Repository: kumahq/kuma
Pull request #1569 (2021-02-17 01:59:43)

fix(*) network attachment definitions for CNI
### Summary

Only create/delete NetworkAttachmentDefinitions when needed (i.e. OpenShift with MultusCNI).

Installing multus is as simple as applying this:
https://raw.githubusercontent.com/intel/multus-cni/master/images/multus-daemonset.yml

Fixes https://github.com/kumahq/kuma/issues/1547

### Documentation

- [ ] Not needed



Patch:
diff --git a/api/go.sum b/api/go.sum
index 33ce00af9..0314f935e 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -148,6 +148,7 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4c=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
diff --git a/api/mesh/v1alpha1/dataplane_helpers.go b/api/mesh/v1alpha1/dataplane_helpers.go
index d03a8db90..eb7ad25ff 100644
--- a/api/mesh/v1alpha1/dataplane_helpers.go
+++ b/api/mesh/v1alpha1/dataplane_helpers.go
@@ -139,6 +139,16 @@ func (n *Dataplane_Networking) ToInboundInterface(inbound *Dataplane_Networking_
 	return iface
 }
 
+func (n *Dataplane_Networking) GetHealthyInbounds() (inbounds []*Dataplane_Networking_Inbound) {
+	for _, inbound := range n.GetInbound() {
+		if inbound.Health != nil && !inbound.Health.Ready {
+			continue
+		}
+		inbounds = append(inbounds, inbound)
+	}
+	return
+}
+
 // Matches is simply an alias for MatchTags to make source code more aesthetic.
 func (d *Dataplane) Matches(selector TagSelector) bool {
 	if d != nil {
diff --git a/api/mesh/v1alpha1/health_check.pb.go b/api/mesh/v1alpha1/health_check.pb.go
index 32f10cdb0..ceda69775 100644
--- a/api/mesh/v1alpha1/health_check.pb.go
+++ b/api/mesh/v1alpha1/health_check.pb.go
@@ -111,13 +111,17 @@ type HealthCheck_Conf struct {
 	UnhealthyThreshold uint32 `protobuf:"varint,3,opt,name=unhealthy_threshold,json=unhealthyThreshold,proto3" json:"unhealthy_threshold,omitempty"`
 	// Number of consecutive healthy checks before considering a host healthy.
 	HealthyThreshold uint32 `protobuf:"varint,4,opt,name=healthy_threshold,json=healthyThreshold,proto3" json:"healthy_threshold,omitempty"`
-	// If specified, Envoy will start health checking after for a random time in ms between 0 and initial_jitter.
-	// This only applies to the first health check.
+	// If specified, Envoy will start health checking after for a random time in
+	// ms between 0 and initial_jitter. This only applies to the first health
+	// check.
 	InitialJitter *duration.Duration `protobuf:"bytes,7,opt,name=initial_jitter,json=initialJitter,proto3" json:"initial_jitter,omitempty"`
-	// If specified, during every interval Envoy will add interval_jitter to the wait time.
+	// If specified, during every interval Envoy will add interval_jitter to the
+	// wait time.
 	IntervalJitter *duration.Duration `protobuf:"bytes,8,opt,name=interval_jitter,json=intervalJitter,proto3" json:"interval_jitter,omitempty"`
-	// If specified, during every interval Envoy will add interval_ms * interval_jitter_percent / 100 to the wait time.
-	// If interval_jitter_ms and interval_jitter_percent are both set, both of them will be used to increase the wait time.
+	// If specified, during every interval Envoy will add interval_ms *
+	// interval_jitter_percent / 100 to the wait time. If interval_jitter_ms and
+	// interval_jitter_percent are both set, both of them will be used to
+	// increase the wait time.
 	IntervalJitterPercent uint32 `protobuf:"varint,9,opt,name=interval_jitter_percent,json=intervalJitterPercent,proto3" json:"interval_jitter_percent,omitempty"`
 	// Types that are assignable to Protocol:
 	//	*HealthCheck_Conf_Tcp_
diff --git a/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go b/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go
index 33e3ee677..05f445e92 100644
--- a/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go
+++ b/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go
@@ -44,7 +44,7 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/README.md": &vfsgen۰CompressedFileInfo{
 			name:             "README.md",
-			modTime:          time.Date(2021, 2, 10, 14, 45, 16, 218246808, time.UTC),
+			modTime:          time.Date(2021, 2, 17, 1, 42, 44, 511912402, time.UTC),
 			uncompressedSize: 9132,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xb4\x5a\x59\x73\x1b\x37\xf2\x7f\x9f\x4f\xd1\xa1\x1e\x7c\x14\x39\x94\x9d\xc4\x7f\x17\xeb\xbf\xbb\xa5\x48\xc9\x5a\x65\xc7\x61\x59\x72\xf6\x41\x51\x99\x18\xa0\x39\x84\x89\x01\xc6\x00\x86\x12\x63\xf9\xbb\x6f\x35\x30\x17\x0f\x1d\xde\x38\x79\x88\x87\x33\x8d\x5f\x37\x1a\x7d\xa2\x75\xf1\xdd\xc5\xe5\xc5\xb2\x2a\xd8\x48\x99\xdc\x5c\xd6\xcf\x95\x55\x97\x49\x72\x04\xaf\x50\x15\xc0\x17\xcc\x7a\x98\x1b\x0b\x7e\x81\xf0\xba\x2a\x18\x1c\x1b\xed\xad\x51\x30\x55\x4c\x63\x92\x7c\x77\x71\xbe\x2e\x71\x02\xac\x2c\x95\xe4\xcc\x4b\xa3\x2f\x1f\x2f\xbc\x2f\xdd\x64\x3c\x96\x45\x9e\xba\x85\x44\x25\x5c\x2a\xcd\x38\x63\x22\xc7\x31\xd1\x8f\x7a\xe4\x23\xa9\xe7\xc6\x16\xe1\x99\xa9\x7f\x39\xbf\x56\xf8\x8f\xb9\x62\x7e\xe4\x3e\x55\xcc\xe2\x13\xf8\xee\xe2\x77\xb4\x4e\x1a\x3d\x81\xc3\xf4\x87\xf4\xe5\x3d\x0c\x6a\xe2\x51\xa0\x7d\x08\xfa\x51\x59\xb6\x0c\x9e\xa5\x87\xe9\xff\xdd\xc3\xa0\xa3\x1f\x05\xf2\x7b\x79\x24\xc9\xd3\xa7\xaf\x4c\x81\x25\xcb\x71\xf2\xf4\x29\xfc\x7f\x03\x9f\x4b\xbf\xa8\xb2\x94\x9b\x62\x4c\xca\x5f\x7c\x0a\xff\xfc\x33\x49\x0e\x0e\xe0\x77\xa6\x2a\x74\x49\x72\x03\xaf\x71\x0d\x37\x40\x7a\x83\x1b\x38\xc1\x39\xab\x94\x0f\x4f\x8e\x5b\x59\x12\x57\xb8\x49\x6e\x46\xf4\x5f\xfc\x7f\xf3\xcf\xc6\x53\xf8\x95\xdc\x40\xae\x4c\xc6\x54\x2a\x0b\x96\x63\x6a\x31\x97\xce\x5b\xc2\x77\xde\x4a\x9d\xc3\x0d\xcc\x06\x4b\xa3\xf3\x91\x30\x7c\x89\x76\x14\x8c\x22\x3e\xa7\x99\xd4\xde\xb2\x75\x2a\xcd\x60\xd6\x13\xa5\x05\x21\x43\x61\x4a\x45\x43\x39\x25\x06\x0e\x76\x58\x7a\x96\x6f\x70\xd3\x52\x11\xd8\xf9\x02\x41\xd4\x80\x44\xb2\x81\x15\x56\xba\x21\x5c\x2d\x24\x5f\x80\xf4\x0e\xd5\xbc\xa1\x76\xe0\x0d\xa4\xc7\x64\xa9\x69\x77\x32\x81\x6f\xc9\x3c\x5f\x9c\xad\x9d\xc7\xe2\x2d\x2b\xd0\x95\x8c\x93\x0a\x33\x63\x14\x71\xf6\xb6\x42\x62\xfd\x9f\x05\xfa\x05\x5a\x30\x16\xb4\xf1\x04\x17\x16\x06\x9b\xf7\xcc\xe6\xe8\x41\xb7\xcb\xaf\xa4\x8f\x5f\x5c\xc0\x05\xc5\x32\x54\x81\x9b\xd4\xce\x33\xa5\x8e\xad\x70\xbf\xe9\xf7\x65\x6e\x99\x20\x6e\x26\xfb\x88\x9c\xce\x6b\xf6\x79\x80\x9a\x65\x0a\xc5\x60\x42\xac\x87\x83\xb0\xad\x69\xa5\xd4\x19\x72\x8b\xde\x0d\x26\x17\x97\x5f\x36\x24\xf2\x41\xa2\x1a\x19\x34\x5e\xc1\xf1\xbb\x13\x07\x19\xce\x8d\x45\xa8\x6a\x26\xf0\x58\xce\x81\xe9\x35\x5c\xa1\x45\xa0\x43\x32\xa2\xe2\x28\x00\xa0\x93\x97\x16\xaf\x6a\xe5\x98\x79\xd0\xeb\x93\x20\x37\x8f\x1e\x1d\x1c\x3a\x55\x26\x7f\x83\x2b\xda\x51\xdf\x20\xc8\xc0\xc3\x91\xc7\x10\x30\x05\x65\x72\x50\x44\x37\x01\xa3\x91\xf0\xcc\x7c\x3e\x24\xb2\xa1\xc0\xac\xca\x77\x81\x0b\x13\xb4\xd1\x03\x75\x9e\x69\xc1\x94\xd1\xb8\x01\x4d\x84\xae\x85\xed\x88\x86\x16\x0b\xe3\x71\x18\x8d\x69\x97\xc1\x9f\xb4\x62\x8f\x61\x35\xb8\xf4\x7d\x08\x72\x0e\xb6\xd2\x9a\x48\x8a\x4a\x79\x19\x57\x6d\x63\x2d\x85\xfb\x77\x60\x73\x24\x84\x45\xe7\x36\x05\x0f\xe2\xfe\xa6\xd5\x1a\x2a\x87\x02\xa4\x86\x59\x94\x6d\x06\x71\x97\xdb\x70\x16\x43\xb4\x23\x18\xa9\x83\x29\x3c\x23\x88\xb7\x55\x91\xd1\x21\xcf\xa1\x25\x30\xf3\x5e\xa4\x9d\xa6\x70\x9a\x6b\x63\x51\xc0\xd5\x02\x35\xb0\xca\x1b\xc7\x99\x22\x39\xa4\x83\xda\x98\x76\xd9\xf5\xe8\xd2\x96\xa8\xb5\xfa\x39\x53\x6e\xc3\xec\xbd\xa9\xa1\xe0\x95\xb1\xa4\x10\xcf\x14\x4c\x8d\x80\xa3\x0e\xa7\x71\x3d\x8b\x9f\x2a\x69\xd1\x05\x29\x2f\x7e\x45\x6f\x25\x77\x70\x86\x76\x85\xb6\x8b\x9a\x1b\x61\x2d\x43\xab\xd1\xa3\x1b\x39\x99\xbb\x71\x11\x97\x8c\x5c\x58\xf2\x84\x94\x47\x50\x5c\x55\xce\xa3\xbd\x7b\x2f\x85\xd4\xef\x76\x34\xf9\xbc\x09\x1e\x85\xd4\xb2\xa8\x0a\x3a\xea\xd2\x88\x10\x15\x98\x52\xe6\xea\x1e\x4c\x76\xbd\x8b\xf9\x63\x8b\xc9\xae\xfb\x78\xb4\x08\xe9\xe1\x4e\xc8\x18\x32\x8e\xa7\xef\xdf\x7b\xa9\xe4\x9f\x21\x2d\x4c\xd1\x72\xd4\x9e\xe5\xd8\x71\x79\x79\x48\x6c\x7e\x31\xb6\xd9\x3d\x69\x95\x79\x10\x46\x3f\xf2\xe0\xaa\xb2\x34\xd6\xf7\x0f\x7d\xbc\x7a\x9e\xa1\x67\xc3\xcd\x77\xcf\xc8\x16\x82\x21\xde\xbd\xd1\xfa\xac\x6e\x40\x49\x17\xf8\x5f\x7c\x1e\x58\x74\xa6\xb2\x1c\x07\x93\xcf\x03\x0a\x71\x83\xc9\x80\x97\xd5\x60\x38\x88\x7b\xa0\xd7\x6c\x85\x96\xe5\xd8\xdb\xcb\x60\xf2\xf2\x70\x38\xf0\xeb\x92\xc8\xfb\xef\xbf\x7c\x69\x5f\xbf\x6b\x80\xbf\x5c\xde\xb6\xc9\x3b\x77\x58\x39\x84\x56\xe2\xed\x6d\x69\x23\xf0\x0c\x15\x72\x6f\xec\x56\x80\xed\xcc\x8d\xd2\x35\xb3\x7c\x31\x98\x0c\x58\x21\x5e\xfc\x30\x18\x6e\x7d\x34\x6e\x30\x19\x28\xa9\xab\xeb\x41\x88\xb9\x6f\xc9\x75\x5d\x03\x7b\x7b\xcd\x13\xad\x61\x47\x28\xa9\x3f\x86\x95\xbf\x30\xa9\x2a\x8b\x53\xa3\x24\xdf\x4a\xab\xd1\x99\x43\xf4\xa8\xa9\xa0\x8c\x64\xb5\xdb\x17\x95\x67\x9e\xa8\xaf\x30\x5b\x18\xb3\x04\x59\x94\x0a\x0b\xd4\x1e\x05\x64\xeb\x4e\xa0\xd3\x9a\x19\x70\x53\x94\x46\x23\x19\xd4\xb6\x40\xe4\x61\x92\x63\x4a\xe7\xba\x2f\x2e\xfe\x56\xc6\x7a\x45\xad\xc1\xac\xd0\x5a\x29\x70\x33\xfc\x6c\x6c\xfa\x2c\xa2\x3d\x72\x10\xf1\x6e\xe3\xe6\x63\x95\xd2\xdb\xf5\x71\x3c\xf7\xd3\x69\xd8\x78\x8d\x03\x81\xee\x76\x76\xb7\xe2\x33\xad\x8d\x0f\xe6\xe6\x36\x8f\x3e\x9c\xe1\x91\x10\x32\xee\x0a\xfa\x84\x94\xd1\x2b\x0f\x46\x3f\x98\x5d\x4c\x32\xef\x42\x54\x3f\x5b\x6b\xde\x88\xbd\x69\x6d\x3d\x1e\x83\xc9\xe7\x2f\xc3\x01\xd9\xf3\x60\xf2\xe3\x8b\x97\x3f\xb6\x9e\xf0\xc6\x30\xf1\x13\x53\x4c\x73\xb4\xd1\xd0\xde\xbf\x7b\x43\x3b\x8f\x09\xa6\x4d\x4f\x0f\x15\x61\x8f\x86\x37\x58\xdc\xa6\xe4\xc8\x6e\x14\xf1\xc0\xad\x35\x7f\x38\xcb\x6f\xa0\xf4\x7a\xb7\x35\x7b\x02\x6f\xa5\x7c\xb0\x18\x21\x5a\x74\x41\xfa\xc5\xcb\x10\xa7\xa7\xf4\xd6\xe8\x3a\x41\xdd\xc1\x87\x52\xe6\x75\x69\xf6\x46\xca\xa6\x96\x4c\xdd\x52\x96\xbf\xa2\x5b\x1c\x5b\x64\xb1\xb2\xbe\x3d\x71\x76\xf5\x22\xad\x02\x1e\x96\xe8\x3c\xec\xb7\x29\x65\x09\x6b\x5f\x41\x10\xc3\xa3\x7b\xa8\x63\x12\x64\xb3\x08\x5c\x89\x7b\x0e\xcf\x2b\x97\xe6\xa8\xd1\x32\x95\xba\x50\x4f\xbe\xdd\xf6\xfc\x41\x6d\x1d\xf4\x31\x86\x61\x42\x60\x92\x4e\x4b\xb9\x94\x5b\x3f\x84\x25\xae\xe9\x01\x98\x16\xc0\x59\x78\xa4\x58\x58\x5a\xe3\x91\x87\xed\xc5\x8a\x5c\x8f\x9a\x9c\xcd\x4d\x51\x54\xba\xee\xe6\xee\x96\x8b\xb3\x9f\x2a\x2d\xd4\x3e\xa9\x7e\x62\x0e\x5f\xfc\x00\xa8\xb9\x11\x28\xe0\xf8\x08\x38\x5a\x2f\xe7\x84\x8b\xf0\x38\x54\xdc\xb4\x1f\xe6\xa8\x66\xb8\x67\xe7\x07\x51\xf2\x27\xfb\xa5\x61\xa5\x8c\x15\xcb\xb7\xd0\xd3\x3e\xe5\x1c\x4d\x4f\xc9\x22\x5f\x9d\x9f\x4f\xcf\xee\x13\x81\x2b\x89\xda\x1f\xa3\xf5\xee\xec\xab\xa5\x09\xa9\xdc\xcc\x21\x2d\xb1\xe8\xeb\xab\x4e\xb2\x9c\x69\x60\x9c\x53\x01\xcb\x44\x21\x35\xa0\x16\xa5\x91\xda\xbb\xa6\x03\x78\x80\xa8\x6d\x2d\xfc\xb7\xe9\x8c\x5b\xe3\x1c\x7c\x85\x39\x2d\x85\x8b\x0e\x7e\x1c\x94\xf7\x3f\x88\x54\x5b\x76\x8c\x19\x57\xac\x2e\xa0\xc8\x93\x65\xae\xe1\xf5\xc9\x59\x13\x48\x62\x9d\x9a\xc2\x7b\xfa\x4e\x72\x1f\x4f\xa9\x8b\x8a\x7a\xde\x2b\x60\xec\x72\xcb\x4a\xa9\xbd\x35\xc0\xfc\xad\xf1\x53\x8b\x0e\xb5\xdf\x68\x7b\x4e\x9b\x5e\xb0\x59\xb5\x1f\xd7\x62\x69\x9c\xf4\x66\xa7\x65\xa7\x36\x9d\x97\x1b\x90\x61\x05\xf4\x57\xec\x66\xd5\xd0\x77\x36\x45\xa1\x99\xc3\x67\xf8\x59\xaf\x26\x35\xf2\xb0\x56\x5e\xf7\xfb\x35\xae\x9b\x1f\xf0\xa5\x17\xb3\xea\x06\x36\x14\xdd\x42\x90\x93\xa2\x5e\x49\x6b\x34\x15\x2f\xb0\x62\x56\x52\x83\x11\x3a\x78\x6a\x51\x67\x3f\xeb\xd5\x8c\x02\x72\x68\x4c\xe9\xdc\xea\x2c\x85\x7a\xd5\x52\x0f\x61\x16\x61\xf7\x52\xc6\x4f\xc3\x10\xa7\x66\xaf\x71\xdd\x12\x2d\x71\xbd\x49\x03\x2b\xa6\xaa\x50\xb6\x53\x55\xb9\xa3\x03\xd4\xab\xdf\x99\xbd\x27\xb1\xed\xdd\x4d\xb4\xa9\x2b\xa9\x14\x64\x08\x25\x73\xb5\x0d\x85\x86\xa6\xae\x2f\xca\xfd\xf5\x45\x5d\xe0\xb9\x74\xc5\x94\x14\xcc\x1b\x9b\xb2\x96\xdb\xbb\x4a\xe1\xbe\x96\xb3\x27\x8f\x0d\x24\xa4\xed\xb2\xa4\x3c\xa1\xe3\xa1\xb7\x68\x4d\x05\x19\x0c\x77\x5e\xa9\xd8\x40\x66\x95\x54\x22\x78\x5c\xe5\xbc\x29\xda\xea\x53\x83\x37\x65\x13\x12\xd2\x3b\xa4\x35\x57\x1a\xed\x3b\x9c\xa3\x45\x4d\x75\xc1\x37\x10\x39\x40\x82\x6d\x30\xff\xba\xe0\x5a\xde\xd5\xf4\x9e\xd6\x57\x29\x81\x77\xb8\x1b\x39\x7e\x7b\x1a\x2e\x58\x90\x09\x42\x2a\xad\xb9\x5e\x83\xd4\xb2\x8d\x16\x4d\x5b\xaa\x65\xca\x17\xf4\xfb\x4e\xe0\x08\x07\x0d\x65\x77\x21\xa0\x65\xaa\xd1\x9f\x48\xbb\xa9\xa6\x31\x7a\x3e\xe6\x5a\x8e\x8b\x4a\xf9\xca\x8d\x35\xfa\x54\xd4\x81\xcb\x07\x53\x6a\x04\x24\x74\x21\x6d\x28\xfc\xd7\x2d\x66\x26\xf5\x2e\xe6\x8a\xd9\xb1\x92\x59\xc0\xcd\xa4\xde\x81\xcb\xa4\xde\x03\xc5\x8d\x9e\xef\x06\xd1\x18\x59\xea\xcf\x3b\x48\xf4\x52\xe6\x95\x8d\xc1\xb0\xeb\x0d\xb4\xbc\xef\x2a\x89\x56\x3f\xec\x1a\x89\x34\xf7\xf7\xb5\x7c\x67\xdb\x2d\x1f\x09\xd6\xf5\x78\x5a\xde\x79\x55\x5a\xdf\x8c\xca\x6e\x4f\x4d\xd4\x6d\xa8\xb7\x40\xf6\x87\x6f\x65\xb2\xa5\x59\x49\xb5\x66\xe3\xfa\xa8\x49\xe5\x3b\x98\x9b\x91\xbc\x45\xdd\xbe\x52\x1d\x1c\xa6\x87\xe9\xf3\xad\xd5\x81\x28\xb9\x01\xc1\x3c\x7b\x70\x46\x11\x31\xa3\x9c\x37\x6d\xd3\xc9\x2d\x59\x65\x1b\xf4\xeb\xd2\xdf\xc9\xfe\xf4\xd7\x03\xd5\xd2\x9f\xde\x2f\x2d\x91\xed\xca\x4b\xae\xbc\x57\x68\xa9\x73\x8b\xce\xdd\x19\x2e\xe6\x10\xae\x6a\x41\x7a\x10\x58\x2a\xb3\x76\x70\x1a\x97\x05\x7b\xb9\xaf\x74\x69\x58\x14\xa1\x0d\xd8\x30\x9c\xd8\x20\x04\x71\x43\x93\xe0\x4d\x5d\x8e\x9c\x30\xcf\x62\xda\x68\x38\x65\xa8\x8c\xce\x5d\x73\xf3\xd4\x80\x0a\xcb\xa4\x3e\x97\xdb\x0e\xfb\xfd\xa1\x8b\x4a\xa0\x2f\x24\x64\x84\x35\x4a\x84\x2c\x4f\x85\x72\x4c\x5a\xce\xd7\xa9\x8b\x71\x2f\x57\xa1\xb4\x0e\x90\x01\xa8\xc7\xe7\xab\xaf\x2f\x1b\xb9\xfb\x20\xee\xaf\xb5\xaf\x77\x41\x7e\x83\xf6\xb4\x81\x77\xbd\x9e\x74\x9b\xcd\x66\xfb\xf9\xec\xf0\xf0\xf0\xd9\x6e\xff\xd9\x00\x6d\x35\x9b\x64\x9e\xdc\xab\x07\xb8\x1c\xf7\xaa\x35\xe1\xfa\xf7\x3e\xeb\x4d\x0e\x0e\xe0\x38\x26\xc3\xe6\xae\x0d\x4e\x70\x4e\xc6\x4e\xdb\x4b\x92\xa3\x26\xc9\x85\x81\x01\xb3\x08\xca\x30\xea\xac\x56\x92\xc5\xdb\xdb\x19\xb7\xc2\xcd\x2e\x1f\xd3\x3f\x4f\xba\x74\x90\x86\xdb\xba\xc2\x58\x6a\x62\x3d\x93\x2a\x5c\x71\xb7\x03\x2e\xda\x6a\x84\xd4\x22\x0c\x09\x87\x49\xa9\x90\x39\x8c\x39\x9c\xf4\x7a\x41\xf0\x61\x7e\x28\x0c\xaf\xa8\x66\x8a\x73\xc1\x8b\x05\xaa\x62\xc4\xad\xb8\x4c\x83\xfc\x27\xa8\x90\x1a\x80\x24\x39\x72\x50\x32\x1b\x0a\xd0\x0b\x5a\xf8\x88\x5a\x9b\x42\xd6\x67\xd5\x2d\x1c\xf5\xdf\x0e\xa3\x1c\xc1\x94\xa9\x0f\xcf\x48\x60\x85\xbe\xb9\x2e\x27\x29\x66\xa4\xc2\x59\x3d\xc7\x94\xae\x25\x60\x5a\x24\x45\xe5\x36\x16\x15\x4c\x57\xd4\x75\xa7\xd4\xe0\x6b\x08\x9a\xeb\xaf\x79\xdd\xe6\x92\xfa\x95\x0b\x03\xaa\xae\x97\x0f\xa6\xca\x3c\x2c\xa5\x0e\x25\xf0\x15\x2a\x35\x04\x47\x05\xa1\x74\xe0\x16\xa6\x52\x22\x21\x86\x94\xeb\x38\xb3\x54\xdf\xa8\x75\x9a\x24\xe7\x06\x44\x4d\x15\x4a\x92\x19\xa5\x2d\xee\xd5\x8c\x94\xfd\x54\xcb\x6b\x2a\x23\x3d\x1d\x81\x1b\x82\xad\xf4\x24\x49\x66\xb3\x99\x5b\xa0\x52\x49\x4d\x0a\x39\x7a\xa0\x93\x84\x1b\xc8\x2d\x96\xc1\x76\x52\x69\xe0\x06\xbc\x85\x91\x83\x01\x0c\xe0\x06\x78\xe5\x61\x24\xc2\x8f\xd1\xfc\x19\xdc\xc0\x35\xb3\xb9\x83\x06\x24\xee\x8b\x70\x92\xe4\x00\x28\x74\x90\x38\x1f\x3f\xed\x72\x19\x19\xf8\xe8\xc2\xf5\xc8\xc7\x4f\xf0\x28\x95\x1e\x0b\x77\x71\x99\x16\xe8\x19\x85\xed\xf6\xd6\x31\x24\xd7\xc7\xe9\x8d\x47\xe7\x1f\x0f\xd2\xa7\x24\xd6\x1f\x7f\x50\xbe\x7c\xf2\xe4\xd1\x5d\xfc\x67\xb3\x59\x30\x92\xde\x10\x22\x49\x4e\x35\xd5\x67\xa2\xe2\x64\x01\x21\x28\x4b\x6a\x6d\x57\xd2\x85\xf9\x45\x37\xc9\xd8\xbc\xde\xeb\x0f\x4e\x28\x20\xbe\x92\xf9\x02\x8e\x56\x4c\x2a\x96\x49\x25\xfd\x3a\xed\xb3\xa1\x36\x21\xb4\x12\xc9\xac\x1b\x88\x4c\x8d\x68\x48\xd0\xce\xba\xbb\x98\xba\xe1\xb1\x28\x2a\x2d\x98\xe6\xeb\xe0\x17\xf5\xa0\x80\x8a\x89\x7a\x7a\x90\x31\x0a\x05\xe4\x3b\xd3\xf7\x50\x75\x97\xe6\xdb\x83\x95\x24\xb8\xe6\xf2\xa5\x83\xcd\x49\xc9\xe5\x05\xe9\x68\xb4\xf5\x92\xd8\x67\xd8\x4e\xb4\xcc\xc6\x30\xa5\x71\xb2\x15\x2a\x53\x92\x17\x26\x09\x05\x95\xe0\x0b\x31\x22\xd4\xe3\x2b\x8f\x36\x5e\x37\x49\x1d\x1d\x26\xc4\x9c\x58\x86\xcc\x86\x04\x69\xe3\xbc\x91\xc0\xe7\x46\x29\x73\x45\xdc\x62\x41\x1f\xab\xf9\xe0\x70\x22\xb2\xa2\x6f\x1a\xaf\x88\x91\x87\x39\x32\x5f\x59\x74\x93\x04\x9e\x86\xfe\x6b\x56\xb0\x25\x42\xbc\xae\xf1\x38\xae\xd9\x35\x55\xcf\x78\xf9\xd2\x8d\xeb\xde\x63\x14\x92\xe0\x2c\x74\xe5\x6b\xcd\xa1\x8d\x2a\x61\xd6\x1b\x1b\xbf\x6d\x69\xc1\x63\x41\xbe\x82\x8e\xf8\x91\x7b\xb6\x2f\xa2\x6f\x3a\x4f\x6b\xa3\x97\x95\x16\x47\xb3\x88\x53\x1a\xe7\xe9\xd9\x22\x98\x42\xfa\x36\x86\x94\xd6\x70\x74\x2e\x4c\xdc\xf6\x28\x87\x34\x7c\xd0\x94\xfe\x44\xb4\x39\x11\x0b\xc6\xb6\x69\xc0\xf3\xfe\x61\x51\xa0\x18\x92\x9b\x19\x0a\x37\x4d\x15\x11\x84\x63\xe0\x64\x21\x15\xb3\x6a\x4d\x4e\x34\x1f\x39\x99\x53\x3f\xc1\xd1\xfa\x61\x1c\x16\xd4\xac\xa2\x29\x40\x13\xcd\x9a\x82\x3c\xb6\xa2\x61\x02\x96\x48\xed\x90\x57\x16\x83\x9f\x29\xf4\x70\xfe\xe6\x2c\xad\x07\x5c\x4b\xaa\x0c\xdd\x12\x66\x24\xcc\x38\xd6\x38\x5b\x53\xba\x59\xb3\x5f\x17\x63\x54\x98\x8e\x53\x26\xe9\xa6\xc9\xe1\x7a\x2e\x5e\x95\x24\x49\xf7\x87\x24\x13\x68\x46\x82\x75\x38\x1a\x27\xbd\xbf\x38\xd9\xfc\x3a\x2a\xab\x4c\x49\x3e\xa2\x36\xda\xbb\xd4\x7d\x9f\xb2\x82\xfd\x69\x34\xbb\x72\xed\x1f\x48\x84\x75\xa3\xd5\xf3\xb4\xd4\x79\xd2\xa5\x93\x0e\x88\x5e\xa5\x6e\x31\x16\x86\xbb\x71\xb0\xf4\x0f\x19\x3a\xff\xa1\xb4\x54\xe3\x70\x74\xe3\xd8\x41\x7e\x68\x1c\xf8\x83\xe8\x92\xe6\x38\xd9\x9f\x68\x6e\x81\xf7\xa6\x94\x0d\x17\x37\x3e\xe8\xad\x18\x19\x4d\x20\x2e\xd9\xeb\xb4\x1d\xdc\x83\xe7\xa4\xc9\x7f\x03\x00\x00\xff\xff\xa5\x18\x2f\x8a\xac\x23\x00\x00"),
@@ -181,7 +181,7 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates": &vfsgen۰DirInfo{
 			name:    "templates",
-			modTime: time.Date(2021, 2, 10, 14, 45, 3, 739158731, time.UTC),
+			modTime: time.Date(2021, 2, 16, 23, 28, 59, 454313311, time.UTC),
 		},
 		"/templates/NOTES.txt": &vfsgen۰CompressedFileInfo{
 			name:             "NOTES.txt",
@@ -248,10 +248,10 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates/cp-rbac.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-rbac.yaml",
-			modTime:          time.Date(2020, 12, 22, 18, 24, 43, 246057139, time.UTC),
-			uncompressedSize: 3414,
+			modTime:          time.Date(2021, 2, 16, 23, 28, 59, 454236203, time.UTC),
+			uncompressedSize: 3561,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xd4\x56\x4b\x6f\xdb\x38\x10\xbe\xfb\x57\x10\xde\xdb\x02\x52\xb0\xc0\x1e\x02\xdf\x76\xf7\xb0\x97\xa2\x28\x92\x22\x77\x9a\xfa\x64\x4d\x4d\x0d\x55\x72\xe8\xa4\x71\xfd\xdf\x0b\xca\x8a\xe5\x5a\xb6\x11\x2b\x49\x1f\x3a\x89\x43\xce\xeb\x9b\xa7\x6e\xe8\x0e\x3e\x90\xe3\x99\x5a\xfd\x35\x59\x12\x17\x33\x75\x0b\xbf\x22\x83\x7f\x8c\x71\x91\x65\x52\x43\x74\xa1\x45\xcf\x26\x4a\xb1\xae\x31\x53\xeb\xb5\x22\x36\x36\x16\x50\xd3\x65\xac\x75\x9e\xc8\x53\x95\xab\xcd\x26\x33\x8e\xc5\x3b\x9b\x35\x56\x33\x3a\x8e\xd0\x68\xb3\x65\xcb\x6f\x60\xa1\x03\xf2\xf7\x4f\x64\xb5\xd9\x4c\x94\xb2\x7a\x0e\x1b\x92\x86\xf5\x3a\x3b\x10\xbe\xbd\x4b\xe2\xbf\x2a\x26\x2e\xc0\xa2\xfe\x4e\x6c\x59\x96\x4d\xf6\x1d\xf0\x73\x6d\x72\x1d\xa5\x72\x9e\x1e\xb5\x90\xe3\x7c\x79\x1d\x72\x72\x57\x3b\xd7\xfe\xb3\x31\x08\xfc\x8d\xb3\x78\xa1\x5f\xa3\x2c\xf6\xd1\xa2\xe5\xc9\x94\x6e\xe8\x7f\xef\x62\xd3\x1e\xd3\x97\xa9\xe9\xb4\xfd\xf5\x08\x2e\x7a\x83\xbd\x9b\x1d\x88\x61\x47\x6a\x5c\xd1\x1f\xc2\x36\x62\x3d\xc1\x38\x2e\x69\x51\xeb\xa6\x27\xb1\x2b\xba\x07\x2b\xf8\xf9\x9e\xf0\x05\x64\xf7\x6f\x29\xf4\x87\x7b\x2d\xa6\xba\xdc\x58\xac\xc0\x72\x54\x93\xf1\xd0\x82\xde\x85\x73\xf2\x5b\x20\xc9\x9d\x52\x92\x02\xd7\x86\x22\x0c\x49\xc4\x81\x16\x95\xf4\x37\x35\x42\xb5\xf7\xf0\xd1\xf1\xc1\xe9\x28\xc7\x80\xd8\xa1\x3c\xa0\x37\xde\x3d\x7c\x11\xd4\x8d\xd5\xb2\x27\x58\xbc\x2e\x4b\x32\x0d\x7c\x4d\x21\x65\xe8\xe0\xca\xbb\x28\x23\x63\x72\x14\xd0\xd8\x14\xc7\xf0\xed\xe0\x81\x45\x7b\x39\x06\x6e\x43\xde\x44\x92\xb9\x87\x5e\xc2\xf7\x8e\xe0\x41\xe0\x59\xdb\x41\x02\x96\x3a\x5a\x21\xfe\x04\x23\xdf\x79\x5e\x41\x5b\xa9\x4c\x05\xb3\xec\x89\x1e\xe2\x69\x88\x9c\x75\x8b\x01\x4d\xfc\xae\x0a\xc6\x40\xd6\xd6\x6a\xa9\xf0\x59\xe5\x77\xda\x46\x84\xbc\xab\xeb\x0f\x29\x71\xf2\xda\xa5\x1a\xf6\xa8\x9d\x60\xba\xed\x4c\x2f\x00\x3a\x29\x03\x17\x49\x4e\xa7\x77\xa7\x94\x29\x07\xeb\xb9\x45\xb1\xd5\x72\x3c\x26\xd7\xdb\x97\x86\x4d\x79\x26\x36\x0c\xb9\x77\x7e\x99\x69\x11\x6d\xaa\x1a\x2c\x59\x81\x92\x98\x7a\xe4\x5f\x25\xbb\x3a\xbf\xf6\xbc\xba\xb8\x35\xa4\xa6\x75\x55\x12\x6b\x4b\x8f\x4f\x69\x74\x60\xdb\xf4\xcf\xe9\xc8\x1c\xdd\x56\xf9\x9b\x89\xef\x3b\xce\xb3\x54\xfc\xa1\x56\xda\x52\x4a\x93\x14\x47\x25\x6e\x09\x56\x73\x94\xce\x43\x51\x08\x11\xc4\x0b\x55\x7f\x7c\x77\xab\x0c\xbc\x9c\xb2\x29\x4d\x33\xb0\x90\xd9\x1f\x67\xa7\x2c\x6c\x75\x78\xac\x08\xf7\xe7\xda\xef\xcb\xc6\xe6\xbf\xc4\x05\xf1\xe2\xa7\x4c\x4f\x67\x71\x83\x32\x71\x3d\x41\x75\xc6\xfa\x89\x52\xc3\x99\x7f\xb9\xad\x21\xce\x53\x13\xeb\xa6\xf6\xd1\x05\x29\xa1\x7b\x39\x04\xcf\x5b\x8d\x46\x04\xeb\x15\x96\x9b\x37\x5c\xda\xc6\xae\x40\x01\xc6\x43\x7e\x8d\x61\x79\xda\xca\x83\xbd\xeb\x87\x19\x3a\x32\x4d\x5e\xa7\x98\x9f\x93\x2d\x23\x6b\xf7\xf7\x2c\xda\x6f\x01\x00\x00\xff\xff\x8c\xc9\xba\xa8\x56\x0d\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xd4\x56\x4d\x6f\xdb\x3c\x0c\xbe\xe7\x57\x08\x79\x6f\x2f\x60\x17\x03\x76\x28\x72\xdb\x76\xd8\x65\x18\x86\x76\xe8\x9d\x91\xe9\x98\xb3\x4c\x79\x12\x95\x76\xcd\xf2\xdf\x07\xd9\x4e\x9c\xc6\x49\xd0\x38\xed\x3e\x72\x8a\x48\x8b\x1f\x0f\x1f\x52\x84\x9a\xee\xd0\x79\xb2\x3c\x53\xcb\x37\x93\x92\x38\x9b\xa9\x5b\x74\x4b\xd2\xf8\x4e\x6b\x1b\x58\x26\x15\x0a\x64\x20\x30\x9b\x28\xc5\x50\xe1\x4c\xad\x56\x8a\x58\x9b\x90\xa1\x9a\x96\xa1\x82\x34\x8a\xa7\x2a\x55\xeb\x75\xa2\x2d\x8b\xb3\x26\xa9\x0d\x30\x76\x37\x7c\x0d\xba\xbd\x96\xde\xa0\x41\xf0\x98\x7e\xde\x88\xd5\x7a\x3d\x51\xca\xc0\x1c\x8d\x8f\x1e\x56\xab\x64\xcf\x78\xab\x8b\xe6\x7f\x2a\x26\xce\x90\x45\xbd\x8d\xd7\x92\x24\x99\xec\x26\xe0\xe6\xa0\x53\x08\x52\x58\x47\x8f\x20\x64\x39\x2d\xaf\x7d\x4a\xf6\x6a\x9b\xda\x07\x13\xbc\xa0\xbb\xb1\x06\x2f\xcc\x6b\x54\xc4\x2e\x18\x6c\xee\x24\x0a\x6a\xfa\xe8\x6c\xa8\x9b\x63\xfc\x25\x6a\x3a\x6d\xfe\x3a\xf4\x36\x38\x8d\x3b\x9a\x2d\x88\x7e\x2b\xaa\x6d\xd6\x1f\x7c\x5b\xb1\x5e\xa0\x2d\xe7\xb4\xa8\xa0\xee\x45\x6c\xb3\xee\x83\x25\xba\xf9\x8e\xf1\x05\xca\xf6\xbf\x21\xdf\x1f\xee\x41\x74\x71\x7e\xb0\xb8\x44\x96\x83\x9e\xb4\x43\x10\xec\x53\x38\x65\xbf\x01\x92\xec\x31\x27\xb1\x70\x4d\x29\xfc\x50\x44\xec\x69\x51\x48\xaf\xa9\xd0\x17\x3b\x1f\x3e\x5a\xde\x3b\x1d\xbc\x31\x10\x76\x28\x0f\xe4\xb5\xb3\x0f\x3f\x04\xab\xda\x80\xec\x18\x16\x07\x79\x4e\xba\x46\x57\x91\x8f\x0c\x1d\xa8\x9c\x0d\x32\xb2\x26\x07\x01\x0d\x75\x76\x08\xdf\x0e\x1e\x34\xd8\x28\xc7\xc0\xad\xc9\xe9\x40\x32\x77\x08\x25\xba\x3e\x11\x7c\x10\x74\x0c\x66\x40\xc0\x1c\x82\x11\xe2\x6f\xa8\xe5\x49\xe6\x05\x82\x91\x42\x17\xa8\xcb\x5e\xe8\x50\x1c\x0d\x91\x33\x76\x31\x90\x89\xdb\x76\xc1\x18\xc8\x9a\x5e\xcd\x15\x7e\x57\xe9\x1d\x98\x80\x3e\xed\xfa\xfa\x4b\x24\x4e\x5a\xd9\xd8\xc3\x0e\x2b\x2b\x38\x6d\x27\xd3\x05\x40\x47\x67\xc8\x59\x6b\xa7\xf3\xbc\x75\xcb\x94\x22\xc3\xdc\x60\xa7\x3f\x5c\x95\xeb\xf6\x4b\xcd\x3a\x3f\x51\x1d\x46\xb9\xb7\xae\x4c\x40\x04\x74\x51\x21\x4b\x92\x61\x4e\x4c\x3d\xf6\x2f\xc2\xaf\xd3\x14\x82\x9a\x22\x1d\xb8\xa1\x7a\x37\x79\x8f\xf2\x29\x78\xb1\xd5\x46\x71\x69\xb0\x4f\x80\x3e\x73\x5a\xc5\x39\x7a\x95\x13\x83\xa1\xc7\x0d\xb3\xf7\xfc\x4f\xff\x9f\x8e\x6c\x9b\x76\xf0\xbc\x9a\xf9\x7e\x08\x3e\xcb\xc5\x7f\x6a\x09\x86\x22\x73\x23\xb1\x94\xd8\x12\x59\xcd\x31\xb7\x0e\x15\x79\x1f\x90\x78\xa1\xaa\xaf\x9f\x6e\x95\x46\x27\x47\xcb\x1c\xa4\x40\x16\xd2\xbb\x2f\xec\xb1\x08\x1b\x1f\x0e\x97\x84\xf7\xa7\x5e\x84\xcb\x5e\xf2\xf7\xc4\x19\xf1\xe2\x8f\x3c\xe8\xd6\xe0\x0d\xe6\xf1\xd6\x06\xaa\x13\xd1\x4f\x94\x1a\xae\x21\xe7\xc7\xea\xc3\x3c\xce\xd5\x6e\x91\x38\xb8\xb3\x45\x74\xcf\x87\xe0\x79\xdb\xda\x88\x62\xbd\xc0\xbe\xf5\x8a\x7b\xe4\xd8\xad\xcc\xa3\x76\x28\x7f\xc7\xfb\x7d\x3c\xca\xbd\x55\xf0\xb7\x05\x3a\x92\x26\x2f\xd3\xcc\xcf\x61\xcb\xc8\xde\xfd\x37\x9b\xf6\x57\x00\x00\x00\xff\xff\x17\x90\xd0\x97\xe9\x0d\x00\x00"),
 		},
 		"/templates/cp-service.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-service.yaml",
@@ -262,7 +262,7 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates/cp-webhooks-and-secrets.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-webhooks-and-secrets.yaml",
-			modTime:          time.Date(2021, 2, 10, 14, 45, 3, 739657404, time.UTC),
+			modTime:          time.Date(2021, 2, 12, 6, 36, 2, 597922708, time.UTC),
 			uncompressedSize: 6050,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xe4\x58\xdd\x6f\xd4\x38\x10\x7f\xcf\x5f\x31\x8a\x40\x02\xa4\x38\xdd\xb6\x5b\xf5\x22\xf5\x81\x83\xc2\x9d\xae\x20\x54\x7a\xf0\xec\x38\x93\xc4\xb7\x8e\x9d\xb3\x9d\x2d\x7b\xa5\xff\xfb\xc9\xce\xc7\x26\xdb\x6d\xbb\x07\x48\xf4\x60\xdf\x76\xbe\xe7\x37\x1f\x1e\xe5\xea\x2a\x82\x47\x8c\xfe\xda\xc8\x4c\x20\x24\x27\x40\x3e\x50\xd1\xa0\x21\x4c\x49\xab\x95\x78\x27\xa8\x44\x62\x85\x21\x05\x4a\xd4\x54\x90\x41\xf8\xfa\x3a\xb8\xba\x8a\x9f\x05\xaf\x3d\xc3\x22\x30\xd4\x96\xe7\x9c\x51\x8b\x26\x30\x88\x09\x94\xd6\xd6\x26\x89\xe3\x8a\x1a\x8b\xba\xe2\x32\x33\xa4\xe0\xb6\x6c\x52\xc2\x55\x6c\x6a\xcd\x8b\x98\xe9\x55\x6d\x15\x29\x6d\x25\x36\x94\x30\xe3\x4d\x45\x98\xaa\x62\xd9\x2c\x55\x54\x68\xd5\xd4\x91\x45\x56\xc6\x95\x5a\x62\xb4\x52\x8d\x8e\x9c\x4f\x13\x59\x15\x95\x28\xaa\xe8\x30\x9f\xe7\x47\xb3\x83\x83\x63\xca\xe8\xd4\x58\xe7\xd5\x1b\x43\x7b\xa9\xf4\xc2\xa0\x5e\x72\x86\x15\x9a\x72\x1b\x29\x15\x2a\x8d\x8f\xf7\x0e\x69\x36\xdf\xdb\x3f\x4a\xd3\x79\x96\x66\xfb\xc7\x73\xb6\xbf\xbf\x97\xcf\xe6\x07\xbf\xcc\x73\xdc\x9f\xe3\xe1\x51\x3e\xc7\x2c\x8d\x33\xac\x85\x5a\x55\x28\xad\x89\x5d\x24\xb1\x34\x55\xcc\x4a\xaa\xad\x89\x69\x56\x71\x63\xb8\x92\xd1\x25\xa6\xa5\x52\x8b\xd8\x62\x55\x0b\x87\xd2\x4d\x5e\x64\x90\x69\xb4\xc4\xd6\x22\x08\x3e\x22\x28\x29\x56\x40\x1b\xab\x8a\x31\xca\x06\x78\x0e\x8d\x41\x0d\x19\xcf\x40\x2a\x0b\xac\x54\x06\xc1\x96\xc8\x35\xa8\x4b\x09\x9d\x99\x7b\x4c\xd8\xb2\xfd\x03\xdc\x78\x2b\x2b\xb4\xd0\x4b\x65\x04\x2e\x4a\x6e\xe0\x92\xae\xe0\x12\x61\x81\x58\x7b\xf9\xd6\xb2\x81\x14\xed\x25\xa2\x84\xdf\x4e\xcf\xde\x40\x53\x17\x9a\x66\x68\x48\xf0\x2c\xbe\xbe\x0e\x02\xd7\x56\x3c\x07\xfc\xfb\xfe\x7e\x6a\xed\xbd\xa5\x15\x42\x18\x42\xe4\xbb\xca\xf5\xa4\x0b\x2b\x39\x71\xb4\x9e\xb4\xc0\xd5\x06\x65\xa4\x9b\x9c\x40\xad\xb9\xb4\xf0\x84\x4b\x26\x9a\x0c\x21\x5c\x34\x15\x25\x92\x56\x18\x02\x79\x0a\x61\x64\x85\xf1\xfd\xe2\xf5\xc7\x06\x9c\xf2\x13\xa1\xd4\xa2\xa9\x21\x5c\xce\x42\x08\xdf\x7b\x7a\x08\xe4\x1c\x05\x52\x83\xc4\xf9\x30\x35\x65\x38\x76\xfa\x74\x08\x97\xe7\x83\x2d\x47\x02\x58\xe7\x70\x02\x5c\x66\xf8\xa9\xe7\x93\x8c\x5a\x0a\xa1\x43\x80\xb9\x50\x46\xe2\x2e\xbf\xdb\xa5\x17\xb8\x9a\x48\x0f\x73\xb8\x5d\x85\xd1\xb5\x7d\x27\x8f\xc2\xe0\x44\x5d\x55\x95\x92\x3d\x74\x1b\xa0\x4d\x8a\xd5\x4d\xc5\xdb\x1e\xc8\x91\x11\x2a\x3c\x0e\xc6\x99\x10\xdc\x58\x78\xe2\x6b\x90\x43\xf8\xd8\x90\xc7\x26\x9c\xb8\xb9\x89\xe5\xd3\x0d\x79\x62\x96\xec\x7e\x9d\x0d\x80\x2f\x2e\xce\x9c\xfb\x83\xa3\xf9\xde\x14\x1e\x47\x2d\x50\xbe\x78\xde\x26\x15\x31\x1a\xae\x35\x9c\x64\x2f\xea\x84\xba\x6e\x2b\x50\xbe\xe7\x85\xc4\xcc\x13\xc6\x91\x48\x2e\x46\xf9\x0e\x76\x9c\x9f\x9b\x15\xef\x4d\x12\x6f\xe6\x33\xa4\x47\x87\x28\xd9\xcd\x5a\x0f\x72\x7f\xe0\xea\xa6\xd8\xa4\xc6\x8f\x18\xdd\xb0\xd6\x17\x56\x66\x5e\x23\x8a\xa2\x80\xd6\xfc\x03\x6a\xb7\x4f\x12\x58\xce\x82\x05\x97\x59\x02\x6d\x2f\x07\x76\x55\x63\x02\x8b\x26\x45\x2d\xd1\xa2\x71\x1b\xd8\x0a\x13\x54\x68\xa9\x6b\x99\x24\x00\x70\xc3\x92\x78\xcf\xa3\xc9\xf2\xd1\xc8\x1e\x7f\xcf\xde\x32\x16\x5e\x4a\xd0\x14\x85\x49\xba\x24\xa7\x3d\xd5\xf2\x42\x20\xf0\x19\xa4\xeb\x58\x69\xe1\xd0\xa9\xf5\xce\xbb\x91\x68\xfd\x7b\x20\xbd\xcd\xae\xf7\x5b\xb2\x83\xcd\x53\xdb\xf6\x4e\xa6\x28\x8d\x10\xd9\x02\xc8\xb0\x6b\x35\x16\xdc\x58\x4d\x2d\x57\x92\x2c\x8e\x3d\x12\xcb\x59\x8a\x96\xf6\x90\xbd\x69\x2c\xb5\x5c\x16\x1f\xdb\xa5\xfc\x42\xc9\x9c\x17\x4d\xab\xb1\x1d\xb0\xad\x4b\x07\xae\xaf\xa3\xf5\x86\xaf\x3a\xa3\xc3\xaa\x67\x13\xb3\x5f\x82\xf1\xae\x10\x77\x1e\xbd\x56\xd4\x05\xed\x5e\x39\x92\x61\x4e\x1b\x61\x51\x13\x3f\x22\x43\xb0\xfe\x2f\xe1\x2a\x00\x00\xc8\x29\x17\x8d\xc6\x77\x4a\x70\xb6\x4a\xe0\x15\xe5\xc2\xd3\x99\xe0\x28\x6d\x0b\x4e\xe2\x29\xae\x2e\x6d\x2d\x6e\x56\xa6\xe5\x77\xcb\xa4\x17\xdf\x35\xe9\xb5\xec\x16\xb4\xef\xd8\x56\x63\xed\x9a\xda\x32\x81\xb8\x4b\x39\xf2\x09\x73\x15\x2d\x67\x54\xd4\x25\x9d\x45\x0e\x10\x2f\xac\x1b\x81\xa6\x8f\x30\x02\x5a\xf3\xd7\xee\xf4\x30\xeb\xa0\x1d\x79\x8c\x90\xfb\xad\x5b\x6d\x43\xb0\x77\x30\x10\x55\x8d\x6d\xcd\x37\x04\x5f\x9c\x9f\x3e\xbf\x38\x9d\x90\xfe\x7c\xf7\x72\x4c\xd2\x68\x54\xa3\x19\x6e\x28\xba\xc8\xd1\x78\x92\xe1\x19\x9e\xe6\x39\x32\x6b\x12\x78\xab\x24\x8e\x2a\xae\x2e\x25\xea\x48\x63\x8e\x1a\x25\xc3\x9f\xa7\xe4\x1b\x89\xdf\x28\xfd\x43\xaa\xfa\x2d\x25\x66\x5c\xb3\x86\xdb\x54\x23\x5d\xa0\x36\x13\x1e\x7e\xb2\xa8\x25\x15\x1d\x0e\x53\xa6\x6f\x76\x2e\xff\x42\xe6\x7d\x4f\x78\x25\x52\x61\x4b\x56\x22\x5b\x4c\x19\x1a\xad\xe6\x1b\x86\x6a\xad\x3e\xad\x86\xcb\x75\xc2\xb2\x9a\xe6\x39\x67\x42\x15\x5b\xe9\xb5\x3b\xfd\x7d\x8f\x6d\x65\x6b\xd5\xdc\x62\xd0\x6a\xda\xa7\xe3\x1a\x65\xdb\x25\xd9\x6f\x36\xe2\x6b\x7c\x3e\xf4\x36\xcd\x32\xee\x12\xa6\xe2\xdc\xd5\x75\xb4\x10\x8f\xfa\x06\xb9\x6b\x54\xda\x0e\xf1\xa8\x29\x7d\xd7\x64\xdc\x16\x57\xaf\xfb\x6a\x2c\xde\x7b\xfe\x7f\x4e\x51\x9b\x52\xe4\x60\x63\x54\xff\x87\x99\x09\xc3\x5d\xc6\xe5\x1b\x0d\x4a\xad\xb2\xdb\x36\xe1\x57\x1c\x04\x1f\xa8\xe0\xd9\xb7\x3a\x09\x96\x83\xb1\x07\x72\x0a\x74\x01\xa9\x9f\xe8\x0a\xe8\x52\x7e\xd8\x6f\xc1\x96\x0b\xc0\x91\x5e\x9e\x9e\x9d\x7e\xdd\x8b\xe1\x7a\xb5\x76\x40\x7d\x8f\x87\x64\x74\xad\x3c\x8c\xb7\xa5\xe7\xfc\xa3\xe4\xae\xaf\xcd\x7a\x62\xbe\xf2\xa1\xe9\xa0\x26\x5f\x32\x82\xbf\x17\x52\x69\xfc\x11\x86\x70\x39\x8b\x3a\xe1\xef\xfe\xac\xec\x7e\x75\x4f\xa6\xe4\xee\x1a\xfb\xef\x32\x3b\x95\x78\xa8\xc1\x7b\x14\xfe\x80\xe8\x7d\x56\xd4\xb2\xf2\x6c\x58\xf8\xed\xaf\xd3\x8c\xcd\xca\x58\xac\xa2\x51\x01\x43\xab\x1b\x0c\x7f\x80\xae\xb9\xb7\x6d\xfc\xc7\x8d\x07\xd8\x35\xbb\x6f\xea\xee\x8b\xea\x2d\x7d\xf4\x6f\x00\x00\x00\xff\xff\xa4\xa3\x8c\xe2\xa2\x17\x00\x00"),
diff --git a/deployments/charts/kuma/templates/cp-rbac.yaml b/deployments/charts/kuma/templates/cp-rbac.yaml
index 8d196f4ae..610e089cb 100644
--- a/deployments/charts/kuma/templates/cp-rbac.yaml
+++ b/deployments/charts/kuma/templates/cp-rbac.yaml
@@ -73,7 +73,7 @@ rules:
       - patch
       - delete
   {{- end }}
-{{- if .Values.cni.enabled }}
+  {{- if .Values.cni.enabled }}
   - apiGroups:
       - k8s.cni.cncf.io
     resources:
@@ -84,7 +84,15 @@ rules:
       - watch
       - create
       - delete
-{{- end }}
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - watch
+  {{- end }}
   - apiGroups:
       - ""
     resources:
diff --git a/go.sum b/go.sum
index a561a1ed1..fcaa24e59 100644
--- a/go.sum
+++ b/go.sum
@@ -50,6 +50,7 @@ github.com/Azure/azure-sdk-for-go v35.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9mo
 github.com/Azure/azure-sdk-for-go v38.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v44.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v46.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
 github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
@@ -107,8 +108,10 @@ github.com/InVisionApp/go-health v2.1.0+incompatible/go.mod h1:/+Gv1o8JUsrjC6pi6
 github.com/InVisionApp/go-logger v1.0.1/go.mod h1:+cGTDSn+P8105aZkeOfIhdd7vFO5X1afUHcjvanY0L8=
 github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
 github.com/MakeNowJust/heredoc v0.0.0-20170808103936-bb23615498cd/go.mod h1:64YHyfSL2R96J44Nlwm39UHepQbyR5q10x7iYa1ks2E=
+github.com/Masterminds/goutils v1.1.0 h1:zukEsf/1JZwCMgHiK3GZftabmxiCw4apj3a28RPBiVg=
 github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.0 h1:Y2lUDsFKVRSYGojLJ1yLxSXdMmMYTYls0rCvoqmMUQk=
 github.com/Masterminds/semver/v3 v3.1.0/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
@@ -149,6 +152,7 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
 github.com/alicebob/miniredis v2.5.0+incompatible/go.mod h1:8HZjEj4yU0dwhYHky+DxYx+6BMjkBbe5ONFIF1MXffk=
+github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 h1:MzBOUgng9orim59UnfUTLRjMpd09C5uEVQ6RPGeCaVI=
 github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129/go.mod h1:rFgpPQZYZ8vdbc+48xibu8ALc3yeyd64IhHS+PU6Yyg=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antlr/antlr4 v0.0.0-20190819145818-b43a4c3a8015/go.mod h1:T7PbCXFs94rrTttyxjbyT5+/1V8T2TYDejxUfHJjw1Y=
@@ -293,6 +297,7 @@ github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop
 github.com/docker/cli v0.0.0-20200109221225-a4f60165b7a3/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v0.0.0-20200130152716-5d0cf8839492/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20191216044856-a8371794149d/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
+github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
@@ -302,9 +307,11 @@ github.com/docker/docker v1.13.1/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsv
 github.com/docker/docker v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible h1:iWPIG7pWIsCwT6ZtHnTUpoVMnete7O/pzd9HFE3+tn8=
 github.com/docker/docker v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
@@ -452,6 +459,7 @@ github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/gobuffalo/envy v1.7.0/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
@@ -481,6 +489,7 @@ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69
 github.com/golang-migrate/migrate/v4 v4.14.1 h1:qmRd/rNGjM1r3Ve5gHd5ZplytrD02UcItYNxJ3iUHHE=
 github.com/golang-migrate/migrate/v4 v4.14.1/go.mod h1:l7Ks0Au6fYHuUIxUhQ0rcVX1uLlJg54C/VvW7tvxSz0=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -650,6 +659,7 @@ github.com/hashicorp/vault/sdk v0.1.13/go.mod h1:B+hVj7TpuQY1Y/GPbCpffmgd+tSEwvh
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69 h1:umaj0TCQ9lWUUKy2DxAhEzPbwd0jnxiw1EI2z3FiILM=
 github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69/go.mod h1:zdLK9ilQRSMjSeLKoZ4BqUfBT7jswTGF8zRlKEsiRXA=
 github.com/howeyc/fsnotify v0.9.0/go.mod h1:41HzSPxBGeFRQKEEwgh49TRw/nKBsYZ2cF1OzPjSJsA=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -665,6 +675,7 @@ github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/imdario/mergo v0.3.9 h1:UauaLniWCFHWd+Jp9oCEkTBj8VO/9DKg3PV3VCNMDIg=
 github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imkira/go-observer v1.0.3/go.mod h1:zLzElv2cGTHufQG17IEILJMPDg32TD85fFgKyFv00wU=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
@@ -737,10 +748,12 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxv
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/ktrysmt/go-bitbucket v0.6.4/go.mod h1:9u0v3hsd2rqCHRIpbir1oP7F58uo5dq19sBYvuMoyQ4=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
@@ -837,6 +850,7 @@ github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -897,6 +911,7 @@ github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQ
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
@@ -916,6 +931,7 @@ github.com/openzipkin/zipkin-go v0.2.2/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnh
 github.com/oracle/oci-go-sdk v7.1.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
 github.com/pact-foundation/pact-go v1.0.4/go.mod h1:uExwJY4kCzNPcHRj+hCR/HBbOOIwwtUjcrb0b5/5kLM=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
@@ -940,6 +956,7 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
@@ -1089,6 +1106,7 @@ github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3
 github.com/streadway/handy v0.0.0-20190108123426-d5acb3125c2a/go.mod h1:qNTQ5P5JnDBl6z3cMAg/SywNDC5ABu5ApDIw6lUbRmI=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.0/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -1531,6 +1549,7 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.2/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.6 h1:lMO5rYAqUxkmaj76jAkRUvt5JZgFymx/+Q5Mzfivuhc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11KCFhTc/+EFRbzSCOZx+VUbRMk55Yv5MYk=
 google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -1621,6 +1640,7 @@ gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUy
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/d4l3k/messagediff.v1 v1.2.1/go.mod h1:EUzikiKadqXWcD1AzJLagx0j/BeeWGtn++04Xniyg44=
@@ -1660,6 +1680,7 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20190905181640-827449938966/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 helm.sh/helm/v3 v3.2.4/go.mod h1:ZaXz/vzktgwjyGGFbUWtIQkscfE7WYoRGP2szqAFHR0=
 helm.sh/helm/v3 v3.3.4 h1:tbad6WQVMxEw1HlVBvI2rQqOblmI5lgXOrWAMwJ198M=
diff --git a/pkg/plugins/resources/k8s/native/go.mod b/pkg/plugins/resources/k8s/native/go.mod
index 2ad5ebb2d..6f3227327 100644
--- a/pkg/plugins/resources/k8s/native/go.mod
+++ b/pkg/plugins/resources/k8s/native/go.mod
@@ -13,7 +13,6 @@ require (
 	k8s.io/apimachinery v0.18.14
 	k8s.io/client-go v0.18.14
 	sigs.k8s.io/controller-runtime v0.6.4
-	sigs.k8s.io/controller-tools v0.3.0 // indirect
 )
 
 replace github.com/kumahq/kuma/api => ../../../../../api
diff --git a/pkg/plugins/resources/k8s/native/go.sum b/pkg/plugins/resources/k8s/native/go.sum
index d5d6e2f33..7c2ce3762 100644
--- a/pkg/plugins/resources/k8s/native/go.sum
+++ b/pkg/plugins/resources/k8s/native/go.sum
@@ -29,6 +29,7 @@ github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -72,12 +73,12 @@ github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLi
 github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch v4.9.0+incompatible h1:kLcOMZeuLAJvL2BPWLMIj5oaZQobrkAqrL+WFZwQses=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
@@ -131,8 +132,6 @@ github.com/go-openapi/validate v0.18.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+
 github.com/go-openapi/validate v0.19.2/go.mod h1:1tRCw7m3jtI8eNWEEliiAqUIcBztB2KDnRCRMUi7GTA=
 github.com/go-openapi/validate v0.19.5/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85nY1c2z52x1Gk4=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/gobuffalo/flect v0.2.0 h1:EWCvMGGxOjsgwlWaP+f4+Hh6yrrte7JeFL2S6b+0hdM=
-github.com/gobuffalo/flect v0.2.0/go.mod h1:W3K3X9ksuZfir8f/LrfVtWmCDQFfayuylOJ7sz/Fj80=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
@@ -195,7 +194,6 @@ github.com/iancoleman/strcase v0.0.0-20180726023541-3605ed457bf7/go.mod h1:SK73t
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.9 h1:UauaLniWCFHWd+Jp9oCEkTBj8VO/9DKg3PV3VCNMDIg=
 github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -211,9 +209,11 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/lyft/protoc-gen-star v0.5.1/go.mod h1:9toiA3cC7z5uVbODF7kEQ91Xn7XNFkVUl+SrEe+ZORU=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -224,11 +224,7 @@ github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.2 h1:/bC9yWikZXAL9uJdulbSfyVNIR3n3trXl+v8+1sx8mU=
-github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8 h1:HLtExJ+uU2HOZ+wI0Tt5DtUDrx8yhUqDcp7fYERX4CE=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -256,7 +252,6 @@ github.com/onsi/ginkgo v1.15.0/go.mod h1:hF8qUzuuC8DJGygJH3726JnCZX4MYbRB8yFfISq
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.10.5 h1:7n6FEkpFmfCoo2t+YYqXH0evK+a9ICQz0xcAy9dYcaQ=
 github.com/onsi/gomega v1.10.5/go.mod h1:gza4q3jKQJijlu05nKWRCW/GavJumGt8aNRxWg7mt48=
@@ -268,6 +263,7 @@ github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -296,7 +292,6 @@ github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY52
 github.com/spf13/afero v1.3.4/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.5 h1:f0B+LkLX6DtmRH1isoNA9VTtNUK9K8xYd28JNNfOv/s=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
@@ -356,7 +351,6 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -400,7 +394,6 @@ golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190321052220-f7bb7a8bee54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -441,7 +434,6 @@ golang.org/x/tools v0.0.0-20190920225731-5eefd052ad72/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200522201501-cb1345f3a375/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e h1:4nW4NLDYnU28ojHaHO8OVxFHk/aQ33U01a9cjED+pzE=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -453,6 +445,7 @@ gomodules.xyz/jsonpatch/v2 v2.0.1/go.mod h1:IhYNNY4jnS53ZnfE4PAmpKtDpTCj1JFXc+3m
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -481,6 +474,7 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
@@ -498,33 +492,25 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20190905181640-827449938966/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
 k8s.io/api v0.18.6/go.mod h1:eeyxr+cwCjMdLAmr2W3RyDI0VvTawSg/3RFFBEnmZGI=
 k8s.io/api v0.18.14 h1:tKRYsRhfL7Hfs60rFm8sNdhWydDuk7vnBqnt8uy+i/Q=
 k8s.io/api v0.18.14/go.mod h1:rMEP0KbqUY9Bm/nbQBXtUizL9r7XvD7IV1XhnGSHsy4=
-k8s.io/apiextensions-apiserver v0.18.2/go.mod h1:q3faSnRGmYimiocj6cHQ1I3WpLqmDgJFlKL37fC4ZvY=
 k8s.io/apiextensions-apiserver v0.18.6 h1:vDlk7cyFsDyfwn2rNAO2DbmUbvXy5yT5GE3rrqOzaMo=
 k8s.io/apiextensions-apiserver v0.18.6/go.mod h1:lv89S7fUysXjLZO7ke783xOwVTm6lKizADfvUM/SS/M=
-k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
 k8s.io/apimachinery v0.18.6/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
 k8s.io/apimachinery v0.18.14 h1:wH0doJJajeG0qIuQD1/yo5JrBDAsZ3olqlNXZBiauVw=
 k8s.io/apimachinery v0.18.14/go.mod h1:PF5taHbXgTEJLU+xMypMmYTXTWPJ5LaW8bfsisxnEXk=
-k8s.io/apiserver v0.18.2/go.mod h1:Xbh066NqrZO8cbsoenCwyDJ1OSi8Ag8I2lezeHxzwzw=
 k8s.io/apiserver v0.18.6/go.mod h1:Zt2XvTHuaZjBz6EFYzpp+X4hTmgWGy8AthNVnTdm3Wg=
-k8s.io/client-go v0.18.2/go.mod h1:Xcm5wVGXX9HAA2JJ2sSBUn3tCJ+4SVlCbl2MNNv+CIU=
 k8s.io/client-go v0.18.6/go.mod h1:/fwtGLjYMS1MaM5oi+eXhKwG+1UHidUEXRh6cNsdO0Q=
 k8s.io/client-go v0.18.14 h1:9dWb5D0dBsuc2umLPuWVE07rPDmBNsggW3vvctDyJII=
 k8s.io/client-go v0.18.14/go.mod h1:fpZHBter1MB6bs+GISolsmIRsGlBEJyd0mllE0H9f2Y=
-k8s.io/code-generator v0.18.2/go.mod h1:+UHX5rSbxmR8kzS+FAv7um6dtYrZokQvjHpDSYRVkTc=
 k8s.io/code-generator v0.18.6/go.mod h1:TgNEVx9hCyPGpdtCWA34olQYLkh3ok9ar7XfSsr8b6c=
-k8s.io/component-base v0.18.2/go.mod h1:kqLlMuhJNHQ9lz8Z7V5bxUUtjFZnrypArGl58gmDfUM=
 k8s.io/component-base v0.18.6/go.mod h1:knSVsibPR5K6EW2XOjEHik6sdU5nCvKMrzMt2D4In14=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20200114144118-36b2048a9120/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
@@ -534,7 +520,6 @@ k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/klog/v2 v2.0.0 h1:Foj74zO6RbjjP4hBEKjnYtjjAhGg4jNynUdYF6fJrok=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
 k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6 h1:Oh3Mzx5pJ+yIumsAD0MOECPVeXsVot0UkiaCGVyfGQY=
 k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
 k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
@@ -543,8 +528,6 @@ k8s.io/utils v0.0.0-20200603063816-c1c6865ac451/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
 sigs.k8s.io/controller-runtime v0.6.4 h1:4013CKsBs5bEqo+LevzDett+LLxag/FjQWG94nVZ/9g=
 sigs.k8s.io/controller-runtime v0.6.4/go.mod h1:WlZNXcM0++oyaQt4B7C2lEE5JYRs8vJUzRP4N4JpdAY=
-sigs.k8s.io/controller-tools v0.3.0 h1:y3YD99XOyWaXkiF1kd41uRvfp/64teWcrEZFuHxPhJ4=
-sigs.k8s.io/controller-tools v0.3.0/go.mod h1:enhtKGfxZD1GFEoMgP8Fdbu+uKQ/cq1/WGJhdVChfvI=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0 h1:dOmIZBMfhcHS09XZkMyUgkq5trg3/jRyJYFZUiaOp8E=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
diff --git a/pkg/plugins/runtime/k8s/controllers/namespace_controller.go b/pkg/plugins/runtime/k8s/controllers/namespace_controller.go
index 058ec1a7d..400467769 100644
--- a/pkg/plugins/runtime/k8s/controllers/namespace_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/namespace_controller.go
@@ -3,6 +3,11 @@ package controllers
 import (
 	"context"
 
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+
 	"github.com/go-logr/logr"
 	"github.com/pkg/errors"
 	kube_core "k8s.io/api/core/v1"
@@ -34,6 +39,16 @@ func (r *NamespaceReconciler) Reconcile(req kube_ctrl.Request) (kube_ctrl.Result
 	log := r.Log.WithValues("namespace", req.Name)
 	ctx := context.Background()
 
+	hasNAD, err := r.hasNetworkAttachmentDefinition()
+	if err != nil {
+		return kube_ctrl.Result{}, err
+	}
+
+	if !hasNAD {
+		log.V(1).Info("network-attachment-definitions.k8s.cni.cncf.io not found")
+		return kube_ctrl.Result{}, nil
+	}
+
 	ns := &kube_core.Namespace{}
 	if err := r.Get(ctx, req.NamespacedName, ns); err != nil {
 		if kube_apierrs.IsNotFound(err) {
@@ -63,6 +78,19 @@ func (r *NamespaceReconciler) Reconcile(req kube_ctrl.Request) (kube_ctrl.Result
 	}
 }
 
+func (r *NamespaceReconciler) hasNetworkAttachmentDefinition() (bool, error) {
+	crd := v1beta1.CustomResourceDefinition{}
+	err := r.Client.Get(context.Background(), kube_client.ObjectKey{Name: "network-attachment-definitions.k8s.cni.cncf.io"}, &crd)
+	if err != nil {
+		if kube_apierrs.IsNotFound(err) {
+			return false, nil
+		}
+		return false, errors.Wrap(err, "could not get network-attachment-definitions.k8s.cni.cncf.io")
+	}
+
+	return true, nil
+}
+
 func (r *NamespaceReconciler) createOrUpdateNetworkAttachmentDefinition(namespace string) error {
 	nad := &network_v1.NetworkAttachmentDefinition{
 		ObjectMeta: kube_meta.ObjectMeta{
@@ -102,7 +130,26 @@ func (r *NamespaceReconciler) SetupWithManager(mgr kube_ctrl.Manager) error {
 	if err := k8scnicncfio.AddToScheme(mgr.GetScheme()); err != nil {
 		return errors.Wrapf(err, "could not add %q to scheme", k8scnicncfio.GroupVersion)
 	}
+	if err := v1beta1.AddToScheme(mgr.GetScheme()); err != nil {
+		return errors.Wrapf(err, "could not add %q to scheme", v1beta1.SchemeGroupVersion)
+	}
 	return kube_ctrl.NewControllerManagedBy(mgr).
-		For(&kube_core.Namespace{}).
+		For(&kube_core.Namespace{}, builder.WithPredicates(namespaceEvents)).
 		Complete(r)
 }
+
+// we only want create and update events
+var namespaceEvents = predicate.Funcs{
+	CreateFunc: func(event event.CreateEvent) bool {
+		return true
+	},
+	DeleteFunc: func(deleteEvent event.DeleteEvent) bool {
+		return false
+	},
+	UpdateFunc: func(updateEvent event.UpdateEvent) bool {
+		return true
+	},
+	GenericFunc: func(genericEvent event.GenericEvent) bool {
+		return false
+	},
+}
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_controller.go b/pkg/plugins/runtime/k8s/controllers/pod_controller.go
index a482f9b7a..200f1f66d 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_controller.go
@@ -75,6 +75,11 @@ func (r *PodReconciler) Reconcile(req kube_ctrl.Request) (kube_ctrl.Result, erro
 		return kube_ctrl.Result{}, nil
 	}
 
+	// skip a Pod if is complete/terminated (most probably a completed job)
+	if r.isPodComplete(pod) {
+		return kube_ctrl.Result{}, nil
+	}
+
 	// for Pods marked with ingress annotation special type of Dataplane will be injected
 	enabled, exist, err := metadata.Annotations(pod.Annotations).GetEnabled(metadata.KumaIngressAnnotation)
 	if err != nil {
@@ -288,6 +293,20 @@ func (r *PodReconciler) SetupWithManager(mgr kube_ctrl.Manager) error {
 		Complete(r)
 }
 
+func (r *PodReconciler) isPodComplete(pod *kube_core.Pod) bool {
+	for _, cs := range pod.Status.ContainerStatuses {
+		// the sidecar amy or may not be terminated yet
+		if cs.Name == util_k8s.KumaSidecarContainerName {
+			continue
+		}
+		if cs.State.Terminated == nil {
+			// at least one container not terminated, therefore pod is still active
+			return false
+		}
+	}
+	return true
+}
+
 type ServiceToPodsMapper struct {
 	kube_client.Client
 	Log logr.Logger
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_status_controller.go b/pkg/plugins/runtime/k8s/controllers/pod_status_controller.go
index 2023e5375..083389b1d 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_status_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_status_controller.go
@@ -3,6 +3,8 @@ package controllers
 import (
 	"context"
 
+	"go.uber.org/multierr"
+
 	"github.com/pkg/errors"
 
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
@@ -97,10 +99,18 @@ func (r *PodStatusReconciler) Reconcile(req kube_ctrl.Request) (kube_ctrl.Result
 			return kube_ctrl.Result{}, err
 		}
 
+		var errs error
 		err := r.EnvoyAdminClient.PostQuit(dp)
 		if err != nil {
-			return kube_ctrl.Result{}, errors.Wrapf(err, "envoy admin client failed. Most probably the pod is already going down.")
+			errs = multierr.Append(errs, errors.Wrapf(err, "envoy admin client failed. Most probably the pod is already going down."))
 		}
+
+		err = r.Client.Delete(ctx, dataplane)
+		if err != nil {
+			errs = multierr.Append(errs, errors.Wrapf(err, "trying to delete the job's dataplane"))
+		}
+
+		return kube_ctrl.Result{}, errs
 	}
 
 	return kube_ctrl.Result{}, nil
diff --git a/pkg/xds/ingress/dataplane.go b/pkg/xds/ingress/dataplane.go
index fabb3fd6c..4d30d4afd 100644
--- a/pkg/xds/ingress/dataplane.go
+++ b/pkg/xds/ingress/dataplane.go
@@ -86,7 +86,7 @@ func GetIngressAvailableServices(others []*core_mesh.DataplaneResource) []*mesh_
 		if dp.Spec.IsIngress() {
 			continue
 		}
-		for _, dpInbound := range dp.Spec.GetNetworking().GetInbound() {
+		for _, dpInbound := range dp.Spec.GetNetworking().GetHealthyInbounds() {
 			tagSets.addInstanceOfTags(dp.GetMeta().GetMesh(), dpInbound.Tags)
 		}
 	}
diff --git a/pkg/xds/ingress/outbound.go b/pkg/xds/ingress/outbound.go
index 0f2f50325..a75d0c52b 100644
--- a/pkg/xds/ingress/outbound.go
+++ b/pkg/xds/ingress/outbound.go
@@ -16,7 +16,7 @@ func BuildEndpointMap(destinations core_xds.DestinationMap, dataplanes []*mesh_c
 		if dataplane.Spec.IsIngress() {
 			continue
 		}
-		for _, inbound := range dataplane.Spec.Networking.GetInbound() {
+		for _, inbound := range dataplane.Spec.GetNetworking().GetHealthyInbounds() {
 			service := inbound.Tags[mesh_proto.ServiceTag]
 			selectors, ok := destinations[service]
 			if !ok {
diff --git a/pkg/xds/topology/outbound.go b/pkg/xds/topology/outbound.go
index 4865776b2..d666941b4 100644
--- a/pkg/xds/topology/outbound.go
+++ b/pkg/xds/topology/outbound.go
@@ -66,17 +66,11 @@ func fillDataplaneOutbounds(outbound core_xds.EndpointMap, dataplanes []*mesh_co
 		if dataplane.Spec.IsIngress() {
 			continue
 		}
-		for _, inbound := range dataplane.Spec.Networking.GetInbound() {
+		for _, inbound := range dataplane.Spec.GetNetworking().GetHealthyInbounds() {
 			service := inbound.Tags[mesh_proto.ServiceTag]
 			iface := dataplane.Spec.Networking.ToInboundInterface(inbound)
 			// TODO(yskopets): do we need to dedup?
 			// TODO(yskopets): sort ?
-
-			// if inbound.Health == nil we consider Dataplane as healthy in order to be compatible with Universal
-			// where we Kuma doesn't fill inbound.Health automatically
-			if inbound.Health != nil && !inbound.Health.Ready {
-				continue
-			}
 			outbound[service] = append(outbound[service], core_xds.Endpoint{
 				Target:   iface.DataplaneIP,
 				Port:     iface.DataplanePort,


Test patch:
diff --git a/api/mesh/v1alpha1/dataplane_helpers_test.go b/api/mesh/v1alpha1/dataplane_helpers_test.go
index 1728dc402..e13a60680 100644
--- a/api/mesh/v1alpha1/dataplane_helpers_test.go
+++ b/api/mesh/v1alpha1/dataplane_helpers_test.go
@@ -128,6 +128,44 @@ var _ = Describe("Dataplane_Networking", func() {
 			)
 		})
 	})
+
+	Describe("GetHealthyInbounds()", func() {
+
+		It("should return only healty inbounds", func() {
+			networking := &Dataplane_Networking{
+				Inbound: []*Dataplane_Networking_Inbound{
+					{
+						Health:      nil,
+						Port:        8080,
+						ServicePort: 80,
+					},
+					{
+						Health:      &Dataplane_Networking_Inbound_Health{Ready: true},
+						Port:        9090,
+						ServicePort: 90,
+					},
+					{
+						Health:      &Dataplane_Networking_Inbound_Health{Ready: false},
+						Port:        7070,
+						ServicePort: 70,
+					},
+				},
+			}
+
+			actual := networking.GetHealthyInbounds()
+			Expect(actual).To(HaveLen(2))
+			Expect(actual).To(ConsistOf(
+				&Dataplane_Networking_Inbound{
+					Health:      &Dataplane_Networking_Inbound_Health{Ready: true},
+					Port:        9090,
+					ServicePort: 90,
+				},
+				&Dataplane_Networking_Inbound{
+					Port:        8080,
+					ServicePort: 80,
+				}))
+		})
+	})
 })
 
 var _ = Describe("Dataplane_Networking_Outbound", func() {
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
index 26effdbcd..fb145a9b2 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
@@ -6858,6 +6858,14 @@ rules:
       - watch
       - create
       - delete
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - watch
   - apiGroups:
       - ""
     resources:
diff --git a/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go b/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go
index 5230f23c3..5f9920862 100644
--- a/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go
@@ -3,6 +3,8 @@ package controllers_test
 import (
 	"context"
 
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	kube_core "k8s.io/api/core/v1"
@@ -53,6 +55,15 @@ var _ = Describe("NamespaceReconciler", func() {
 	})
 
 	It("should create NetworkAttachmentDefinition", func() {
+		// setup CustomResourceDefinition
+		crd := &v1beta1.CustomResourceDefinition{
+			ObjectMeta: kube_meta.ObjectMeta{
+				Name: "network-attachment-definitions.k8s.cni.cncf.io",
+			},
+		}
+		err := kubeClient.Create(context.Background(), crd)
+		Expect(err).ToNot(HaveOccurred())
+
 		// given
 		req := kube_ctrl.Request{
 			NamespacedName: kube_types.NamespacedName{
@@ -78,6 +89,15 @@ var _ = Describe("NamespaceReconciler", func() {
 	})
 
 	It("should delete NetworkAttachmentDefinition when injection annotation is no longer on the namespace", func() {
+		// setup CustomResourceDefinition
+		crd := &v1beta1.CustomResourceDefinition{
+			ObjectMeta: kube_meta.ObjectMeta{
+				Name: "network-attachment-definitions.k8s.cni.cncf.io",
+			},
+		}
+		err := kubeClient.Create(context.Background(), crd)
+		Expect(err).ToNot(HaveOccurred())
+
 		// setup NetworkAttachmentDefinition in the namespace
 		nad := &v1.NetworkAttachmentDefinition{
 			ObjectMeta: kube_meta.ObjectMeta{
@@ -85,7 +105,7 @@ var _ = Describe("NamespaceReconciler", func() {
 				Name:      metadata.KumaCNI,
 			},
 		}
-		err := kubeClient.Create(context.Background(), nad)
+		err = kubeClient.Create(context.Background(), nad)
 		Expect(err).ToNot(HaveOccurred())
 
 		// given namespace without kuma.io/sidecar-injection annotation
@@ -133,4 +153,27 @@ var _ = Describe("NamespaceReconciler", func() {
 		Expect(nads.Items).To(HaveLen(0))
 	})
 
+	It("should skip creating NetworkAttachmentDefinition when CRD is absent in the cluster", func() {
+		// given
+		req := kube_ctrl.Request{
+			NamespacedName: kube_types.NamespacedName{
+				Namespace: "non-system-ns-with-sidecar-injection",
+				Name:      "non-system-ns-with-sidecar-injection",
+			},
+		}
+
+		// when
+		result, err := reconciler.Reconcile(req)
+
+		// then
+		Expect(err).ToNot(HaveOccurred())
+		Expect(result).To(BeZero())
+
+		// and NetworkAttachmentDefinition is created
+		nads := &v1.NetworkAttachmentDefinitionList{}
+		err = kubeClient.List(context.Background(), nads)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(nads.Items).To(HaveLen(0))
+	})
+
 })
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go b/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go
index 3b9043795..dad188091 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_controller_test.go
@@ -87,6 +87,11 @@ var _ = Describe("PodReconciler", func() {
 				},
 				Status: kube_core.PodStatus{
 					PodIP: "192.168.0.1",
+					ContainerStatuses: []kube_core.ContainerStatus{
+						{
+							State: kube_core.ContainerState{},
+						},
+					},
 				},
 			},
 			&kube_core.Pod{
@@ -103,6 +108,11 @@ var _ = Describe("PodReconciler", func() {
 				},
 				Status: kube_core.PodStatus{
 					PodIP: "192.168.0.1",
+					ContainerStatuses: []kube_core.ContainerStatus{
+						{
+							State: kube_core.ContainerState{},
+						},
+					},
 				},
 			},
 			&kube_core.Pod{
@@ -119,6 +129,11 @@ var _ = Describe("PodReconciler", func() {
 				},
 				Status: kube_core.PodStatus{
 					PodIP: "192.168.0.1",
+					ContainerStatuses: []kube_core.ContainerStatus{
+						{
+							State: kube_core.ContainerState{},
+						},
+					},
 				},
 			},
 			&kube_core.Service{
@@ -348,12 +363,14 @@ var _ = Describe("PodReconciler", func() {
           networking:
             address: 192.168.0.1
             inbound:
-            - port: 8080
+            - health: {} 
+              port: 8080
               tags:
                 app: sample
                 kuma.io/protocol: http
                 kuma.io/service: example_demo_svc_80
-            - port: 6060
+            - health: {} 
+              port: 6060
               tags:
                 app: sample
                 kuma.io/service: example_demo_svc_6061
@@ -420,12 +437,14 @@ var _ = Describe("PodReconciler", func() {
           networking:
             address: 192.168.0.1
             inbound:
-            - port: 8080
+            - health: {} 
+              port: 8080
               tags:
                 app: sample
                 kuma.io/protocol: http
                 kuma.io/service: example_demo_svc_80
-            - port: 6060
+            - health: {} 
+              port: 6060
               tags:
                 app: sample
                 kuma.io/service: example_demo_svc_6061
diff --git a/pkg/plugins/runtime/k8s/controllers/suite_test.go b/pkg/plugins/runtime/k8s/controllers/suite_test.go
index 2d5209faa..c49f36a25 100644
--- a/pkg/plugins/runtime/k8s/controllers/suite_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/suite_test.go
@@ -4,6 +4,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 
 	. "github.com/onsi/ginkgo"
@@ -49,6 +51,8 @@ var _ = BeforeSuite(func(done Done) {
 	Expect(err).NotTo(HaveOccurred())
 	err = k8scnicncfio.AddToScheme(k8sClientScheme)
 	Expect(err).NotTo(HaveOccurred())
+	err = v1beta1.AddToScheme(k8sClientScheme)
+	Expect(err).NotTo(HaveOccurred())
 
 	// +kubebuilder:scaffold:scheme
 
diff --git a/test/e2e/deploy/kuma_deploy_hybrid_kube_global_test.go b/test/e2e/deploy/kuma_deploy_hybrid_kube_global_test.go
index b0f54bda5..c2f4c0a27 100644
--- a/test/e2e/deploy/kuma_deploy_hybrid_kube_global_test.go
+++ b/test/e2e/deploy/kuma_deploy_hybrid_kube_global_test.go
@@ -55,8 +55,8 @@ var _ = Describe("Test Kubernetes/Universal deployment when Global is on K8S", f
 
 		err = NewClusterSetup().
 			Install(Kuma(core.Remote, optsRemote...)).
-			Install(EchoServerUniversal("universal", "default", echoServerToken)).
-			Install(DemoClientUniversal("default", demoClientToken)).
+			Install(EchoServerUniversal(AppModeEchoServer, "default", "universal", echoServerToken)).
+			Install(DemoClientUniversal(AppModeDemoClient, "default", demoClientToken)).
 			Install(IngressUniversal("default", ingressToken)).
 			Setup(remoteCluster)
 		Expect(err).ToNot(HaveOccurred())
diff --git a/test/e2e/deploy/kuma_deploy_hybrid_test.go b/test/e2e/deploy/kuma_deploy_hybrid_test.go
index 4e57cf027..3febed9db 100644
--- a/test/e2e/deploy/kuma_deploy_hybrid_test.go
+++ b/test/e2e/deploy/kuma_deploy_hybrid_test.go
@@ -136,8 +136,8 @@ metadata:
 
 		err = NewClusterSetup().
 			Install(Kuma(core.Remote, optsRemote3...)).
-			Install(EchoServerUniversal("universal", nonDefaultMesh, echoServerToken, WithTransparentProxy(true))).
-			Install(DemoClientUniversal(nonDefaultMesh, demoClientToken, WithTransparentProxy(true))).
+			Install(EchoServerUniversal(AppModeEchoServer, nonDefaultMesh, "universal", echoServerToken, WithTransparentProxy(true))).
+			Install(DemoClientUniversal(AppModeDemoClient, nonDefaultMesh, demoClientToken, WithTransparentProxy(true))).
 			Install(IngressUniversal(defaultMesh, ingressToken)).
 			Setup(remote_3)
 		Expect(err).ToNot(HaveOccurred())
@@ -152,7 +152,7 @@ metadata:
 
 		err = NewClusterSetup().
 			Install(Kuma(core.Remote, optsRemote4...)).
-			Install(DemoClientUniversal(nonDefaultMesh, demoClientToken)).
+			Install(DemoClientUniversal(AppModeDemoClient, nonDefaultMesh, demoClientToken)).
 			Install(IngressUniversal(defaultMesh, ingressToken)).
 			Setup(remote_4)
 		Expect(err).ToNot(HaveOccurred())
diff --git a/test/e2e/deploy/kuma_deploy_universal_test.go b/test/e2e/deploy/kuma_deploy_universal_test.go
index 99e6487ce..a0adf2097 100644
--- a/test/e2e/deploy/kuma_deploy_universal_test.go
+++ b/test/e2e/deploy/kuma_deploy_universal_test.go
@@ -84,8 +84,8 @@ name: %s
 
 		err = NewClusterSetup().
 			Install(Kuma(core.Remote, optsRemote1...)).
-			Install(EchoServerUniversal("universal1", nonDefaultMesh, echoServerToken, WithTransparentProxy(true))).
-			Install(DemoClientUniversal(nonDefaultMesh, demoClientToken, WithTransparentProxy(true))).
+			Install(EchoServerUniversal(AppModeEchoServer, nonDefaultMesh, "universal1", echoServerToken, WithTransparentProxy(true))).
+			Install(DemoClientUniversal(AppModeDemoClient, nonDefaultMesh, demoClientToken, WithTransparentProxy(true))).
 			Install(IngressUniversal(defaultMesh, ingressToken)).
 			Setup(remote_1)
 		Expect(err).ToNot(HaveOccurred())
@@ -101,8 +101,8 @@ name: %s
 
 		err = NewClusterSetup().
 			Install(Kuma(core.Remote, optsRemote2...)).
-			Install(EchoServerUniversal("universal2", nonDefaultMesh, echoServerToken, WithTransparentProxy(true))).
-			Install(DemoClientUniversal(nonDefaultMesh, demoClientToken, WithTransparentProxy(true))).
+			Install(EchoServerUniversal(AppModeEchoServer, nonDefaultMesh, "universal2", echoServerToken, WithTransparentProxy(true))).
+			Install(DemoClientUniversal(AppModeDemoClient, nonDefaultMesh, demoClientToken, WithTransparentProxy(true))).
 			Install(IngressUniversal(defaultMesh, ingressToken)).
 			Setup(remote_2)
 		Expect(err).ToNot(HaveOccurred())
diff --git a/test/e2e/deploy/kuma_deploy_universal_transparent_proxy_test.go b/test/e2e/deploy/kuma_deploy_universal_transparent_proxy_test.go
index d3546a6e6..3a0f1f3d2 100644
--- a/test/e2e/deploy/kuma_deploy_universal_transparent_proxy_test.go
+++ b/test/e2e/deploy/kuma_deploy_universal_transparent_proxy_test.go
@@ -35,9 +35,9 @@ var _ = Describe("Test Universal Transparent Proxy deployment", func() {
 		demoClientToken, err := cluster.GetKuma().GenerateDpToken("default", "demo-client")
 		Expect(err).ToNot(HaveOccurred())
 
-		err = EchoServerUniversal("universal", "default", echoServerToken, WithTransparentProxy(true))(cluster)
+		err = EchoServerUniversal(AppModeEchoServer, "default", "universal", echoServerToken, WithTransparentProxy(true))(cluster)
 		Expect(err).ToNot(HaveOccurred())
-		err = DemoClientUniversal("default", demoClientToken, WithTransparentProxy(true))(cluster)
+		err = DemoClientUniversal(AppModeDemoClient, "default", demoClientToken, WithTransparentProxy(true))(cluster)
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/test/e2e/externalservices/externalservices_universal_test.go b/test/e2e/externalservices/externalservices_universal_test.go
index ff6263da2..85795dfbb 100644
--- a/test/e2e/externalservices/externalservices_universal_test.go
+++ b/test/e2e/externalservices/externalservices_universal_test.go
@@ -87,7 +87,7 @@ networking:
 		err = NewClusterSetup().
 			Install(externalservice.Install(externalservice.HttpServer, externalservice.UniversalAppEchoServer)).
 			Install(externalservice.Install(externalservice.HttpsServer, externalservice.UniversalAppHttpsEchoServer)).
-			Install(DemoClientUniversal("default", demoClientToken)).
+			Install(DemoClientUniversal(AppModeDemoClient, "default", demoClientToken)).
 			Setup(cluster)
 		Expect(err).ToNot(HaveOccurred())
 
diff --git a/test/e2e/healthcheck/healthcheck_hybrid_test.go b/test/e2e/healthcheck/healthcheck_hybrid_test.go
new file mode 100644
index 000000000..719174d8d
--- /dev/null
+++ b/test/e2e/healthcheck/healthcheck_hybrid_test.go
@@ -0,0 +1,166 @@
+package healthcheck_test
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gruntwork-io/terratest/modules/k8s"
+	"github.com/gruntwork-io/terratest/modules/retry"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"github.com/pkg/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/kumahq/kuma/pkg/config/core"
+	. "github.com/kumahq/kuma/test/framework"
+)
+
+var _ = Describe("Test application HealthCheck on Kubernetes/Universal", func() {
+	meshMTLSOn := func(mesh string) string {
+		return fmt.Sprintf(`
+apiVersion: kuma.io/v1alpha1
+kind: Mesh
+metadata:
+  name: %s
+spec:
+  mtls:
+    enabledBackend: ca-1
+    backends:
+    - name: ca-1
+      type: builtin
+`, mesh)
+	}
+
+	namespaceWithSidecarInjection := func(namespace string) string {
+		return fmt.Sprintf(`
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: %s
+  annotations:
+    kuma.io/sidecar-injection: "enabled"
+`, namespace)
+	}
+
+	var global, remoteK8s, remoteUniversal Cluster
+	var optsRemoteK8s, optsRemoteUniversal []DeployOptionsFunc
+
+	BeforeEach(func() {
+		k8sClusters, err := NewK8sClusters([]string{Kuma1, Kuma2}, Silent)
+		Expect(err).ToNot(HaveOccurred())
+
+		universalClusters, err := NewUniversalClusters([]string{Kuma3}, Silent)
+		Expect(err).ToNot(HaveOccurred())
+
+		global = k8sClusters.GetCluster(Kuma1)
+		err = NewClusterSetup().
+			Install(Kuma(core.Global)).
+			Install(YamlK8s(meshMTLSOn("default"))).
+			Setup(global)
+		Expect(err).ToNot(HaveOccurred())
+
+		optsRemoteK8s = []DeployOptionsFunc{
+			WithIngress(),
+			WithGlobalAddress(global.GetKuma().GetKDSServerAddress()),
+		}
+		remoteK8s = k8sClusters.GetCluster(Kuma2)
+		err = NewClusterSetup().
+			Install(Kuma(core.Remote, optsRemoteK8s...)).
+			Install(KumaDNS()).
+			Install(YamlK8s(namespaceWithSidecarInjection(TestNamespace))).
+			Install(DemoClientK8s("default")).
+			Setup(remoteK8s)
+		Expect(err).ToNot(HaveOccurred())
+
+		echoServerToken, err := global.GetKuma().GenerateDpToken("default", "echo-server_kuma-test_svc_8080")
+		Expect(err).ToNot(HaveOccurred())
+		ingressToken, err := global.GetKuma().GenerateDpToken("default", "ingress")
+		Expect(err).ToNot(HaveOccurred())
+
+		optsRemoteUniversal = []DeployOptionsFunc{
+			WithGlobalAddress(global.GetKuma().GetKDSServerAddress()),
+		}
+		remoteUniversal = universalClusters.GetCluster(Kuma3)
+		err = NewClusterSetup().
+			Install(Kuma(core.Remote, optsRemoteUniversal...)).
+			Install(EchoServerUniversal("dp-echo-1", "default", "echo-universal-1", echoServerToken, WithProtocol("tcp"))).
+			Install(EchoServerUniversal("dp-echo-2", "default", "echo-universal-2", echoServerToken, WithProtocol("tcp"), ProxyOnly(), ServiceProbe())).
+			Install(EchoServerUniversal("dp-echo-3", "default", "echo-universal-3", echoServerToken, WithProtocol("tcp"))).
+			Install(IngressUniversal("default", ingressToken)).
+			Setup(remoteUniversal)
+		Expect(err).ToNot(HaveOccurred())
+		err = remoteUniversal.VerifyKuma()
+		Expect(err).ToNot(HaveOccurred())
+	})
+
+	AfterEach(func() {
+		if ShouldSkipCleanup() {
+			return
+		}
+
+		_ = k8s.KubectlDeleteFromStringE(remoteK8s.GetTesting(), remoteK8s.GetKubectlOptions(), namespaceWithSidecarInjection(TestNamespace))
+		err := remoteK8s.DeleteKuma(optsRemoteK8s...)
+		Expect(err).ToNot(HaveOccurred())
+
+		err = remoteUniversal.DeleteKuma(optsRemoteUniversal...)
+		Expect(err).ToNot(HaveOccurred())
+
+		err = global.DeleteKuma()
+		Expect(err).ToNot(HaveOccurred())
+
+		err = remoteUniversal.DismissCluster()
+		Expect(err).ToNot(HaveOccurred())
+	})
+
+	It("should not load balance requests to unhealthy instance", func() {
+		pods, err := k8s.ListPodsE(remoteK8s.GetTesting(), remoteK8s.GetKubectlOptions(TestNamespace), metav1.ListOptions{
+			LabelSelector: fmt.Sprintf("app=%s", "demo-client"),
+		})
+		Expect(err).ToNot(HaveOccurred())
+		Expect(pods).To(HaveLen(1))
+
+		cmd := []string{"curl", "-v", "-m", "3", "--fail", "echo-server_kuma-test_svc_8080.mesh"}
+
+		checkInstance := func(instance string) {
+			_, err = retry.DoWithRetryE(remoteK8s.GetTesting(), fmt.Sprintf("kubectl exec -- %s", strings.Join(cmd, " ")),
+				DefaultRetries, DefaultTimeout, func() (string, error) {
+					stdout, _, err := remoteK8s.Exec(TestNamespace, pods[0].GetName(), "demo-client", cmd...)
+					if err != nil {
+						return "", err
+					}
+					if !strings.Contains(stdout, instance) {
+						return "", errors.New("wrong instance")
+					}
+					return "", nil
+				},
+			)
+		}
+
+		checkInstance("echo-universal-1")
+		checkInstance("echo-universal-2")
+
+		var counter1, counter2, counter3 int
+		const numOfRequest = 100
+
+		for i := 0; i < numOfRequest; i++ {
+			var stdout string
+
+			stdout, _, err = remoteK8s.Exec(TestNamespace, pods[0].GetName(), "demo-client", cmd...)
+			Expect(err).ToNot(HaveOccurred())
+
+			switch {
+			case strings.Contains(stdout, "Echo echo-universal-1"):
+				counter1++
+			case strings.Contains(stdout, "Echo echo-universal-2"):
+				counter2++
+			case strings.Contains(stdout, "Echo echo-universal-3"):
+				counter3++
+			}
+		}
+
+		Expect(counter2).To(Equal(0))
+		Expect(counter1 > 0).To(BeTrue())
+		Expect(counter3 > 0).To(BeTrue())
+		Expect(counter1 + counter3).To(Equal(numOfRequest))
+	})
+})
diff --git a/test/e2e/healthcheck/healthcheck_universal_test.go b/test/e2e/healthcheck/healthcheck_universal_test.go
index 048999b1a..de5b5adf4 100644
--- a/test/e2e/healthcheck/healthcheck_universal_test.go
+++ b/test/e2e/healthcheck/healthcheck_universal_test.go
@@ -29,9 +29,9 @@ var _ = Describe("Test application HealthCheck on Universal", func() {
 		demoClientToken, err := cluster.GetKuma().GenerateDpToken("default", "demo-client")
 		Expect(err).ToNot(HaveOccurred())
 
-		err = EchoServerUniversal("universal", "default", echoServerToken, ProxyOnly(), ServiceProbe())(cluster)
+		err = EchoServerUniversal("dp-echo-server", "default", "universal", echoServerToken, ProxyOnly(), ServiceProbe())(cluster)
 		Expect(err).ToNot(HaveOccurred())
-		err = DemoClientUniversal("default", demoClientToken, ServiceProbe())(cluster)
+		err = DemoClientUniversal("dp-demo-client", "default", demoClientToken, ServiceProbe())(cluster)
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/test/e2e/tracing/tracing_universal_test.go b/test/e2e/tracing/tracing_universal_test.go
index b9c5ddfbf..8223a2502 100644
--- a/test/e2e/tracing/tracing_universal_test.go
+++ b/test/e2e/tracing/tracing_universal_test.go
@@ -59,9 +59,9 @@ selectors:
 		demoClientToken, err := cluster.GetKuma().GenerateDpToken("default", "demo-client")
 		Expect(err).ToNot(HaveOccurred())
 
-		err = EchoServerUniversal("universal", "default", echoServerToken)(cluster)
+		err = EchoServerUniversal(AppModeEchoServer, "default", "universal", echoServerToken)(cluster)
 		Expect(err).ToNot(HaveOccurred())
-		err = DemoClientUniversal("default", demoClientToken)(cluster)
+		err = DemoClientUniversal(AppModeDemoClient, "default", demoClientToken)(cluster)
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/test/framework/interface.go b/test/framework/interface.go
index 9ae7e9b17..349eb0a25 100644
--- a/test/framework/interface.go
+++ b/test/framework/interface.go
@@ -39,14 +39,35 @@ type deployOptions struct {
 	// app specific
 	namespace   string
 	appname     string
-	id          string
+	name        string
+	appYaml     string
+	appArgs     []string
 	token       string
 	transparent bool
+	protocol    string
 	mesh        string
 }
 
 type DeployOptionsFunc func(*deployOptions)
 
+func WithYaml(appYaml string) DeployOptionsFunc {
+	return func(o *deployOptions) {
+		o.appYaml = appYaml
+	}
+}
+
+func WithProtocol(protocol string) DeployOptionsFunc {
+	return func(o *deployOptions) {
+		o.protocol = protocol
+	}
+}
+
+func WithArgs(appArgs []string) DeployOptionsFunc {
+	return func(o *deployOptions) {
+		o.appArgs = appArgs
+	}
+}
+
 func ProxyOnly() DeployOptionsFunc {
 	return func(o *deployOptions) {
 		o.proxyOnly = true
@@ -163,9 +184,9 @@ func WithAppname(appname string) DeployOptionsFunc {
 	}
 }
 
-func WithId(id string) DeployOptionsFunc {
+func WithName(name string) DeployOptionsFunc {
 	return func(o *deployOptions) {
-		o.id = id
+		o.name = name
 	}
 }
 
diff --git a/test/framework/setup.go b/test/framework/setup.go
index a55b4eb71..4b44b7cec 100644
--- a/test/framework/setup.go
+++ b/test/framework/setup.go
@@ -245,9 +245,23 @@ spec:
 	)
 }
 
-func EchoServerUniversal(id, mesh, token string, fs ...DeployOptionsFunc) InstallFunc {
+func EchoServerUniversal(name, mesh, echo, token string, fs ...DeployOptionsFunc) InstallFunc {
 	return func(cluster Cluster) error {
-		fs = append(fs, WithMesh(mesh), WithAppname(AppModeEchoServer), WithId(id), WithToken(token))
+		opts := newDeployOpt(fs...)
+		args := []string{"ncat", "-lk", "-p", "80", "--sh-exec", "'echo \"HTTP/1.1 200 OK\n\n Echo " + echo + "\n\"'"}
+		appYaml := ""
+		if opts.protocol == "" {
+			opts.protocol = "http"
+		}
+		switch {
+		case opts.transparent:
+			appYaml = fmt.Sprintf(EchoServerDataplaneTransparentProxy, mesh, "8080", "80", "8080", redirectPortInbound, redirectPortOutbound)
+		case opts.serviceProbe:
+			appYaml = fmt.Sprintf(EchoServerDataplaneWithServiceProbe, mesh, "8080", "80", "8080", opts.protocol)
+		default:
+			appYaml = fmt.Sprintf(EchoServerDataplane, mesh, "8080", "80", "8080", opts.protocol)
+		}
+		fs = append(fs, WithName(name), WithMesh(mesh), WithAppname(AppModeEchoServer), WithToken(token), WithArgs(args), WithYaml(appYaml))
 		return cluster.DeployApp(fs...)
 	}
 }
@@ -255,7 +269,7 @@ func EchoServerUniversal(id, mesh, token string, fs ...DeployOptionsFunc) Instal
 func IngressUniversal(mesh, token string) InstallFunc {
 	return func(cluster Cluster) error {
 		uniCluster := cluster.(*UniversalCluster)
-		app, err := NewUniversalApp(cluster.GetTesting(), uniCluster.name, AppIngress, true, []string{})
+		app, err := NewUniversalApp(cluster.GetTesting(), uniCluster.name, AppIngress, AppIngress, true, []string{})
 		if err != nil {
 			return err
 		}
@@ -360,9 +374,21 @@ spec:
 	)
 }
 
-func DemoClientUniversal(mesh, token string, fs ...DeployOptionsFunc) InstallFunc {
+func DemoClientUniversal(name, mesh, token string, fs ...DeployOptionsFunc) InstallFunc {
 	return func(cluster Cluster) error {
-		fs = append(fs, WithMesh(mesh), WithAppname(AppModeDemoClient), WithToken(token))
+		opts := newDeployOpt(fs...)
+		args := []string{"ncat", "-lvk", "-p", "3000"}
+		appYaml := ""
+		if opts.transparent {
+			appYaml = fmt.Sprintf(DemoClientDataplaneTransparentProxy, mesh, "3000", redirectPortInbound, redirectPortOutbound)
+		} else {
+			if opts.serviceProbe {
+				appYaml = fmt.Sprintf(DemoClientDataplaneWithServiceProbe, mesh, "13000", "3000", "80", "8080")
+			} else {
+				appYaml = fmt.Sprintf(DemoClientDataplane, mesh, "13000", "3000", "80", "8080")
+			}
+		}
+		fs = append(fs, WithName(name), WithMesh(mesh), WithAppname(AppModeDemoClient), WithToken(token), WithArgs(args), WithYaml(appYaml))
 		return cluster.DeployApp(fs...)
 	}
 }
diff --git a/test/framework/universal_app.go b/test/framework/universal_app.go
index d2f0eb845..47b9c8568 100644
--- a/test/framework/universal_app.go
+++ b/test/framework/universal_app.go
@@ -53,7 +53,7 @@ networking:
     servicePort: %s
     tags:
       kuma.io/service: echo-server_kuma-test_svc_%s
-      kuma.io/protocol: http
+      kuma.io/protocol: %s
 `
 
 	EchoServerDataplaneWithServiceProbe = `
@@ -69,7 +69,7 @@ networking:
       tcp: {}
     tags:
       kuma.io/service: echo-server_kuma-test_svc_%s
-      kuma.io/protocol: http
+      kuma.io/protocol: %s
 `
 
 	EchoServerDataplaneTransparentProxy = `
@@ -183,7 +183,7 @@ type UniversalApp struct {
 	verbose      bool
 }
 
-func NewUniversalApp(t testing.TestingT, clusterName string, mode AppMode, verbose bool, caps []string) (*UniversalApp, error) {
+func NewUniversalApp(t testing.TestingT, clusterName, dpName string, mode AppMode, verbose bool, caps []string) (*UniversalApp, error) {
 	app := &UniversalApp{
 		t:            t,
 		ports:        map[string]string{},
@@ -198,7 +198,7 @@ func NewUniversalApp(t testing.TestingT, clusterName string, mode AppMode, verbo
 	}
 
 	opts := defaultDockerOptions
-	opts.OtherOptions = append(opts.OtherOptions, "--name", clusterName+"_"+string(mode))
+	opts.OtherOptions = append(opts.OtherOptions, "--name", clusterName+"_"+dpName)
 	for _, cap := range caps {
 		opts.OtherOptions = append(opts.OtherOptions, "--cap-add", cap)
 	}
@@ -302,7 +302,7 @@ func (s *UniversalApp) CreateDP(token, cpAddress, appname, ip, dpyaml string) {
 		"--cp-address=" + cpAddress,
 		"--dataplane-token-file=/kuma/token-" + appname,
 		"--dataplane-file=/kuma/dpyaml-" + appname,
-		"--dataplane-var", "name=dp-" + appname,
+		"--dataplane-var", "name=" + appname,
 		"--dataplane-var", "address=" + ip,
 		"--binary-path", "/usr/local/bin/envoy",
 	})
diff --git a/test/framework/universal_cluster.go b/test/framework/universal_cluster.go
index 9e6777418..3e9ee58a3 100644
--- a/test/framework/universal_cluster.go
+++ b/test/framework/universal_cluster.go
@@ -85,7 +85,7 @@ func (c *UniversalCluster) DeployKuma(mode string, fs ...DeployOptionsFunc) erro
 		cmd = append(cmd, "--config-file", confPath)
 	}
 
-	app, err := NewUniversalApp(c.t, c.name, AppModeCP, true, caps)
+	app, err := NewUniversalApp(c.t, c.name, AppModeCP, AppModeCP, true, caps)
 	if err != nil {
 		return err
 	}
@@ -155,29 +155,20 @@ func (c *UniversalCluster) DeployApp(fs ...DeployOptionsFunc) error {
 	opts := newDeployOpt(fs...)
 	appname := opts.appname
 	token := opts.token
-	id := opts.id
 	transparent := opts.transparent
+	dpyaml := opts.appYaml
+	args := opts.appArgs
 
 	if opts.mesh == "" {
 		opts.mesh = "default"
 	}
 
-	var args []string
-	switch appname {
-	case AppModeEchoServer:
-		args = []string{"ncat", "-lk", "-p", "80", "--sh-exec", "'echo \"HTTP/1.1 200 OK\n\n Echo " + id + "\n\"'"}
-	case AppModeDemoClient:
-		args = []string{"ncat", "-lvk", "-p", "3000"}
-	default:
-		return errors.Errorf("not supported app type %s", appname)
-	}
-
 	caps := []string{}
 	if transparent {
 		caps = append(caps, "NET_ADMIN", "NET_RAW")
 	}
 
-	app, err := NewUniversalApp(c.t, c.name, AppMode(appname), c.verbose, caps)
+	app, err := NewUniversalApp(c.t, c.name, opts.name, AppMode(appname), c.verbose, caps)
 	if err != nil {
 		return err
 	}
@@ -188,31 +179,7 @@ func (c *UniversalCluster) DeployApp(fs ...DeployOptionsFunc) error {
 
 	ip := app.ip
 
-	dpyaml := ""
-	switch appname {
-	case AppModeEchoServer:
-		if transparent {
-			dpyaml = fmt.Sprintf(EchoServerDataplaneTransparentProxy, opts.mesh, "8080", "80", "8080", redirectPortInbound, redirectPortOutbound)
-		} else {
-			if opts.serviceProbe {
-				dpyaml = fmt.Sprintf(EchoServerDataplaneWithServiceProbe, opts.mesh, "8080", "80", "8080")
-			} else {
-				dpyaml = fmt.Sprintf(EchoServerDataplane, opts.mesh, "8080", "80", "8080")
-			}
-		}
-	case AppModeDemoClient:
-		if transparent {
-			dpyaml = fmt.Sprintf(DemoClientDataplaneTransparentProxy, opts.mesh, "3000", redirectPortInbound, redirectPortOutbound)
-		} else {
-			if opts.serviceProbe {
-				dpyaml = fmt.Sprintf(DemoClientDataplaneWithServiceProbe, opts.mesh, "13000", "3000", "80", "8080")
-			} else {
-				dpyaml = fmt.Sprintf(DemoClientDataplane, opts.mesh, "13000", "3000", "80", "8080")
-			}
-		}
-	}
-
-	err = c.CreateDP(app, appname, ip, dpyaml, token)
+	err = c.CreateDP(app, opts.name, ip, dpyaml, token)
 	if err != nil {
 		return err
 	}
@@ -225,7 +192,7 @@ func (c *UniversalCluster) DeployApp(fs ...DeployOptionsFunc) error {
 		}
 	}
 
-	c.apps[appname] = app
+	c.apps[opts.name] = app
 
 	return nil
 }