Repository: kumahq/kuma
Pull request #1589 (2021-02-19 09:53:33)

chore(kuma-cp) V3 as default API
### Summary

### Full changelog

* Change V3 as default API version
* Change CI so V3 (instead of V2) is run on branch and V3+V2 on master
* Change some tests (mostly proxy generator) so they are using V3, not V2

### Documentation

- [X] Internal change?

jakubdyszkiewicz: Yes, v4 is next. Now we have tools and a path to do this migration quicker.

Patch:
diff --git a/.circleci/config.yml b/.circleci/config.yml
index aa7857d4c..f1efa8595 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -350,7 +350,7 @@ jobs:
       api:
         description: XDS API version
         type: string
-        default: v2
+        default: v3
     parallelism: 2
     environment:
       GOPATH: /home/circleci/.go-kuma-go
@@ -748,11 +748,11 @@ workflows:
             - images
       - e2e:
           <<: *commit_workflow_filters
-          name: test/e2e V3
+          name: test/e2e V2
           requires:
             - images
           # custom parameters
-          api: v3
+          api: v2
 
   kuma-release:
     jobs:
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index ef98227f1..ddb1407be 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -66,7 +66,7 @@ store:
 # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
 bootstrapServer:
   # The version of Envoy API (available: "v2", "v3")
-  apiVersion: v2
+  apiVersion: v3
   # Parameters of bootstrap configuration
   params:
     # Address of Envoy Admin
diff --git a/pkg/config/xds/bootstrap/config.go b/pkg/config/xds/bootstrap/config.go
index 1bc6221dd..d410b623d 100644
--- a/pkg/config/xds/bootstrap/config.go
+++ b/pkg/config/xds/bootstrap/config.go
@@ -37,7 +37,7 @@ func (b *BootstrapServerConfig) Validate() error {
 
 func DefaultBootstrapServerConfig() *BootstrapServerConfig {
 	return &BootstrapServerConfig{
-		APIVersion: envoy_common.APIV2,
+		APIVersion: envoy_common.APIV3,
 		Params:     DefaultBootstrapParamsConfig(),
 	}
 }


Test patch:
diff --git a/pkg/api-server/config_ws_test.go b/pkg/api-server/config_ws_test.go
index 5ac0516cb..f71e41740 100644
--- a/pkg/api-server/config_ws_test.go
+++ b/pkg/api-server/config_ws_test.go
@@ -78,7 +78,7 @@ var _ = Describe("Config WS", func() {
             "readOnly": false
           },
           "bootstrapServer": {
-            "apiVersion": "v2",
+            "apiVersion": "v3",
             "params": {
               "adminAccessLogPath": "/dev/null",
               "adminAddress": "127.0.0.1",
diff --git a/pkg/config/xds/bootstrap/testdata/default-config.golden.yaml b/pkg/config/xds/bootstrap/testdata/default-config.golden.yaml
index 999dacb4f..fa1813bc9 100644
--- a/pkg/config/xds/bootstrap/testdata/default-config.golden.yaml
+++ b/pkg/config/xds/bootstrap/testdata/default-config.golden.yaml
@@ -1,4 +1,4 @@
-apiVersion: v2
+apiVersion: v3
 params:
   adminAccessLogPath: /dev/null
   adminAddress: 127.0.0.1
diff --git a/pkg/xds/bootstrap/server_test.go b/pkg/xds/bootstrap/server_test.go
index 70bcca976..6cb390011 100644
--- a/pkg/xds/bootstrap/server_test.go
+++ b/pkg/xds/bootstrap/server_test.go
@@ -27,6 +27,7 @@ import (
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test"
+	"github.com/kumahq/kuma/pkg/test/matchers"
 	test_metrics "github.com/kumahq/kuma/pkg/test/metrics"
 	"github.com/kumahq/kuma/pkg/xds/bootstrap"
 )
@@ -148,11 +149,7 @@ var _ = Describe("Bootstrap Server", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			Expect(resp.StatusCode).To(Equal(http.StatusOK))
-
-			expected, err := ioutil.ReadFile(filepath.Join("testdata", given.expectedConfigFile))
-			Expect(err).ToNot(HaveOccurred())
-
-			Expect(received).To(MatchYAML(expected))
+			Expect(received).To(matchers.MatchGoldenYAML(filepath.Join("testdata", given.expectedConfigFile)))
 		},
 		Entry("minimal data provided (universal)", testCase{
 			dataplaneName:      "dp-1",
diff --git a/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml b/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml
index 9f275b581..5e6f679a8 100644
--- a/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml
@@ -2,44 +2,46 @@ dynamicResources:
   adsConfig:
     apiType: GRPC
     grpcServices:
-      - googleGrpc:
-          callCredentials:
-            - fromPlugin:
-                name: envoy.grpc_credentials.file_based_metadata
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.grpc_credential.v2alpha.FileBasedMetadataConfig
-                  secretData:
-                    filename: /tmp/token
-          channelCredentials:
-            sslCredentials:
-              rootCerts:
-                inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-          credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-          statPrefix: ads
-          targetUri: localhost:5678
-    transportApiVersion: V2
-  cdsConfig:
-    ads: {}
-  ldsConfig:
-    ads: {}
-hdsConfig:
-  apiType: GRPC
-  grpcServices:
     - googleGrpc:
         callCredentials:
-          - fromPlugin:
-              name: envoy.grpc_credentials.file_based_metadata
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.grpc_credential.v2alpha.FileBasedMetadataConfig
-                secretData:
-                  filename: /tmp/token
+        - fromPlugin:
+            name: envoy.grpc_credentials.file_based_metadata
+            typedConfig:
+              '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
+              secretData:
+                filename: /tmp/token
         channelCredentials:
           sslCredentials:
             rootCerts:
               inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
         credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-        statPrefix: hds
+        statPrefix: ads
         targetUri: localhost:5678
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+hdsConfig:
+  apiType: GRPC
+  grpcServices:
+  - googleGrpc:
+      callCredentials:
+      - fromPlugin:
+          name: envoy.grpc_credentials.file_based_metadata
+          typedConfig:
+            '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
+            secretData:
+              filename: /tmp/token
+      channelCredentials:
+        sslCredentials:
+          rootCerts:
+            inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
+      statPrefix: hds
+      targetUri: localhost:5678
   setNodeOnFirstMessageOnly: true
   transportApiVersion: V3
 node:
@@ -48,41 +50,41 @@ node:
   metadata:
     dataplaneTokenPath: /tmp/token
     version:
-      kumaDp:
-        version: 0.0.1
-        gitTag: v0.0.1
-        gitCommit: 91ce236824a9d875601679aa80c63783fb0e8725
-        buildDate: 2019-08-07T11:26:06Z
       envoy:
-        version: 1.15.0
         build: hash/1.15.0/RELEASE
+        version: 1.15.0
+      kumaDp:
+        buildDate: "2019-08-07T11:26:06Z"
+        gitCommit: 91ce236824a9d875601679aa80c63783fb0e8725
+        gitTag: v0.0.1
+        version: 0.0.1
 staticResources:
   clusters:
-    - connectTimeout: 1s
-      http2ProtocolOptions: {}
-      loadAssignment:
-        clusterName: access_log_sink
-        endpoints:
-          - lbEndpoints:
-              - endpoint:
-                  address:
-                    pipe:
-                      path: /tmp/kuma-al-dp-1.default-default.sock
-      name: access_log_sink
-      type: STATIC
-      upstreamConnectionOptions:
-        tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: access_log_sink
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              pipe:
+                path: /tmp/kuma-al-dp-1.default-default.sock
+    name: access_log_sink
+    type: STATIC
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
-    - regex: ^grpc\.((.+)\.)
-      tagName: name
-    - regex: ^grpc.*streams_closed(_([0-9]+))
-      tagName: status
-    - regex: ^kafka(\.(\S*[0-9]))\.
-      tagName: kafka_name
-    - regex: ^kafka\..*\.(.*)
-      tagName: kafka_type
-    - regex: (worker_([0-9]+)\.)
-      tagName: worker
-    - regex: ((.+?)\.)rbac\.
-      tagName: listener
+  - regex: ^grpc\.((.+)\.)
+    tagName: name
+  - regex: ^grpc.*streams_closed(_([0-9]+))
+    tagName: status
+  - regex: ^kafka(\.(\S*[0-9]))\.
+    tagName: kafka_name
+  - regex: ^kafka\..*\.(.*)
+    tagName: kafka_type
+  - regex: (worker_([0-9]+)\.)
+    tagName: worker
+  - regex: ((.+?)\.)rbac\.
+    tagName: listener
diff --git a/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml b/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml
index af0ba6fd7..7afe01d38 100644
--- a/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml
@@ -8,44 +8,46 @@ dynamicResources:
   adsConfig:
     apiType: GRPC
     grpcServices:
-      - googleGrpc:
-          callCredentials:
-            - fromPlugin:
-                name: envoy.grpc_credentials.file_based_metadata
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.grpc_credential.v2alpha.FileBasedMetadataConfig
-                  secretData:
-                    filename: /tmp/token
-          channelCredentials:
-            sslCredentials:
-              rootCerts:
-                inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-          credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-          statPrefix: ads
-          targetUri: localhost:5678
-    transportApiVersion: V2
-  cdsConfig:
-    ads: {}
-  ldsConfig:
-    ads: {}
-hdsConfig:
-  apiType: GRPC
-  grpcServices:
     - googleGrpc:
         callCredentials:
-          - fromPlugin:
-              name: envoy.grpc_credentials.file_based_metadata
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.grpc_credential.v2alpha.FileBasedMetadataConfig
-                secretData:
-                  filename: /tmp/token
+        - fromPlugin:
+            name: envoy.grpc_credentials.file_based_metadata
+            typedConfig:
+              '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
+              secretData:
+                filename: /tmp/token
         channelCredentials:
           sslCredentials:
             rootCerts:
               inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
         credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-        statPrefix: hds
+        statPrefix: ads
         targetUri: localhost:5678
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+hdsConfig:
+  apiType: GRPC
+  grpcServices:
+  - googleGrpc:
+      callCredentials:
+      - fromPlugin:
+          name: envoy.grpc_credentials.file_based_metadata
+          typedConfig:
+            '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
+            secretData:
+              filename: /tmp/token
+      channelCredentials:
+        sslCredentials:
+          rootCerts:
+            inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
+      statPrefix: hds
+      targetUri: localhost:5678
   setNodeOnFirstMessageOnly: true
   transportApiVersion: V3
 node:
@@ -55,41 +57,41 @@ node:
     dataplane.admin.port: "1234"
     dataplaneTokenPath: /tmp/token
     version:
-      kumaDp:
-        version: 0.0.1
-        gitTag: v0.0.1
-        gitCommit: 91ce236824a9d875601679aa80c63783fb0e8725
-        buildDate: 2019-08-07T11:26:06Z
       envoy:
-        version: 1.15.0
         build: hash/1.15.0/RELEASE
+        version: 1.15.0
+      kumaDp:
+        buildDate: "2019-08-07T11:26:06Z"
+        gitCommit: 91ce236824a9d875601679aa80c63783fb0e8725
+        gitTag: v0.0.1
+        version: 0.0.1
 staticResources:
   clusters:
-    - connectTimeout: 1s
-      http2ProtocolOptions: {}
-      loadAssignment:
-        clusterName: access_log_sink
-        endpoints:
-          - lbEndpoints:
-              - endpoint:
-                  address:
-                    pipe:
-                      path: /tmp/kuma-al-dp-1.default-default.sock
-      name: access_log_sink
-      type: STATIC
-      upstreamConnectionOptions:
-        tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: access_log_sink
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              pipe:
+                path: /tmp/kuma-al-dp-1.default-default.sock
+    name: access_log_sink
+    type: STATIC
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
-    - regex: ^grpc\.((.+)\.)
-      tagName: name
-    - regex: ^grpc.*streams_closed(_([0-9]+))
-      tagName: status
-    - regex: ^kafka(\.(\S*[0-9]))\.
-      tagName: kafka_name
-    - regex: ^kafka\..*\.(.*)
-      tagName: kafka_type
-    - regex: (worker_([0-9]+)\.)
-      tagName: worker
-    - regex: ((.+?)\.)rbac\.
-      tagName: listener
+  - regex: ^grpc\.((.+)\.)
+    tagName: name
+  - regex: ^grpc.*streams_closed(_([0-9]+))
+    tagName: status
+  - regex: ^kafka(\.(\S*[0-9]))\.
+    tagName: kafka_name
+  - regex: ^kafka\..*\.(.*)
+    tagName: kafka_type
+  - regex: (worker_([0-9]+)\.)
+    tagName: worker
+  - regex: ((.+?)\.)rbac\.
+    tagName: listener
diff --git a/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml b/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml
index afb577b4f..e86ac6039 100644
--- a/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml
@@ -2,44 +2,46 @@ dynamicResources:
   adsConfig:
     apiType: GRPC
     grpcServices:
-      - googleGrpc:
-          callCredentials:
-            - fromPlugin:
-                name: envoy.grpc_credentials.file_based_metadata
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.grpc_credential.v2alpha.FileBasedMetadataConfig
-                  secretData:
-                    filename: /tmp/token
-          channelCredentials:
-            sslCredentials:
-              rootCerts:
-                inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-          credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-          statPrefix: ads
-          targetUri: localhost:5678
-    transportApiVersion: V2
-  cdsConfig:
-    ads: {}
-  ldsConfig:
-    ads: {}
-hdsConfig:
-  apiType: GRPC
-  grpcServices:
     - googleGrpc:
         callCredentials:
-          - fromPlugin:
-              name: envoy.grpc_credentials.file_based_metadata
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.grpc_credential.v2alpha.FileBasedMetadataConfig
-                secretData:
-                  filename: /tmp/token
+        - fromPlugin:
+            name: envoy.grpc_credentials.file_based_metadata
+            typedConfig:
+              '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
+              secretData:
+                filename: /tmp/token
         channelCredentials:
           sslCredentials:
             rootCerts:
               inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
         credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-        statPrefix: hds
+        statPrefix: ads
         targetUri: localhost:5678
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+hdsConfig:
+  apiType: GRPC
+  grpcServices:
+  - googleGrpc:
+      callCredentials:
+      - fromPlugin:
+          name: envoy.grpc_credentials.file_based_metadata
+          typedConfig:
+            '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
+            secretData:
+              filename: /tmp/token
+      channelCredentials:
+        sslCredentials:
+          rootCerts:
+            inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
+      statPrefix: hds
+      targetUri: localhost:5678
   setNodeOnFirstMessageOnly: true
   transportApiVersion: V3
 node:
@@ -48,41 +50,41 @@ node:
   metadata:
     dataplaneTokenPath: /tmp/token
     version:
-      kumaDp:
-        version: 0.0.1
-        gitTag: v0.0.1
-        gitCommit: 91ce236824a9d875601679aa80c63783fb0e8725
-        buildDate: 2019-08-07T11:26:06Z
       envoy:
-        version: 1.15.0
         build: hash/1.15.0/RELEASE
+        version: 1.15.0
+      kumaDp:
+        buildDate: "2019-08-07T11:26:06Z"
+        gitCommit: 91ce236824a9d875601679aa80c63783fb0e8725
+        gitTag: v0.0.1
+        version: 0.0.1
 staticResources:
   clusters:
-    - connectTimeout: 1s
-      http2ProtocolOptions: {}
-      loadAssignment:
-        clusterName: access_log_sink
-        endpoints:
-          - lbEndpoints:
-              - endpoint:
-                  address:
-                    pipe:
-                      path: /tmp/kuma-al-dp-1-default.sock
-      name: access_log_sink
-      type: STATIC
-      upstreamConnectionOptions:
-        tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: access_log_sink
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              pipe:
+                path: /tmp/kuma-al-dp-1-default.sock
+    name: access_log_sink
+    type: STATIC
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
-    - regex: ^grpc\.((.+)\.)
-      tagName: name
-    - regex: ^grpc.*streams_closed(_([0-9]+))
-      tagName: status
-    - regex: ^kafka(\.(\S*[0-9]))\.
-      tagName: kafka_name
-    - regex: ^kafka\..*\.(.*)
-      tagName: kafka_type
-    - regex: (worker_([0-9]+)\.)
-      tagName: worker
-    - regex: ((.+?)\.)rbac\.
-      tagName: listener
+  - regex: ^grpc\.((.+)\.)
+    tagName: name
+  - regex: ^grpc.*streams_closed(_([0-9]+))
+    tagName: status
+  - regex: ^kafka(\.(\S*[0-9]))\.
+    tagName: kafka_name
+  - regex: ^kafka\..*\.(.*)
+    tagName: kafka_type
+  - regex: (worker_([0-9]+)\.)
+    tagName: worker
+  - regex: ((.+?)\.)rbac\.
+    tagName: listener
diff --git a/pkg/xds/cache/cla/cache_test.go b/pkg/xds/cache/cla/cache_test.go
index 3458c689c..ef4c6050c 100644
--- a/pkg/xds/cache/cla/cache_test.go
+++ b/pkg/xds/cache/cla/cache_test.go
@@ -103,7 +103,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 
 	It("should cache Get() queries", func() {
 		By("getting CLA for the first time")
-		cla, err := claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV2)
+		cla, err := claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV3)
 		Expect(err).ToNot(HaveOccurred())
 		Expect(countingManager.getQueries).To(Equal(1))
 		Expect(countingManager.listQueries).To(Equal(2))
@@ -116,7 +116,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 		Expect(js).To(MatchJSON(string(expected)))
 
 		By("getting cached CLA")
-		_, err = claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV2)
+		_, err = claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV3)
 		Expect(err).ToNot(HaveOccurred())
 		Expect(countingManager.getQueries).To(Equal(1))
 		Expect(countingManager.listQueries).To(Equal(2))
@@ -131,7 +131,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 
 		<-time.After(2 * time.Second)
 
-		cla, err = claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV2)
+		cla, err = claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV3)
 		Expect(err).ToNot(HaveOccurred())
 		Expect(countingManager.getQueries).To(Equal(2))
 		Expect(countingManager.listQueries).To(Equal(4))
@@ -148,7 +148,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 		for i := 0; i < 100; i++ {
 			wg.Add(1)
 			go func() {
-				cla, err := claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV2)
+				cla, err := claCache.GetCLA(context.Background(), "mesh-0", "", "backend", envoy_common.APIV3)
 				Expect(err).ToNot(HaveOccurred())
 
 				marshalled, err := json.Marshal(cla) // to imitate Read access to 'cla'
diff --git a/pkg/xds/generator/admin_proxy_generator_test.go b/pkg/xds/generator/admin_proxy_generator_test.go
index 43ccd5b4c..8dca6cb11 100644
--- a/pkg/xds/generator/admin_proxy_generator_test.go
+++ b/pkg/xds/generator/admin_proxy_generator_test.go
@@ -53,7 +53,7 @@ var _ = Describe("AdminProxyGenerator", func() {
 					AdminPort: 9901,
 				},
 				Dataplane:  dataplane,
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 			}
 
 			// when
diff --git a/pkg/xds/generator/direct_access_proxy_generator_test.go b/pkg/xds/generator/direct_access_proxy_generator_test.go
index 802e84453..6cea5bd55 100644
--- a/pkg/xds/generator/direct_access_proxy_generator_test.go
+++ b/pkg/xds/generator/direct_access_proxy_generator_test.go
@@ -82,7 +82,7 @@ var _ = Describe("DirectAccessProxyGenerator", func() {
 
 			proxy := &xds.Proxy{
 				Dataplane:  dataplane,
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 			}
 
 			// when
diff --git a/pkg/xds/generator/inbound_proxy_generator_test.go b/pkg/xds/generator/inbound_proxy_generator_test.go
index 2e4a81a6b..560bee2e2 100644
--- a/pkg/xds/generator/inbound_proxy_generator_test.go
+++ b/pkg/xds/generator/inbound_proxy_generator_test.go
@@ -71,7 +71,7 @@ var _ = Describe("InboundProxyGenerator", func() {
 					},
 					Spec: &dataplane,
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Policies: model.MatchedPolicies{
 
 					TrafficPermissions: model.TrafficPermissionMap{
diff --git a/pkg/xds/generator/ingress_generator_test.go b/pkg/xds/generator/ingress_generator_test.go
index 79caeef40..a346fd90e 100644
--- a/pkg/xds/generator/ingress_generator_test.go
+++ b/pkg/xds/generator/ingress_generator_test.go
@@ -41,7 +41,7 @@ var _ = Describe("IngressGenerator", func() {
 					},
 					Spec: dataplane,
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Routing: core_xds.Routing{
 					OutboundTargets:  given.outboundTargets,
 					TrafficRouteList: given.trafficRoutes,
diff --git a/pkg/xds/generator/outbound_proxy_generator_test.go b/pkg/xds/generator/outbound_proxy_generator_test.go
index 2da5d6fe2..82027ae7f 100644
--- a/pkg/xds/generator/outbound_proxy_generator_test.go
+++ b/pkg/xds/generator/outbound_proxy_generator_test.go
@@ -167,7 +167,7 @@ var _ = Describe("OutboundProxyGenerator", func() {
 					},
 					Spec: dataplane,
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Routing: model.Routing{
 					TrafficRoutes: model.RouteMap{
 						mesh_proto.OutboundInterface{
@@ -521,7 +521,7 @@ var _ = Describe("OutboundProxyGenerator", func() {
 				},
 				Spec: dataplane,
 			},
-			APIVersion: envoy_common.APIV2,
+			APIVersion: envoy_common.APIV3,
 			Routing: model.Routing{
 				TrafficRoutes: model.RouteMap{
 					mesh_proto.OutboundInterface{
diff --git a/pkg/xds/generator/probe_generator_test.go b/pkg/xds/generator/probe_generator_test.go
index 0e18796c4..01dcae83f 100644
--- a/pkg/xds/generator/probe_generator_test.go
+++ b/pkg/xds/generator/probe_generator_test.go
@@ -38,7 +38,7 @@ var _ = Describe("ProbeGenerator", func() {
 					},
 					Spec: dataplane,
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 			}
 
 			// when
diff --git a/pkg/xds/generator/prometheus_endpoint_generator_test.go b/pkg/xds/generator/prometheus_endpoint_generator_test.go
index 274920bae..893790a58 100644
--- a/pkg/xds/generator/prometheus_endpoint_generator_test.go
+++ b/pkg/xds/generator/prometheus_endpoint_generator_test.go
@@ -60,7 +60,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 					},
 					Spec: &mesh_proto.Dataplane{},
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 			},
 		}),
 		Entry("Datalane has Prometheus configuration while Mesh doesn't", testCase{
@@ -76,7 +76,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -122,7 +122,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -169,7 +169,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -244,7 +244,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -289,7 +289,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -361,7 +361,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -424,7 +424,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -488,7 +488,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &model.Proxy{
 				Id:         model.ProxyId{Name: "demo.backend-01"},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
 						Name: "backend-01",
@@ -543,7 +543,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 				}
 				proxy := &model.Proxy{
 					Id:         model.ProxyId{Name: "demo.backend-01"},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 					Dataplane: &mesh_core.DataplaneResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "backend-01",
diff --git a/pkg/xds/generator/proxy_template_profile_source_test.go b/pkg/xds/generator/proxy_template_profile_source_test.go
index 05b0cfba6..90c5431ed 100644
--- a/pkg/xds/generator/proxy_template_profile_source_test.go
+++ b/pkg/xds/generator/proxy_template_profile_source_test.go
@@ -108,7 +108,7 @@ var _ = Describe("ProxyTemplateProfileSource", func() {
 					},
 					Spec: dataplane,
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Routing: model.Routing{
 					TrafficRoutes: model.RouteMap{
 						mesh_proto.OutboundInterface{
diff --git a/pkg/xds/generator/proxy_template_raw_source_test.go b/pkg/xds/generator/proxy_template_raw_source_test.go
index b5f99ea63..1515139b2 100644
--- a/pkg/xds/generator/proxy_template_raw_source_test.go
+++ b/pkg/xds/generator/proxy_template_raw_source_test.go
@@ -60,7 +60,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
@@ -89,7 +89,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:     "raw-name",
@@ -117,7 +117,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
@@ -147,7 +147,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
@@ -188,7 +188,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
@@ -264,7 +264,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw:      nil,
 				expected: `{}`,
@@ -288,7 +288,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
@@ -349,7 +349,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
@@ -408,7 +408,7 @@ var _ = Describe("ProxyTemplateRawSource", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				raw: []*mesh_proto.ProxyTemplateRawResource{{
 					Name:    "raw-name",
diff --git a/pkg/xds/generator/proxy_template_test.go b/pkg/xds/generator/proxy_template_test.go
index bebfe2360..07942a693 100644
--- a/pkg/xds/generator/proxy_template_test.go
+++ b/pkg/xds/generator/proxy_template_test.go
@@ -83,7 +83,7 @@ var _ = Describe("ProxyTemplateGenerator", func() {
 							},
 						},
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 				},
 				template: &mesh_proto.ProxyTemplate{
 					Conf: &mesh_proto.ProxyTemplate_Conf{
@@ -161,7 +161,7 @@ var _ = Describe("ProxyTemplateGenerator", func() {
 						},
 						Spec: dataplane,
 					},
-					APIVersion: envoy_common.APIV2,
+					APIVersion: envoy_common.APIV3,
 					Metadata:   &model.DataplaneMetadata{},
 				}
 
diff --git a/pkg/xds/generator/testdata/admin/01.envoy-config.golden.yaml b/pkg/xds/generator/testdata/admin/01.envoy-config.golden.yaml
index 16682697d..5035f2fb7 100644
--- a/pkg/xds/generator/testdata/admin/01.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/admin/01.envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: kuma_envoy_admin
     connectTimeout: 5s
     loadAssignment:
@@ -17,7 +17,7 @@ resources:
     type: STATIC
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -26,7 +26,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -34,7 +34,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   prefix: /ready
@@ -47,7 +47,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -55,7 +55,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   headers:
@@ -69,7 +69,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificates:
             - certificateChain:
diff --git a/pkg/xds/generator/testdata/direct-access/03.envoy-config.golden.yaml b/pkg/xds/generator/testdata/direct-access/03.envoy-config.golden.yaml
index 95aa37639..010d003f8 100644
--- a/pkg/xds/generator/testdata/direct-access/03.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/direct-access/03.envoy-config.golden.yaml
@@ -1,61 +1,58 @@
 resources:
 - name: direct_access
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
     name: direct_access
     type: ORIGINAL_DST
 - name: direct_access_192.168.0.2:1234
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
         portValue: 1234
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: direct_access
           statPrefix: direct_access_192_168_0_2_1234
     name: direct_access_192.168.0.2:1234
     trafficDirection: OUTBOUND
 - name: direct_access_192.168.0.2:1235
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
         portValue: 1235
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: direct_access
           statPrefix: direct_access_192_168_0_2_1235
     name: direct_access_192.168.0.2:1235
     trafficDirection: OUTBOUND
 - name: direct_access_192.168.0.3:1234
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.3
         portValue: 1234
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: direct_access
           statPrefix: direct_access_192_168_0_3_1234
     name: direct_access_192.168.0.3:1234
diff --git a/pkg/xds/generator/testdata/direct-access/04.envoy-config.golden.yaml b/pkg/xds/generator/testdata/direct-access/04.envoy-config.golden.yaml
index 3d904a36b..2709017ac 100644
--- a/pkg/xds/generator/testdata/direct-access/04.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/direct-access/04.envoy-config.golden.yaml
@@ -1,43 +1,41 @@
 resources:
 - name: direct_access
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
     name: direct_access
     type: ORIGINAL_DST
 - name: direct_access_192.168.0.2:1234
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
         portValue: 1234
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: direct_access
           statPrefix: direct_access_192_168_0_2_1234
     name: direct_access_192.168.0.2:1234
     trafficDirection: OUTBOUND
 - name: direct_access_192.168.0.3:1234
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.3
         portValue: 1234
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: direct_access
           statPrefix: direct_access_192_168_0_3_1234
     name: direct_access_192.168.0.3:1234
diff --git a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
index 4f155e290..84ec7de2f 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -17,7 +17,7 @@ resources:
     type: STATIC
 - name: localhost:8443
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8443
     connectTimeout: 5s
     loadAssignment:
@@ -33,7 +33,7 @@ resources:
     type: STATIC
 - name: inbound:192.168.0.1:443
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -42,18 +42,18 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_443.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8443
           statPrefix: localhost_8443
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -72,6 +72,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -85,12 +87,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:443
     trafficDirection: INBOUND
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -99,7 +103,7 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules:
             policies:
               tp-1:
@@ -112,11 +116,11 @@ resources:
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.fault
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault
+              '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
               delay:
                 fixedDelay: 5s
                 percentage:
@@ -146,7 +150,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -165,6 +169,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -178,12 +184,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: inbound:192.168.0.2:443
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
@@ -192,18 +200,18 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_2_443.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8443
           statPrefix: localhost_8443
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -222,6 +230,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -235,12 +245,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.2:443
     trafficDirection: INBOUND
 - name: inbound:192.168.0.2:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
@@ -249,12 +261,12 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_2_80.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -276,7 +288,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -295,6 +307,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -308,6 +322,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.2:80
     trafficDirection: INBOUND
diff --git a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
index f2d1d56a2..63ce8db01 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -17,7 +17,7 @@ resources:
     type: STATIC
 - name: localhost:8443
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8443
     connectTimeout: 5s
     loadAssignment:
@@ -33,29 +33,28 @@ resources:
     type: STATIC
 - name: inbound:192.168.0.1:443
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
         portValue: 443
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_443.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8443
           statPrefix: localhost_8443
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -74,6 +73,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -87,23 +88,24 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:443
     trafficDirection: INBOUND
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
         portValue: 80
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules:
             policies:
               tp-1:
@@ -116,11 +118,11 @@ resources:
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.fault
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault
+              '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
               delay:
                 fixedDelay: 5s
                 percentage:
@@ -150,7 +152,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -169,6 +171,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -182,34 +186,35 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: inbound:192.168.0.2:443
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
         portValue: 443
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_2_443.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8443
           statPrefix: localhost_8443
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -228,6 +233,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -241,28 +248,29 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.2:443
     trafficDirection: INBOUND
 - name: inbound:192.168.0.2:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.2
         portValue: 80
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_2_80.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -284,7 +292,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -303,6 +311,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -316,6 +326,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.2:80
     trafficDirection: INBOUND
diff --git a/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml b/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml
index b5ca4e809..4e37df7f1 100644
--- a/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+    '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
     clusterName: backend
     endpoints:
     - lbEndpoints:
@@ -39,11 +39,12 @@ resources:
               version: v2
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -54,7 +55,7 @@ resources:
     type: EDS
 - name: inbound:10.0.0.1:10001
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 10.0.0.1
@@ -67,7 +68,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
diff --git a/pkg/xds/generator/testdata/ingress/02.envoy.golden.yaml b/pkg/xds/generator/testdata/ingress/02.envoy.golden.yaml
index 768db0138..75cacb17b 100644
--- a/pkg/xds/generator/testdata/ingress/02.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/ingress/02.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: inbound:10.0.0.1:10001
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 10.0.0.1
diff --git a/pkg/xds/generator/testdata/ingress/03.envoy.golden.yaml b/pkg/xds/generator/testdata/ingress/03.envoy.golden.yaml
index 036d46f21..4a9e3472c 100644
--- a/pkg/xds/generator/testdata/ingress/03.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/ingress/03.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+    '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
     clusterName: backend
     endpoints:
     - lbEndpoints:
@@ -39,11 +39,12 @@ resources:
               version: v2
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -62,7 +63,7 @@ resources:
     type: EDS
 - name: inbound:10.0.0.1:10001
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 10.0.0.1
@@ -75,7 +76,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -90,7 +91,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -105,7 +106,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
diff --git a/pkg/xds/generator/testdata/ingress/04.envoy.golden.yaml b/pkg/xds/generator/testdata/ingress/04.envoy.golden.yaml
index a854eb5a1..2f6131875 100644
--- a/pkg/xds/generator/testdata/ingress/04.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/ingress/04.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+    '@type': type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
     clusterName: backend
     endpoints:
     - lbEndpoints:
@@ -99,11 +99,12 @@ resources:
               version: v2
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -126,7 +127,7 @@ resources:
     type: EDS
 - name: inbound:10.0.0.1:10001
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 10.0.0.1
@@ -139,7 +140,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -154,7 +155,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -169,7 +170,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -183,7 +184,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -198,7 +199,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -213,7 +214,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           metadataMatch:
             filterMetadata:
@@ -227,7 +228,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: frontend
           metadataMatch:
             filterMetadata:
@@ -243,7 +244,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: frontend
           metadataMatch:
             filterMetadata:
@@ -258,7 +259,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: frontend
           metadataMatch:
             filterMetadata:
@@ -272,7 +273,7 @@ resources:
       filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: frontend
           metadataMatch:
             filterMetadata:
diff --git a/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml
index 6765e70f2..8c15083f3 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml
@@ -145,23 +145,28 @@ resources:
               role: master
 - name: api-grpc
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbPolicy: RANDOM
     name: api-grpc
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: api-http
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: api-http
     outlierDetection:
       enforcingConsecutive5xx: 100
@@ -170,14 +175,19 @@ resources:
       enforcingFailurePercentage: 0
       enforcingSuccessRate: 0
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: api-http2
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbPolicy: RING_HASH
     name: api-http2
     ringHashLbConfig:
@@ -185,38 +195,53 @@ resources:
       maximumRingSize: "1024"
       minimumRingSize: "64"
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: api-tcp
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbPolicy: LEAST_REQUEST
     leastRequestLbConfig:
       choiceCount: 4
     name: api-tcp
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbPolicy: MAGLEV
     name: backend
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -225,9 +250,14 @@ resources:
         - role
     name: db
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: outbound:127.0.0.1:18080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -236,14 +266,14 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           statPrefix: backend
     name: outbound:127.0.0.1:18080
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:40001
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -252,13 +282,15 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           accessLog:
           - name: envoy.access_loggers.file
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
-              format: |+
-                [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "gateway" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
+              '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+              logFormat:
+                textFormatSource:
+                  inlineString: |+
+                    [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "gateway" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
 
               path: /var/log
           httpFilters:
@@ -285,7 +317,7 @@ resources:
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:40002
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -294,11 +326,11 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           accessLog:
           - name: envoy.access_loggers.http_grpc
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
+              '@type': type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
               commonConfig:
                 grpcService:
                   envoyGrpc:
@@ -306,13 +338,14 @@ resources:
                 logName: |+
                   logstash:1234;[%START_TIME%] %RESPONSE_FLAGS% mesh1 10.0.0.1(gateway)->%UPSTREAM_HOST%(api-tcp) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
 
+                transportApiVersion: V3
           cluster: api-tcp
           statPrefix: api-tcp
     name: outbound:127.0.0.1:40002
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:40003
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -321,7 +354,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -346,7 +379,7 @@ resources:
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:40004
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -355,11 +388,11 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.grpc_stats
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.filter.http.grpc_stats.v2alpha.FilterConfig
+              '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
               emitFilterState: true
               statsForAllMethods: true
           - name: envoy.filters.http.router
@@ -385,7 +418,7 @@ resources:
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -394,7 +427,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           statPrefix: db
           weightedClusters:
             clusters:
diff --git a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
index 6c89705c1..277914510 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
@@ -109,12 +109,12 @@ resources:
               role: master
 - name: api-http
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: api-http
     outlierDetection:
       enforcingConsecutive5xx: 100
@@ -125,7 +125,7 @@ resources:
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -144,6 +144,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -157,16 +159,23 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: api-http{mesh=mesh1}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: api-tcp
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbPolicy: LEAST_REQUEST
     leastRequestLbConfig:
       choiceCount: 4
@@ -174,7 +183,7 @@ resources:
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -193,6 +202,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -206,22 +217,29 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: api-tcp{mesh=mesh1}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: backend
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbPolicy: MAGLEV
     name: backend
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -240,6 +258,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -253,16 +273,23 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: backend{mesh=mesh1}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -277,7 +304,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -296,6 +323,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -309,6 +338,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           sni: db{mesh=mesh1,role=master}
     - match:
         role: replica
@@ -316,7 +347,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -335,6 +366,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -348,46 +381,53 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           sni: db{mesh=mesh1,role=replica}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: outbound:127.0.0.1:18080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 18080
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend
           statPrefix: backend
     name: outbound:127.0.0.1:18080
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:40001
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 40001
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           accessLog:
           - name: envoy.access_loggers.file
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
-              format: |+
-                [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "web" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
+              '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+              logFormat:
+                textFormatSource:
+                  inlineString: |+
+                    [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "web" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
 
               path: /var/log
           httpFilters:
@@ -414,22 +454,21 @@ resources:
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:40002
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 40002
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           accessLog:
           - name: envoy.access_loggers.http_grpc
             typedConfig:
-              '@type': type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
+              '@type': type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
               commonConfig:
                 grpcService:
                   envoyGrpc:
@@ -437,24 +476,24 @@ resources:
                 logName: |+
                   logstash:1234;[%START_TIME%] %RESPONSE_FLAGS% mesh1 10.0.0.1(web)->%UPSTREAM_HOST%(api-tcp) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
 
+                transportApiVersion: V3
           cluster: api-tcp
           statPrefix: api-tcp
     name: outbound:127.0.0.1:40002
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 54321
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           statPrefix: db
           weightedClusters:
             clusters:
diff --git a/pkg/xds/generator/testdata/outbound-proxy/05.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/05.envoy.golden.yaml
index 01f5615bd..4a548a9b7 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/05.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/05.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: es
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
@@ -29,18 +29,17 @@ resources:
     type: STRICT_DNS
 - name: outbound:127.0.0.1:18081
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 18081
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
diff --git a/pkg/xds/generator/testdata/outbound-proxy/06.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/06.envoy.golden.yaml
index 4db0a1409..ae3af962b 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/06.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/06.envoy.golden.yaml
@@ -1,9 +1,8 @@
 resources:
 - name: es2
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
-    http2ProtocolOptions: {}
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -28,20 +27,24 @@ resources:
                 kuma.io/protocol: http2
     name: es2
     type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: outbound:127.0.0.1:18082
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 18082
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
diff --git a/pkg/xds/generator/testdata/outbound-proxy/07.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/07.envoy.golden.yaml
index 2e209b4a1..ce209a48d 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/07.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/07.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: outbound:127.0.0.1:4040
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
diff --git a/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml
index ce9a625cd..0ff29df64 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml
@@ -17,23 +17,28 @@ resources:
     clusterName: db
 - name: backend.kuma-system
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: backend_kuma-system
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: backend.kuma-system
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     lbSubsetConfig:
       fallbackPolicy: ANY_ENDPOINT
       subsetSelectors:
@@ -42,9 +47,14 @@ resources:
         - version
     name: db
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: outbound:127.0.0.1:18080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -53,14 +63,14 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: backend.kuma-system
           statPrefix: backend_kuma-system
     name: outbound:127.0.0.1:18080
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -69,7 +79,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: db
           metadataMatch:
             filterMetadata:
diff --git a/pkg/xds/generator/testdata/probe/01.envoy.golden.yaml b/pkg/xds/generator/testdata/probe/01.envoy.golden.yaml
index d21481272..aeee7b8fd 100644
--- a/pkg/xds/generator/testdata/probe/01.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/probe/01.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: probe:listener
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         portValue: 9000
@@ -9,7 +9,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
diff --git a/pkg/xds/generator/testdata/probe/03.envoy.golden.yaml b/pkg/xds/generator/testdata/probe/03.envoy.golden.yaml
index ae20f8815..d22db591d 100644
--- a/pkg/xds/generator/testdata/probe/03.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/probe/03.envoy.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: probe:listener
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         portValue: 9000
@@ -9,7 +9,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
diff --git a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
index beadb36fa..6b98efd84 100644
--- a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
@@ -31,17 +31,17 @@ resources:
         loadBalancingWeight: 1
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: db
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -60,6 +60,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -73,27 +75,34 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: db{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: elastic
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     healthChecks:
     - healthyThreshold: 2
       interval: 5s
       tcpHealthCheck: {}
       timeout: 4s
       unhealthyThreshold: 3
-    http2ProtocolOptions: {}
     name: elastic
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -112,6 +121,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -125,11 +136,18 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: elastic{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: kuma_envoy_admin
     connectTimeout: 5s
     loadAssignment:
@@ -145,7 +163,7 @@ resources:
     type: STATIC
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -161,7 +179,7 @@ resources:
     type: STATIC
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -170,18 +188,18 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8080
           statPrefix: localhost_8080
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -200,6 +218,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -213,12 +233,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -227,7 +249,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -235,7 +257,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   prefix: /ready
@@ -248,7 +270,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -256,7 +278,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   headers:
@@ -270,7 +292,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificates:
             - certificateChain:
@@ -286,7 +308,7 @@ resources:
     trafficDirection: INBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -295,14 +317,14 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: db
           statPrefix: db
     name: outbound:127.0.0.1:54321
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:59200
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -311,7 +333,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: elastic
           statPrefix: elastic
     name: outbound:127.0.0.1:59200
diff --git a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
index 438106f33..dc226d3bd 100644
--- a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
@@ -31,17 +31,17 @@ resources:
         loadBalancingWeight: 1
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: db
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -60,6 +60,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -73,27 +75,34 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: db{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: elastic
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     healthChecks:
     - healthyThreshold: 2
       interval: 5s
       tcpHealthCheck: {}
       timeout: 4s
       unhealthyThreshold: 3
-    http2ProtocolOptions: {}
     name: elastic
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -112,6 +121,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -125,11 +136,18 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: elastic{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: inbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: inbound_passthrough
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
@@ -141,7 +159,7 @@ resources:
         portValue: 0
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: kuma_envoy_admin
     connectTimeout: 5s
     loadAssignment:
@@ -157,7 +175,7 @@ resources:
     type: STATIC
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -173,7 +191,7 @@ resources:
     type: STATIC
 - name: outbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: outbound_passthrough
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
@@ -181,29 +199,28 @@ resources:
     type: ORIGINAL_DST
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
         portValue: 80
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8080
           statPrefix: localhost_8080
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -222,6 +239,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -235,12 +254,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: inbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 0.0.0.0
@@ -249,7 +270,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: inbound:passthrough
           statPrefix: inbound_passthrough
     name: inbound:passthrough
@@ -257,7 +278,7 @@ resources:
     useOriginalDst: true
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -266,7 +287,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -274,7 +295,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   prefix: /ready
@@ -287,7 +308,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -295,7 +316,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   headers:
@@ -309,7 +330,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificates:
             - certificateChain:
@@ -325,43 +346,41 @@ resources:
     trafficDirection: INBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 54321
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: db
           statPrefix: db
     name: outbound:127.0.0.1:54321
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:59200
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 59200
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: elastic
           statPrefix: elastic
     name: outbound:127.0.0.1:59200
     trafficDirection: OUTBOUND
 - name: outbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 0.0.0.0
@@ -370,7 +389,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: outbound:passthrough
           statPrefix: outbound_passthrough
     name: outbound:passthrough
diff --git a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
index 92cce7a9f..65f1d40e0 100644
--- a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
@@ -31,17 +31,17 @@ resources:
         loadBalancingWeight: 1
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: db
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -60,6 +60,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -73,27 +75,34 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: db{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: elastic
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     healthChecks:
     - healthyThreshold: 2
       interval: 5s
       tcpHealthCheck: {}
       timeout: 4s
       unhealthyThreshold: 3
-    http2ProtocolOptions: {}
     name: elastic
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -112,6 +121,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -125,11 +136,18 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: elastic{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: kuma_envoy_admin
     connectTimeout: 5s
     loadAssignment:
@@ -145,7 +163,7 @@ resources:
     type: STATIC
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -161,7 +179,7 @@ resources:
     type: STATIC
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -170,12 +188,12 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -197,7 +215,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -216,6 +234,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -229,12 +249,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -243,7 +265,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -251,7 +273,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   prefix: /ready
@@ -264,7 +286,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -272,7 +294,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   headers:
@@ -286,7 +308,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificates:
             - certificateChain:
@@ -302,7 +324,7 @@ resources:
     trafficDirection: INBOUND
 - name: kuma:metrics:prometheus
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -315,7 +337,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -323,7 +345,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
@@ -334,12 +356,12 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: kuma_metrics_prometheus.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -347,7 +369,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
@@ -358,7 +380,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -377,6 +399,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -390,12 +414,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: kuma:metrics:prometheus
     trafficDirection: INBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -404,14 +430,14 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: db
           statPrefix: db
     name: outbound:127.0.0.1:54321
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:59200
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
@@ -420,7 +446,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: elastic
           statPrefix: elastic
     name: outbound:127.0.0.1:59200
diff --git a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
index ea9f87849..09f98758e 100644
--- a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
@@ -31,17 +31,17 @@ resources:
         loadBalancingWeight: 1
 - name: db
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
-    http2ProtocolOptions: {}
+        resourceApiVersion: V3
     name: db
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -60,6 +60,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -73,27 +75,34 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: db{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: elastic
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     connectTimeout: 5s
     edsClusterConfig:
       edsConfig:
         ads: {}
+        resourceApiVersion: V3
     healthChecks:
     - healthyThreshold: 2
       interval: 5s
       tcpHealthCheck: {}
       timeout: 4s
       unhealthyThreshold: 3
-    http2ProtocolOptions: {}
     name: elastic
     transportSocket:
       name: envoy.transport_sockets.tls
       typedConfig:
-        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         commonTlsContext:
           combinedValidationContext:
             defaultValidationContext:
@@ -112,6 +121,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_mesh_ca
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
           - name: identity_cert
             sdsConfig:
@@ -125,11 +136,18 @@ resources:
                           inlineBytes: MTIzNDU=
                     statPrefix: sds_identity_cert
                     targetUri: kuma-system:5677
+                transportApiVersion: V3
+              resourceApiVersion: V3
         sni: elastic{mesh=demo}
     type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions: {}
 - name: inbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: inbound_passthrough
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
@@ -141,7 +159,7 @@ resources:
         portValue: 0
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: kuma_envoy_admin
     connectTimeout: 5s
     loadAssignment:
@@ -157,7 +175,7 @@ resources:
     type: STATIC
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -173,7 +191,7 @@ resources:
     type: STATIC
 - name: outbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: outbound_passthrough
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
@@ -181,23 +199,22 @@ resources:
     type: ORIGINAL_DST
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
         portValue: 80
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -219,7 +236,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -238,6 +255,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -251,12 +270,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: inbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 0.0.0.0
@@ -265,7 +286,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: inbound:passthrough
           statPrefix: inbound_passthrough
     name: inbound:passthrough
@@ -273,7 +294,7 @@ resources:
     useOriginalDst: true
 - name: kuma:envoy:admin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -282,7 +303,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -290,7 +311,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   prefix: /ready
@@ -303,7 +324,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -311,7 +332,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_envoy_admin
+              name: kuma:envoy:admin
               routes:
               - match:
                   headers:
@@ -325,7 +346,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificates:
             - certificateChain:
@@ -341,7 +362,7 @@ resources:
     trafficDirection: INBOUND
 - name: kuma:metrics:prometheus
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -354,7 +375,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -362,7 +383,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
@@ -373,12 +394,12 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: kuma_metrics_prometheus.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -386,7 +407,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
@@ -397,7 +418,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -416,6 +437,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -429,48 +452,48 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: kuma:metrics:prometheus
     trafficDirection: INBOUND
 - name: outbound:127.0.0.1:54321
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 54321
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: db
           statPrefix: db
     name: outbound:127.0.0.1:54321
     trafficDirection: OUTBOUND
 - name: outbound:127.0.0.1:59200
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 127.0.0.1
         portValue: 59200
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: elastic
           statPrefix: elastic
     name: outbound:127.0.0.1:59200
     trafficDirection: OUTBOUND
 - name: outbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 0.0.0.0
@@ -479,7 +502,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: outbound:passthrough
           statPrefix: outbound_passthrough
     name: outbound:passthrough
diff --git a/pkg/xds/generator/testdata/prometheus-endpoint/custom.envoy-config.golden.yaml b/pkg/xds/generator/testdata/prometheus-endpoint/custom.envoy-config.golden.yaml
index 890a46ffc..94d38b2e6 100644
--- a/pkg/xds/generator/testdata/prometheus-endpoint/custom.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/prometheus-endpoint/custom.envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: kuma:metrics:prometheus
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -10,7 +10,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -18,7 +18,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /even-more-non-standard-path
diff --git a/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml b/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
index 6328ff9d1..048f85d88 100644
--- a/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: kuma:metrics:prometheus
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -14,7 +14,7 @@ resources:
       filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -22,7 +22,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
@@ -33,12 +33,12 @@ resources:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: kuma_metrics_prometheus.
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -46,7 +46,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
@@ -57,7 +57,7 @@ resources:
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -76,6 +76,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -89,6 +91,8 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: kuma:metrics:prometheus
     trafficDirection: INBOUND
diff --git a/pkg/xds/generator/testdata/prometheus-endpoint/default.envoy-config.golden.yaml b/pkg/xds/generator/testdata/prometheus-endpoint/default.envoy-config.golden.yaml
index f99d613e0..e9832c44b 100644
--- a/pkg/xds/generator/testdata/prometheus-endpoint/default.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/prometheus-endpoint/default.envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: kuma:metrics:prometheus
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
@@ -10,7 +10,7 @@ resources:
     - filters:
       - name: envoy.filters.network.http_connection_manager
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
           httpFilters:
           - name: envoy.filters.http.router
           routeConfig:
@@ -18,7 +18,7 @@ resources:
             virtualHosts:
             - domains:
               - '*'
-              name: kuma_metrics_prometheus
+              name: kuma:metrics:prometheus
               routes:
               - match:
                   prefix: /non-standard-path
diff --git a/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
index 7382fffe3..2eccc97bd 100644
--- a/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
@@ -1,7 +1,23 @@
 resources:
-- name: inbound:passthrough
+- name: raw-name
   resource:
     '@type': type.googleapis.com/envoy.api.v2.Cluster
+    altStatName: localhost_8443
+    connectTimeout: 5s
+    loadAssignment:
+      clusterName: localhost:8443
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: 127.0.0.1
+                portValue: 8443
+    name: localhost:8443
+    type: STATIC
+- name: inbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: inbound_passthrough
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
@@ -13,7 +29,7 @@ resources:
         portValue: 0
 - name: localhost:8080
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: localhost_8080
     connectTimeout: 5s
     loadAssignment:
@@ -29,53 +45,36 @@ resources:
     type: STATIC
 - name: outbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: outbound_passthrough
     connectTimeout: 5s
     lbPolicy: CLUSTER_PROVIDED
     name: outbound:passthrough
     type: ORIGINAL_DST
-- name: raw-name
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
-    altStatName: localhost_8443
-    connectTimeout: 5s
-    loadAssignment:
-      clusterName: localhost:8443
-      endpoints:
-      - lbEndpoints:
-        - endpoint:
-            address:
-              socketAddress:
-                address: 127.0.0.1
-                portValue: 8443
-    name: localhost:8443
-    type: STATIC
 - name: inbound:192.168.0.1:80
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 192.168.0.1
         portValue: 80
-    deprecatedV1:
-      bindToPort: false
+    bindToPort: false
     filterChains:
     - filters:
       - name: envoy.filters.network.rbac
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
+          '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
           rules: {}
           statPrefix: inbound_192_168_0_1_80.
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: localhost:8080
           statPrefix: localhost_8080
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             combinedValidationContext:
               defaultValidationContext:
@@ -94,6 +93,8 @@ resources:
                               inlineBytes: MTIzNDU=
                         statPrefix: sds_mesh_ca
                         targetUri: kuma-system:5677
+                    transportApiVersion: V3
+                  resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
@@ -107,12 +108,14 @@ resources:
                             inlineBytes: MTIzNDU=
                       statPrefix: sds_identity_cert
                       targetUri: kuma-system:5677
+                  transportApiVersion: V3
+                resourceApiVersion: V3
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
 - name: inbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 0.0.0.0
@@ -121,7 +124,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: inbound:passthrough
           statPrefix: inbound_passthrough
     name: inbound:passthrough
@@ -129,7 +132,7 @@ resources:
     useOriginalDst: true
 - name: outbound:passthrough
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     address:
       socketAddress:
         address: 0.0.0.0
@@ -138,7 +141,7 @@ resources:
     - filters:
       - name: envoy.filters.network.tcp_proxy
         typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
           cluster: outbound:passthrough
           statPrefix: outbound_passthrough
     name: outbound:passthrough
diff --git a/pkg/xds/generator/testdata/tracing/zipkin.envoy-config.golden.yaml b/pkg/xds/generator/testdata/tracing/zipkin.envoy-config.golden.yaml
index aca8cc063..a96f69dd8 100644
--- a/pkg/xds/generator/testdata/tracing/zipkin.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/tracing/zipkin.envoy-config.golden.yaml
@@ -1,7 +1,7 @@
 resources:
 - name: tracing:zipkin
   resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     altStatName: tracing_zipkin
     connectTimeout: 5s
     loadAssignment:
diff --git a/pkg/xds/generator/testdata/transparent-proxy/01.envoy.golden.yaml b/pkg/xds/generator/testdata/transparent-proxy/01.envoy.golden.yaml
new file mode 100644
index 000000000..0967ef424
--- /dev/null
+++ b/pkg/xds/generator/testdata/transparent-proxy/01.envoy.golden.yaml
@@ -0,0 +1,1 @@
+{}
diff --git a/pkg/xds/generator/testdata/transparent-proxy/02.envoy.golden.yaml b/pkg/xds/generator/testdata/transparent-proxy/02.envoy.golden.yaml
new file mode 100644
index 000000000..c8f0d3a63
--- /dev/null
+++ b/pkg/xds/generator/testdata/transparent-proxy/02.envoy.golden.yaml
@@ -0,0 +1,55 @@
+resources:
+- name: inbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: inbound_passthrough
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: inbound:passthrough
+    type: ORIGINAL_DST
+    upstreamBindConfig:
+      sourceAddress:
+        address: 127.0.0.6
+        portValue: 0
+- name: outbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: outbound_passthrough
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: outbound:passthrough
+    type: ORIGINAL_DST
+- name: inbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 15006
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: inbound:passthrough
+          statPrefix: inbound_passthrough
+    name: inbound:passthrough
+    trafficDirection: INBOUND
+    useOriginalDst: true
+- name: outbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 15001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: outbound:passthrough
+          statPrefix: outbound_passthrough
+    name: outbound:passthrough
+    trafficDirection: OUTBOUND
+    useOriginalDst: true
diff --git a/pkg/xds/generator/testdata/transparent-proxy/03.envoy.golden.yaml b/pkg/xds/generator/testdata/transparent-proxy/03.envoy.golden.yaml
new file mode 100644
index 000000000..fd7be9086
--- /dev/null
+++ b/pkg/xds/generator/testdata/transparent-proxy/03.envoy.golden.yaml
@@ -0,0 +1,65 @@
+resources:
+- name: inbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: inbound_passthrough
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: inbound:passthrough
+    type: ORIGINAL_DST
+    upstreamBindConfig:
+      sourceAddress:
+        address: 127.0.0.6
+        portValue: 0
+- name: outbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: outbound_passthrough
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: outbound:passthrough
+    type: ORIGINAL_DST
+- name: inbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 15006
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: inbound:passthrough
+          statPrefix: inbound_passthrough
+    name: inbound:passthrough
+    trafficDirection: INBOUND
+    useOriginalDst: true
+- name: outbound:passthrough
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 15001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          accessLog:
+          - name: envoy.access_loggers.file
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+              logFormat:
+                textFormatSource:
+                  inlineString: |+
+                    [%START_TIME%] %RESPONSE_FLAGS% default (unknown)->%UPSTREAM_HOST%(external) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
+
+              path: /var/log
+          cluster: outbound:passthrough
+          statPrefix: outbound_passthrough
+    name: outbound:passthrough
+    trafficDirection: OUTBOUND
+    useOriginalDst: true
diff --git a/pkg/xds/generator/tracing_generator_test.go b/pkg/xds/generator/tracing_generator_test.go
index 07132a3fe..c083fc035 100644
--- a/pkg/xds/generator/tracing_generator_test.go
+++ b/pkg/xds/generator/tracing_generator_test.go
@@ -48,7 +48,7 @@ var _ = Describe("TracingProxyGenerator", func() {
 						Mesh: "demo",
 					},
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 			},
 		}),
 	)
@@ -86,7 +86,7 @@ var _ = Describe("TracingProxyGenerator", func() {
 						},
 					},
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Policies: model.MatchedPolicies{
 					TracingBackend: &mesh_proto.TracingBackend{
 						Name: "zipkin",
diff --git a/pkg/xds/generator/transparent_proxy_generator_test.go b/pkg/xds/generator/transparent_proxy_generator_test.go
index b4de38a1c..85abcf226 100644
--- a/pkg/xds/generator/transparent_proxy_generator_test.go
+++ b/pkg/xds/generator/transparent_proxy_generator_test.go
@@ -1,6 +1,8 @@
 package generator_test
 
 import (
+	"path/filepath"
+
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
 	. "github.com/onsi/gomega"
@@ -8,6 +10,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	model "github.com/kumahq/kuma/pkg/core/xds"
+	. "github.com/kumahq/kuma/pkg/test/matchers"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
@@ -25,7 +28,7 @@ var _ = Describe("TransparentProxyGenerator", func() {
 
 	DescribeTable("Generate Envoy xDS resources",
 		func(given testCase) {
-			// setup
+			// given
 			gen := &generator.TransparentProxyGenerator{}
 			ctx := xds_context.Context{
 				Mesh: xds_context.MeshContext{
@@ -44,16 +47,13 @@ var _ = Describe("TransparentProxyGenerator", func() {
 			// then
 			Expect(err).ToNot(HaveOccurred())
 
-			// when
 			resp, err := rs.List().ToDeltaDiscoveryResponse()
-			// then
 			Expect(err).ToNot(HaveOccurred())
-			// when
 			actual, err := util_proto.ToYAML(resp)
-			// then
 			Expect(err).ToNot(HaveOccurred())
 
-			Expect(actual).To(MatchYAML(given.expected))
+			// and output matches golden files
+			Expect(actual).To(MatchGoldenYAML(filepath.Join("testdata", "transparent-proxy", given.expected)))
 		},
 		Entry("transparent_proxying=false", testCase{
 			proxy: &model.Proxy{
@@ -63,11 +63,9 @@ var _ = Describe("TransparentProxyGenerator", func() {
 						Version: "v1",
 					},
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 			},
-			expected: `
-        {}
-`,
+			expected: "01.envoy.golden.yaml",
 		}),
 		Entry("transparent_proxying=true", testCase{
 			proxy: &model.Proxy{
@@ -85,7 +83,7 @@ var _ = Describe("TransparentProxyGenerator", func() {
 						},
 					},
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Policies: model.MatchedPolicies{
 					Logs: map[model.ServiceName]*mesh_proto.LoggingBackend{ // to show that is not picked
 						"some-service": {
@@ -98,63 +96,7 @@ var _ = Describe("TransparentProxyGenerator", func() {
 					},
 				},
 			},
-			expected: `
-        resources:
-        - name: inbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Cluster
-            altStatName: inbound_passthrough
-            connectTimeout: 5s
-            lbPolicy: CLUSTER_PROVIDED
-            name: inbound:passthrough
-            type: ORIGINAL_DST
-            upstreamBindConfig:
-              sourceAddress:
-                address: 127.0.0.6
-                portValue: 0
-        - name: outbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Cluster
-            altStatName: outbound_passthrough
-            connectTimeout: 5s
-            lbPolicy: CLUSTER_PROVIDED
-            name: outbound:passthrough
-            type: ORIGINAL_DST
-        - name: inbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Listener
-            address:
-              socketAddress:
-                address: 0.0.0.0
-                portValue: 15006
-            filterChains:
-            - filters:
-              - name: envoy.filters.network.tcp_proxy
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                  cluster: inbound:passthrough
-                  statPrefix: inbound_passthrough
-            name: inbound:passthrough
-            trafficDirection: INBOUND
-            useOriginalDst: true
-        - name: outbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Listener
-            address:
-              socketAddress:
-                address: 0.0.0.0
-                portValue: 15001
-            filterChains:
-            - filters:
-              - name: envoy.filters.network.tcp_proxy
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                  cluster: outbound:passthrough
-                  statPrefix: outbound_passthrough
-            name: outbound:passthrough
-            trafficDirection: OUTBOUND
-            useOriginalDst: true
-`,
+			expected: "02.envoy.golden.yaml",
 		}),
 		Entry("transparent_proxying=true with logs", testCase{
 			proxy: &model.Proxy{
@@ -172,7 +114,7 @@ var _ = Describe("TransparentProxyGenerator", func() {
 						},
 					},
 				},
-				APIVersion: envoy_common.APIV2,
+				APIVersion: envoy_common.APIV3,
 				Policies: model.MatchedPolicies{
 					Logs: map[model.ServiceName]*mesh_proto.LoggingBackend{ // to show that is is not picked
 						"pass_through": {
@@ -185,71 +127,7 @@ var _ = Describe("TransparentProxyGenerator", func() {
 					},
 				},
 			},
-			expected: `
-        resources:
-        - name: inbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Cluster
-            altStatName: inbound_passthrough
-            connectTimeout: 5s
-            lbPolicy: CLUSTER_PROVIDED
-            name: inbound:passthrough
-            type: ORIGINAL_DST
-            upstreamBindConfig:
-              sourceAddress:
-                address: 127.0.0.6
-                portValue: 0
-        - name: outbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Cluster
-            altStatName: outbound_passthrough
-            connectTimeout: 5s
-            lbPolicy: CLUSTER_PROVIDED
-            name: outbound:passthrough
-            type: ORIGINAL_DST
-        - name: inbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Listener
-            address:
-              socketAddress:
-                address: 0.0.0.0
-                portValue: 15006
-            filterChains:
-            - filters:
-              - name: envoy.filters.network.tcp_proxy
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                  cluster: inbound:passthrough
-                  statPrefix: inbound_passthrough
-            name: inbound:passthrough
-            trafficDirection: INBOUND
-            useOriginalDst: true
-        - name: outbound:passthrough
-          resource:
-            '@type': type.googleapis.com/envoy.api.v2.Listener
-            address:
-              socketAddress:
-                address: 0.0.0.0
-                portValue: 15001
-            filterChains:
-            - filters:
-              - name: envoy.filters.network.tcp_proxy
-                typedConfig:
-                  '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                  accessLog:
-                  - name: envoy.access_loggers.file
-                    typedConfig:
-                      '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
-                      format: |+
-                        [%START_TIME%] %RESPONSE_FLAGS% default (unknown)->%UPSTREAM_HOST%(external) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
-                        
-                      path: /var/log
-                  cluster: outbound:passthrough
-                  statPrefix: outbound_passthrough
-            name: outbound:passthrough
-            trafficDirection: OUTBOUND
-            useOriginalDst: true
-`,
+			expected: "03.envoy.golden.yaml",
 		}),
 	)
 })