tagKeySlice)).
@@ -66,9 +69,12 @@ func GenerateEDS(
 	var resources []*core_xds.Resource
 
 	for _, service := range services.Sorted() {
+		clusters := services[service]
 		endpoints := endpointMap[service]
-
 		clusterName := envoy_names.GetMeshClusterName(meshName, service)
+		if clusters.BackendRef().LegacyBackendRef != nil && clusters.BackendRef().LegacyBackendRef.ReferencesRealObject() {
+			clusterName = service
+		}
 		cla, err := envoy_endpoints.CreateClusterLoadAssignment(clusterName, endpoints, apiVersion)
 		if err != nil {
 			return nil, err
@@ -173,8 +179,6 @@ func AddFilterChains(
 	}
 
 	for _, refDest := range meshDestinations.BackendRefs {
-		clusterName := envoy_names.GetMeshClusterName(refDest.Mesh, refDest.DestinationName)
-
 		if _, ok := sniUsed[refDest.SNI]; ok {
 			continue
 		}
@@ -186,7 +190,7 @@ func AddFilterChains(
 		// Destination name usually equals to kuma.io/service so we will add already existing cluster which will be
 		// then deduplicated in later steps
 		cluster := envoy_common.NewCluster(
-			envoy_common.WithName(clusterName),
+			envoy_common.WithName(refDest.DestinationName),
 			envoy_common.WithService(refDest.DestinationName),
 			envoy_common.WithTags(relevantTags),
 		)
@@ -197,15 +201,14 @@ func AddFilterChains(
 				envoy_listeners.MatchTransportProtocol("tls"),
 				envoy_listeners.MatchServerNames(refDest.SNI),
 				envoy_listeners.TcpProxyDeprecatedWithMetadata(
-					clusterName,
+					refDest.DestinationName,
 					cluster,
 				),
 			),
 		)
 
 		listenerBuilder.Configure(filterChain)
-
-		servicesAcc.Add(cluster)
+		servicesAcc.AddBackendRef(pointer.Deref(refDest.Resource), cluster)
 	}
 
 	return servicesAcc.Services()
diff --git a/pkg/xds/topology/outbound.go b/pkg/xds/topology/outbound.go
index 1bacb71b1..1826b3872 100644
--- a/pkg/xds/topology/outbound.go
+++ b/pkg/xds/topology/outbound.go
@@ -650,7 +650,7 @@ func createMeshExternalServiceEndpoint(
 	zone string,
 ) error {
 	es := &core_xds.ExternalService{
-		Protocol:      core_mesh.ParseProtocol(string(mes.Spec.Match.Protocol)),
+		Protocol:      mes.Spec.Match.Protocol,
 		OwnerResource: pointer.To(core_rules.UniqueKey(mes, "")),
 	}
 	tags := maps.Clone(mes.Meta.GetLabels())
@@ -658,7 +658,6 @@ func createMeshExternalServiceEndpoint(
 		tags = map[string]string{}
 	}
 	meshName := mesh.GetMeta().GetName()
-	name := mes.Meta.GetName()
 	tls := mes.Spec.Tls
 	if tls != nil && tls.Enabled {
 		var caCert, clientCert, clientKey []byte
@@ -741,7 +740,7 @@ func createMeshExternalServiceEndpoint(
 			Tags:            tags,
 			Locality:        GetLocality(zone, getZone(tags), mesh.LocalityAwareLbEnabled()),
 		}
-		outbounds[name] = append(outbounds[name], *outboundEndpoint)
+		outbounds[mes.DestinationName(uint32(mes.Spec.Match.Port))] = append(outbounds[mes.DestinationName(uint32(mes.Spec.Match.Port))], *outboundEndpoint)
 	}
 	return nil
 }
@@ -799,7 +798,7 @@ func fillExternalServicesOutboundsThroughEgress(
 	for _, mes := range meshExternalServices {
 		// deep copy map to not modify tags in ExternalService.
 		serviceTags := maps.Clone(mes.Meta.GetLabels())
-		serviceName := mes.Meta.GetName()
+		serviceName := mes.DestinationName(uint32(mes.Spec.Match.Port))
 		locality := GetLocality(localZone, getZone(serviceTags), mesh.LocalityAwareLbEnabled())
 
 		for _, ze := range zoneEgresses {
@@ -816,7 +815,7 @@ func fillExternalServicesOutboundsThroughEgress(
 				Weight:   1,
 				Locality: locality,
 				ExternalService: &core_xds.ExternalService{
-					Protocol:      core_mesh.ParseProtocol(string(mes.Spec.Match.Protocol)),
+					Protocol:      mes.Spec.Match.Protocol,
 					OwnerResource: pointer.To(core_rules.UniqueKey(mes, "")),
 				},
 			}
diff --git a/tools/policy-gen/generator/pkg/parse/policyconfig.go b/tools/policy-gen/generator/pkg/parse/policyconfig.go
index 67ceaff3e..53769baf3 100644
--- a/tools/policy-gen/generator/pkg/parse/policyconfig.go
+++ b/tools/policy-gen/generator/pkg/parse/policyconfig.go
@@ -150,6 +150,9 @@ func newPolicyConfig(pkg, name string, markers map[string]string, fields map[str
 	}
 	if v, ok := markers["kuma:policy:kds_flags"]; ok {
 		res.KDSFlags = v
+	} else if res.HasTo {
+		// potentially a producer policy, so we need to sync it from one zone to another
+		res.KDSFlags = "model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag | model.GlobalToAllButOriginalZoneFlag"
 	} else {
 		res.KDSFlags = "model.GlobalToAllZonesFlag | model.ZoneToGlobalFlag"
 	}


Test patch:
diff --git a/app/kumactl/cmd/install/install_transparent_proxy_test.go b/app/kumactl/cmd/install/install_transparent_proxy_test.go
index 37b208259..6321bc8a3 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy_test.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy_test.go
@@ -203,7 +203,7 @@ var _ = Context("kumactl install transparent proxy", func() {
 				"--redirect-all-dns-traffic",
 			},
 			goldenFile:   "install-transparent-proxy.defaults.golden.txt",
-			errorMatcher: Equal("Error: one of --redirect-dns or --redirect-all-dns-traffic should be specified\n"),
+			errorMatcher: Equal("Error: only one of '--redirect-dns' or '--redirect-all-dns-traffic' should be specified\n"),
 		}),
 		Entry("should error out on invalid port value", testCase{
 			extraArgs: []string{
diff --git a/pkg/core/resources/model/resource_test.go b/pkg/core/resources/model/resource_test.go
index e26976eaa..ba66838f9 100644
--- a/pkg/core/resources/model/resource_test.go
+++ b/pkg/core/resources/model/resource_test.go
@@ -171,12 +171,19 @@ var _ = Describe("IsReferenced", func() {
 var _ = Describe("ComputePolicyRole", func() {
 	type testCase struct {
 		policy       core_model.Policy
+		namespace    string
 		expectedRole mesh_proto.PolicyRole
+		expectedErr  error
 	}
 
 	DescribeTable("should compute the correct policy role",
 		func(given testCase) {
-			role := core_model.ComputePolicyRole(given.policy)
+			role, err := core_model.ComputePolicyRole(given.policy, given.namespace)
+			if given.expectedErr != nil {
+				Expect(err).To(Equal(given.expectedErr))
+			} else {
+				Expect(err).ToNot(HaveOccurred())
+			}
 			Expect(role).To(Equal(given.expectedRole))
 		},
 		Entry("consumer policy", testCase{
@@ -187,8 +194,46 @@ var _ = Describe("ComputePolicyRole", func() {
 					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
 				}).
 				Build().Spec,
+			namespace:    "kuma-demo",
+			expectedRole: mesh_proto.ConsumerPolicyRole,
+		}),
+		Entry("consumer policy with labels", testCase{
+			policy: builders.MeshTimeout().
+				WithMesh("mesh-1").WithName("name-1").
+				WithTargetRef(builders.TargetRefMesh()).
+				AddTo(builders.TargetRefMeshServiceLabels(map[string]string{
+					"kuma.io/display-name":  "test",
+					"kuma.io/zone":          "zone-1",
+					"k8s.kuma.io/namespace": "kuma-demo",
+				}, ""), meshtimeout_api.Conf{
+					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
+				}).
+				Build().Spec,
+			namespace:    "kuma-demo",
 			expectedRole: mesh_proto.ConsumerPolicyRole,
 		}),
+		Entry("producer policy", testCase{
+			policy: builders.MeshTimeout().
+				WithMesh("mesh-1").WithName("name-1").
+				WithTargetRef(builders.TargetRefMesh()).
+				AddTo(builders.TargetRefMeshService("backend", "kuma-demo", ""), meshtimeout_api.Conf{
+					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
+				}).
+				Build().Spec,
+			namespace:    "kuma-demo",
+			expectedRole: mesh_proto.ProducerPolicyRole,
+		}),
+		Entry("producer policy with no namespace in to[]", testCase{
+			policy: builders.MeshTimeout().
+				WithMesh("mesh-1").WithName("name-1").
+				WithTargetRef(builders.TargetRefMesh()).
+				AddTo(builders.TargetRefMeshService("backend", "", ""), meshtimeout_api.Conf{
+					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
+				}).
+				Build().Spec,
+			namespace:    "kuma-demo",
+			expectedRole: mesh_proto.ProducerPolicyRole,
+		}),
 		Entry("workload-owner policy with from", testCase{
 			policy: builders.MeshTimeout().
 				WithMesh("mesh-1").WithName("name-1").
@@ -197,6 +242,7 @@ var _ = Describe("ComputePolicyRole", func() {
 					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
 				}).
 				Build().Spec,
+			namespace:    "kuma-demo",
 			expectedRole: mesh_proto.WorkloadOwnerPolicyRole,
 		}),
 		Entry("workload-owner policy with both from and to", testCase{
@@ -210,6 +256,7 @@ var _ = Describe("ComputePolicyRole", func() {
 					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
 				}).
 				Build().Spec,
+			namespace:    "kuma-demo",
 			expectedRole: mesh_proto.WorkloadOwnerPolicyRole,
 		}),
 	)
diff --git a/pkg/kds/context/context_test.go b/pkg/kds/context/context_test.go
index e0ad95c42..afadb1fc2 100644
--- a/pkg/kds/context/context_test.go
+++ b/pkg/kds/context/context_test.go
@@ -324,6 +324,13 @@ var _ = Describe("Context", func() {
 			}),
 		)
 
+		zoneLabelsFn := func(zoneName string) map[string]string {
+			return map[string]string{
+				mesh_proto.ZoneTag:             zoneName,
+				mesh_proto.ResourceOriginLabel: string(mesh_proto.ZoneResourceOrigin),
+			}
+		}
+
 		DescribeTable("zone ingresses",
 			func(given testCase) {
 				ctx := stdcontext.Background()
@@ -345,7 +352,8 @@ var _ = Describe("Context", func() {
 			Entry("should not filter out zone ingresses from the different, enabled zone", testCase{
 				resource: &core_mesh.ZoneIngressResource{
 					Meta: &test_model.ResourceMeta{
-						Name: "zone-ingress-1",
+						Name:   "zone-ingress-1",
+						Labels: zoneLabelsFn("different-zone"),
 					},
 					Spec: &mesh_proto.ZoneIngress{
 						Zone: "different-zone",
@@ -365,7 +373,8 @@ var _ = Describe("Context", func() {
 			Entry("should filter out zone ingresses from the same zone", testCase{
 				resource: &core_mesh.ZoneIngressResource{
 					Meta: &test_model.ResourceMeta{
-						Name: "zone-ingress-1",
+						Name:   "zone-ingress-1",
+						Labels: zoneLabelsFn(clusterID),
 					},
 					Spec: &mesh_proto.ZoneIngress{
 						Zone: clusterID,
@@ -376,7 +385,8 @@ var _ = Describe("Context", func() {
 			Entry("should filter out zone ingresses from the different, not enabled zone", testCase{
 				resource: &core_mesh.ZoneIngressResource{
 					Meta: &test_model.ResourceMeta{
-						Name: "zone-ingress-1",
+						Name:   "zone-ingress-1",
+						Labels: zoneLabelsFn("different-zone"),
 					},
 					Spec: &mesh_proto.ZoneIngress{
 						Zone: "different-zone",
diff --git a/pkg/kds/v2/client/zone_sync_test.go b/pkg/kds/v2/client/zone_sync_test.go
index d7bd87519..fcba13baa 100644
--- a/pkg/kds/v2/client/zone_sync_test.go
+++ b/pkg/kds/v2/client/zone_sync_test.go
@@ -204,12 +204,18 @@ var _ = Describe("Zone Delta Sync", func() {
 	})
 
 	It("should sync ingresses", func() {
+		labelFn := func(zoneName string) map[string]string {
+			return map[string]string{
+				mesh_proto.ZoneTag:             zoneName,
+				mesh_proto.ResourceOriginLabel: string(mesh_proto.ZoneResourceOrigin),
+			}
+		}
 		// create Ingress for current zone, shouldn't be synced
-		err := globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc(zoneName)}, store.CreateByKey("dp-1", model.NoMesh))
+		err := globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc(zoneName)}, store.CreateByKey("dp-1", model.NoMesh), store.CreateWithLabels(labelFn(zoneName)))
 		Expect(err).ToNot(HaveOccurred())
-		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-1")}, store.CreateByKey("dp-2", model.NoMesh))
+		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-1")}, store.CreateByKey("dp-2", model.NoMesh), store.CreateWithLabels(labelFn("another-zone-1")))
 		Expect(err).ToNot(HaveOccurred())
-		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-2")}, store.CreateByKey("dp-3", model.NoMesh))
+		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-2")}, store.CreateByKey("dp-3", model.NoMesh), store.CreateWithLabels(labelFn("another-zone-2")))
 		Expect(err).ToNot(HaveOccurred())
 
 		Eventually(func() int {
diff --git a/pkg/kds/zone/components_test.go b/pkg/kds/zone/components_test.go
index 78419f77a..6e41e8827 100644
--- a/pkg/kds/zone/components_test.go
+++ b/pkg/kds/zone/components_test.go
@@ -75,12 +75,18 @@ var _ = Describe("Zone Sync", func() {
 	}
 
 	VerifySyncOfIngressesFromGlobalToZone := func() {
+		labelFn := func(zoneName string) map[string]string {
+			return map[string]string{
+				mesh_proto.ZoneTag:             zoneName,
+				mesh_proto.ResourceOriginLabel: string(mesh_proto.ZoneResourceOrigin),
+			}
+		}
 		// create Ingress for current zone, shouldn't be synced
-		err := globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc(zoneName)}, store.CreateByKey("dp-1", model.NoMesh))
+		err := globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc(zoneName)}, store.CreateByKey("dp-1", model.NoMesh), store.CreateWithLabels(labelFn(zoneName)))
 		Expect(err).ToNot(HaveOccurred())
-		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-1")}, store.CreateByKey("dp-2", model.NoMesh))
+		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-1")}, store.CreateByKey("dp-2", model.NoMesh), store.CreateWithLabels(labelFn("another-zone-1")))
 		Expect(err).ToNot(HaveOccurred())
-		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-2")}, store.CreateByKey("dp-3", model.NoMesh))
+		err = globalStore.Create(context.Background(), &mesh.ZoneIngressResource{Spec: ingressFunc("another-zone-2")}, store.CreateByKey("dp-3", model.NoMesh), store.CreateWithLabels(labelFn("another-zone-2")))
 		Expect(err).ToNot(HaveOccurred())
 
 		Eventually(func() int {
diff --git a/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin_test.go
index e7833b35e..c73901d46 100644
--- a/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1/plugin_test.go
@@ -481,6 +481,8 @@ var _ = Describe("MeshCircuitBreaker", func() {
 			Protocol:       core_mesh.ProtocolTCP,
 		})
 
+		mesDefault := samples.MeshExternalServiceExampleBuilder().WithName("external").WithMesh("default").Build()
+		mesMesh2 := samples.MeshExternalServiceExampleBuilder().WithName("external").WithMesh("mesh2").Build()
 		proxy := &core_xds.Proxy{
 			APIVersion: envoy_common.APIV3,
 			ZoneEgressProxy: &core_xds.ZoneEgressProxy{
@@ -499,13 +501,11 @@ var _ = Describe("MeshCircuitBreaker", func() {
 						Mesh: builders.Mesh().WithName("default").WithEnabledMTLSBackend("ca-1").WithBuiltinMTLSBackend("ca-1").Build(),
 						Resources: map[core_model.ResourceType]core_model.ResourceList{
 							meshexternalservice_api.MeshExternalServiceType: &meshexternalservice_api.MeshExternalServiceResourceList{
-								Items: []*meshexternalservice_api.MeshExternalServiceResource{
-									samples.MeshExternalServiceExampleBuilder().WithName("external").WithMesh("default").Build(),
-								},
+								Items: []*meshexternalservice_api.MeshExternalServiceResource{mesDefault},
 							},
 						},
 						Dynamic: core_xds.ExternalServiceDynamicPolicies{
-							"external": {
+							mesDefault.DestinationName(0): {
 								api.MeshCircuitBreakerType: core_xds.TypedMatchingPolicies{
 									ToRules: core_rules.ToRules{
 										ResourceRules: core_rules.ResourceRules{
@@ -527,13 +527,11 @@ var _ = Describe("MeshCircuitBreaker", func() {
 						Mesh: builders.Mesh().WithName("mesh2").WithEnabledMTLSBackend("ca-2").WithBuiltinMTLSBackend("ca-2").Build(),
 						Resources: map[core_model.ResourceType]core_model.ResourceList{
 							meshexternalservice_api.MeshExternalServiceType: &meshexternalservice_api.MeshExternalServiceResourceList{
-								Items: []*meshexternalservice_api.MeshExternalServiceResource{
-									samples.MeshExternalServiceExampleBuilder().WithName("external").WithMesh("mesh2").Build(),
-								},
+								Items: []*meshexternalservice_api.MeshExternalServiceResource{mesMesh2},
 							},
 						},
 						Dynamic: core_xds.ExternalServiceDynamicPolicies{
-							"external": {
+							mesMesh2.DestinationName(0): {
 								api.MeshCircuitBreakerType: core_xds.TypedMatchingPolicies{
 									ToRules: core_rules.ToRules{
 										ResourceRules: core_rules.ResourceRules{
diff --git a/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin_test.go
index f2d91515a..0d6ad00ba 100644
--- a/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1/plugin_test.go
@@ -329,7 +329,7 @@ var _ = Describe("MeshHealthCheck", func() {
 							},
 						},
 						Dynamic: core_xds.ExternalServiceDynamicPolicies{
-							"external": {
+							"default_external___extsvc_9000": {
 								api.MeshHealthCheckType: core_xds.TypedMatchingPolicies{
 									ToRules: core_rules.ToRules{
 										ResourceRules: core_rules.ResourceRules{
@@ -364,7 +364,7 @@ var _ = Describe("MeshHealthCheck", func() {
 							},
 						},
 						Dynamic: core_xds.ExternalServiceDynamicPolicies{
-							"external": {
+							"mesh-2_external___extsvc_9000": {
 								api.MeshHealthCheckType: core_xds.TypedMatchingPolicies{
 									ToRules: core_rules.ToRules{
 										ResourceRules: core_rules.ResourceRules{
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
index 750d7d498..f3c3509b0 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
@@ -195,12 +195,12 @@ var _ = Describe("MeshHTTPRoute", func() {
 		}()),
 		Entry("default-meshservice", func() outboundsTestCase {
 			outboundTargets := xds_builders.EndpointMap().
-				AddEndpoint("backend_msvc_80", xds_builders.Endpoint().
+				AddEndpoint("default_backend___msvc_80", xds_builders.Endpoint().
 					WithTarget("192.168.0.4").
 					WithPort(8084).
 					WithWeight(1).
 					WithTags(mesh_proto.ServiceTag, "backend", mesh_proto.ProtocolTag, core_mesh.ProtocolHTTP, "app", "backend")).
-				AddEndpoint("backend_msvc_80", xds_builders.Endpoint().
+				AddEndpoint("default_backend___msvc_80", xds_builders.Endpoint().
 					WithTarget("192.168.0.5").
 					WithPort(8084).
 					WithWeight(1).
@@ -236,7 +236,7 @@ var _ = Describe("MeshHTTPRoute", func() {
 					WithMeshBuilder(builders.Mesh().WithBuiltinMTLSBackend("builtin").WithEnabledMTLSBackend("builtin")).
 					WithEndpointMap(outboundTargets).
 					WithResources(resources).
-					AddServiceProtocol("backend_svc_80", core_mesh.ProtocolHTTP).
+					AddServiceProtocol("default_backend___svc_80", core_mesh.ProtocolHTTP).
 					Build(),
 				proxy: xds_builders.Proxy().
 					WithSecretsTracker(envoy.NewSecretsTracker(core_model.DefaultMesh, nil)).
@@ -698,7 +698,7 @@ var _ = Describe("MeshHTTPRoute", func() {
 				Items: []*meshservice_api.MeshServiceResource{&meshSvc},
 			}
 			outboundTargets := xds_builders.EndpointMap().
-				AddEndpoint("backend_msvc_80", xds_builders.Endpoint().
+				AddEndpoint("default_backend___msvc_80", xds_builders.Endpoint().
 					WithTarget("192.168.0.4").
 					WithPort(8084).
 					WithWeight(1).
@@ -791,7 +791,7 @@ var _ = Describe("MeshHTTPRoute", func() {
 													}},
 													Default: api.RuleConf{
 														BackendRefs: &[]common_api.BackendRef{{
-															TargetRef: builders.TargetRefMeshService("backend", "test-port"),
+															TargetRef: builders.TargetRefMeshService("backend", "", "test-port"),
 															Weight:    pointer.To(uint(100)),
 															Port:      pointer.To(uint32(80)),
 														}},
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.clusters.golden.yaml
index 00aa03799..8aad6df4d 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: backend-second_msvc_80
+- name: default_backend-second___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: backend-second_msvc_80
+    name: default_backend-second___msvc_80
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
@@ -38,7 +38,7 @@ resources:
         '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
         explicitHttpConfig:
           http2ProtocolOptions: {}
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -46,7 +46,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: backend_msvc_80
+    name: default_backend___msvc_80
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.endpoints.golden.yaml
index 5e55a7271..807974a23 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.endpoints.golden.yaml
@@ -1,9 +1,9 @@
 resources:
-- name: backend-second_msvc_80
+- name: default_backend-second___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: backend-second_msvc_80
-- name: backend_msvc_80
+    clusterName: default_backend-second___msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: backend_msvc_80
+    clusterName: default_backend___msvc_80
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.listeners.golden.yaml
index 6c4c62388..17218d45e 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.listeners.golden.yaml
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: outbound:backend_msvc_80
+            name: outbound:default_backend___msvc_80
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,39 +26,39 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: backend_msvc_80
+              name: default_backend___msvc_80
               routes:
               - match:
                   path: /version1
                 name: ExEgbKnY+1gXGsNYQ6CZ7dck4MNOIit5oX7HLROlnE4=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
               - match:
                   prefix: /version1/
                 name: ExEgbKnY+1gXGsNYQ6CZ7dck4MNOIit5oX7HLROlnE4=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
               - match:
                   path: /version2
                 name: mNuADh5d2QXFo3V0KWvZuj8EUfszOl6JoAaFFDm7ueU=
                 route:
-                  cluster: backend-second_msvc_80
+                  cluster: default_backend-second___msvc_80
                   timeout: 0s
               - match:
                   prefix: /version2/
                 name: mNuADh5d2QXFo3V0KWvZuj8EUfszOl6JoAaFFDm7ueU=
                 route:
-                  cluster: backend-second_msvc_80
+                  cluster: default_backend-second___msvc_80
                   timeout: 0s
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
-          statPrefix: backend_msvc_80
+          statPrefix: default_backend___msvc_80
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml
index 4aa51d1e6..672a3a22f 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml
@@ -29,7 +29,7 @@ resources:
         '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
         explicitHttpConfig:
           http2ProtocolOptions: {}
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -37,7 +37,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: backend_msvc_80
+    name: default_backend___msvc_80
     type: EDS
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml
index 4645a2edd..d65adb054 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml
@@ -53,10 +53,10 @@ resources:
             envoy.transport_socket_match:
               kuma.io/protocol: http
               region: us
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: backend_msvc_80
+    clusterName: default_backend___msvc_80
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml
index 71a8943cf..c6f3eb154 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: outbound:backend_msvc_80
+            name: outbound:default_backend___msvc_80
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,7 +26,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: backend_msvc_80
+              name: default_backend___msvc_80
               routes:
               - match:
                   path: /v1
@@ -68,21 +68,21 @@ resources:
                   path: /v4
                 name: UszzxTjarAB0Egv5zi/OpbBLkZsjGV5NpM2+96fwVa8=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
               - match:
                   prefix: /v4/
                 name: UszzxTjarAB0Egv5zi/OpbBLkZsjGV5NpM2+96fwVa8=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
-          statPrefix: backend_msvc_80
+          statPrefix: default_backend___msvc_80
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml
index 11bf33126..349f9dc73 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example
+    name: default_example___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml
index f330d84a3..9eff51c37 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example
+    clusterName: default_example___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml
index d0ce34daa..54648b4b5 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: outbound:10.20.20.1:9090
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: meshexternalservice_example
+            name: default_example___extsvc_9090
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,18 +26,18 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: example
+              name: default_example___extsvc_9090
               routes:
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
-          statPrefix: meshexternalservice_example
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
-    name: meshexternalservice_example
+    name: outbound:10.20.20.1:9090
     trafficDirection: OUTBOUND
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.clusters.golden.yaml
index 124a3921e..69d4cf61d 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: multi-backend_mzsvc_80
+- name: default_multi-backend___mzsvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: multi-backend_mzsvc_80
+    name: default_multi-backend___mzsvc_80
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.endpoints.golden.yaml
index ccde38c71..3f64ad2b0 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.endpoints.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: multi-backend_mzsvc_80
+- name: default_multi-backend___mzsvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: multi-backend_mzsvc_80
+    clusterName: default_multi-backend___mzsvc_80
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.listeners.golden.yaml
index 24898204b..e077a5afe 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.listeners.golden.yaml
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: outbound:multi-backend_mzsvc_80
+            name: outbound:default_multi-backend___mzsvc_80
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,15 +26,15 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: multi-backend_mzsvc_80
+              name: default_multi-backend___mzsvc_80
               routes:
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
-                  cluster: multi-backend_mzsvc_80
+                  cluster: default_multi-backend___mzsvc_80
                   timeout: 0s
-          statPrefix: multi-backend_mzsvc_80
+          statPrefix: default_multi-backend___mzsvc_80
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.clusters.golden.yaml
index 7dd19f9f4..4a93542b9 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: backend_msvc_80
+    name: default_backend___msvc_80
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.endpoints.golden.yaml
index 08e8478ee..c79b73dcd 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: backend_msvc_80
+    clusterName: default_backend___msvc_80
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.listeners.golden.yaml
index c087aedcb..401e08160 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.listeners.golden.yaml
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: outbound:backend_msvc_80
+            name: outbound:default_backend___msvc_80
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,15 +26,15 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: backend_msvc_80
+              name: default_backend___msvc_80
               routes:
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
-                  cluster: backend_msvc_80
+                  cluster: default_backend___msvc_80
                   timeout: 0s
-          statPrefix: backend_msvc_80
+          statPrefix: default_backend___msvc_80
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.clusters.golden.yaml
index 961b21fea..3cadb9706 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: backend_msvc_80-6c7282d3d97450ca
+- name: default_backend___msvc_80-01804e3659fbd290
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: backend_msvc_80-6c7282d3d97450ca
+    name: default_backend___msvc_80-01804e3659fbd290
     perConnectionBufferLimitBytes: 32768
     type: EDS
     typedExtensionProtocolOptions:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.endpoints.golden.yaml
index eff575153..a88afc078 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.endpoints.golden.yaml
@@ -1,13 +1,5 @@
 resources:
-- name: backend_msvc_80-6c7282d3d97450ca
+- name: default_backend___msvc_80-01804e3659fbd290
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: backend_msvc_80-6c7282d3d97450ca
-    endpoints:
-    - lbEndpoints:
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.4
-              portValue: 8080
-        loadBalancingWeight: 1
+    clusterName: default_backend___msvc_80-01804e3659fbd290
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.routes.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.routes.golden.yaml
index c23dd9047..bf697c3ca 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.routes.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-real-mesh-service.routes.golden.yaml
@@ -20,7 +20,7 @@ resources:
           idleTimeout: 5s
           weightedClusters:
             clusters:
-            - name: backend_msvc_80-6c7282d3d97450ca
+            - name: default_backend___msvc_80-01804e3659fbd290
               requestHeadersToAdd:
               - header:
                   key: x-kuma-tags
@@ -34,7 +34,7 @@ resources:
           idleTimeout: 5s
           weightedClusters:
             clusters:
-            - name: backend_msvc_80-6c7282d3d97450ca
+            - name: default_backend___msvc_80-01804e3659fbd290
               requestHeadersToAdd:
               - header:
                   key: x-kuma-tags
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml
index 2225f0d6a..68dd0f333 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example
+    name: default_example___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.endpoints.golden.yaml
index f330d84a3..9eff51c37 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example
+    clusterName: default_example___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.listeners.golden.yaml
index e55b6e699..49af57fd4 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.listeners.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: outbound:10.20.20.1:9090
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: meshexternalservice_example
+            name: default_example___extsvc_9090
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,32 +26,32 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: example
+              name: default_example___extsvc_9090
               routes:
               - match:
                   path: /v1
                 name: bzv64o+joRk33jfDADgGv5ar4QyONO0NEVKnoBfJW/E=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
               - match:
                   prefix: /v1/
                 name: bzv64o+joRk33jfDADgGv5ar4QyONO0NEVKnoBfJW/E=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
-          statPrefix: meshexternalservice_example
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
-    name: meshexternalservice_example
+    name: outbound:10.20.20.1:9090
     trafficDirection: OUTBOUND
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.clusters.golden.yaml
index 11bf33126..349f9dc73 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example
+    name: default_example___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.endpoints.golden.yaml
index f330d84a3..9eff51c37 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example
+    clusterName: default_example___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.listeners.golden.yaml
index d0ce34daa..54648b4b5 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.listeners.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: outbound:10.20.20.1:9090
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: meshexternalservice_example
+            name: default_example___extsvc_9090
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,18 +26,18 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: example
+              name: default_example___extsvc_9090
               routes:
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
-          statPrefix: meshexternalservice_example
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
-    name: meshexternalservice_example
+    name: outbound:10.20.20.1:9090
     trafficDirection: OUTBOUND
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.clusters.golden.yaml
index 11bf33126..349f9dc73 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example
+    name: default_example___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.endpoints.golden.yaml
index f330d84a3..9eff51c37 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example
+    clusterName: default_example___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.listeners.golden.yaml
index d0ce34daa..54648b4b5 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.listeners.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: outbound:10.20.20.1:9090
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: meshexternalservice_example
+            name: default_example___extsvc_9090
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,18 +26,18 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: example
+              name: default_example___extsvc_9090
               routes:
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
-          statPrefix: meshexternalservice_example
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
-    name: meshexternalservice_example
+    name: outbound:10.20.20.1:9090
     trafficDirection: OUTBOUND
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.clusters.golden.yaml
index 11bf33126..349f9dc73 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example
+    name: default_example___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.endpoints.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.endpoints.golden.yaml
index f330d84a3..9eff51c37 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example
+    clusterName: default_example___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.listeners.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.listeners.golden.yaml
index d0ce34daa..54648b4b5 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.listeners.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: meshexternalservice_example
+- name: outbound:10.20.20.1:9090
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
@@ -17,7 +17,7 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           normalizePath: true
           routeConfig:
-            name: meshexternalservice_example
+            name: default_example___extsvc_9090
             requestHeadersToAdd:
             - header:
                 key: x-kuma-tags
@@ -26,18 +26,18 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: example
+              name: default_example___extsvc_9090
               routes:
               - match:
                   prefix: /
                 name: 9Zuf5Tg79OuZcQITwBbQykxAk2u4fRKrwYn3//AL4Yo=
                 route:
                   autoHostRewrite: true
-                  cluster: meshexternalservice_example
+                  cluster: default_example___extsvc_9090
                   timeout: 0s
-          statPrefix: meshexternalservice_example
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
-    name: meshexternalservice_example
+    name: outbound:10.20.20.1:9090
     trafficDirection: OUTBOUND
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go
index e6b3ee90e..1f0b742c5 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go
@@ -34,7 +34,7 @@ import (
 	"github.com/kumahq/kuma/pkg/xds/envoy/clusters"
 	"github.com/kumahq/kuma/pkg/xds/envoy/endpoints/v3"
 	. "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
-	"github.com/kumahq/kuma/pkg/xds/envoy/names"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 	"github.com/kumahq/kuma/pkg/xds/generator"
 	"github.com/kumahq/kuma/pkg/xds/generator/egress"
 )
@@ -460,7 +460,7 @@ var _ = Describe("MeshLoadBalancingStrategy", func() {
 		Entry("egress_meshexternalservice", testCase{
 			resources: []core_xds.Resource{
 				{
-					Name:   "mesh-1:external",
+					Name:   "mesh-1_external___extsvc_9000",
 					Origin: egress.OriginEgress,
 					Resource: clusters.NewClusterBuilder(envoy_common.APIV3, "mesh-1:external").
 						Configure(clusters.EdsCluster()).
@@ -482,9 +482,9 @@ var _ = Describe("MeshLoadBalancingStrategy", func() {
 					Name:   "egress-listener",
 					Origin: egress.OriginEgress,
 					Resource: NewInboundListenerBuilder(envoy_common.APIV3, "127.0.0.1", 10002, core_xds.SocketAddressProtocolTCP).
-						Configure(FilterChain(NewFilterChainBuilder(envoy_common.APIV3, names.GetEgressFilterChainName("external", "mesh-1")).
+						Configure(FilterChain(NewFilterChainBuilder(envoy_common.APIV3, "mesh-1_external___extsvc_9000").
 							Configure(MatchTransportProtocol("tls")).
-							Configure(MatchServerNames("external{mesh=mesh-1}")).
+							Configure(MatchServerNames(tls.SNIForResource("external", "mesh-1", meshexternalservice_api.MeshExternalServiceType, 9000, nil))).
 							Configure(HttpConnectionManager("127.0.0.1:10002", false)).
 							Configure(
 								HttpInboundRoutes(
@@ -508,7 +508,7 @@ var _ = Describe("MeshLoadBalancingStrategy", func() {
 						{
 							Mesh: builders.Mesh().WithName("mesh-1").Build(),
 							Dynamic: core_xds.ExternalServiceDynamicPolicies{
-								"external": {
+								"mesh-1_external___extsvc_9000": {
 									v1alpha1.MeshLoadBalancingStrategyType: core_xds.TypedMatchingPolicies{
 										ToRules: core_rules.ToRules{
 											ResourceRules: core_rules.ResourceRules{
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.clusters.golden.yaml b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.clusters.golden.yaml
index 57fe21d9d..4ec8c466b 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: mesh-1:external
+- name: mesh-1_external___extsvc_9000
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: mesh-1_external
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.listeners.golden.yaml b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.listeners.golden.yaml
index be79b1e9a..821349178 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/testdata/egress_meshexternalservice.listeners.golden.yaml
@@ -10,7 +10,7 @@ resources:
     filterChains:
     - filterChainMatch:
         serverNames:
-        - external{mesh=mesh-1}
+        - ad098e6a3e7e807e1.external.9000.mesh-1.mes
         transportProtocol: tls
       filters:
       - name: envoy.filters.network.http_connection_manager
@@ -42,6 +42,6 @@ resources:
                       sourceIp: true
                   timeout: 0s
           statPrefix: "127_0_0_1_10002"
-      name: external_mesh-1
+      name: mesh-1_external___extsvc_9000
     name: inbound:127.0.0.1:10002
     trafficDirection: INBOUND
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
index 7c6eb9397..8a90895cf 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
@@ -479,7 +479,7 @@ var _ = Describe("MeshTCPRoute", func() {
 											{
 												TargetRef: builders.TargetRefMeshExternalService("example2"),
 												Weight:    pointer.To(uint(100)),
-												Port:      pointer.To(uint32(80)),
+												Port:      pointer.To(uint32(9090)),
 											},
 										},
 									},
@@ -580,14 +580,14 @@ var _ = Describe("MeshTCPRoute", func() {
 				Items: []*meshservice_api.MeshServiceResource{&meshSvc},
 			}
 			outboundTargets := xds_builders.EndpointMap().
-				AddEndpoint("backend_msvc_80", xds_builders.Endpoint().
+				AddEndpoint("default_backend___msvc_80", xds_builders.Endpoint().
 					WithTarget("192.168.0.4").
 					WithPort(8084).
 					WithWeight(1).
 					WithTags(mesh_proto.ServiceTag, "backend", mesh_proto.ProtocolTag, core_mesh.ProtocolHTTP, "app", "backend"))
 			return outboundsTestCase{
 				xdsContext: *xds_builders.Context().WithEndpointMap(outboundTargets).
-					AddServiceProtocol("backend", core_mesh.ProtocolHTTP).
+					AddServiceProtocol("default_backend___msvc_80", core_mesh.ProtocolHTTP).
 					WithResources(resources).
 					Build(),
 				proxy: xds_builders.Proxy().
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml
index 699f9b7cf..da8c0b86b 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.clusters.golden.yaml
@@ -1,5 +1,5 @@
 resources:
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -7,7 +7,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: backend_msvc_80
+    name: default_backend___msvc_80
     type: EDS
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml
index dd9bd95fc..ccbf65a51 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.endpoints.golden.yaml
@@ -1,8 +1,8 @@
 resources:
-- name: backend_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: backend_msvc_80
+    clusterName: default_backend___msvc_80
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml
index 4477af8fb..cd1a1ab8f 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml
@@ -11,8 +11,8 @@ resources:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-          cluster: backend_msvc_80
-          statPrefix: backend_msvc_80
+          cluster: default_backend___msvc_80
+          statPrefix: default_backend___msvc_80
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml
index 780baa54c..bd215a779 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.clusters.golden.yaml
@@ -38,7 +38,7 @@ resources:
         '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
         explicitHttpConfig:
           http2ProtocolOptions: {}
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -46,7 +46,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example
+    name: default_example___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml
index 821110d37..8ce798d66 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.endpoints.golden.yaml
@@ -3,10 +3,10 @@ resources:
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
     clusterName: backend
-- name: meshexternalservice_example
+- name: default_example___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example
+    clusterName: default_example___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml
index e019bb3a2..10df75844 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml
@@ -11,8 +11,8 @@ resources:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-          cluster: meshexternalservice_example
-          statPrefix: example
+          cluster: default_example___extsvc_9090
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.clusters.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.clusters.golden.yaml
index a50c934d9..fde88a03c 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.clusters.golden.yaml
@@ -38,7 +38,7 @@ resources:
         '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
         explicitHttpConfig:
           http2ProtocolOptions: {}
-- name: meshexternalservice_example2
+- name: default_example2___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     edsClusterConfig:
@@ -46,7 +46,7 @@ resources:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: meshexternalservice_example2
+    name: default_example2___extsvc_9090
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
@@ -70,5 +70,5 @@ resources:
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
-        sni: a0ac70962fd61fdc0.example2.80.default.mes
+        sni: a0ac70962fd61fdc0.example2.9090.default.mes
     type: EDS
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.endpoints.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.endpoints.golden.yaml
index 724b13291..fa5da3871 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.endpoints.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.endpoints.golden.yaml
@@ -3,10 +3,10 @@ resources:
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
     clusterName: backend
-- name: meshexternalservice_example2
+- name: default_example2___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: meshexternalservice_example2
+    clusterName: default_example2___extsvc_9090
     endpoints:
     - lbEndpoints:
       - endpoint:
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.listeners.golden.yaml b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.listeners.golden.yaml
index 46b85601b..6acf510fe 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.listeners.golden.yaml
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/testdata/tcproute-meshexternalservice.listeners.golden.yaml
@@ -11,8 +11,8 @@ resources:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-          cluster: meshexternalservice_example2
-          statPrefix: example
+          cluster: default_example2___extsvc_9090
+          statPrefix: default_example___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
@@ -30,8 +30,8 @@ resources:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-          cluster: meshexternalservice_example2
-          statPrefix: example2
+          cluster: default_example2___extsvc_9090
+          statPrefix: default_example2___extsvc_9090
     metadata:
       filterMetadata:
         io.kuma.tags: {}
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go b/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go
index ca0e87778..98a59947e 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go
@@ -419,6 +419,7 @@ var _ = Describe("PodReconciler", func() {
 			Log:           core.Log.WithName("test"),
 			PodConverter: PodConverter{
 				ResourceConverter: k8s.NewSimpleConverter(),
+				ServiceGetter:     kubeClient,
 			},
 			SystemNamespace:   "kuma-system",
 			ResourceConverter: k8s.NewSimpleConverter(),
@@ -738,6 +739,170 @@ var _ = Describe("PodReconciler", func() {
 `))
 	})
 
+	It("should not update Dataplane if nothing has changed", func() {
+		// setup
+		err := kubeClient.Create(context.Background(), &mesh_k8s.Dataplane{
+			Mesh: "poc",
+			ObjectMeta: kube_meta.ObjectMeta{
+				Namespace: "demo",
+				Name:      "pod-with-kuma-sidecar-and-ip",
+			},
+			Spec: mesh_k8s.ToSpec(&mesh_proto.Dataplane{
+				Networking: &mesh_proto.Dataplane_Networking{
+					Address: "192.168.0.1",
+					Inbound: []*mesh_proto.Dataplane_Networking_Inbound{
+						{
+							Port:   8080,
+							Health: &mesh_proto.Dataplane_Networking_Inbound_Health{},
+							State:  mesh_proto.Dataplane_Networking_Inbound_NotReady,
+							Tags: map[string]string{
+								"app":                      "sample",
+								"kuma.io/protocol":         "http",
+								"kuma.io/service":          "example_demo_svc_80",
+								"k8s.kuma.io/service-name": "example",
+								"k8s.kuma.io/service-port": "80",
+								"k8s.kuma.io/namespace":    "demo",
+							},
+						},
+						{
+							Port:   6060,
+							Health: &mesh_proto.Dataplane_Networking_Inbound_Health{},
+							State:  mesh_proto.Dataplane_Networking_Inbound_NotReady,
+							Tags: map[string]string{
+								"app":                      "sample",
+								"kuma.io/protocol":         "tcp",
+								"kuma.io/service":          "example_demo_svc_6061",
+								"k8s.kuma.io/service-name": "example",
+								"k8s.kuma.io/service-port": "6061",
+								"k8s.kuma.io/namespace":    "demo",
+							},
+						},
+						{
+							Port:   9090,
+							Health: &mesh_proto.Dataplane_Networking_Inbound_Health{},
+							State:  mesh_proto.Dataplane_Networking_Inbound_NotReady,
+							Tags: map[string]string{
+								"app":                      "sample",
+								"kuma.io/protocol":         "http",
+								"kuma.io/service":          "manual-example_demo_svc_90",
+								"k8s.kuma.io/service-name": "manual-example",
+								"k8s.kuma.io/service-port": "90",
+								"k8s.kuma.io/namespace":    "demo",
+							},
+						},
+					},
+					Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
+						{
+							Address: "192.168.0.1",
+							Port:    6061,
+							Tags: map[string]string{
+								"kuma.io/service": "example_demo_svc_6061",
+							},
+						},
+						{
+							Address: "192.168.0.1",
+							Port:    80,
+							Tags: map[string]string{
+								"kuma.io/service": "example_demo_svc_80",
+							},
+						},
+						{
+							Address: "192.168.0.1",
+							Port:    90,
+							Tags: map[string]string{
+								"kuma.io/service": "manual-example_demo_svc_90",
+							},
+						},
+					},
+				},
+			}),
+		})
+
+		Expect(err).NotTo(HaveOccurred())
+
+		// given
+		req := kube_ctrl.Request{
+			NamespacedName: kube_types.NamespacedName{Namespace: "demo", Name: "pod-with-kuma-sidecar-and-ip"},
+		}
+
+		// when
+		result, err := reconciler.Reconcile(context.Background(), req)
+
+		// then
+		Expect(err).ToNot(HaveOccurred())
+		// and
+		Expect(result).To(BeZero())
+
+		// when
+		dataplanes := &mesh_k8s.DataplaneList{}
+		err = kubeClient.List(context.Background(), dataplanes)
+		// then
+		Expect(err).ToNot(HaveOccurred())
+		// and
+		Expect(dataplanes.Items).To(HaveLen(1))
+
+		// when
+		actual, err := json.Marshal(dataplanes.Items[0])
+		// then
+		Expect(err).ToNot(HaveOccurred())
+		// and should not add owner reference
+		Expect(actual).To(MatchYAML(`
+        mesh: poc
+        metadata:
+          creationTimestamp: null
+          name: pod-with-kuma-sidecar-and-ip
+          namespace: demo
+          resourceVersion: "1"
+        spec:
+          networking:
+            address: 192.168.0.1
+            inbound:
+            - state: NotReady 
+              health: {}
+              port: 8080
+              tags:
+                app: sample
+                kuma.io/protocol: http
+                kuma.io/service: example_demo_svc_80
+                k8s.kuma.io/service-name: example
+                k8s.kuma.io/service-port: "80"
+                k8s.kuma.io/namespace: demo
+            - state: NotReady
+              health: {}
+              port: 6060
+              tags:
+                app: sample
+                kuma.io/service: example_demo_svc_6061
+                kuma.io/protocol: tcp
+                k8s.kuma.io/service-name: example
+                k8s.kuma.io/service-port: "6061"
+                k8s.kuma.io/namespace: demo
+            - state: NotReady
+              health: {}
+              port: 9090
+              tags:
+                app: sample
+                kuma.io/service: manual-example_demo_svc_90
+                kuma.io/protocol: http
+                k8s.kuma.io/service-name: manual-example
+                k8s.kuma.io/service-port: "90"
+                k8s.kuma.io/namespace: demo
+            outbound:
+            - address: 192.168.0.1
+              port: 6061
+              tags:
+                kuma.io/service: example_demo_svc_6061
+            - address: 192.168.0.1
+              port: 80
+              tags:
+                kuma.io/service: example_demo_svc_80
+            - address: 192.168.0.1
+              port: 90
+              tags:
+                kuma.io/service: manual-example_demo_svc_90
+`))
+	})
+
 	It("should update Pods when ExternalService updated", func() {
 		err := kubeClient.Create(context.Background(), &mesh_k8s.Dataplane{
 			Mesh: "mesh-1",
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_converter_test.go b/pkg/plugins/runtime/k8s/controllers/pod_converter_test.go
index 6b0c30ef8..db8f6ab42 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_converter_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_converter_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/kumahq/kuma/pkg/plugins/resources/k8s"
 	mesh_k8s "github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 	. "github.com/kumahq/kuma/pkg/plugins/runtime/k8s/controllers"
+	k8s_util "github.com/kumahq/kuma/pkg/plugins/runtime/k8s/util"
 	. "github.com/kumahq/kuma/pkg/test/matchers"
 	"github.com/kumahq/kuma/pkg/util/pointer"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
@@ -51,6 +52,7 @@ var _ = Describe("PodToDataplane(..)", func() {
 		dataplane         string
 		existingDataplane string
 		nodeLabelsToCopy  []string
+		unchanged         bool
 	}
 	DescribeTable("should convert Pod into a Dataplane YAML version",
 		func(given testCase) {
@@ -360,11 +362,16 @@ var _ = Describe("PodToDataplane(..)", func() {
 
 			// then
 			err = converter.PodToIngress(context.Background(), ingress, pod, services)
-			Expect(err).ToNot(HaveOccurred())
+			if given.unchanged {
+				Expect(err).To(HaveOccurred())
+				Expect(err).To(Equal(k8s_util.UnchangedResourceError))
+			} else {
+				Expect(err).ToNot(HaveOccurred())
 
-			actual, err := yaml.Marshal(ingress)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(actual).To(MatchGoldenYAML(filepath.Join("testdata", "ingress", given.dataplane)))
+				actual, err := yaml.Marshal(ingress)
+				Expect(err).ToNot(HaveOccurred())
+				Expect(actual).To(MatchGoldenYAML(filepath.Join("testdata", "ingress", given.dataplane)))
+			}
 		},
 		Entry("01. Ingress with load balancer service and hostname", testCase{ // AWS use case
 			pod:            "01.pod.yaml",
@@ -398,11 +405,11 @@ var _ = Describe("PodToDataplane(..)", func() {
 			servicesForPod: "06.services-for-pod.yaml",
 			dataplane:      "06.dataplane.yaml",
 		}),
-		Entry("Existing ZoneIngress with load balancer and ip", testCase{
+		Entry("Existing ZoneIngress with load balancer and ip should not be updated when no change", testCase{
 			pod:               "ingress-exists.pod.yaml",
 			servicesForPod:    "ingress-exists.services-for-pod.yaml",
 			existingDataplane: "ingress-exists.existing-dataplane.yaml",
-			dataplane:         "ingress-exists.golden.yaml",
+			unchanged:         true,
 		}),
 	)
 
diff --git a/pkg/plugins/runtime/k8s/controllers/testdata/ingress/ingress-exists.golden.yaml b/pkg/plugins/runtime/k8s/controllers/testdata/ingress/ingress-exists.golden.yaml
deleted file mode 100644
index 74ebdeff6..000000000
--- a/pkg/plugins/runtime/k8s/controllers/testdata/ingress/ingress-exists.golden.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-metadata:
-  creationTimestamp: null
-spec:
-  availableServices:
-  - instances: 3
-    mesh: mesh-1
-    tags:
-      kuma.io/protocol: http
-      kuma.io/service: service-1-zone-2
-  networking:
-    address: 192.168.0.1
-    advertisedAddress: 192.168.100.1
-    advertisedPort: 10001
-    port: 10001
diff --git a/pkg/plugins/runtime/k8s/webhooks/defaulter_test.go b/pkg/plugins/runtime/k8s/webhooks/defaulter_test.go
index 41de498e3..736fb7125 100644
--- a/pkg/plugins/runtime/k8s/webhooks/defaulter_test.go
+++ b/pkg/plugins/runtime/k8s/webhooks/defaulter_test.go
@@ -360,8 +360,7 @@ var _ = Describe("Defaulter", func() {
                 "creationTimestamp": null,
                 "labels": {
                   "kuma.io/mesh": "default",
-                  "kuma.io/origin": "global",
-                  "kuma.io/policy-role": "workload-owner"
+                  "kuma.io/origin": "global"
                 },
                 "annotations": {
                   "kuma.io/display-name": "empty"
@@ -551,8 +550,7 @@ var _ = Describe("Defaulter", func() {
                 "labels": {
                   "kuma.io/mesh": "default",
                   "kuma.io/origin": "zone",
-                  "kuma.io/zone": "zone-1",
-                  "kuma.io/policy-role": "system"
+                  "kuma.io/zone": "zone-1"
                 },
                 "annotations": {
                   "kuma.io/display-name": "empty"
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_dpp.global.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_dpp.global.golden.yaml
index 44a4228d3..493306707 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_dpp.global.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_dpp.global.golden.yaml
@@ -2,11 +2,6 @@ Patches: null
 allowed: false
 status:
   code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be empty
-      reason: FieldValueInvalid
   message: Operation not allowed. Kuma resources like Dataplane can be updated or
     deleted only from the ZONE control plane and not from a GLOBAL control plane.
   metadata: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-policy-role-label.federated.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-policy-role-label.federated.golden.yaml
index 3e0bdfddf..190722b79 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-policy-role-label.federated.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-policy-role-label.federated.golden.yaml
@@ -1,15 +1,6 @@
 Patches: null
-allowed: false
+allowed: true
 status:
-  code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be set
-      reason: FieldValueInvalid
-  message: Operation not allowed. kuma.io/policy-role label should have consumer value,
-    got invalid
+  code: 200
   metadata: {}
-  reason: Forbidden
-  status: Failure
 uid: "12345"
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-system-policy-role-label.federated.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-system-policy-role-label.federated.golden.yaml
index 78b13183c..190722b79 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-system-policy-role-label.federated.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-system-policy-role-label.federated.golden.yaml
@@ -1,15 +1,6 @@
 Patches: null
-allowed: false
+allowed: true
 status:
-  code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be set
-      reason: FieldValueInvalid
-  message: Operation not allowed. kuma.io/policy-role label should have system value,
-    got invalid
+  code: 200
   metadata: {}
-  reason: Forbidden
-  status: Failure
 uid: "12345"
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-zone-label.federated.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-zone-label.federated.golden.yaml
index 9fb5fc4f7..b63c8cf33 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-zone-label.federated.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_mt-zone-label.federated.golden.yaml
@@ -2,11 +2,6 @@ Patches: null
 allowed: false
 status:
   code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be set
-      reason: FieldValueInvalid
   message: Operation not allowed. kuma.io/zone label should have zone-1 value, got
     wrong-zone
   metadata: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_tr.federated.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_tr.federated.golden.yaml
index 776b05429..b699dca31 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_tr.federated.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_create_tr.federated.golden.yaml
@@ -2,11 +2,6 @@ Patches: null
 allowed: false
 status:
   code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be empty
-      reason: FieldValueInvalid
   message: Operation not allowed. Kuma resources like TrafficRoute can be updated
     or deleted only from the GLOBAL control plane and not from a ZONE control plane.
   metadata: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_delete_tr.federated.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_delete_tr.federated.golden.yaml
index 776b05429..b699dca31 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_delete_tr.federated.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_delete_tr.federated.golden.yaml
@@ -2,11 +2,6 @@ Patches: null
 allowed: false
 status:
   code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be empty
-      reason: FieldValueInvalid
   message: Operation not allowed. Kuma resources like TrafficRoute can be updated
     or deleted only from the GLOBAL control plane and not from a ZONE control plane.
   metadata: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_update_tr.federated.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_update_tr.federated.golden.yaml
index 776b05429..b699dca31 100644
--- a/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_update_tr.federated.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/testdata/validation/cli-user_update_tr.federated.golden.yaml
@@ -2,11 +2,6 @@ Patches: null
 allowed: false
 status:
   code: 403
-  details:
-    causes:
-    - field: metadata.annotations[kuma.io/synced]
-      message: cannot be empty
-      reason: FieldValueInvalid
   message: Operation not allowed. Kuma resources like TrafficRoute can be updated
     or deleted only from the GLOBAL control plane and not from a ZONE control plane.
   metadata: {}
diff --git a/pkg/test/resources/builders/targetref_builder.go b/pkg/test/resources/builders/targetref_builder.go
index 47fbb1d96..bd1fb9881 100644
--- a/pkg/test/resources/builders/targetref_builder.go
+++ b/pkg/test/resources/builders/targetref_builder.go
@@ -32,10 +32,19 @@ func TargetRefServiceSubset(name string, kv ...string) common_api.TargetRef {
 	}
 }
 
-func TargetRefMeshService(name, sectionName string) common_api.TargetRef {
+func TargetRefMeshService(name, namespace, sectionName string) common_api.TargetRef {
 	return common_api.TargetRef{
 		Kind:        common_api.MeshService,
 		Name:        name,
+		Namespace:   namespace,
+		SectionName: sectionName,
+	}
+}
+
+func TargetRefMeshServiceLabels(labels map[string]string, sectionName string) common_api.TargetRef {
+	return common_api.TargetRef{
+		Kind:        common_api.MeshService,
+		Labels:      labels,
 		SectionName: sectionName,
 	}
 }
diff --git a/pkg/xds/generator/egress/testdata/01.externalservice-only.golden.yaml b/pkg/xds/generator/egress/testdata/01.externalservice-only.golden.yaml
index deda6d078..20bb1d702 100644
--- a/pkg/xds/generator/egress/testdata/01.externalservice-only.golden.yaml
+++ b/pkg/xds/generator/egress/testdata/01.externalservice-only.golden.yaml
@@ -30,14 +30,13 @@ resources:
         '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
         explicitHttpConfig:
           httpProtocolOptions: {}
-- name: meshexternalservice-1
+- name: mesh-1_meshexternalservice-1___extsvc_9090
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-    altStatName: mesh-1_meshexternalservice_meshexternalservice-1
     connectTimeout: 5s
     dnsLookupFamily: V4_ONLY
     loadAssignment:
-      clusterName: mesh-1:meshexternalservice_meshexternalservice-1
+      clusterName: mesh-1_meshexternalservice-1___extsvc_9090
       endpoints:
       - lbEndpoints:
         - endpoint:
@@ -64,7 +63,7 @@ resources:
                 mesh: mesh-1
               envoy.transport_socket_match:
                 mesh: mesh-1
-    name: mesh-1:meshexternalservice_meshexternalservice-1
+    name: mesh-1_meshexternalservice-1___extsvc_9090
     type: STRICT_DNS
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -164,21 +163,21 @@ resources:
             typedConfig:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           routeConfig:
-            name: mesh-1:meshexternalservice_meshexternalservice-1
+            name: mesh-1_meshexternalservice-1___extsvc_9090
             validateClusters: false
             virtualHosts:
             - domains:
               - '*'
-              name: meshexternalservice-1
+              name: mesh-1_meshexternalservice-1___extsvc_9090
               routes:
               - match:
                   prefix: /
                 route:
                   autoHostRewrite: true
-                  cluster: mesh-1:meshexternalservice_meshexternalservice-1
+                  cluster: mesh-1_meshexternalservice-1___extsvc_9090
                   timeout: 0s
-          statPrefix: meshexternalservice-1
-      name: meshexternalservice-1_mesh-1
+          statPrefix: mesh-1_meshexternalservice-1___extsvc_9090
+      name: mesh-1_meshexternalservice-1___extsvc_9090
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
diff --git a/pkg/xds/generator/testdata/ingress/mesh-service.envoy.golden.yaml b/pkg/xds/generator/testdata/ingress/mesh-service.envoy.golden.yaml
index ec5663639..25b83fad9 100644
--- a/pkg/xds/generator/testdata/ingress/mesh-service.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/ingress/mesh-service.envoy.golden.yaml
@@ -1,36 +1,34 @@
 resources:
-- name: mesh1:backend2_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-    altStatName: mesh1_backend2_msvc_80
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: mesh1:backend2_msvc_80
+    name: default_backend___msvc_80
     type: EDS
-- name: mesh1:backend_msvc_80
+- name: default_backend__east_msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-    altStatName: mesh1_backend_msvc_80
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
         initialFetchTimeout: 0s
         resourceApiVersion: V3
-    name: mesh1:backend_msvc_80
+    name: default_backend__east_msvc_80
     type: EDS
-- name: mesh1:backend2_msvc_80
+- name: default_backend___msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: mesh1:backend2_msvc_80
-- name: mesh1:backend_msvc_80
+    clusterName: default_backend___msvc_80
+- name: default_backend__east_msvc_80
   resource:
     '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
-    clusterName: mesh1:backend_msvc_80
+    clusterName: default_backend__east_msvc_80
 - name: inbound:10.0.0.1:10001
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
@@ -48,8 +46,8 @@ resources:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-          cluster: default:backend_msvc_80
-          statPrefix: default_backend_msvc_80
+          cluster: default_backend__east_msvc_80
+          statPrefix: default_backend__east_msvc_80
     - filterChainMatch:
         serverNames:
         - aec60634adf0f45d6.backend2.80.default.ms
@@ -58,8 +56,8 @@ resources:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-          cluster: default:backend2_msvc_80
-          statPrefix: default_backend2_msvc_80
+          cluster: default_backend___msvc_80
+          statPrefix: default_backend___msvc_80
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:
diff --git a/pkg/xds/topology/ingress_outbound_test.go b/pkg/xds/topology/ingress_outbound_test.go
index 71eb21add..388f2259b 100644
--- a/pkg/xds/topology/ingress_outbound_test.go
+++ b/pkg/xds/topology/ingress_outbound_test.go
@@ -313,7 +313,7 @@ var _ = Describe("IngressTrafficRoute", func() {
 							ExternalService: nil,
 						},
 					},
-					"kong_kong-system_msvc_8080": []core_xds.Endpoint{
+					"default_kong.kong-system___msvc_8080": []core_xds.Endpoint{
 						{
 							Target:         "192.168.0.2",
 							UnixDomainPath: "",
@@ -340,7 +340,7 @@ var _ = Describe("IngressTrafficRoute", func() {
 							ExternalService: nil,
 						},
 					},
-					"redis_msvc_6379": []core_xds.Endpoint{
+					"default_redis___msvc_6379": []core_xds.Endpoint{
 						{
 							Target:         "192.168.0.1",
 							UnixDomainPath: "",
@@ -353,7 +353,7 @@ var _ = Describe("IngressTrafficRoute", func() {
 							ExternalService: nil,
 						},
 					},
-					"redis-0_msvc_6379": []core_xds.Endpoint{
+					"default_redis-0___msvc_6379": []core_xds.Endpoint{
 						{
 							Target: "192.168.0.1",
 							Port:   6379,
@@ -375,7 +375,7 @@ var _ = Describe("IngressTrafficRoute", func() {
 							ExternalService: nil,
 						},
 					},
-					"kong_kong-system_msvc_8081": []core_xds.Endpoint{
+					"default_kong.kong-system___msvc_8081": []core_xds.Endpoint{
 						{
 							Target:         "192.168.0.2",
 							UnixDomainPath: "",
diff --git a/pkg/xds/topology/outbound_test.go b/pkg/xds/topology/outbound_test.go
index 7b68ffbcd..2eea6cdfa 100644
--- a/pkg/xds/topology/outbound_test.go
+++ b/pkg/xds/topology/outbound_test.go
@@ -1259,7 +1259,7 @@ var _ = Describe("TrafficRoute", func() {
 							Weight:   1,
 						},
 					},
-					"redis_msvc_6379": []core_xds.Endpoint{
+					"default_redis___msvc_6379": []core_xds.Endpoint{
 						{
 							Target:   "192.168.0.1",
 							Port:     6379,
@@ -1268,7 +1268,7 @@ var _ = Describe("TrafficRoute", func() {
 							Weight:   1,
 						},
 					},
-					"redis-0_msvc_6379": []core_xds.Endpoint{
+					"default_redis-0___msvc_6379": []core_xds.Endpoint{
 						{
 							Target:   "192.168.0.1",
 							Port:     6379,
@@ -1286,7 +1286,7 @@ var _ = Describe("TrafficRoute", func() {
 							Weight:   1,
 						},
 					},
-					"kong_kong-system_msvc_8080": []core_xds.Endpoint{
+					"default_kong.kong-system___msvc_8080": []core_xds.Endpoint{
 						{
 							Target:   "192.168.0.2",
 							Port:     80,
@@ -1304,7 +1304,7 @@ var _ = Describe("TrafficRoute", func() {
 							Weight:   1,
 						},
 					},
-					"kong_kong-system_msvc_8081": []core_xds.Endpoint{
+					"default_kong.kong-system___msvc_8081": []core_xds.Endpoint{
 						{
 							Target:   "192.168.0.2",
 							Port:     8001,
@@ -1423,7 +1423,7 @@ var _ = Describe("TrafficRoute", func() {
 				},
 				mesh: defaultMeshWithMTLSAndZoneEgress,
 				expected: core_xds.EndpointMap{
-					"another-mes": []core_xds.Endpoint{
+					"default_another-mes___extsvc_10000": []core_xds.Endpoint{
 						{
 							Target: "1.1.1.1",
 							Port:   10002,
@@ -1445,7 +1445,7 @@ var _ = Describe("TrafficRoute", func() {
 							},
 						},
 					},
-					"example-mes": []core_xds.Endpoint{
+					"default_example-mes___extsvc_10000": []core_xds.Endpoint{
 						{
 							Target:   "1.1.1.1",
 							Port:     10002,
@@ -1555,7 +1555,7 @@ var _ = Describe("TrafficRoute", func() {
 							Weight: 1,
 						},
 					},
-					"backend_msvc_80": []core_xds.Endpoint{
+					"default_backend___msvc_80": []core_xds.Endpoint{
 						{
 							Target: "192.168.0.1",
 							Port:   80,
@@ -1565,19 +1565,19 @@ var _ = Describe("TrafficRoute", func() {
 							Weight: 1,
 						},
 					},
-					"backend-4v44xv7dwv4v8z2d_msvc_80": []core_xds.Endpoint{
+					"default_backend__east_msvc_80": []core_xds.Endpoint{
 						{
 							Target: "192.168.0.100",
 							Port:   12345,
 							Tags: map[string]string{
-								"kuma.io/service": "backend-4v44xv7dwv4v8z2d_msvc_80",
+								"kuma.io/service": "default_backend__east_msvc_80",
 								"kuma.io/zone":    "east",
 							},
 							Weight:   1,
 							Locality: &core_xds.Locality{Zone: "east", SubZone: "", Priority: 1, Weight: 0},
 						},
 					},
-					"backend_mzsvc_80": []core_xds.Endpoint{
+					"default_backend___mzsvc_80": []core_xds.Endpoint{
 						{
 							Target: "192.168.0.1",
 							Port:   80,
@@ -1590,7 +1590,7 @@ var _ = Describe("TrafficRoute", func() {
 							Target: "192.168.0.100",
 							Port:   12345,
 							Tags: map[string]string{
-								"kuma.io/service": "backend-4v44xv7dwv4v8z2d_msvc_80",
+								"kuma.io/service": "default_backend__east_msvc_80",
 								"kuma.io/zone":    "east",
 							},
 							Weight:   1,
@@ -1701,7 +1701,7 @@ var _ = Describe("TrafficRoute", func() {
 								ExternalService: &core_xds.ExternalService{TLSEnabled: false},
 							},
 						},
-						"example": []core_xds.Endpoint{
+						"default_example___extsvc_443": []core_xds.Endpoint{
 							{
 								Target: "192.168.1.1",
 								Port:   10000,
diff --git a/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go b/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go
index 631f71617..ecb4d4ada 100644
--- a/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go
+++ b/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go
@@ -96,7 +96,7 @@ spec:
 			g.Expect(err).ToNot(HaveOccurred())
 			stdout, err := k8sCluster.GetKumactlOptions().RunKumactlAndGetOutput("inspect", "dataplane", pod+"."+namespace, "--type=clusters", fmt.Sprintf("--mesh=%s", meshName))
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(stdout).To(Not(ContainSubstring(fmt.Sprintf("first-test-server_%s_msvc_80", namespace))))
+			g.Expect(stdout).To(Not(ContainSubstring(fmt.Sprintf("%s_first-test-server_%s_defaul_msvc_80", meshName, namespace))))
 		}, "30s", "1s").Should(Succeed())
 
 		Eventually(func(g Gomega) {
@@ -104,7 +104,7 @@ spec:
 			g.Expect(err).ToNot(HaveOccurred())
 			stdout, err := k8sCluster.GetKumactlOptions().RunKumactlAndGetOutput("inspect", "dataplane", pod+"."+namespace, "--type=clusters", fmt.Sprintf("--mesh=%s", meshName))
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(stdout).To(ContainSubstring(fmt.Sprintf("first-test-server_%s_msvc_80", namespace)))
+			g.Expect(stdout).To(ContainSubstring(fmt.Sprintf("%s_first-test-server_%s_default_msvc_80", meshName, namespace)))
 		}, "30s", "1s").Should(Succeed())
 
 		Consistently(func(g Gomega) {
diff --git a/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go b/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go
index c23b04736..50b5f4d83 100644
--- a/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go
+++ b/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go
@@ -94,9 +94,9 @@ spec:
 		})
 
 		filter := fmt.Sprintf(
-			"cluster.%s_%s_%s.upstream_rq_total",
+			"cluster.%s_%s_%s_default_extsvc_80.upstream_rq_total",
 			meshName,
-			"meshexternalservice_http-external-service",
+			"http-external-service",
 			Config.KumaNamespace,
 		)
 
@@ -152,9 +152,9 @@ spec:
 `, Config.KumaNamespace, meshNameEgress)
 
 		filter := fmt.Sprintf(
-			"cluster.%s_%s_%s.upstream_rq_total",
+			"cluster.%s_%s_%s_default_extsvc_80.upstream_rq_total",
 			meshNameEgress,
-			"meshexternalservice_mesh-external-service-egress",
+			"mesh-external-service-egress",
 			Config.KumaNamespace,
 		)
 		BeforeAll(func() {
@@ -220,9 +220,9 @@ spec:
       port: 80
 `, Config.KumaNamespace, meshName)
 		filter := fmt.Sprintf(
-			"cluster.%s_%s_%s.upstream_rq_total",
+			"cluster.%s_%s_%s_default_extsvc_80.upstream_rq_total",
 			meshName,
-			"meshexternalservice_tcp-external-service",
+			"tcp-external-service",
 			Config.KumaNamespace,
 		)
 		BeforeAll(func() {
@@ -290,9 +290,9 @@ spec:
       mode: SkipCA # test-server certificate is not signed by a CA that is in the system trust store
 `, Config.KumaNamespace, meshName)
 		filter := fmt.Sprintf(
-			"cluster.%s_%s_%s.upstream_rq_total", // cx
+			"cluster.%s_%s_%s_default_extsvc_80.upstream_rq_total", // cx
 			meshName,
-			"meshexternalservice_tls-external-service",
+			"tls-external-service",
 			Config.KumaNamespace,
 		)
 		BeforeAll(func() {
diff --git a/test/e2e_env/multizone/multizone_suite_test.go b/test/e2e_env/multizone/multizone_suite_test.go
index dcb2cb981..5040a277d 100644
--- a/test/e2e_env/multizone/multizone_suite_test.go
+++ b/test/e2e_env/multizone/multizone_suite_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/kumahq/kuma/test/e2e_env/multizone/meshtls"
 	"github.com/kumahq/kuma/test/e2e_env/multizone/meshtrafficpermission"
 	"github.com/kumahq/kuma/test/e2e_env/multizone/ownership"
+	"github.com/kumahq/kuma/test/e2e_env/multizone/producer"
 	"github.com/kumahq/kuma/test/e2e_env/multizone/reachablebackends"
 	"github.com/kumahq/kuma/test/e2e_env/multizone/resilience"
 	multizone_sync "github.com/kumahq/kuma/test/e2e_env/multizone/sync"
@@ -81,6 +82,7 @@ var (
 	_ = Describe("MeshMultiZoneService MeshLbStrategy", localityawarelb.MeshMzService, Ordered)
 	_ = Describe("Available services", connectivity.AvailableServices, Ordered)
 	_ = Describe("ReachableBackends", reachablebackends.ReachableBackends, Ordered)
+	_ = Describe("Producer Policy Flow", producer.ProducerPolicyFlow, Ordered)
 	_ = Describe("MeshServiceReachableBackends", reachablebackends.MeshServicesWithReachableBackendsOption, Ordered)
 	_ = Describe("MeshTLS", meshtls.MeshTLS, Ordered)
 )
diff --git a/test/e2e_env/multizone/producer/producer.go b/test/e2e_env/multizone/producer/producer.go
new file mode 100644
index 000000000..4b2657132
--- /dev/null
+++ b/test/e2e_env/multizone/producer/producer.go
@@ -0,0 +1,144 @@
+package producer
+
+import (
+	"fmt"
+
+	"github.com/gruntwork-io/terratest/modules/k8s"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	"github.com/kumahq/kuma/pkg/kds/hash"
+	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
+	meshtimeout_api "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/api/v1alpha1"
+	. "github.com/kumahq/kuma/test/framework"
+	framework_client "github.com/kumahq/kuma/test/framework/client"
+	"github.com/kumahq/kuma/test/framework/deployments/testserver"
+	"github.com/kumahq/kuma/test/framework/envs/multizone"
+)
+
+func ProducerPolicyFlow() {
+	const mesh = "producer-policy-flow"
+	const k8sZoneNamespace = "producer-policy-flow-ns"
+
+	BeforeAll(func() {
+		// Global
+		Expect(NewClusterSetup().
+			Install(MTLSMeshWithMeshServicesUniversal(mesh, "Exclusive")).
+			Install(MeshTrafficPermissionAllowAllUniversal(mesh)).
+			Setup(multizone.Global)).To(Succeed())
+		Expect(WaitForMesh(mesh, multizone.Zones())).To(Succeed())
+
+		// Kube Zone 1
+		Expect(NewClusterSetup().
+			Install(NamespaceWithSidecarInjection(k8sZoneNamespace)).
+			Install(testserver.Install(
+				testserver.WithName("test-client"),
+				testserver.WithMesh(mesh),
+				testserver.WithNamespace(k8sZoneNamespace),
+			)).
+			Setup(multizone.KubeZone1),
+		).To(Succeed())
+
+		Expect(NewClusterSetup().
+			Install(NamespaceWithSidecarInjection(k8sZoneNamespace)).
+			Install(testserver.Install(
+				testserver.WithName("test-server"),
+				testserver.WithMesh(mesh),
+				testserver.WithNamespace(k8sZoneNamespace),
+				testserver.WithEchoArgs("echo", "--instance", "kube-test-server-2"),
+			)).
+			Setup(multizone.KubeZone2),
+		).To(Succeed())
+	})
+
+	AfterEachFailure(func() {
+		DebugUniversal(multizone.Global, mesh)
+		DebugKube(multizone.KubeZone1, mesh, k8sZoneNamespace)
+		DebugKube(multizone.KubeZone2, mesh, k8sZoneNamespace)
+	})
+
+	E2EAfterEach(func() {
+		Expect(DeleteMeshResources(multizone.Global, mesh, meshtimeout_api.MeshTimeoutResourceTypeDescriptor)).To(Succeed())
+		Expect(DeleteMeshResources(multizone.Global, mesh, meshhttproute_api.MeshHTTPRouteResourceTypeDescriptor)).To(Succeed())
+	})
+
+	E2EAfterAll(func() {
+		Expect(multizone.KubeZone1.TriggerDeleteNamespace(k8sZoneNamespace)).To(Succeed())
+		Expect(multizone.KubeZone2.TriggerDeleteNamespace(k8sZoneNamespace)).To(Succeed())
+		Expect(multizone.Global.DeleteMesh(mesh)).To(Succeed())
+	})
+
+	It("should sync producer policy to other clusters", func() {
+		Expect(YamlK8s(fmt.Sprintf(`
+kind: MeshTimeout
+apiVersion: kuma.io/v1alpha1
+metadata:
+  name: to-test-server
+  namespace: %s
+  labels:
+    kuma.io/origin: zone
+    kuma.io/mesh: %s
+spec:
+  targetRef:
+    kind: Mesh
+  to:
+    - targetRef:
+        kind: MeshService
+        name: test-server
+      default:
+        http:
+          requestTimeout: 2s
+`, k8sZoneNamespace, mesh))(multizone.KubeZone2)).To(Succeed())
+
+		Eventually(func(g Gomega) {
+			out, err := k8s.RunKubectlAndGetOutputE(
+				multizone.KubeZone1.GetTesting(),
+				multizone.KubeZone1.GetKubectlOptions(Config.KumaNamespace),
+				"get", "meshtimeouts")
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(out).To(ContainSubstring(hash.HashedName(mesh, "to-test-server", Kuma2, k8sZoneNamespace)))
+		}).Should(Succeed())
+
+		Eventually(func(g Gomega) {
+			response, err := framework_client.CollectFailure(
+				multizone.KubeZone1, "test-client", fmt.Sprintf("test-server.%s.svc.kuma-2.mesh.local", k8sZoneNamespace),
+				framework_client.FromKubernetesPod(k8sZoneNamespace, "test-client"),
+				framework_client.WithHeader("x-set-response-delay-ms", "5000"),
+				framework_client.WithMaxTime(10), // we don't want 'curl' to return early
+			)
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(response.ResponseCode).To(Equal(504))
+		}, "1m", "1s", MustPassRepeatedly(5)).Should(Succeed())
+
+		Expect(YamlK8s(fmt.Sprintf(`
+kind: MeshTimeout
+apiVersion: kuma.io/v1alpha1
+metadata:
+  name: to-test-server
+  namespace: %s
+  labels:
+    kuma.io/origin: zone
+    kuma.io/mesh: %s
+spec:
+  targetRef:
+    kind: Mesh
+  to:
+    - targetRef:
+        kind: MeshService
+        name: test-server
+        namespace: random-ns-name
+      default:
+        http:
+          requestTimeout: 2s
+`, k8sZoneNamespace, mesh))(multizone.KubeZone2)).To(Succeed())
+
+		Eventually(func(g Gomega) {
+			out, err := k8s.RunKubectlAndGetOutputE(
+				multizone.KubeZone1.GetTesting(),
+				multizone.KubeZone1.GetKubectlOptions(Config.KumaNamespace),
+				"get", "meshtimeouts")
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(out).ToNot(ContainSubstring(hash.HashedName(mesh, "to-test-server", Kuma2, k8sZoneNamespace)))
+		}).Should(Succeed())
+	})
+}
diff --git a/test/e2e_env/multizone/reachablebackends/reachablebackends.go b/test/e2e_env/multizone/reachablebackends/reachablebackends.go
index ac1a650d4..251b93e8e 100644
--- a/test/e2e_env/multizone/reachablebackends/reachablebackends.go
+++ b/test/e2e_env/multizone/reachablebackends/reachablebackends.go
@@ -328,7 +328,7 @@ spec:
 			)
 			// then it fails because Kuma DP has no such DNS
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(response.Exitcode).To(Equal(6))
+			g.Expect(response.Exitcode).To(Or(Equal(6), Equal(28)))
 		}, "5s", "100ms").Should(Succeed())
 
 		Consistently(func(g Gomega) {
@@ -350,7 +350,7 @@ spec:
 			)
 			// then it fails because we don't encrypt traffic to unknown destination in the mesh
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(response.Exitcode).To(Or(Equal(6)))
+			g.Expect(response.Exitcode).To(Or(Equal(6), Equal(28)))
 		}, "5s", "100ms").Should(Succeed())
 
 		Consistently(func(g Gomega) {
diff --git a/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go b/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go
index bc66156bd..e5a436b73 100644
--- a/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go
+++ b/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go
@@ -143,8 +143,8 @@ spec:
 			)
 			// then
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(resp.Exitcode).To(Equal(6))
-		}, "15s", "500ms", MustPassRepeatedly(10)).Should(Succeed())
+			g.Expect(resp.Exitcode).To(Or(Equal(6), Equal(28)))
+		}, "15s", "500ms", MustPassRepeatedly(5)).Should(Succeed())
 	})
 
 	It("should be able to connect if reachable backends is set", func() {
@@ -162,8 +162,8 @@ spec:
 			g.Expect(err).ToNot(HaveOccurred())
 			stdout, err := multizone.KubeZone1.GetKumactlOptions().RunKumactlAndGetOutput("inspect", "dataplane", pod+"."+namespace, "--type=clusters", fmt.Sprintf("--mesh=%s", meshName))
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(stdout).To(ContainSubstring(fmt.Sprintf("local-test-server_%s_msvc_80", namespace)))
-		}, "10s", "500ms", MustPassRepeatedly(10)).Should(Succeed())
+			g.Expect(stdout).To(ContainSubstring(fmt.Sprintf("%s_local-test-server_%s_kuma-1_msvc_80", meshName, namespace)))
+		}, "10s", "500ms", MustPassRepeatedly(5)).Should(Succeed())
 
 		Eventually(func(g Gomega) {
 			// when
@@ -174,6 +174,6 @@ spec:
 			// then
 			g.Expect(err).ToNot(HaveOccurred())
 			g.Expect(resp.Instance).To(HavePrefix("other-zone-test-server"))
-		}, "10s", "500ms", MustPassRepeatedly(10)).Should(Succeed())
+		}, "10s", "500ms", MustPassRepeatedly(5)).Should(Succeed())
 	})
 }
diff --git a/test/e2e_env/universal/meshexternalservice/meshexternalservice.go b/test/e2e_env/universal/meshexternalservice/meshexternalservice.go
index af08ada07..2b3eebafa 100644
--- a/test/e2e_env/universal/meshexternalservice/meshexternalservice.go
+++ b/test/e2e_env/universal/meshexternalservice/meshexternalservice.go
@@ -660,7 +660,7 @@ spec:
 			Eventually(func(g Gomega) {
 				egressClusters, err := universal.Cluster.GetZoneEgressEnvoyTunnel().GetClusters()
 				g.Expect(err).ToNot(HaveOccurred())
-				cluster := egressClusters.GetCluster(fmt.Sprintf("%s:meshexternalservice_mes-health-check", meshNameNoDefaults))
+				cluster := egressClusters.GetCluster(fmt.Sprintf("%s_mes-health-check__kuma-3_extsvc_80", meshNameNoDefaults))
 				g.Expect(cluster).ToNot(BeNil())
 				g.Expect(cluster.HostStatuses).To(HaveLen(1))
 				g.Expect(cluster.HostStatuses[0].HealthStatus.FailedActiveHealthCheck).To(BeTrue())
diff --git a/test/e2e_env/universal/meshservice/meshservice.go b/test/e2e_env/universal/meshservice/meshservice.go
index e2413910b..61149739c 100644
--- a/test/e2e_env/universal/meshservice/meshservice.go
+++ b/test/e2e_env/universal/meshservice/meshservice.go
@@ -127,8 +127,8 @@ mtls:
 				universal.Cluster, "demo-client", "http://localhost:9901/stats",
 			)
 			g.Expect(err).ToNot(HaveOccurred())
-			g.Expect(stdout).To(ContainSubstring("cluster.backend_msvc_80.ssl.handshake"))
-			g.Expect(stdout).ToNot(ContainSubstring("cluster.backend_msvc_80.ssl.handshake: 0"))
+			g.Expect(stdout).To(ContainSubstring(fmt.Sprintf("cluster.%s_backend__kuma-3_msvc_80.ssl.handshake", meshName)))
+			g.Expect(stdout).ToNot(ContainSubstring(fmt.Sprintf("cluster.%s_backend__kuma-3_msvc_80.ssl.handshake: 0", meshName)))
 		}, "30s", "1s").Should(Succeed())
 		Expect(reqError.Load()).To(BeNil())