Repository: kumahq/kuma
Pull request #11437 (2024-09-16 16:40:43)

feat(meshtls): added builtin gateway implementation
### Checklist prior to review

While testing, I noticed that the built-in gateway isn't supported. This PR adds support for configuring Gateway clusters with TLS versions and ciphers.

d8b489d4e304bfcc4e9dac9bb3ccadbc02dc41f0 implementation 
fdc419a824a97961dfbb6843fbc1ceea600f2a2b unit test + golden files 
4b2c978538d052c1b62f3a3da59868bbe9e30123 e2e test


- [ ] [Link to relevant issue][1] as well as docs and UI issues -- fix: https://github.com/kumahq/kuma/issues/11424
- [ ] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS --
- [ ] Tests (Unit test, E2E tests, manual test on universal and k8s) --
  - Don't forget `ci/` labels to run additional/fewer tests
- [ ] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)? --
- [ ] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label) --

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword



Patch:
diff --git a/deployments/charts/kuma/crds/kuma.io_circuitbreakers.yaml b/deployments/charts/kuma/crds/kuma.io_circuitbreakers.yaml
index 0278d6252..ea955f2ab 100644
--- a/deployments/charts/kuma/crds/kuma.io_circuitbreakers.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_circuitbreakers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_containerpatches.yaml b/deployments/charts/kuma/crds/kuma.io_containerpatches.yaml
index e503765c3..9fc77a966 100644
--- a/deployments/charts/kuma/crds/kuma.io_containerpatches.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_containerpatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_dataplaneinsights.yaml b/deployments/charts/kuma/crds/kuma.io_dataplaneinsights.yaml
index b3f28ccf7..23c4538ea 100644
--- a/deployments/charts/kuma/crds/kuma.io_dataplaneinsights.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_dataplaneinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_dataplanes.yaml b/deployments/charts/kuma/crds/kuma.io_dataplanes.yaml
index 8c0ced650..ec8f06342 100644
--- a/deployments/charts/kuma/crds/kuma.io_dataplanes.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_dataplanes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_externalservices.yaml b/deployments/charts/kuma/crds/kuma.io_externalservices.yaml
index 650211769..be37a7b7f 100644
--- a/deployments/charts/kuma/crds/kuma.io_externalservices.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_externalservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: externalservices.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_faultinjections.yaml b/deployments/charts/kuma/crds/kuma.io_faultinjections.yaml
index 9aec8c629..6fb6366d5 100644
--- a/deployments/charts/kuma/crds/kuma.io_faultinjections.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_faultinjections.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: faultinjections.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_healthchecks.yaml b/deployments/charts/kuma/crds/kuma.io_healthchecks.yaml
index ad8babe62..9f2d075b5 100644
--- a/deployments/charts/kuma/crds/kuma.io_healthchecks.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_healthchecks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: healthchecks.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_hostnamegenerators.yaml b/deployments/charts/kuma/crds/kuma.io_hostnamegenerators.yaml
index 9848728a3..943421775 100644
--- a/deployments/charts/kuma/crds/kuma.io_hostnamegenerators.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_hostnamegenerators.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshaccesslogs.yaml b/deployments/charts/kuma/crds/kuma.io_meshaccesslogs.yaml
index 456a3ccff..16191c5ba 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshaccesslogs.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshaccesslogs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshcircuitbreakers.yaml b/deployments/charts/kuma/crds/kuma.io_meshcircuitbreakers.yaml
index 6657095c6..bea1fb597 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshcircuitbreakers.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshcircuitbreakers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshes.yaml b/deployments/charts/kuma/crds/kuma.io_meshes.yaml
index 584a08f9f..a9fec649c 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshes.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshes.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshexternalservices.yaml b/deployments/charts/kuma/crds/kuma.io_meshexternalservices.yaml
index 4e9e9bd17..4350612fc 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshexternalservices.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshexternalservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshfaultinjections.yaml b/deployments/charts/kuma/crds/kuma.io_meshfaultinjections.yaml
index 901a4adc3..538675b6e 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshfaultinjections.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshfaultinjections.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshgatewayconfigs.yaml b/deployments/charts/kuma/crds/kuma.io_meshgatewayconfigs.yaml
index 4026e224f..7960f61f8 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshgatewayconfigs.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshgatewayconfigs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshgatewayinstances.yaml b/deployments/charts/kuma/crds/kuma.io_meshgatewayinstances.yaml
index ddc7becc4..f68545cf0 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshgatewayinstances.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshgatewayinstances.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshgatewayroutes.yaml b/deployments/charts/kuma/crds/kuma.io_meshgatewayroutes.yaml
index 3e7384484..ef006e9cb 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshgatewayroutes.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshgatewayroutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshgateways.yaml b/deployments/charts/kuma/crds/kuma.io_meshgateways.yaml
index 493eed1f6..20ff66677 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshgateways.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshgateways.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgateways.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshhealthchecks.yaml b/deployments/charts/kuma/crds/kuma.io_meshhealthchecks.yaml
index f129d6bfb..d1a3a49f9 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshhealthchecks.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshhealthchecks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshhttproutes.yaml b/deployments/charts/kuma/crds/kuma.io_meshhttproutes.yaml
index d72bf37b4..14f8974b1 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshhttproutes.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshhttproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshinsights.yaml b/deployments/charts/kuma/crds/kuma.io_meshinsights.yaml
index 4e86b51c9..93b570048 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshinsights.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshloadbalancingstrategies.yaml b/deployments/charts/kuma/crds/kuma.io_meshloadbalancingstrategies.yaml
index f35025916..8fe3d6634 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshloadbalancingstrategies.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshloadbalancingstrategies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshmetrics.yaml b/deployments/charts/kuma/crds/kuma.io_meshmetrics.yaml
index 96eb71027..d244c2e04 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshmetrics.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshmetrics.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshmultizoneservices.yaml b/deployments/charts/kuma/crds/kuma.io_meshmultizoneservices.yaml
index 375548a37..7bb02ef79 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshmultizoneservices.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshmultizoneservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -54,11 +54,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
diff --git a/deployments/charts/kuma/crds/kuma.io_meshpassthroughs.yaml b/deployments/charts/kuma/crds/kuma.io_meshpassthroughs.yaml
index 326c39a03..9f5822b55 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshpassthroughs.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshpassthroughs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshproxypatches.yaml b/deployments/charts/kuma/crds/kuma.io_meshproxypatches.yaml
index 02fa83166..bf6342d25 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshproxypatches.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshproxypatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshratelimits.yaml b/deployments/charts/kuma/crds/kuma.io_meshratelimits.yaml
index ef301637f..52424a985 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshratelimits.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshratelimits.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshretries.yaml b/deployments/charts/kuma/crds/kuma.io_meshretries.yaml
index 66befddcf..f4337a105 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshretries.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshretries.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshservices.yaml b/deployments/charts/kuma/crds/kuma.io_meshservices.yaml
index 729720632..69a129d40 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshservices.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshtcproutes.yaml b/deployments/charts/kuma/crds/kuma.io_meshtcproutes.yaml
index 714cd6b73..9d1d0ad7e 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshtcproutes.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshtcproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml b/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml
index 67372635f..330873a94 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshtlses.yaml b/deployments/charts/kuma/crds/kuma.io_meshtlses.yaml
index 4774210d5..82c2d1e92 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshtlses.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshtlses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshtraces.yaml b/deployments/charts/kuma/crds/kuma.io_meshtraces.yaml
index abaea0dcc..19f58e12f 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshtraces.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshtraces.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_meshtrafficpermissions.yaml b/deployments/charts/kuma/crds/kuma.io_meshtrafficpermissions.yaml
index f490facc5..3e38acc06 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshtrafficpermissions.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshtrafficpermissions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_proxytemplates.yaml b/deployments/charts/kuma/crds/kuma.io_proxytemplates.yaml
index 6940f5cec..78b1d55e4 100644
--- a/deployments/charts/kuma/crds/kuma.io_proxytemplates.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_proxytemplates.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: proxytemplates.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_ratelimits.yaml b/deployments/charts/kuma/crds/kuma.io_ratelimits.yaml
index 6bceaf06f..85f1876eb 100644
--- a/deployments/charts/kuma/crds/kuma.io_ratelimits.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_ratelimits.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: ratelimits.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_retries.yaml b/deployments/charts/kuma/crds/kuma.io_retries.yaml
index cf7c15b5b..10a4843e1 100644
--- a/deployments/charts/kuma/crds/kuma.io_retries.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_retries.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: retries.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_serviceinsights.yaml b/deployments/charts/kuma/crds/kuma.io_serviceinsights.yaml
index 1661d120d..827ea521d 100644
--- a/deployments/charts/kuma/crds/kuma.io_serviceinsights.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_serviceinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: serviceinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_timeouts.yaml b/deployments/charts/kuma/crds/kuma.io_timeouts.yaml
index ca263bdb9..ba78d88c5 100644
--- a/deployments/charts/kuma/crds/kuma.io_timeouts.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_timeouts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: timeouts.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_trafficlogs.yaml b/deployments/charts/kuma/crds/kuma.io_trafficlogs.yaml
index b8ac3a071..ece8562e5 100644
--- a/deployments/charts/kuma/crds/kuma.io_trafficlogs.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_trafficlogs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficlogs.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_trafficpermissions.yaml b/deployments/charts/kuma/crds/kuma.io_trafficpermissions.yaml
index 33defdbdb..9c79605af 100644
--- a/deployments/charts/kuma/crds/kuma.io_trafficpermissions.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_trafficpermissions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficpermissions.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_trafficroutes.yaml b/deployments/charts/kuma/crds/kuma.io_trafficroutes.yaml
index 0ddf4e1e2..5bdd3ac85 100644
--- a/deployments/charts/kuma/crds/kuma.io_trafficroutes.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_trafficroutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficroutes.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_traffictraces.yaml b/deployments/charts/kuma/crds/kuma.io_traffictraces.yaml
index 3c1f5c5d4..c224ea526 100644
--- a/deployments/charts/kuma/crds/kuma.io_traffictraces.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_traffictraces.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: traffictraces.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_virtualoutbounds.yaml b/deployments/charts/kuma/crds/kuma.io_virtualoutbounds.yaml
index f254f87cb..c4372dd0b 100644
--- a/deployments/charts/kuma/crds/kuma.io_virtualoutbounds.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_virtualoutbounds.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: virtualoutbounds.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_zoneegresses.yaml b/deployments/charts/kuma/crds/kuma.io_zoneegresses.yaml
index c32b14cea..143aaafdb 100644
--- a/deployments/charts/kuma/crds/kuma.io_zoneegresses.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_zoneegresses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegresses.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_zoneegressinsights.yaml b/deployments/charts/kuma/crds/kuma.io_zoneegressinsights.yaml
index dfc71b491..05746b39a 100644
--- a/deployments/charts/kuma/crds/kuma.io_zoneegressinsights.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_zoneegressinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegressinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_zoneingresses.yaml b/deployments/charts/kuma/crds/kuma.io_zoneingresses.yaml
index fd98804d9..d02c5b35b 100644
--- a/deployments/charts/kuma/crds/kuma.io_zoneingresses.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_zoneingresses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingresses.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_zoneingressinsights.yaml b/deployments/charts/kuma/crds/kuma.io_zoneingressinsights.yaml
index c2731f7e8..ded86e6c2 100644
--- a/deployments/charts/kuma/crds/kuma.io_zoneingressinsights.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_zoneingressinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingressinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_zoneinsights.yaml b/deployments/charts/kuma/crds/kuma.io_zoneinsights.yaml
index bb0944db8..aad82d4be 100644
--- a/deployments/charts/kuma/crds/kuma.io_zoneinsights.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_zoneinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/deployments/charts/kuma/crds/kuma.io_zones.yaml b/deployments/charts/kuma/crds/kuma.io_zones.yaml
index f5444cddb..12022fce9 100644
--- a/deployments/charts/kuma/crds/kuma.io_zones.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_zones.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zones.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/openapi.yaml b/docs/generated/openapi.yaml
index 8e923b400..3bff3fe5c 100644
--- a/docs/generated/openapi.yaml
+++ b/docs/generated/openapi.yaml
@@ -11523,11 +11523,6 @@ components:
                   port:
                     format: int32
                     type: integer
-                  targetPort:
-                    anyOf:
-                      - type: integer
-                      - type: string
-                    x-kubernetes-int-or-string: true
                 required:
                   - port
                 type: object
diff --git a/docs/generated/raw/crds/kuma.io_circuitbreakers.yaml b/docs/generated/raw/crds/kuma.io_circuitbreakers.yaml
index 0278d6252..ea955f2ab 100644
--- a/docs/generated/raw/crds/kuma.io_circuitbreakers.yaml
+++ b/docs/generated/raw/crds/kuma.io_circuitbreakers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_containerpatches.yaml b/docs/generated/raw/crds/kuma.io_containerpatches.yaml
index e503765c3..9fc77a966 100644
--- a/docs/generated/raw/crds/kuma.io_containerpatches.yaml
+++ b/docs/generated/raw/crds/kuma.io_containerpatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_dataplaneinsights.yaml b/docs/generated/raw/crds/kuma.io_dataplaneinsights.yaml
index b3f28ccf7..23c4538ea 100644
--- a/docs/generated/raw/crds/kuma.io_dataplaneinsights.yaml
+++ b/docs/generated/raw/crds/kuma.io_dataplaneinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_dataplanes.yaml b/docs/generated/raw/crds/kuma.io_dataplanes.yaml
index 8c0ced650..ec8f06342 100644
--- a/docs/generated/raw/crds/kuma.io_dataplanes.yaml
+++ b/docs/generated/raw/crds/kuma.io_dataplanes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_externalservices.yaml b/docs/generated/raw/crds/kuma.io_externalservices.yaml
index 650211769..be37a7b7f 100644
--- a/docs/generated/raw/crds/kuma.io_externalservices.yaml
+++ b/docs/generated/raw/crds/kuma.io_externalservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: externalservices.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_faultinjections.yaml b/docs/generated/raw/crds/kuma.io_faultinjections.yaml
index 9aec8c629..6fb6366d5 100644
--- a/docs/generated/raw/crds/kuma.io_faultinjections.yaml
+++ b/docs/generated/raw/crds/kuma.io_faultinjections.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: faultinjections.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_healthchecks.yaml b/docs/generated/raw/crds/kuma.io_healthchecks.yaml
index ad8babe62..9f2d075b5 100644
--- a/docs/generated/raw/crds/kuma.io_healthchecks.yaml
+++ b/docs/generated/raw/crds/kuma.io_healthchecks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: healthchecks.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_hostnamegenerators.yaml b/docs/generated/raw/crds/kuma.io_hostnamegenerators.yaml
index 9848728a3..943421775 100644
--- a/docs/generated/raw/crds/kuma.io_hostnamegenerators.yaml
+++ b/docs/generated/raw/crds/kuma.io_hostnamegenerators.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshaccesslogs.yaml b/docs/generated/raw/crds/kuma.io_meshaccesslogs.yaml
index 456a3ccff..16191c5ba 100644
--- a/docs/generated/raw/crds/kuma.io_meshaccesslogs.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshaccesslogs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshcircuitbreakers.yaml b/docs/generated/raw/crds/kuma.io_meshcircuitbreakers.yaml
index 6657095c6..bea1fb597 100644
--- a/docs/generated/raw/crds/kuma.io_meshcircuitbreakers.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshcircuitbreakers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshes.yaml b/docs/generated/raw/crds/kuma.io_meshes.yaml
index 584a08f9f..a9fec649c 100644
--- a/docs/generated/raw/crds/kuma.io_meshes.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshes.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshexternalservices.yaml b/docs/generated/raw/crds/kuma.io_meshexternalservices.yaml
index 4e9e9bd17..4350612fc 100644
--- a/docs/generated/raw/crds/kuma.io_meshexternalservices.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshexternalservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshfaultinjections.yaml b/docs/generated/raw/crds/kuma.io_meshfaultinjections.yaml
index 901a4adc3..538675b6e 100644
--- a/docs/generated/raw/crds/kuma.io_meshfaultinjections.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshfaultinjections.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshgatewayconfigs.yaml b/docs/generated/raw/crds/kuma.io_meshgatewayconfigs.yaml
index 4026e224f..7960f61f8 100644
--- a/docs/generated/raw/crds/kuma.io_meshgatewayconfigs.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshgatewayconfigs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshgatewayinstances.yaml b/docs/generated/raw/crds/kuma.io_meshgatewayinstances.yaml
index ddc7becc4..f68545cf0 100644
--- a/docs/generated/raw/crds/kuma.io_meshgatewayinstances.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshgatewayinstances.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshgatewayroutes.yaml b/docs/generated/raw/crds/kuma.io_meshgatewayroutes.yaml
index 3e7384484..ef006e9cb 100644
--- a/docs/generated/raw/crds/kuma.io_meshgatewayroutes.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshgatewayroutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshgateways.yaml b/docs/generated/raw/crds/kuma.io_meshgateways.yaml
index 493eed1f6..20ff66677 100644
--- a/docs/generated/raw/crds/kuma.io_meshgateways.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshgateways.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgateways.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshhealthchecks.yaml b/docs/generated/raw/crds/kuma.io_meshhealthchecks.yaml
index f129d6bfb..d1a3a49f9 100644
--- a/docs/generated/raw/crds/kuma.io_meshhealthchecks.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshhealthchecks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshhttproutes.yaml b/docs/generated/raw/crds/kuma.io_meshhttproutes.yaml
index d72bf37b4..14f8974b1 100644
--- a/docs/generated/raw/crds/kuma.io_meshhttproutes.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshhttproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshinsights.yaml b/docs/generated/raw/crds/kuma.io_meshinsights.yaml
index 4e86b51c9..93b570048 100644
--- a/docs/generated/raw/crds/kuma.io_meshinsights.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshloadbalancingstrategies.yaml b/docs/generated/raw/crds/kuma.io_meshloadbalancingstrategies.yaml
index f35025916..8fe3d6634 100644
--- a/docs/generated/raw/crds/kuma.io_meshloadbalancingstrategies.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshloadbalancingstrategies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshmetrics.yaml b/docs/generated/raw/crds/kuma.io_meshmetrics.yaml
index 96eb71027..d244c2e04 100644
--- a/docs/generated/raw/crds/kuma.io_meshmetrics.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshmetrics.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshmultizoneservices.yaml b/docs/generated/raw/crds/kuma.io_meshmultizoneservices.yaml
index 375548a37..7bb02ef79 100644
--- a/docs/generated/raw/crds/kuma.io_meshmultizoneservices.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshmultizoneservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -54,11 +54,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
diff --git a/docs/generated/raw/crds/kuma.io_meshpassthroughs.yaml b/docs/generated/raw/crds/kuma.io_meshpassthroughs.yaml
index 326c39a03..9f5822b55 100644
--- a/docs/generated/raw/crds/kuma.io_meshpassthroughs.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshpassthroughs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshproxypatches.yaml b/docs/generated/raw/crds/kuma.io_meshproxypatches.yaml
index 02fa83166..bf6342d25 100644
--- a/docs/generated/raw/crds/kuma.io_meshproxypatches.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshproxypatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshratelimits.yaml b/docs/generated/raw/crds/kuma.io_meshratelimits.yaml
index ef301637f..52424a985 100644
--- a/docs/generated/raw/crds/kuma.io_meshratelimits.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshratelimits.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshretries.yaml b/docs/generated/raw/crds/kuma.io_meshretries.yaml
index 66befddcf..f4337a105 100644
--- a/docs/generated/raw/crds/kuma.io_meshretries.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshretries.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshservices.yaml b/docs/generated/raw/crds/kuma.io_meshservices.yaml
index 729720632..69a129d40 100644
--- a/docs/generated/raw/crds/kuma.io_meshservices.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshtcproutes.yaml b/docs/generated/raw/crds/kuma.io_meshtcproutes.yaml
index 714cd6b73..9d1d0ad7e 100644
--- a/docs/generated/raw/crds/kuma.io_meshtcproutes.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshtcproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml b/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml
index 67372635f..330873a94 100644
--- a/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshtlses.yaml b/docs/generated/raw/crds/kuma.io_meshtlses.yaml
index 4774210d5..82c2d1e92 100644
--- a/docs/generated/raw/crds/kuma.io_meshtlses.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshtlses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshtraces.yaml b/docs/generated/raw/crds/kuma.io_meshtraces.yaml
index abaea0dcc..19f58e12f 100644
--- a/docs/generated/raw/crds/kuma.io_meshtraces.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshtraces.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_meshtrafficpermissions.yaml b/docs/generated/raw/crds/kuma.io_meshtrafficpermissions.yaml
index f490facc5..3e38acc06 100644
--- a/docs/generated/raw/crds/kuma.io_meshtrafficpermissions.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshtrafficpermissions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_proxytemplates.yaml b/docs/generated/raw/crds/kuma.io_proxytemplates.yaml
index 6940f5cec..78b1d55e4 100644
--- a/docs/generated/raw/crds/kuma.io_proxytemplates.yaml
+++ b/docs/generated/raw/crds/kuma.io_proxytemplates.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: proxytemplates.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_ratelimits.yaml b/docs/generated/raw/crds/kuma.io_ratelimits.yaml
index 6bceaf06f..85f1876eb 100644
--- a/docs/generated/raw/crds/kuma.io_ratelimits.yaml
+++ b/docs/generated/raw/crds/kuma.io_ratelimits.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: ratelimits.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_retries.yaml b/docs/generated/raw/crds/kuma.io_retries.yaml
index cf7c15b5b..10a4843e1 100644
--- a/docs/generated/raw/crds/kuma.io_retries.yaml
+++ b/docs/generated/raw/crds/kuma.io_retries.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: retries.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_serviceinsights.yaml b/docs/generated/raw/crds/kuma.io_serviceinsights.yaml
index 1661d120d..827ea521d 100644
--- a/docs/generated/raw/crds/kuma.io_serviceinsights.yaml
+++ b/docs/generated/raw/crds/kuma.io_serviceinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: serviceinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_timeouts.yaml b/docs/generated/raw/crds/kuma.io_timeouts.yaml
index ca263bdb9..ba78d88c5 100644
--- a/docs/generated/raw/crds/kuma.io_timeouts.yaml
+++ b/docs/generated/raw/crds/kuma.io_timeouts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: timeouts.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_trafficlogs.yaml b/docs/generated/raw/crds/kuma.io_trafficlogs.yaml
index b8ac3a071..ece8562e5 100644
--- a/docs/generated/raw/crds/kuma.io_trafficlogs.yaml
+++ b/docs/generated/raw/crds/kuma.io_trafficlogs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficlogs.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_trafficpermissions.yaml b/docs/generated/raw/crds/kuma.io_trafficpermissions.yaml
index 33defdbdb..9c79605af 100644
--- a/docs/generated/raw/crds/kuma.io_trafficpermissions.yaml
+++ b/docs/generated/raw/crds/kuma.io_trafficpermissions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficpermissions.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_trafficroutes.yaml b/docs/generated/raw/crds/kuma.io_trafficroutes.yaml
index 0ddf4e1e2..5bdd3ac85 100644
--- a/docs/generated/raw/crds/kuma.io_trafficroutes.yaml
+++ b/docs/generated/raw/crds/kuma.io_trafficroutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficroutes.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_traffictraces.yaml b/docs/generated/raw/crds/kuma.io_traffictraces.yaml
index 3c1f5c5d4..c224ea526 100644
--- a/docs/generated/raw/crds/kuma.io_traffictraces.yaml
+++ b/docs/generated/raw/crds/kuma.io_traffictraces.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: traffictraces.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_virtualoutbounds.yaml b/docs/generated/raw/crds/kuma.io_virtualoutbounds.yaml
index f254f87cb..c4372dd0b 100644
--- a/docs/generated/raw/crds/kuma.io_virtualoutbounds.yaml
+++ b/docs/generated/raw/crds/kuma.io_virtualoutbounds.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: virtualoutbounds.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_zoneegresses.yaml b/docs/generated/raw/crds/kuma.io_zoneegresses.yaml
index c32b14cea..143aaafdb 100644
--- a/docs/generated/raw/crds/kuma.io_zoneegresses.yaml
+++ b/docs/generated/raw/crds/kuma.io_zoneegresses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegresses.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_zoneegressinsights.yaml b/docs/generated/raw/crds/kuma.io_zoneegressinsights.yaml
index dfc71b491..05746b39a 100644
--- a/docs/generated/raw/crds/kuma.io_zoneegressinsights.yaml
+++ b/docs/generated/raw/crds/kuma.io_zoneegressinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegressinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_zoneingresses.yaml b/docs/generated/raw/crds/kuma.io_zoneingresses.yaml
index fd98804d9..d02c5b35b 100644
--- a/docs/generated/raw/crds/kuma.io_zoneingresses.yaml
+++ b/docs/generated/raw/crds/kuma.io_zoneingresses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingresses.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_zoneingressinsights.yaml b/docs/generated/raw/crds/kuma.io_zoneingressinsights.yaml
index c2731f7e8..ded86e6c2 100644
--- a/docs/generated/raw/crds/kuma.io_zoneingressinsights.yaml
+++ b/docs/generated/raw/crds/kuma.io_zoneingressinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingressinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_zoneinsights.yaml b/docs/generated/raw/crds/kuma.io_zoneinsights.yaml
index bb0944db8..aad82d4be 100644
--- a/docs/generated/raw/crds/kuma.io_zoneinsights.yaml
+++ b/docs/generated/raw/crds/kuma.io_zoneinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/docs/generated/raw/crds/kuma.io_zones.yaml b/docs/generated/raw/crds/kuma.io_zones.yaml
index f5444cddb..12022fce9 100644
--- a/docs/generated/raw/crds/kuma.io_zones.yaml
+++ b/docs/generated/raw/crds/kuma.io_zones.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zones.kuma.io
 spec:
   group: kuma.io
diff --git a/go.mod b/go.mod
index de39f816c..3a43a6c18 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.0
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/Nordix/simple-ipam v1.0.0
-	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/bakito/go-log-logr-adapter v0.0.3-0.20231211113354-bfa42fa7e121
 	github.com/cilium/ebpf v0.16.0
 	github.com/containernetworking/cni v1.2.3
@@ -28,7 +28,7 @@ require (
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
 	github.com/gruntwork-io/terratest v0.47.1
 	github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69
-	github.com/jackc/pgx/v5 v5.7.0
+	github.com/jackc/pgx/v5 v5.7.1
 	github.com/josephburnett/jd/v2 v2.0.0-20230813234251-7b2e87c80934
 	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/kennygrant/sanitize v1.2.4
@@ -75,17 +75,17 @@ require (
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
-	helm.sh/helm/v3 v3.15.4
-	k8s.io/api v0.31.0
-	k8s.io/apiextensions-apiserver v0.31.0
-	k8s.io/apimachinery v0.31.0
-	k8s.io/client-go v0.31.0
+	helm.sh/helm/v3 v3.16.1
+	k8s.io/api v0.31.1
+	k8s.io/apiextensions-apiserver v0.31.1
+	k8s.io/apimachinery v0.31.1
+	k8s.io/client-go v0.31.1
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108
-	k8s.io/kubectl v0.31.0
+	k8s.io/kubectl v0.31.1
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	sigs.k8s.io/controller-runtime v0.19.0
-	sigs.k8s.io/controller-tools v0.16.2
+	sigs.k8s.io/controller-tools v0.16.3
 	// When updating this also update version in: test/framework/k8s.go
 	sigs.k8s.io/gateway-api v1.1.0
 	sigs.k8s.io/yaml v1.4.0
@@ -109,7 +109,7 @@ require (
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/dockercfg v0.3.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
+	github.com/cyphar/filepath-securejoin v0.3.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/docker v27.2.0+incompatible // indirect
@@ -152,7 +152,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/puddle/v2 v2.2.1 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 2fae36666..6d030832a 100644
--- a/go.sum
+++ b/go.sum
@@ -26,8 +26,8 @@ github.com/Nordix/simple-ipam v1.0.0 h1:oMyASgx2EEH0ccjAEBgCgCviu7z4uB+Od7UUCBxq
 github.com/Nordix/simple-ipam v1.0.0/go.mod h1:7d9TR/lF/zpNDHYhT43qhewce8vNdzVG5kCk7K9dPac=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
-github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.49.6 h1:yNldzF5kzLBRvKlKz1S0bkvc2+04R1kt13KfBWQBfFA=
 github.com/aws/aws-sdk-go v1.49.6/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
 github.com/bakito/go-log-logr-adapter v0.0.3-0.20231211113354-bfa42fa7e121 h1:0mA5T6mV0/9+t7TfYAWINV3V6PNrXl0G0bnUgSIpq4E=
@@ -64,8 +64,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lV
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
-github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
-github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
+github.com/cyphar/filepath-securejoin v0.3.1 h1:1V7cHiaW+C+39wEfpH6XlLBQo3j/PciWFrgfCLS8XrE=
+github.com/cyphar/filepath-securejoin v0.3.1/go.mod h1:F7i41x/9cBF7lzCrVsYs9fuzwRZm4NQsGTBdpp6mETc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -86,8 +86,8 @@ github.com/envoyproxy/go-control-plane v0.11.2-0.20231010133108-1dfbe83bcebc h1:
 github.com/envoyproxy/go-control-plane v0.11.2-0.20231010133108-1dfbe83bcebc/go.mod h1:9ODlpdyEVNyci9DZ6cdQYkwYSW1YMrnSz3xnku3cjL0=
 github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
 github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
-github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
-github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
+github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
 github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/exaring/otelpgx v0.6.2 h1:z1ayuDusPITNOhzvmx3nLpFax+tv7Hu7mdrjtgW3ZeA=
@@ -213,10 +213,10 @@ github.com/jackc/pgtype v1.14.2 h1:QBdZQTKpPdBlw2AdKwHEyqUcm/lrl2cwWAHjCMyln/o=
 github.com/jackc/pgtype v1.14.2/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgx/v4 v4.18.2 h1:xVpYkNR5pk5bMCZGfClbO962UIqVABcAGt7ha1s/FeU=
 github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
-github.com/jackc/pgx/v5 v5.7.0 h1:FG6VLIdzvAPhnYqP14sQ2xhFLkiUQHCs6ySqO91kF4g=
-github.com/jackc/pgx/v5 v5.7.0/go.mod h1:awP1KNnjylvpxHuHP63gzjhnGkI1iw+PMoIwvoleN/8=
-github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
-github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jackc/pgx/v5 v5.7.1 h1:x7SYsPBYDkHDksogeSmZZ5xzThcTgRz++I5E+ePFUcs=
+github.com/jackc/pgx/v5 v5.7.1/go.mod h1:e7O26IywZZ+naJtWWos6i6fvWK+29etgITqrqHLfoZA=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
@@ -555,28 +555,28 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
-helm.sh/helm/v3 v3.15.4 h1:UFHd6oZ1IN3FsUZ7XNhOQDyQ2QYknBNWRHH57e9cbHY=
-helm.sh/helm/v3 v3.15.4/go.mod h1:phOwlxqGSgppCY/ysWBNRhG3MtnpsttOzxaTK+Mt40E=
-k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo=
-k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
-k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
-k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
-k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
-k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
-k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
+helm.sh/helm/v3 v3.16.1 h1:cER6tI/8PgUAsaJaQCVBUg3VI9KN4oVaZJgY60RIc0c=
+helm.sh/helm/v3 v3.16.1/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps=
+k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU=
+k8s.io/api v0.31.1/go.mod h1:sbN1g6eY6XVLeqNsZGLnI5FwVseTrZX7Fv3O26rhAaI=
+k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40=
+k8s.io/apiextensions-apiserver v0.31.1/go.mod h1:tWMPR3sgW+jsl2xm9v7lAyRF1rYEK71i9G5dRtkknoQ=
+k8s.io/apimachinery v0.31.1 h1:mhcUBbj7KUjaVhyXILglcVjuS4nYXiwC+KKFBgIVy7U=
+k8s.io/apimachinery v0.31.1/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/client-go v0.31.1 h1:f0ugtWSbWpxHR7sjVpQwuvw9a3ZKLXX0u0itkFXufb0=
+k8s.io/client-go v0.31.1/go.mod h1:sKI8871MJN2OyeqRlmA4W4KM9KBdBUpDLu/43eGemCg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108 h1:Q8Z7VlGhcJgBHJHYugJ/K/7iB8a2eSxCyxdVjJp+lLY=
 k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/kubectl v0.31.0 h1:kANwAAPVY02r4U4jARP/C+Q1sssCcN/1p9Nk+7BQKVg=
-k8s.io/kubectl v0.31.0/go.mod h1:pB47hhFypGsaHAPjlwrNbvhXgmuAr01ZBvAIIUaI8d4=
+k8s.io/kubectl v0.31.1 h1:ih4JQJHxsEggFqDJEHSOdJ69ZxZftgeZvYo7M/cpp24=
+k8s.io/kubectl v0.31.1/go.mod h1:aNuQoR43W6MLAtXQ/Bu4GDmoHlbhHKuyD49lmTC8eJM=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/controller-runtime v0.19.0 h1:nWVM7aq+Il2ABxwiCizrVDSlmDcshi9llbaFbC0ji/Q=
 sigs.k8s.io/controller-runtime v0.19.0/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
-sigs.k8s.io/controller-tools v0.16.2 h1:uUFF/AW3phBWPiERvkSNOVct//L427bPS7xGfKi6Tz4=
-sigs.k8s.io/controller-tools v0.16.2/go.mod h1:0I0xqjR65YTfoO12iR+mZR6s6UAVcUARgXRlsu0ljB0=
+sigs.k8s.io/controller-tools v0.16.3 h1:z48C5/d4jCVQQvtiSBL5MYyZ3EO2eFIOXrIKMgHVhFY=
+sigs.k8s.io/controller-tools v0.16.3/go.mod h1:AEj6k+w1kYpLZv2einOH3mj52ips4W/6FUjnB5tkJGs=
 sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM=
 sigs.k8s.io/gateway-api v1.1.0/go.mod h1:ZH4lHrL2sDi0FHZ9jjneb8kKnGzFWyrTya35sWUTrRs=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
diff --git a/mk/dependencies/deps.lock b/mk/dependencies/deps.lock
index a983e8f03..d40952d4f 100644
--- a/mk/dependencies/deps.lock
+++ b/mk/dependencies/deps.lock
@@ -1,1 +1,1 @@
-7cf725e6e74fc99f84483c82810e493110f84816
+db851ac785c9bf8165f14194412ade6c8d25197c
diff --git a/mk/dependencies/go-deps.versions b/mk/dependencies/go-deps.versions
index dc7f96212..ef221967e 100644
--- a/mk/dependencies/go-deps.versions
+++ b/mk/dependencies/go-deps.versions
@@ -4,7 +4,7 @@ google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1.0
 github.com/chrusty/protoc-gen-jsonschema/cmd/protoc-gen-jsonschema@v0.0.0-20230606235304-e35f2ad05c0c
 github.com/envoyproxy/protoc-gen-validate@v1.1.0
 github.com/onsi/ginkgo/v2/ginkgo@v2.20.2
-sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.2
+sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.3
 github.com/mikefarah/yq/v4@v4.30.8
 github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0
 golang.stackrox.io/kube-linter/cmd/kube-linter@v0.6.5
diff --git a/pkg/api-server/resource_endpoints.go b/pkg/api-server/resource_endpoints.go
index 35e69158b..7c87858d0 100644
--- a/pkg/api-server/resource_endpoints.go
+++ b/pkg/api-server/resource_endpoints.go
@@ -934,7 +934,7 @@ func (r *resourceEndpoints) rulesForResource() restful.RouteFunction {
 			for itemIdentifier, resourceRuleItem := range res.ToRules.ResourceRules {
 				toResourceRules = append(toResourceRules, api_common.ResourceRule{
 					Conf:                resourceRuleItem.Conf,
-					Origin:              oapi_helpers.OriginListToResourceRuleOrigin(itemIdentifier.ResourceType, resourceRuleItem.Origin),
+					Origin:              oapi_helpers.OriginListToResourceRuleOrigin(res.Type, resourceRuleItem.Origin),
 					ResourceMeta:        oapi_helpers.ResourceMetaToMeta(itemIdentifier.ResourceType, resourceRuleItem.Resource),
 					ResourceSectionName: &resourceRuleItem.ResourceSectionName,
 				})
diff --git a/pkg/core/resources/apis/donothingresource/k8s/crd/kuma.io_donothingresources.yaml b/pkg/core/resources/apis/donothingresource/k8s/crd/kuma.io_donothingresources.yaml
index 4c728d0bd..7ac8563c3 100644
--- a/pkg/core/resources/apis/donothingresource/k8s/crd/kuma.io_donothingresources.yaml
+++ b/pkg/core/resources/apis/donothingresource/k8s/crd/kuma.io_donothingresources.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: donothingresources.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/core/resources/apis/hostnamegenerator/k8s/crd/kuma.io_hostnamegenerators.yaml b/pkg/core/resources/apis/hostnamegenerator/k8s/crd/kuma.io_hostnamegenerators.yaml
index 9848728a3..943421775 100644
--- a/pkg/core/resources/apis/hostnamegenerator/k8s/crd/kuma.io_hostnamegenerators.yaml
+++ b/pkg/core/resources/apis/hostnamegenerator/k8s/crd/kuma.io_hostnamegenerators.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/core/resources/apis/mesh/dataplane_helpers.go b/pkg/core/resources/apis/mesh/dataplane_helpers.go
index f57735bca..486410834 100644
--- a/pkg/core/resources/apis/mesh/dataplane_helpers.go
+++ b/pkg/core/resources/apis/mesh/dataplane_helpers.go
@@ -1,7 +1,6 @@
 package mesh
 
 import (
-	"fmt"
 	"hash/fnv"
 	"net"
 	"strconv"
@@ -13,6 +12,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	xds_types "github.com/kumahq/kuma/pkg/core/xds/types"
+	"github.com/kumahq/kuma/pkg/util/pointer"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 )
 
@@ -237,29 +237,20 @@ func (d *DataplaneResource) AsOutbounds(resolver core_model.LabelResourceIdentif
 	var outbounds xds_types.Outbounds
 	for _, o := range d.Spec.Networking.Outbound {
 		if o.BackendRef != nil {
-			outbound := &xds_types.Outbound{
-				Address: o.Address,
-				Port:    o.Port,
-				Resource: &core_model.TypedResourceIdentifier{
-					ResourceIdentifier: core_model.TargetRefToResourceIdentifier(
-						d.GetMeta(),
-						common_api.TargetRef{
-							Kind: common_api.TargetRefKind(o.BackendRef.Kind),
-							Name: o.BackendRef.Name,
-							// todo(lobkovilya): add namespace to Dataplane_Networking_Outbound_BackendRef
-						}),
-					ResourceType: core_model.ResourceType(o.BackendRef.Kind),
+			// convert proto BackendRef to common_api.BackendRef
+			backendRef := common_api.BackendRef{
+				TargetRef: common_api.TargetRef{
+					Kind:   common_api.TargetRefKind(o.BackendRef.Kind),
+					Name:   o.BackendRef.Name,
+					Labels: o.BackendRef.Labels,
 				},
+				Port: pointer.To(o.BackendRef.Port),
 			}
-			if len(o.BackendRef.Labels) > 0 {
-				resIdentifier := resolver(core_model.ResourceType(o.BackendRef.Kind), o.BackendRef.Labels)
-				if resIdentifier == nil {
-					continue
-				}
-				outbound.Resource.ResourceIdentifier = *resIdentifier
-			}
-			outbound.Resource.SectionName = fmt.Sprintf("%d", o.BackendRef.Port)
-			outbounds = append(outbounds, outbound)
+			outbounds = append(outbounds, &xds_types.Outbound{
+				Address:  o.Address,
+				Port:     o.Port,
+				Resource: core_model.ResolveBackendRef(d.GetMeta(), backendRef, resolver).ResourceOrNil(),
+			})
 		} else {
 			outbounds = append(outbounds, &xds_types.Outbound{LegacyOutbound: o})
 		}
diff --git a/pkg/core/resources/apis/mesh/dataplane_validator.go b/pkg/core/resources/apis/mesh/dataplane_validator.go
index 4e2aad8fe..0f6ecff49 100644
--- a/pkg/core/resources/apis/mesh/dataplane_validator.go
+++ b/pkg/core/resources/apis/mesh/dataplane_validator.go
@@ -233,8 +233,8 @@ func validateOutbound(outbound *mesh_proto.Dataplane_Networking_Outbound) valida
 		if _, allowed := allowedKinds[outbound.BackendRef.Kind]; !allowed {
 			result.AddViolation("backendRef.kind", fmt.Sprintf("invalid value. Available values are: %s", strings.Join(maps.SortedKeys(allowedKinds), ",")))
 		}
-		if outbound.BackendRef.Name == "" {
-			result.AddViolation("backendRef.name", "cannot be empty")
+		if outbound.BackendRef.Name == "" && len(outbound.BackendRef.Labels) == 0 {
+			result.AddViolation("backendRef", "either 'name' or 'labels' should be specified")
 		}
 		// for MeshExternalService the port does not matter because it's taken from endpoints
 		if outbound.BackendRef.Kind != string(common_api.MeshExternalService) {
diff --git a/pkg/core/resources/apis/meshexternalservice/k8s/crd/kuma.io_meshexternalservices.yaml b/pkg/core/resources/apis/meshexternalservice/k8s/crd/kuma.io_meshexternalservices.yaml
index 4e9e9bd17..4350612fc 100644
--- a/pkg/core/resources/apis/meshexternalservice/k8s/crd/kuma.io_meshexternalservices.yaml
+++ b/pkg/core/resources/apis/meshexternalservice/k8s/crd/kuma.io_meshexternalservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
index 3ec32196a..7f6498375 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/helpers.go
@@ -26,16 +26,16 @@ func (t *MeshMultiZoneServiceResource) AllocateVIP(vip string) {
 	})
 }
 
-func (m *MeshMultiZoneServiceResource) FindPort(port uint32) (meshservice_api.Port, bool) {
+func (m *MeshMultiZoneServiceResource) FindPort(port uint32) (Port, bool) {
 	for _, p := range m.Spec.Ports {
 		if p.Port == port {
 			return p, true
 		}
 	}
-	return meshservice_api.Port{}, false
+	return Port{}, false
 }
 
-func (m *MeshMultiZoneServiceResource) FindPortByName(name string) (meshservice_api.Port, bool) {
+func (m *MeshMultiZoneServiceResource) FindPortByName(name string) (Port, bool) {
 	for _, p := range m.Spec.Ports {
 		if p.Name == name {
 			return p, true
@@ -44,7 +44,7 @@ func (m *MeshMultiZoneServiceResource) FindPortByName(name string) (meshservice_
 			return p, true
 		}
 	}
-	return meshservice_api.Port{}, false
+	return Port{}, false
 }
 
 func (m *MeshMultiZoneServiceResource) DestinationName(port uint32) string {
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go
index bcf1ad9de..b20b26330 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/meshmultizoneservice.go
@@ -2,7 +2,10 @@
 package v1alpha1
 
 import (
+	"fmt"
+
 	hostnamegenerator_api "github.com/kumahq/kuma/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1"
+	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
 )
 
@@ -15,7 +18,21 @@ type MeshMultiZoneService struct {
 	Selector Selector `json:"selector"`
 	// Ports is a list of ports from selected MeshServices
 	// +kubebuilder:validation:MinItems=1
-	Ports []meshservice_api.Port `json:"ports,omitempty"`
+	Ports []Port `json:"ports,omitempty"`
+}
+
+type Port struct {
+	Name string `json:"name,omitempty"`
+	Port uint32 `json:"port"`
+	// +kubebuilder:default=tcp
+	AppProtocol core_mesh.Protocol `json:"appProtocol,omitempty"`
+}
+
+func (p *Port) GetName() string {
+	if p.Name != "" {
+		return p.Name
+	}
+	return fmt.Sprintf("%d", p.Port)
 }
 
 type Selector struct {
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml
index e394de49e..2d326384d 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/schema.yaml
@@ -34,11 +34,6 @@ properties:
             port:
               format: int32
               type: integer
-            targetPort:
-              anyOf:
-                - type: integer
-                - type: string
-              x-kubernetes-int-or-string: true
           required:
             - port
           type: object
diff --git a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/zz_generated.deepcopy.go b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/zz_generated.deepcopy.go
index 09eda2487..0ac66c689 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1/zz_generated.deepcopy.go
@@ -5,8 +5,8 @@
 package v1alpha1
 
 import (
-	hostnamegeneratorapiv1alpha1 "github.com/kumahq/kuma/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1"
-	apiv1alpha1 "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
+	apiv1alpha1 "github.com/kumahq/kuma/pkg/core/resources/apis/hostnamegenerator/api/v1alpha1"
+	meshserviceapiv1alpha1 "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -30,7 +30,7 @@ func (in *MeshMultiZoneService) DeepCopyInto(out *MeshMultiZoneService) {
 	in.Selector.DeepCopyInto(&out.Selector)
 	if in.Ports != nil {
 		in, out := &in.Ports, &out.Ports
-		*out = make([]apiv1alpha1.Port, len(*in))
+		*out = make([]Port, len(*in))
 		copy(*out, *in)
 	}
 }
@@ -50,12 +50,12 @@ func (in *MeshMultiZoneServiceStatus) DeepCopyInto(out *MeshMultiZoneServiceStat
 	*out = *in
 	if in.Addresses != nil {
 		in, out := &in.Addresses, &out.Addresses
-		*out = make([]hostnamegeneratorapiv1alpha1.Address, len(*in))
+		*out = make([]apiv1alpha1.Address, len(*in))
 		copy(*out, *in)
 	}
 	if in.VIPs != nil {
 		in, out := &in.VIPs, &out.VIPs
-		*out = make([]apiv1alpha1.VIP, len(*in))
+		*out = make([]meshserviceapiv1alpha1.VIP, len(*in))
 		copy(*out, *in)
 	}
 	if in.MeshServices != nil {
@@ -65,7 +65,7 @@ func (in *MeshMultiZoneServiceStatus) DeepCopyInto(out *MeshMultiZoneServiceStat
 	}
 	if in.HostnameGenerators != nil {
 		in, out := &in.HostnameGenerators, &out.HostnameGenerators
-		*out = make([]hostnamegeneratorapiv1alpha1.HostnameGeneratorStatus, len(*in))
+		*out = make([]apiv1alpha1.HostnameGeneratorStatus, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -104,6 +104,21 @@ func (in *MeshServiceSelector) DeepCopy() *MeshServiceSelector {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Port) DeepCopyInto(out *Port) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Port.
+func (in *Port) DeepCopy() *Port {
+	if in == nil {
+		return nil
+	}
+	out := new(Port)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Selector) DeepCopyInto(out *Selector) {
 	*out = *in
diff --git a/pkg/core/resources/apis/meshmultizoneservice/k8s/crd/kuma.io_meshmultizoneservices.yaml b/pkg/core/resources/apis/meshmultizoneservice/k8s/crd/kuma.io_meshmultizoneservices.yaml
index 375548a37..7bb02ef79 100644
--- a/pkg/core/resources/apis/meshmultizoneservice/k8s/crd/kuma.io_meshmultizoneservices.yaml
+++ b/pkg/core/resources/apis/meshmultizoneservice/k8s/crd/kuma.io_meshmultizoneservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -54,11 +54,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
diff --git a/pkg/core/resources/apis/meshservice/k8s/crd/kuma.io_meshservices.yaml b/pkg/core/resources/apis/meshservice/k8s/crd/kuma.io_meshservices.yaml
index 729720632..69a129d40 100644
--- a/pkg/core/resources/apis/meshservice/k8s/crd/kuma.io_meshservices.yaml
+++ b/pkg/core/resources/apis/meshservice/k8s/crd/kuma.io_meshservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/core/resources/model/display_name.go b/pkg/core/resources/model/display_name.go
index c2a0871b2..b6e204870 100644
--- a/pkg/core/resources/model/display_name.go
+++ b/pkg/core/resources/model/display_name.go
@@ -17,12 +17,13 @@ func DisplayName(resType string) string {
 }
 
 func PluralType(resType string) string {
+	loweredResType := strings.ToLower(resType)
 	switch {
-	case strings.HasSuffix(resType, "ay"):
+	case strings.HasSuffix(loweredResType, "ay"):
 		return resType + "s"
-	case strings.HasSuffix(resType, "y"):
-		return strings.TrimSuffix(resType, "y") + "ies"
-	case strings.HasSuffix(resType, "s"), strings.HasSuffix(resType, "sh"), strings.HasSuffix(resType, "ch"):
+	case strings.HasSuffix(loweredResType, "y"):
+		return resType[:len(resType)-1] + "ies"
+	case strings.HasSuffix(loweredResType, "s"), strings.HasSuffix(loweredResType, "sh"), strings.HasSuffix(loweredResType, "ch"):
 		return resType + "es"
 	default:
 		return resType + "s"
diff --git a/pkg/core/resources/model/resource.go b/pkg/core/resources/model/resource.go
index c765e84cd..b59a01618 100644
--- a/pkg/core/resources/model/resource.go
+++ b/pkg/core/resources/model/resource.go
@@ -480,14 +480,18 @@ func ComputeLabels(r Resource, mode config_core.CpMode, isK8s bool, systemNamesp
 	}
 
 	if mode == config_core.Zone {
-		setIfNotExist(mesh_proto.ResourceOriginLabel, string(mesh_proto.ZoneResourceOrigin))
-		if labels[mesh_proto.ResourceOriginLabel] != string(mesh_proto.GlobalResourceOrigin) {
-			setIfNotExist(mesh_proto.ZoneTag, localZone)
-			env := mesh_proto.UniversalEnvironment
-			if isK8s {
-				env = mesh_proto.KubernetesEnvironment
+		// If resource can't be created on Zone (like Mesh), there is no point in adding
+		// 'kuma.io/zone', 'kuma.io/origin' and 'kuma.io/env' labels even if the zone is non-federated
+		if r.Descriptor().KDSFlags.Has(AllowedOnZoneSelector) {
+			setIfNotExist(mesh_proto.ResourceOriginLabel, string(mesh_proto.ZoneResourceOrigin))
+			if labels[mesh_proto.ResourceOriginLabel] != string(mesh_proto.GlobalResourceOrigin) {
+				setIfNotExist(mesh_proto.ZoneTag, localZone)
+				env := mesh_proto.UniversalEnvironment
+				if isK8s {
+					env = mesh_proto.KubernetesEnvironment
+				}
+				setIfNotExist(mesh_proto.EnvTag, env)
 			}
-			setIfNotExist(mesh_proto.EnvTag, env)
 		}
 	}
 
@@ -756,19 +760,20 @@ func ResourceToBackendRef(r Resource, resType ResourceType, port uint32) common_
 type LabelResourceIdentifierResolver func(ResourceType, map[string]string) *ResourceIdentifier
 
 func ResolveBackendRef(meta ResourceMeta, br common_api.BackendRef, resolver LabelResourceIdentifierResolver) *ResolvedBackendRef {
-	resolved := ResolvedBackendRef{LegacyBackendRef: &br}
-
 	switch {
 	case br.Kind == common_api.MeshService && br.ReferencesRealObject():
 	case br.Kind == common_api.MeshExternalService:
 	case br.Kind == common_api.MeshMultiZoneService:
 	default:
-		return &resolved
+		return &ResolvedBackendRef{Ref: pointer.To(LegacyBackendRef(br))}
 	}
 
-	resolved.Resource = &TypedResourceIdentifier{
-		ResourceIdentifier: TargetRefToResourceIdentifier(meta, br.TargetRef),
-		ResourceType:       ResourceType(br.Kind),
+	rr := RealResourceBackendRef{
+		Resource: &TypedResourceIdentifier{
+			ResourceIdentifier: TargetRefToResourceIdentifier(meta, br.TargetRef),
+			ResourceType:       ResourceType(br.Kind),
+		},
+		Weight: pointer.DerefOr(br.Weight, 1),
 	}
 
 	if len(br.Labels) > 0 {
@@ -776,14 +781,14 @@ func ResolveBackendRef(meta ResourceMeta, br common_api.BackendRef, resolver Lab
 		if ri == nil {
 			return nil
 		}
-		resolved.Resource.ResourceIdentifier = *ri
+		rr.Resource.ResourceIdentifier = *ri
 	}
 
 	if br.Port != nil {
-		resolved.Resource.SectionName = fmt.Sprintf("%d", *br.Port)
+		rr.Resource.SectionName = fmt.Sprintf("%d", *br.Port)
 	}
 
-	return &resolved
+	return &ResolvedBackendRef{Ref: &rr}
 }
 
 func (r ResourceIdentifier) String() string {
@@ -810,11 +815,62 @@ type TypedResourceIdentifier struct {
 	SectionName  string
 }
 
+type IsResolvedBackendRef interface {
+	isResolvedBackendRef()
+}
+
 type ResolvedBackendRef struct {
-	LegacyBackendRef *common_api.BackendRef
-	Resource         *TypedResourceIdentifier
+	// Ref is either LegacyBackendRef or RealResourceBackendRef
+	Ref IsResolvedBackendRef
 }
 
+func NewResolvedBackendRef(r IsResolvedBackendRef) *ResolvedBackendRef {
+	return &ResolvedBackendRef{Ref: r}
+}
+
+func (rbr *ResolvedBackendRef) ReferencesRealResource() bool {
+	if rbr == nil {
+		return false
+	}
+	if rbr.Ref == nil {
+		return false
+	}
+	_, ok := rbr.Ref.(*RealResourceBackendRef)
+	return ok
+}
+
+func (rbr *ResolvedBackendRef) ResourceOrNil() *TypedResourceIdentifier {
+	if rr := rbr.RealResourceBackendRef(); rr != nil {
+		return rr.Resource
+	}
+	return nil
+}
+
+func (rbr *ResolvedBackendRef) LegacyBackendRef() *LegacyBackendRef {
+	if lbr, ok := rbr.Ref.(*LegacyBackendRef); ok {
+		return lbr
+	}
+	return nil
+}
+
+func (rbr *ResolvedBackendRef) RealResourceBackendRef() *RealResourceBackendRef {
+	if rr, ok := rbr.Ref.(*RealResourceBackendRef); ok {
+		return rr
+	}
+	return nil
+}
+
+type LegacyBackendRef common_api.BackendRef
+
+func (lbr *LegacyBackendRef) isResolvedBackendRef() {}
+
+type RealResourceBackendRef struct {
+	Resource *TypedResourceIdentifier
+	Weight   uint
+}
+
+func (rbr *RealResourceBackendRef) isResolvedBackendRef() {}
+
 type NewTypedResourceIdentifierFunc func(id *TypedResourceIdentifier)
 
 func WithSectionName(sectionName string) NewTypedResourceIdentifierFunc {
diff --git a/pkg/core/xds/types/outbound.go b/pkg/core/xds/types/outbound.go
index 57c0d45c6..dd67ff5a8 100644
--- a/pkg/core/xds/types/outbound.go
+++ b/pkg/core/xds/types/outbound.go
@@ -21,6 +21,15 @@ func (o *Outbound) GetAddress() string {
 	return o.Address
 }
 
+// TagsOrNil returns tags if Outbound is defined using 'kuma.io/service' tag and so LegacyOutbound field is set.
+// Otherwise, it returns nil.
+func (o *Outbound) TagsOrNil() map[string]string {
+	if o.LegacyOutbound != nil {
+		return o.LegacyOutbound.Tags
+	}
+	return nil
+}
+
 func (o *Outbound) GetPort() uint32 {
 	if o.LegacyOutbound != nil {
 		return o.LegacyOutbound.Port
diff --git a/pkg/plugins/policies/core/xds/meshroute/clusters.go b/pkg/plugins/policies/core/xds/meshroute/clusters.go
index bc4f6aa0b..520de74ed 100644
--- a/pkg/plugins/policies/core/xds/meshroute/clusters.go
+++ b/pkg/plugins/policies/core/xds/meshroute/clusters.go
@@ -9,7 +9,6 @@ import (
 	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	core_rules "github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
 	util_maps "github.com/kumahq/kuma/pkg/util/maps"
 	"github.com/kumahq/kuma/pkg/util/pointer"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
@@ -50,7 +49,7 @@ func GenerateClusters(
 								meshCtx.Resource,
 								mesh_proto.ZoneEgressServiceName,
 								true,
-								SniForBackendRef(service.BackendRef(), meshCtx, systemNamespace),
+								SniForBackendRef(service.BackendRef().RealResourceBackendRef(), meshCtx, systemNamespace),
 							))
 					} else {
 						edsClusterBuilder.
@@ -103,9 +102,9 @@ func GenerateClusters(
 						}
 					}
 				} else {
-					if service.BackendRef().LegacyBackendRef.ReferencesRealObject() {
-						if service.BackendRef().LegacyBackendRef.Kind == common_api.MeshService {
-							if ms := meshCtx.MeshServiceByIdentifier[pointer.Deref(service.BackendRef().Resource).ResourceIdentifier]; ms != nil {
+					if realResourceRef := service.BackendRef().RealResourceBackendRef(); realResourceRef != nil {
+						if common_api.TargetRefKind(realResourceRef.Resource.ResourceType) == common_api.MeshService {
+							if ms := meshCtx.MeshServiceByIdentifier[pointer.Deref(realResourceRef.Resource).ResourceIdentifier]; ms != nil {
 								tlsReady = ms.Status.TLS.Status == meshservice_api.TLSReady
 							}
 						}
@@ -113,8 +112,8 @@ func GenerateClusters(
 							proxy.SecretsTracker,
 							meshCtx.Resource,
 							tlsReady,
-							SniForBackendRef(service.BackendRef(), meshCtx, systemNamespace),
-							ServiceTagIdentities(service.BackendRef(), meshCtx),
+							SniForBackendRef(realResourceRef, meshCtx, systemNamespace),
+							ServiceTagIdentities(realResourceRef, meshCtx),
 						))
 					} else {
 						edsClusterBuilder.Configure(envoy_clusters.ClientSideMTLS(
@@ -133,7 +132,7 @@ func GenerateClusters(
 				Name:           clusterName,
 				Origin:         generator.OriginOutbound,
 				Resource:       edsCluster,
-				ResourceOrigin: createResourceOrigin(service.BackendRef(), meshCtx),
+				ResourceOrigin: service.BackendRef().ResourceOrNil(),
 				Protocol:       protocol,
 			})
 		}
@@ -142,67 +141,44 @@ func GenerateClusters(
 	return resources, nil
 }
 
-func createResourceOrigin(
-	ref core_model.ResolvedBackendRef,
-	meshCtx xds_context.MeshContext,
-) *core_model.TypedResourceIdentifier {
-	switch {
-	case ref.LegacyBackendRef.Kind == common_api.MeshService && ref.LegacyBackendRef.ReferencesRealObject():
-		ms := meshCtx.MeshServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier]
-		port, ok := ms.FindPort(pointer.Deref(ref.LegacyBackendRef.Port))
-		if ok {
-			return pointer.To(core_rules.UniqueKey(ms, port.Name))
-		}
-		return pointer.To(core_rules.UniqueKey(ms, ""))
-	case ref.LegacyBackendRef.Kind == common_api.MeshExternalService:
-		mes := meshCtx.MeshExternalServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier]
-		return pointer.To(core_rules.UniqueKey(mes, ""))
-	case ref.LegacyBackendRef.Kind == common_api.MeshMultiZoneService:
-		mzs := meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier]
-		port, ok := mzs.FindPort(pointer.Deref(ref.LegacyBackendRef.Port))
-		if ok {
-			return pointer.To(core_rules.UniqueKey(mzs, port.Name))
-		}
-		return pointer.To(core_rules.UniqueKey(mzs, ""))
-	}
-	return nil
-}
-
 func SniForBackendRef(
-	backendRef core_model.ResolvedBackendRef,
+	backendRef *core_model.RealResourceBackendRef,
 	meshCtx xds_context.MeshContext,
 	systemNamespace string,
 ) string {
 	var resource core_model.Resource
 	var name string
-	switch backendRef.LegacyBackendRef.Kind {
+	var port uint32
+	switch common_api.TargetRefKind(backendRef.Resource.ResourceType) {
 	case common_api.MeshService:
 		ms := meshCtx.MeshServiceByIdentifier[pointer.Deref(backendRef.Resource).ResourceIdentifier]
 		resource = ms
 		name = ms.SNIName(systemNamespace)
+		if p, ok := ms.FindPortByName(backendRef.Resource.SectionName); ok {
+			port = p.Port
+		}
 	case common_api.MeshExternalService:
 		mes := meshCtx.MeshExternalServiceByIdentifier[pointer.Deref(backendRef.Resource).ResourceIdentifier]
 		resource = mes
 		name = core_model.GetDisplayName(resource.GetMeta())
+		port = uint32(mes.Spec.Match.Port)
 	case common_api.MeshMultiZoneService:
-		resource = meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(backendRef.Resource).ResourceIdentifier]
+		mzms := meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(backendRef.Resource).ResourceIdentifier]
+		resource = mzms
 		name = core_model.GetDisplayName(resource.GetMeta())
+		if p, ok := mzms.FindPortByName(backendRef.Resource.SectionName); ok {
+			port = p.Port
+		}
 	}
-	return tls.SNIForResource(
-		name,
-		resource.GetMeta().GetMesh(),
-		resource.Descriptor().Name,
-		pointer.Deref(backendRef.LegacyBackendRef.Port),
-		nil,
-	)
+	return tls.SNIForResource(name, resource.GetMeta().GetMesh(), resource.Descriptor().Name, port, nil)
 }
 
 func ServiceTagIdentities(
-	backendRef core_model.ResolvedBackendRef,
+	backendRef *core_model.RealResourceBackendRef,
 	meshCtx xds_context.MeshContext,
 ) []string {
 	var result []string
-	switch backendRef.LegacyBackendRef.Kind {
+	switch common_api.TargetRefKind(backendRef.Resource.ResourceType) {
 	case common_api.MeshService:
 		ms := meshCtx.MeshServiceByIdentifier[pointer.Deref(backendRef.Resource).ResourceIdentifier]
 		for _, identity := range ms.Spec.Identities {
diff --git a/pkg/plugins/policies/core/xds/meshroute/gateway/gateway.go b/pkg/plugins/policies/core/xds/meshroute/gateway/gateway.go
index 71114e6da..95cf28d84 100644
--- a/pkg/plugins/policies/core/xds/meshroute/gateway/gateway.go
+++ b/pkg/plugins/policies/core/xds/meshroute/gateway/gateway.go
@@ -30,7 +30,7 @@ type listenersHostnames struct {
 }
 
 type MapGatewayRulesToHosts func(
-	resources xds_context.ResourceMap,
+	meshLocalResources xds_context.ResourceMap,
 	rules rules.GatewayRules,
 	address string,
 	port uint32,
diff --git a/pkg/plugins/policies/core/xds/meshroute/listeners.go b/pkg/plugins/policies/core/xds/meshroute/listeners.go
index c22b6bea8..9aa072c1b 100644
--- a/pkg/plugins/policies/core/xds/meshroute/listeners.go
+++ b/pkg/plugins/policies/core/xds/meshroute/listeners.go
@@ -58,12 +58,27 @@ func MakeHTTPSplit(
 }
 
 type DestinationService struct {
-	OutboundInterface mesh_proto.OutboundInterface
-	Resource          *core_model.TypedResourceIdentifier
-	Tags              envoy_tags.Tags
-	Protocol          core_mesh.Protocol
-	ServiceName       string
-	BackendRef        common_api.BackendRef
+	Outbound    *xds_types.Outbound
+	Protocol    core_mesh.Protocol
+	ServiceName string
+}
+
+func (ds *DestinationService) DefaultBackendRef() *core_model.ResolvedBackendRef {
+	if ds.Outbound.Resource != nil {
+		return core_model.NewResolvedBackendRef(&core_model.RealResourceBackendRef{
+			Resource: ds.Outbound.Resource,
+			Weight:   100,
+		})
+	} else {
+		return core_model.NewResolvedBackendRef(&core_model.LegacyBackendRef{
+			TargetRef: common_api.TargetRef{
+				Kind: common_api.MeshService,
+				Name: ds.Outbound.LegacyOutbound.GetService(),
+				Tags: ds.Outbound.LegacyOutbound.GetTags(),
+			},
+			Weight: pointer.To(uint(100)),
+		})
+	}
 }
 
 func CollectServices(
@@ -111,21 +126,9 @@ func collectMeshService(
 		protocol = port.AppProtocol
 	}
 	return &DestinationService{
-		OutboundInterface: mesh_proto.OutboundInterface{
-			DataplaneIP:   outbound.GetAddress(),
-			DataplanePort: outbound.GetPort(),
-		},
-		Tags:        outbound.LegacyOutbound.GetTags(),
-		Resource:    outbound.Resource,
+		Outbound:    outbound,
 		Protocol:    protocol,
 		ServiceName: ms.DestinationName(port.Port),
-		BackendRef: common_api.BackendRef{
-			TargetRef: common_api.TargetRef{
-				Kind: common_api.MeshService,
-				Name: ms.GetMeta().GetName(),
-			},
-			Port: &port.Port,
-		},
 	}
 }
 
@@ -142,21 +145,9 @@ func collectMeshExternalService(
 		protocol = mes.Spec.Match.Protocol
 	}
 	return &DestinationService{
-		Protocol: protocol,
-		OutboundInterface: mesh_proto.OutboundInterface{
-			DataplaneIP:   outbound.GetAddress(),
-			DataplanePort: outbound.GetPort(),
-		},
-		Tags:        outbound.LegacyOutbound.GetTags(),
-		Resource:    outbound.Resource,
+		Outbound:    outbound,
+		Protocol:    protocol,
 		ServiceName: mes.DestinationName(uint32(mes.Spec.Match.Port)),
-		BackendRef: common_api.BackendRef{
-			TargetRef: common_api.TargetRef{
-				Kind: common_api.MeshExternalService,
-				Name: mes.GetMeta().GetName(),
-			},
-			Port: pointer.To(uint32(mes.Spec.Match.Port)),
-		},
 	}
 }
 
@@ -177,21 +168,9 @@ func collectMeshMultiZoneService(
 		protocol = port.AppProtocol
 	}
 	return &DestinationService{
-		OutboundInterface: mesh_proto.OutboundInterface{
-			DataplaneIP:   outbound.GetAddress(),
-			DataplanePort: outbound.GetPort(),
-		},
-		Tags:        outbound.LegacyOutbound.GetTags(),
-		Resource:    outbound.Resource,
+		Outbound:    outbound,
 		Protocol:    protocol,
 		ServiceName: svc.DestinationName(port.Port),
-		BackendRef: common_api.BackendRef{
-			TargetRef: common_api.TargetRef{
-				Kind: common_api.MeshMultiZoneService,
-				Name: svc.GetMeta().GetName(),
-			},
-			Port: &port.Port,
-		},
 	}
 }
 
@@ -201,70 +180,52 @@ func collectServiceTagService(
 ) *DestinationService {
 	serviceName := outbound.LegacyOutbound.GetService()
 	return &DestinationService{
-		OutboundInterface: mesh_proto.OutboundInterface{
-			DataplaneIP:   outbound.GetAddress(),
-			DataplanePort: outbound.GetPort(),
-		},
-		Tags:        outbound.LegacyOutbound.GetTags(),
-		Resource:    outbound.Resource,
+		Outbound:    outbound,
 		Protocol:    meshCtx.GetServiceProtocol(serviceName),
 		ServiceName: serviceName,
-		BackendRef: common_api.BackendRef{
-			TargetRef: common_api.TargetRef{
-				Kind: common_api.MeshService,
-				Name: serviceName,
-				Tags: outbound.LegacyOutbound.GetTags(),
-			},
-		},
 	}
 }
 
-func GetServiceAndProtocolFromRef(
+func GetServiceProtocolPortFromRef(
 	meshCtx xds_context.MeshContext,
-	ref core_model.ResolvedBackendRef,
-) (string, core_mesh.Protocol, bool) {
-	switch {
-	case ref.LegacyBackendRef.Kind == common_api.MeshExternalService:
+	ref *core_model.RealResourceBackendRef,
+) (string, core_mesh.Protocol, uint32, bool) {
+	switch common_api.TargetRefKind(ref.Resource.ResourceType) {
+	case common_api.MeshExternalService:
 		mes, ok := meshCtx.MeshExternalServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier]
 		if !ok {
-			return "", "", false
-		}
-		port := pointer.Deref(ref.LegacyBackendRef.Port)
-		// if backendRef has no port, get the one from MeshExternalService since match allows only 1 port
-		if port == 0 {
-			port = uint32(mes.Spec.Match.Port)
+			return "", "", 0, false
 		}
+		port := uint32(mes.Spec.Match.Port)
 		service := mes.DestinationName(port)
 		protocol := meshCtx.GetServiceProtocol(service)
-		return service, protocol, true
-	case ref.LegacyBackendRef.Kind == common_api.MeshMultiZoneService:
+		return service, protocol, port, true
+	case common_api.MeshMultiZoneService:
 		ms, ok := meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier]
 		if !ok {
-			return "", "", false
+			return "", "", 0, false
 		}
-		port, ok := ms.FindPort(*ref.LegacyBackendRef.Port)
+		port, ok := ms.FindPortByName(ref.Resource.SectionName)
 		if !ok {
-			return "", "", false
+			return "", "", 0, false
 		}
-		service := ms.DestinationName(*ref.LegacyBackendRef.Port)
+		service := ms.DestinationName(port.Port)
 		protocol := port.AppProtocol
-		return service, protocol, true
-	case ref.LegacyBackendRef.Kind == common_api.MeshService && ref.LegacyBackendRef.ReferencesRealObject():
+		return service, protocol, port.Port, true
+	case common_api.MeshService:
 		ms, ok := meshCtx.MeshServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier]
 		if !ok {
-			return "", "", false
+			return "", "", 0, false
 		}
-		port, ok := ms.FindPort(*ref.LegacyBackendRef.Port)
+		port, ok := ms.FindPortByName(ref.Resource.SectionName)
 		if !ok {
-			return "", "", false
+			return "", "", 0, false
 		}
-		service := ms.DestinationName(*ref.LegacyBackendRef.Port)
+		service := ms.DestinationName(port.Port)
 		protocol := port.AppProtocol // todo(jakubdyszkiewicz): do we need to default to TCP or will this be done by MeshService defaulter?
-		return service, protocol, true
+		return service, protocol, port.Port, true
 	default:
-		service := ref.LegacyBackendRef.Name
-		protocol := meshCtx.GetServiceProtocol(service)
-		return service, protocol, true
+		return "", "", 0, false
 	}
 }
 
@@ -278,86 +239,141 @@ func makeSplit(
 	var split []envoy_common.Split
 
 	for _, ref := range refs {
-		switch ref.LegacyBackendRef.Kind {
-		case common_api.MeshService, common_api.MeshExternalService, common_api.MeshServiceSubset, common_api.MeshMultiZoneService:
-		default:
-			continue
+		if ref.ReferencesRealResource() {
+			if s := handleRealResources(protocols, clusterCache, servicesAcc, ref.RealResourceBackendRef(), meshCtx); s != nil {
+				split = append(split, s)
+			}
+		} else {
+			if s := handleLegacyBackendRef(protocols, clusterCache, servicesAcc, ref.LegacyBackendRef(), meshCtx); s != nil {
+				split = append(split, s)
+			}
 		}
+	}
 
-		var service string
-		var protocol core_mesh.Protocol
-		if pointer.DerefOr(ref.LegacyBackendRef.Weight, 1) == 0 {
-			continue
-		}
-		service, protocol, ok := GetServiceAndProtocolFromRef(meshCtx, ref)
-		if !ok {
-			continue
-		}
-		if _, ok := protocols[protocol]; !ok {
-			return nil
-		}
+	return split
+}
 
-		var clusterName string
-		switch ref.LegacyBackendRef.Kind {
-		case common_api.MeshExternalService:
-			clusterName = meshCtx.MeshExternalServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(pointer.Deref(ref.LegacyBackendRef.Port))
-		case common_api.MeshMultiZoneService:
-			clusterName = meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(*ref.LegacyBackendRef.Port)
-		case common_api.MeshService:
-			if ref.LegacyBackendRef.Port != nil {
-				clusterName = meshCtx.MeshServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(*ref.LegacyBackendRef.Port)
-				break
-			}
-			fallthrough
-		default:
-			clusterName, _ = envoy_tags.Tags(ref.LegacyBackendRef.Tags).
-				WithTags(mesh_proto.ServiceTag, service).
-				DestinationClusterName(nil)
-		}
+func handleRealResources(
+	protocols map[core_mesh.Protocol]struct{},
+	clusterCache map[common_api.BackendRefHash]string,
+	servicesAcc envoy_common.ServicesAccumulator,
+	ref *core_model.RealResourceBackendRef,
+	meshCtx xds_context.MeshContext,
+) envoy_common.Split {
+	if ref.Weight == 0 {
+		return nil
+	}
 
-		// The mesh tag is present here if this destination is generated
-		// from a cross-mesh MeshGateway listener virtual outbound.
-		// It is not part of the service tags.
-		if mesh, ok := ref.LegacyBackendRef.Tags[mesh_proto.MeshTag]; ok {
-			// The name should be distinct to the service & mesh combination
-			clusterName = fmt.Sprintf("%s_%s", clusterName, mesh)
-		}
+	service, protocol, port, ok := GetServiceProtocolPortFromRef(meshCtx, ref)
+	if !ok {
+		return nil
+	}
+	if _, ok := protocols[protocol]; !ok {
+		return nil
+	}
 
-		isExternalService := meshCtx.IsExternalService(service)
-		refHash := ref.LegacyBackendRef.Hash()
-
-		if existingClusterName, ok := clusterCache[refHash]; ok {
-			// cluster already exists, so adding only split
-			split = append(split, plugins_xds.NewSplitBuilder().
-				WithClusterName(existingClusterName).
-				WithWeight(uint32(pointer.DerefOr(ref.LegacyBackendRef.Weight, 1))).
-				WithExternalService(isExternalService).
-				Build())
-			continue
-		}
+	var clusterName string
+	var isExternalService bool
 
-		clusterCache[refHash] = clusterName
+	switch common_api.TargetRefKind(ref.Resource.ResourceType) {
+	case common_api.MeshExternalService:
+		clusterName = meshCtx.MeshExternalServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(port)
+		isExternalService = true
+	case common_api.MeshMultiZoneService:
+		clusterName = meshCtx.MeshMultiZoneServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(port)
+	case common_api.MeshService:
+		clusterName = meshCtx.MeshServiceByIdentifier[pointer.Deref(ref.Resource).ResourceIdentifier].DestinationName(port)
+	}
+
+	// todo(lobkovilya): instead of computing hash we should use ResourceIdentifier as a key in clusterCache (or maybe we don't need clusterCache)
+	refHash := common_api.BackendRefHash(ref.Resource.String())
 
-		split = append(split, plugins_xds.NewSplitBuilder().
+	splitTo := func(clusterName string) envoy_common.Split {
+		return plugins_xds.NewSplitBuilder().
 			WithClusterName(clusterName).
-			WithWeight(uint32(pointer.DerefOr(ref.LegacyBackendRef.Weight, 1))).
+			WithWeight(uint32(ref.Weight)).
 			WithExternalService(isExternalService).
-			Build())
-
-		clusterBuilder := plugins_xds.NewClusterBuilder().
-			WithService(service).
-			WithName(clusterName).
-			WithTags(envoy_tags.Tags(ref.LegacyBackendRef.Tags).
-				WithTags(mesh_proto.ServiceTag, ref.LegacyBackendRef.Name).
-				WithoutTags(mesh_proto.MeshTag)).
-			WithExternalService(isExternalService)
-
-		if mesh, ok := ref.LegacyBackendRef.Tags[mesh_proto.MeshTag]; ok {
-			clusterBuilder.WithMesh(mesh)
-		}
+			Build()
+	}
+
+	if existingClusterName, ok := clusterCache[refHash]; ok {
+		// cluster already exists, so adding only split
+		return splitTo(existingClusterName)
+	}
+
+	clusterCache[refHash] = clusterName
+
+	clusterBuilder := plugins_xds.NewClusterBuilder().
+		WithService(service).
+		WithName(clusterName).
+		WithTags(envoy_tags.Tags{}.WithTags(mesh_proto.ServiceTag, service)). // todo(lobkovilya): do we need tags for real resource cluster?
+		WithExternalService(isExternalService)
+
+	servicesAcc.AddBackendRef(core_model.NewResolvedBackendRef(ref), clusterBuilder.Build())
+
+	return splitTo(clusterName)
+}
+
+func handleLegacyBackendRef(
+	protocols map[core_mesh.Protocol]struct{},
+	clusterCache map[common_api.BackendRefHash]string,
+	servicesAcc envoy_common.ServicesAccumulator,
+	ref *core_model.LegacyBackendRef,
+	meshCtx xds_context.MeshContext,
+) envoy_common.Split {
+	if ref.Weight != nil && *ref.Weight == 0 {
+		return nil
+	}
+
+	service := ref.Name
+	protocol := meshCtx.GetServiceProtocol(service)
+	if _, ok := protocols[protocol]; !ok {
+		return nil
+	}
+	clusterName, _ := envoy_tags.Tags(ref.Tags).
+		WithTags(mesh_proto.ServiceTag, service).
+		DestinationClusterName(nil)
+
+	// The mesh tag is present here if this destination is generated
+	// from a cross-mesh MeshGateway listener virtual outbound.
+	// It is not part of the service tags.
+	if mesh, ok := ref.Tags[mesh_proto.MeshTag]; ok {
+		// The name should be distinct to the service & mesh combination
+		clusterName = fmt.Sprintf("%s_%s", clusterName, mesh)
+	}
+
+	isExternalService := meshCtx.IsExternalService(service)
+	refHash := common_api.BackendRef(*ref).Hash()
+
+	if existingClusterName, ok := clusterCache[refHash]; ok {
+		// cluster already exists, so adding only split
+		return plugins_xds.NewSplitBuilder().
+			WithClusterName(existingClusterName).
+			WithWeight(uint32(pointer.DerefOr(ref.Weight, 1))).
+			WithExternalService(isExternalService).
+			Build()
+	}
+
+	clusterCache[refHash] = clusterName
+
+	split := plugins_xds.NewSplitBuilder().
+		WithClusterName(clusterName).
+		WithWeight(uint32(pointer.DerefOr(ref.Weight, 1))).
+		WithExternalService(isExternalService).
+		Build()
+
+	clusterBuilder := plugins_xds.NewClusterBuilder().
+		WithService(service).
+		WithName(clusterName).
+		WithTags(envoy_tags.Tags(ref.Tags).
+			WithTags(mesh_proto.ServiceTag, ref.Name).
+			WithoutTags(mesh_proto.MeshTag)).
+		WithExternalService(isExternalService)
 
-		servicesAcc.AddBackendRef(ref, clusterBuilder.Build())
+	if mesh, ok := ref.Tags[mesh_proto.MeshTag]; ok {
+		clusterBuilder.WithMesh(mesh)
 	}
 
+	servicesAcc.AddBackendRef(core_model.NewResolvedBackendRef(ref), clusterBuilder.Build())
 	return split
 }
diff --git a/pkg/plugins/policies/donothingpolicy/k8s/crd/kuma.io_donothingpolicies.yaml b/pkg/plugins/policies/donothingpolicy/k8s/crd/kuma.io_donothingpolicies.yaml
index bdaa2e422..1213030f7 100644
--- a/pkg/plugins/policies/donothingpolicy/k8s/crd/kuma.io_donothingpolicies.yaml
+++ b/pkg/plugins/policies/donothingpolicy/k8s/crd/kuma.io_donothingpolicies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: donothingpolicies.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshaccesslog/k8s/crd/kuma.io_meshaccesslogs.yaml b/pkg/plugins/policies/meshaccesslog/k8s/crd/kuma.io_meshaccesslogs.yaml
index 456a3ccff..16191c5ba 100644
--- a/pkg/plugins/policies/meshaccesslog/k8s/crd/kuma.io_meshaccesslogs.yaml
+++ b/pkg/plugins/policies/meshaccesslog/k8s/crd/kuma.io_meshaccesslogs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshcircuitbreaker/k8s/crd/kuma.io_meshcircuitbreakers.yaml b/pkg/plugins/policies/meshcircuitbreaker/k8s/crd/kuma.io_meshcircuitbreakers.yaml
index 6657095c6..bea1fb597 100644
--- a/pkg/plugins/policies/meshcircuitbreaker/k8s/crd/kuma.io_meshcircuitbreakers.yaml
+++ b/pkg/plugins/policies/meshcircuitbreaker/k8s/crd/kuma.io_meshcircuitbreakers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshfaultinjection/k8s/crd/kuma.io_meshfaultinjections.yaml b/pkg/plugins/policies/meshfaultinjection/k8s/crd/kuma.io_meshfaultinjections.yaml
index 901a4adc3..538675b6e 100644
--- a/pkg/plugins/policies/meshfaultinjection/k8s/crd/kuma.io_meshfaultinjections.yaml
+++ b/pkg/plugins/policies/meshfaultinjection/k8s/crd/kuma.io_meshfaultinjections.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshhealthcheck/k8s/crd/kuma.io_meshhealthchecks.yaml b/pkg/plugins/policies/meshhealthcheck/k8s/crd/kuma.io_meshhealthchecks.yaml
index f129d6bfb..d1a3a49f9 100644
--- a/pkg/plugins/policies/meshhealthcheck/k8s/crd/kuma.io_meshhealthchecks.yaml
+++ b/pkg/plugins/policies/meshhealthcheck/k8s/crd/kuma.io_meshhealthchecks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshhttproute/api/v1alpha1/compare.go b/pkg/plugins/policies/meshhttproute/api/v1alpha1/compare.go
index 8ef291fee..1f40ed2cd 100644
--- a/pkg/plugins/policies/meshhttproute/api/v1alpha1/compare.go
+++ b/pkg/plugins/policies/meshhttproute/api/v1alpha1/compare.go
@@ -132,8 +132,6 @@ func SortRules(
 				if resolved := core_model.ResolveBackendRef(origin, br, labelResolver); resolved != nil {
 					backendRefs = append(backendRefs, *resolved)
 				}
-			} else {
-				backendRefs = append(backendRefs, core_model.ResolvedBackendRef{LegacyBackendRef: &br})
 			}
 		}
 		out = append(out, Route{
diff --git a/pkg/plugins/policies/meshhttproute/k8s/crd/kuma.io_meshhttproutes.yaml b/pkg/plugins/policies/meshhttproute/k8s/crd/kuma.io_meshhttproutes.yaml
index d72bf37b4..14f8974b1 100644
--- a/pkg/plugins/policies/meshhttproute/k8s/crd/kuma.io_meshhttproutes.yaml
+++ b/pkg/plugins/policies/meshhttproute/k8s/crd/kuma.io_meshhttproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/gateway_routes.go b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/gateway_routes.go
index ec8644406..2632c5b79 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/gateway_routes.go
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/gateway_routes.go
@@ -233,10 +233,14 @@ func makeHttpRouteEntry(
 		if origin, ok := backendRefToOrigin[api.HashMatches(rule.Matches)]; ok {
 			ref = model.ResolveBackendRef(origin, b, resolver)
 		}
-		dest, ok := tags.FromTargetRef(b.TargetRef)
-		if !ok {
-			// This should be caught by validation
-			continue
+		var dest map[string]string
+		if ref == nil || ref.ResourceOrNil() == nil {
+			var ok bool
+			dest, ok = tags.FromLegacyTargetRef(b.TargetRef)
+			if !ok {
+				// This should be caught by validation
+				continue
+			}
 		}
 		target := route.Destination{
 			Destination:   dest,
@@ -276,7 +280,7 @@ func makeHttpRouteEntry(
 			if err != nil {
 				continue
 			}
-			tags, ok := tags.FromTargetRef(m.BackendRef.TargetRef)
+			tags, ok := tags.FromLegacyTargetRef(m.BackendRef.TargetRef)
 			if !ok {
 				continue
 			}
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go
index 070c2f7ab..54e1b04a1 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go
@@ -32,10 +32,9 @@ func generateFromService(
 	rules rules.ToRules,
 	svc meshroute_xds.DestinationService,
 ) (*core_xds.ResourceSet, error) {
-	tags := svc.BackendRef.Tags
-	listenerBuilder := envoy_listeners.NewOutboundListenerBuilder(proxy.APIVersion, svc.OutboundInterface.DataplaneIP, svc.OutboundInterface.DataplanePort, core_xds.SocketAddressProtocolTCP).
+	listenerBuilder := envoy_listeners.NewOutboundListenerBuilder(proxy.APIVersion, svc.Outbound.GetAddress(), svc.Outbound.GetPort(), core_xds.SocketAddressProtocolTCP).
 		Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
-		Configure(envoy_listeners.TagsMetadata(envoy_tags.Tags(tags).WithoutTags(mesh_proto.MeshTag)))
+		Configure(envoy_listeners.TagsMetadata(envoy_tags.Tags(svc.Outbound.TagsOrNil()).WithoutTags(mesh_proto.MeshTag)))
 
 	resourceName := svc.ServiceName
 
@@ -57,7 +56,7 @@ func generateFromService(
 				// we need to create a split for the mirror backend
 				_ = meshroute_xds.MakeHTTPSplit(
 					clusterCache, servicesAcc,
-					[]core_model.ResolvedBackendRef{{LegacyBackendRef: &filter.RequestMirror.BackendRef}},
+					[]core_model.ResolvedBackendRef{*core_model.NewResolvedBackendRef(pointer.To(core_model.LegacyBackendRef(filter.RequestMirror.BackendRef)))},
 					meshCtx,
 				)
 			}
@@ -76,7 +75,7 @@ func generateFromService(
 	}
 
 	var outboundRouteName string
-	if svc.BackendRef.Kind == common_api.MeshExternalService {
+	if svc.Outbound.Resource != nil && svc.Outbound.Resource.ResourceType == core_model.ResourceType(common_api.MeshExternalService) {
 		outboundRouteName = resourceName
 	}
 	outboundRouteConfigurer := &xds.HttpOutboundRouteConfigurer{
@@ -105,7 +104,7 @@ func generateFromService(
 			Name:           listener.GetName(),
 			Origin:         generator.OriginOutbound,
 			Resource:       listener,
-			ResourceOrigin: svc.Resource,
+			ResourceOrigin: svc.Outbound.Resource,
 			Protocol:       svc.Protocol,
 		})
 
@@ -157,8 +156,8 @@ func ComputeHTTPRouteConf(toRules rules.ToRules, svc meshroute_xds.DestinationSe
 		}
 	}
 	// check if there is configuration for real MeshService and prioritize it
-	if svc.Resource != nil {
-		resourceConf := toRules.ResourceRules.Compute(*svc.Resource, meshCtx.Resources)
+	if svc.Outbound.Resource != nil {
+		resourceConf := toRules.ResourceRules.Compute(*svc.Outbound.Resource, meshCtx.Resources)
 		if resourceConf != nil && len(resourceConf.Conf) != 0 {
 			conf = pointer.To(resourceConf.Conf[0].(api.PolicyDefault))
 			for hash := range resourceConf.BackendRefOriginIndex {
@@ -219,12 +218,9 @@ func prepareRoutes(toRules rules.ToRules, svc meshroute_xds.DestinationService,
 		}
 
 		if len(route.BackendRefs) == 0 {
-			defaultBackend := svc.BackendRef
-			defaultBackend.Weight = pointer.To(uint(100))
-			route.BackendRefs = []core_model.ResolvedBackendRef{{
-				LegacyBackendRef: &defaultBackend,
-				Resource:         svc.Resource,
-			}}
+			route.BackendRefs = []core_model.ResolvedBackendRef{
+				*svc.DefaultBackendRef(),
+			}
 		}
 	}
 
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/k8s/crd/kuma.io_meshloadbalancingstrategies.yaml b/pkg/plugins/policies/meshloadbalancingstrategy/k8s/crd/kuma.io_meshloadbalancingstrategies.yaml
index f35025916..8fe3d6634 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/k8s/crd/kuma.io_meshloadbalancingstrategies.yaml
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/k8s/crd/kuma.io_meshloadbalancingstrategies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshmetric/k8s/crd/kuma.io_meshmetrics.yaml b/pkg/plugins/policies/meshmetric/k8s/crd/kuma.io_meshmetrics.yaml
index 96eb71027..d244c2e04 100644
--- a/pkg/plugins/policies/meshmetric/k8s/crd/kuma.io_meshmetrics.yaml
+++ b/pkg/plugins/policies/meshmetric/k8s/crd/kuma.io_meshmetrics.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshpassthrough/k8s/crd/kuma.io_meshpassthroughs.yaml b/pkg/plugins/policies/meshpassthrough/k8s/crd/kuma.io_meshpassthroughs.yaml
index 326c39a03..9f5822b55 100644
--- a/pkg/plugins/policies/meshpassthrough/k8s/crd/kuma.io_meshpassthroughs.yaml
+++ b/pkg/plugins/policies/meshpassthrough/k8s/crd/kuma.io_meshpassthroughs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshproxypatch/k8s/crd/kuma.io_meshproxypatches.yaml b/pkg/plugins/policies/meshproxypatch/k8s/crd/kuma.io_meshproxypatches.yaml
index 02fa83166..bf6342d25 100644
--- a/pkg/plugins/policies/meshproxypatch/k8s/crd/kuma.io_meshproxypatches.yaml
+++ b/pkg/plugins/policies/meshproxypatch/k8s/crd/kuma.io_meshproxypatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshratelimit/k8s/crd/kuma.io_meshratelimits.yaml b/pkg/plugins/policies/meshratelimit/k8s/crd/kuma.io_meshratelimits.yaml
index ef301637f..52424a985 100644
--- a/pkg/plugins/policies/meshratelimit/k8s/crd/kuma.io_meshratelimits.yaml
+++ b/pkg/plugins/policies/meshratelimit/k8s/crd/kuma.io_meshratelimits.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshretry/k8s/crd/kuma.io_meshretries.yaml b/pkg/plugins/policies/meshretry/k8s/crd/kuma.io_meshretries.yaml
index 66befddcf..f4337a105 100644
--- a/pkg/plugins/policies/meshretry/k8s/crd/kuma.io_meshretries.yaml
+++ b/pkg/plugins/policies/meshretry/k8s/crd/kuma.io_meshretries.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshtcproute/k8s/crd/kuma.io_meshtcproutes.yaml b/pkg/plugins/policies/meshtcproute/k8s/crd/kuma.io_meshtcproutes.yaml
index 714cd6b73..9d1d0ad7e 100644
--- a/pkg/plugins/policies/meshtcproute/k8s/crd/kuma.io_meshtcproutes.yaml
+++ b/pkg/plugins/policies/meshtcproute/k8s/crd/kuma.io_meshtcproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/gateway.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/gateway.go
index a8317b832..3bd94a723 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/gateway.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/gateway.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/pkg/errors"
 
+	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
 	api "github.com/kumahq/kuma/pkg/plugins/policies/meshtcproute/api/v1alpha1"
@@ -67,7 +69,11 @@ func generateGatewayClusters(
 	return resources, nil
 }
 
-func generateEnvoyRouteEntries(host plugin_gateway.GatewayHost, toRules rules.Rules) []route.Entry {
+func generateEnvoyRouteEntries(
+	host plugin_gateway.GatewayHost,
+	toRules rules.Rules,
+	resolver model.LabelResourceIdentifierResolver,
+) []route.Entry {
 	var entries []route.Entry
 
 	for _, rule := range toRules {
@@ -76,25 +82,49 @@ func generateEnvoyRouteEntries(host plugin_gateway.GatewayHost, toRules rules.Ru
 			names = append(names, orig.GetName())
 		}
 		slices.Sort(names)
-		entries = append(entries, makeTcpRouteEntry(strings.Join(names, "_"), rule.Conf.(api.Rule)))
+
+		backendRefOrigin := map[common_api.MatchesHash]model.ResourceMeta{}
+		for hash := range rule.BackendRefOriginIndex {
+			if origin, ok := rule.GetBackendRefOrigin(rules.EmptyMatches); ok {
+				backendRefOrigin[hash] = origin
+			}
+		}
+		entries = append(
+			entries,
+			makeTcpRouteEntry(strings.Join(names, "_"), rule.Conf.(api.Rule), backendRefOrigin, resolver),
+		)
 	}
 
 	return plugin_gateway.HandlePrefixMatchesAndPopulatePolicies(host, nil, nil, entries)
 }
 
-func makeTcpRouteEntry(name string, rule api.Rule) route.Entry {
+func makeTcpRouteEntry(
+	name string,
+	rule api.Rule,
+	backendRefToOrigin map[common_api.MatchesHash]model.ResourceMeta,
+	resolver model.LabelResourceIdentifierResolver,
+) route.Entry {
 	entry := route.Entry{
 		Route: name,
 	}
 
 	for _, b := range rule.Default.BackendRefs {
-		dest, ok := tags.FromTargetRef(b.TargetRef)
-		if !ok {
-			// This should be caught by validation
-			continue
+		var ref *model.ResolvedBackendRef
+		if origin, ok := backendRefToOrigin[rules.EmptyMatches]; ok {
+			ref = model.ResolveBackendRef(origin, b, resolver)
+		}
+		var dest map[string]string
+		if ref == nil || ref.ResourceOrNil() == nil {
+			var ok bool
+			dest, ok = tags.FromLegacyTargetRef(b.TargetRef)
+			if !ok {
+				// This should be caught by validation
+				continue
+			}
 		}
 		target := route.Destination{
 			Destination:   dest,
+			BackendRef:    ref,
 			Weight:        uint32(*b.Weight),
 			Policies:      nil,
 			RouteProtocol: core_mesh.ProtocolTCP,
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners.go
index 72dd7402a..cd0ce8518 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners.go
@@ -5,7 +5,6 @@ import (
 
 	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
-	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
 	meshroute_xds "github.com/kumahq/kuma/pkg/plugins/policies/core/xds/meshroute"
@@ -13,6 +12,7 @@ import (
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_listeners "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
+	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/generator"
 )
 
@@ -31,11 +31,7 @@ func generateFromService(
 	serviceName := svc.ServiceName
 	protocol := svc.Protocol
 
-	fallbackBackendRef := model.ResolvedBackendRef{
-		LegacyBackendRef: &svc.BackendRef,
-		Resource:         svc.Resource,
-	}
-	backendRefs := getBackendRefs(toRulesTCP, toRulesHTTP, svc, protocol, fallbackBackendRef, meshCtx)
+	backendRefs := getBackendRefs(toRulesTCP, toRulesHTTP, svc, protocol, meshCtx)
 	if len(backendRefs) == 0 {
 		return nil, nil
 	}
@@ -52,7 +48,7 @@ func generateFromService(
 		Name:           listener.GetName(),
 		Origin:         generator.OriginOutbound,
 		Resource:       listener,
-		ResourceOrigin: svc.Resource,
+		ResourceOrigin: svc.Outbound.Resource,
 		Protocol:       protocol,
 	})
 	return resources, nil
@@ -92,14 +88,12 @@ func buildOutboundListener(
 	svc meshroute_xds.DestinationService,
 	opts ...envoy_listeners.ListenerBuilderOpt,
 ) (envoy_common.NamedResource, error) {
-	tags := svc.Tags
-
 	// build listener name in format: "outbound:[IP]:[Port]"
 	// i.e. "outbound:240.0.0.0:80"
 	builder := envoy_listeners.NewOutboundListenerBuilder(
 		proxy.APIVersion,
-		svc.OutboundInterface.DataplaneIP,
-		svc.OutboundInterface.DataplanePort,
+		svc.Outbound.GetAddress(),
+		svc.Outbound.GetPort(),
 		core_xds.SocketAddressProtocolTCP,
 	)
 
@@ -108,7 +102,7 @@ func buildOutboundListener(
 	)
 
 	tagsMetadata := envoy_listeners.TagsMetadata(
-		tags.WithoutTags(mesh_proto.MeshTag),
+		envoy_tags.Tags(svc.Outbound.TagsOrNil()).WithoutTags(mesh_proto.MeshTag),
 	)
 
 	return builder.Configure(
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners_backendrefs.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners_backendrefs.go
index 3a28ef114..af7c6ae42 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners_backendrefs.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/listeners_backendrefs.go
@@ -24,8 +24,8 @@ func computeConf(toRules core_xds.ToRules, svc meshroute_xds.DestinationService,
 		}
 	}
 	// check if there is configuration for real MeshService and prioritize it
-	if svc.Resource != nil {
-		resourceConf := toRules.ResourceRules.Compute(*svc.Resource, meshCtx.Resources)
+	if svc.Outbound.Resource != nil {
+		resourceConf := toRules.ResourceRules.Compute(*svc.Outbound.Resource, meshCtx.Resources)
 		if resourceConf != nil && len(resourceConf.Conf) != 0 {
 			tcpConf = pointer.To(resourceConf.Conf[0].(api.Rule))
 			if o, ok := resourceConf.GetBackendRefOrigin(core_xds.EmptyMatches); ok {
@@ -41,7 +41,6 @@ func getBackendRefs(
 	toRulesHTTP core_xds.ToRules,
 	svc meshroute_xds.DestinationService,
 	protocol core_mesh.Protocol,
-	fallbackBackendRef core_model.ResolvedBackendRef,
 	meshCtx xds_context.MeshContext,
 ) []core_model.ResolvedBackendRef {
 	tcpConf, backendRefOrigin := computeConf(toRulesTCP, svc, meshCtx)
@@ -68,12 +67,10 @@ func getBackendRefs(
 				if resolved := core_model.ResolveBackendRef(backendRefOrigin, br, meshCtx.ResolveResourceIdentifier); resolved != nil {
 					backendRefs = append(backendRefs, *resolved)
 				}
-			} else {
-				backendRefs = append(backendRefs, core_model.ResolvedBackendRef{LegacyBackendRef: &br})
 			}
 		}
 	} else {
-		return []core_model.ResolvedBackendRef{fallbackBackendRef}
+		return []core_model.ResolvedBackendRef{*svc.DefaultBackendRef()}
 	}
 
 	return backendRefs
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin.go
index 20dfe53b5..1ce71dc1c 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin.go
@@ -157,13 +157,13 @@ func ApplyToGateway(
 }
 
 func sortRulesToHosts(
-	meshLocalResources xds_context.ResourceMap,
+	_ xds_context.ResourceMap,
 	rawRules rules.GatewayRules,
 	address string,
 	port uint32,
 	protocol mesh_proto.MeshGateway_Listener_Protocol,
 	sublisteners []meshroute_gateway.Sublistener,
-	_ model.LabelResourceIdentifierResolver,
+	resolver model.LabelResourceIdentifierResolver,
 ) []plugin_gateway.GatewayListenerHostname {
 	hostInfosByHostname := map[string]plugin_gateway.GatewayListenerHostname{}
 	for _, hostnameTag := range sublisteners {
@@ -185,7 +185,7 @@ func sortRulesToHosts(
 		if !ok {
 			continue
 		}
-		hostInfo.AppendEntries(generateEnvoyRouteEntries(host, rulesForListener))
+		hostInfo.AppendEntries(generateEnvoyRouteEntries(host, rulesForListener, resolver))
 		meshroute_gateway.AddToListenerByHostname(
 			hostInfosByHostname,
 			protocol,
diff --git a/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml b/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml
index 67372635f..330873a94 100644
--- a/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml
+++ b/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshtls/api/v1alpha1/meshtls.go b/pkg/plugins/policies/meshtls/api/v1alpha1/meshtls.go
index 5eb587d37..66f1d6846 100644
--- a/pkg/plugins/policies/meshtls/api/v1alpha1/meshtls.go
+++ b/pkg/plugins/policies/meshtls/api/v1alpha1/meshtls.go
@@ -7,8 +7,7 @@ import (
 )
 
 // MeshTLS
-// +kuma:policy:is_policy=true
-// +kuma:policy:plural=MeshTLSes
+// +kuma:policy:singular_display_name=Mesh TLS
 type MeshTLS struct {
 	// TargetRef is a reference to the resource the policy takes an effect on.
 	// The resource could be either a real store object or virtual resource
diff --git a/pkg/plugins/policies/meshtls/api/v1alpha1/zz_generated.resource.go b/pkg/plugins/policies/meshtls/api/v1alpha1/zz_generated.resource.go
index faab141a8..7c3e36c82 100644
--- a/pkg/plugins/policies/meshtls/api/v1alpha1/zz_generated.resource.go
+++ b/pkg/plugins/policies/meshtls/api/v1alpha1/zz_generated.resource.go
@@ -144,8 +144,8 @@ var MeshTLSResourceTypeDescriptor = model.ResourceTypeDescriptor{
 	AllowToInspect:               true,
 	IsPolicy:                     true,
 	IsExperimental:               false,
-	SingularDisplayName:          "Mesh T L S",
-	PluralDisplayName:            "Mesh T L Ss",
+	SingularDisplayName:          "Mesh TLS",
+	PluralDisplayName:            "Mesh TLSes",
 	IsPluginOriginated:           true,
 	IsTargetRefBased:             true,
 	HasToTargetRef:               false,
diff --git a/pkg/plugins/policies/meshtls/k8s/crd/kuma.io_meshtlses.yaml b/pkg/plugins/policies/meshtls/k8s/crd/kuma.io_meshtlses.yaml
index 4774210d5..82c2d1e92 100644
--- a/pkg/plugins/policies/meshtls/k8s/crd/kuma.io_meshtlses.yaml
+++ b/pkg/plugins/policies/meshtls/k8s/crd/kuma.io_meshtlses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin.go
index 0abdba342..7eb4b7a19 100644
--- a/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin.go
@@ -62,6 +62,9 @@ func (p plugin) Apply(rs *core_xds.ResourceSet, ctx xds_context.Context, proxy *
 	if err := applyToOutbounds(policies.FromRules, clusters.Outbound, clusters.OutboundSplit, proxy.Outbounds, ctx); err != nil {
 		return err
 	}
+	if err := applyToGateways(policies.GatewayRules, clusters.Gateway, ctx); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -139,6 +142,33 @@ func applyToOutbounds(
 	return nil
 }
 
+func applyToGateways(
+	gatewayRules core_rules.GatewayRules,
+	gatewayClusters map[string]*envoy_cluster.Cluster,
+	ctx xds_context.Context,
+) error {
+	for serviceName, cluster := range gatewayClusters {
+		// we shouldn't modify ExternalService
+		// MeshExternalService has different origin
+		if ctx.Mesh.IsExternalService(serviceName) {
+			continue
+		}
+		// there is only one rule always because we're in `Mesh/Mesh`
+		var conf *api.Conf
+		for _, r := range gatewayRules.FromRules {
+			conf = core_rules.ComputeConf[api.Conf](r, core_rules.MeshSubset())
+			break
+		}
+		if conf == nil {
+			continue
+		}
+		if err := configureParams(conf, cluster); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func configureParams(conf *api.Conf, cluster *envoy_cluster.Cluster) error {
 	if cluster.TransportSocket.GetName() != wellknown.TransportSocketTLS {
 		// we only want to configure TLS Version on listeners protected by Kuma's TLS
diff --git a/pkg/plugins/policies/meshtrace/k8s/crd/kuma.io_meshtraces.yaml b/pkg/plugins/policies/meshtrace/k8s/crd/kuma.io_meshtraces.yaml
index abaea0dcc..19f58e12f 100644
--- a/pkg/plugins/policies/meshtrace/k8s/crd/kuma.io_meshtraces.yaml
+++ b/pkg/plugins/policies/meshtrace/k8s/crd/kuma.io_meshtraces.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/policies/meshtrafficpermission/k8s/crd/kuma.io_meshtrafficpermissions.yaml b/pkg/plugins/policies/meshtrafficpermission/k8s/crd/kuma.io_meshtrafficpermissions.yaml
index f490facc5..3e38acc06 100644
--- a/pkg/plugins/policies/meshtrafficpermission/k8s/crd/kuma.io_meshtrafficpermissions.yaml
+++ b/pkg/plugins/policies/meshtrafficpermission/k8s/crd/kuma.io_meshtrafficpermissions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/plugins/runtime/gateway/cluster_generator.go b/pkg/plugins/runtime/gateway/cluster_generator.go
index ad7eaa21d..b75be7fa8 100644
--- a/pkg/plugins/runtime/gateway/cluster_generator.go
+++ b/pkg/plugins/runtime/gateway/cluster_generator.go
@@ -45,11 +45,11 @@ func (c *ClusterGenerator) GenerateClusters(ctx context.Context, xdsCtx xds_cont
 		var r *core_xds.Resource
 		var err error
 
-		if dest.BackendRef != nil && dest.BackendRef.Resource != nil {
+		if dest.BackendRef != nil && dest.BackendRef.ReferencesRealResource() {
 			r, service, err = c.generateRealBackendRefCluster(
 				xdsCtx.Mesh,
 				info.Proxy,
-				*dest.BackendRef,
+				dest.BackendRef.RealResourceBackendRef(),
 				dest.RouteProtocol,
 				xdsCtx.ControlPlane.SystemNamespace,
 				hostTags,
@@ -147,12 +147,12 @@ func (c *ClusterGenerator) GenerateClusters(ctx context.Context, xdsCtx xds_cont
 func (c *ClusterGenerator) generateRealBackendRefCluster(
 	meshCtx xds_context.MeshContext,
 	proxy *core_xds.Proxy,
-	backendRef model.ResolvedBackendRef,
+	backendRef *model.RealResourceBackendRef,
 	routeProtocol core_mesh.Protocol,
 	systemNamespace string,
 	identifyingTags map[string]string,
 ) (*core_xds.Resource, string, error) {
-	service, destProtocol, ok := meshroute.GetServiceAndProtocolFromRef(meshCtx, backendRef)
+	service, destProtocol, _, ok := meshroute.GetServiceProtocolPortFromRef(meshCtx, backendRef)
 	if !ok {
 		return nil, "", nil
 	}
@@ -179,7 +179,7 @@ func (c *ClusterGenerator) generateRealBackendRefCluster(
 		edsClusterBuilder.Configure(clusters.Http())
 	default:
 	}
-	// Note: these tags are just used to get a hash!
+	// Note: these tags are just used to get a cluster name!
 	tags := map[string]string{
 		mesh_proto.ServiceTag: service,
 	}
diff --git a/pkg/xds/envoy/tags/match.go b/pkg/xds/envoy/tags/match.go
index 393095bea..067240a4b 100644
--- a/pkg/xds/envoy/tags/match.go
+++ b/pkg/xds/envoy/tags/match.go
@@ -66,6 +66,9 @@ func (t Tags) DestinationClusterName(
 }
 
 func (t Tags) WithoutTags(tags ...string) Tags {
+	if t == nil {
+		return nil
+	}
 	tagSet := map[string]bool{}
 	for _, t := range tags {
 		tagSet[t] = true
@@ -109,15 +112,13 @@ func (t Tags) String() string {
 	return strings.Join(pairs, ",")
 }
 
-func FromTargetRef(targetRef common_api.TargetRef) (Tags, bool) {
+func FromLegacyTargetRef(targetRef common_api.TargetRef) (Tags, bool) {
 	var service string
 	tags := Tags{}
 
 	switch targetRef.Kind {
 	case common_api.MeshService:
 		service = targetRef.Name
-	case common_api.MeshExternalService:
-		service = targetRef.Name
 	case common_api.MeshServiceSubset:
 		service = targetRef.Name
 		tags = targetRef.Tags
diff --git a/pkg/xds/envoy/types.go b/pkg/xds/envoy/types.go
index 29a3469c5..883333127 100644
--- a/pkg/xds/envoy/types.go
+++ b/pkg/xds/envoy/types.go
@@ -146,7 +146,7 @@ type Service struct {
 	clusters           []Cluster
 	hasExternalService bool
 	tlsReady           bool
-	backendRef         model.ResolvedBackendRef
+	backendRef         *model.ResolvedBackendRef
 }
 
 func (c *Service) Add(cluster Cluster) {
@@ -176,7 +176,7 @@ func (c *Service) TLSReady() bool {
 	return c.tlsReady
 }
 
-func (c *Service) BackendRef() model.ResolvedBackendRef {
+func (c *Service) BackendRef() *model.ResolvedBackendRef {
 	return c.backendRef
 }
 
@@ -219,7 +219,7 @@ func (sa ServicesAccumulator) Add(clusters ...Cluster) {
 	}
 }
 
-func (sa ServicesAccumulator) AddBackendRef(backendRef model.ResolvedBackendRef, cluster Cluster) {
+func (sa ServicesAccumulator) AddBackendRef(backendRef *model.ResolvedBackendRef, cluster Cluster) {
 	if sa.services[cluster.Service()] == nil {
 		sa.services[cluster.Service()] = &Service{
 			tlsReady:   sa.tlsReadiness[cluster.Service()],
@@ -228,7 +228,7 @@ func (sa ServicesAccumulator) AddBackendRef(backendRef model.ResolvedBackendRef,
 		}
 	}
 	// prioritize backendRef pointing to real resource
-	if backendRef.LegacyBackendRef.ReferencesRealObject() && !sa.services[cluster.Service()].backendRef.LegacyBackendRef.ReferencesRealObject() {
+	if backendRef.ReferencesRealResource() && !sa.services[cluster.Service()].backendRef.ReferencesRealResource() {
 		sa.services[cluster.Service()].backendRef = backendRef
 	}
 	sa.services[cluster.Service()].Add(cluster)
diff --git a/pkg/xds/generator/zoneproxy/destinations.go b/pkg/xds/generator/zoneproxy/destinations.go
index ccb40ce71..b5d17e211 100644
--- a/pkg/xds/generator/zoneproxy/destinations.go
+++ b/pkg/xds/generator/zoneproxy/destinations.go
@@ -245,7 +245,7 @@ func addMeshHTTPRouteDestinations(
 	// iterating through them.
 	for _, policy := range policies {
 		for _, to := range policy.Spec.To {
-			if toTags, ok := tags.FromTargetRef(to.TargetRef); ok {
+			if toTags, ok := tags.FromLegacyTargetRef(to.TargetRef); ok {
 				addMeshHTTPRouteToDestinations(to.Rules, toTags, destinations)
 			}
 		}
@@ -266,7 +266,7 @@ func addMeshTCPRouteDestinations(
 	// iterating through them.
 	for _, policy := range policies {
 		for _, to := range policy.Spec.To {
-			if toTags, ok := tags.FromTargetRef(to.TargetRef); ok {
+			if toTags, ok := tags.FromLegacyTargetRef(to.TargetRef); ok {
 				addMeshTCPRouteToDestinations(to.Rules, toTags, destinations)
 			}
 		}
@@ -285,7 +285,7 @@ func addMeshHTTPRouteToDestinations(
 		}
 
 		for _, backendRef := range pointer.Deref(rule.Default.BackendRefs) {
-			if tags, ok := tags.FromTargetRef(backendRef.TargetRef); ok {
+			if tags, ok := tags.FromLegacyTargetRef(backendRef.TargetRef); ok {
 				addDestination(tags, destinations)
 			}
 		}
@@ -304,7 +304,7 @@ func addMeshTCPRouteToDestinations(
 		}
 
 		for _, backendRef := range rule.Default.BackendRefs {
-			if tags, ok := tags.FromTargetRef(backendRef.TargetRef); ok {
+			if tags, ok := tags.FromLegacyTargetRef(backendRef.TargetRef); ok {
 				addDestination(tags, destinations)
 			}
 		}
diff --git a/pkg/xds/generator/zoneproxy/generator.go b/pkg/xds/generator/zoneproxy/generator.go
index 195a1ed01..f383a346e 100644
--- a/pkg/xds/generator/zoneproxy/generator.go
+++ b/pkg/xds/generator/zoneproxy/generator.go
@@ -5,7 +5,6 @@ import (
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	"github.com/kumahq/kuma/pkg/util/pointer"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_clusters "github.com/kumahq/kuma/pkg/xds/envoy/clusters"
 	envoy_endpoints "github.com/kumahq/kuma/pkg/xds/envoy/endpoints"
@@ -38,7 +37,7 @@ func GenerateCDS(
 			envoy_tags.Without(mesh_proto.ServiceTag),
 		)
 		clusterName := envoy_names.GetMeshClusterName(meshName, service)
-		if clusters.BackendRef().LegacyBackendRef != nil && clusters.BackendRef().LegacyBackendRef.ReferencesRealObject() {
+		if clusters.BackendRef().ReferencesRealResource() {
 			clusterName = service
 		}
 		edsCluster, err := envoy_clusters.NewClusterBuilder(apiVersion, clusterName).
@@ -72,7 +71,7 @@ func GenerateEDS(
 		clusters := services[service]
 		endpoints := endpointMap[service]
 		clusterName := envoy_names.GetMeshClusterName(meshName, service)
-		if clusters.BackendRef().LegacyBackendRef != nil && clusters.BackendRef().LegacyBackendRef.ReferencesRealObject() {
+		if clusters.BackendRef().ReferencesRealResource() {
 			clusterName = service
 		}
 		cla, err := envoy_endpoints.CreateClusterLoadAssignment(clusterName, endpoints, apiVersion)
@@ -208,7 +207,7 @@ func AddFilterChains(
 		)
 
 		listenerBuilder.Configure(filterChain)
-		servicesAcc.AddBackendRef(pointer.Deref(refDest.Resource), cluster)
+		servicesAcc.AddBackendRef(refDest.Resource, cluster)
 	}
 
 	return servicesAcc.Services()


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
index c99197246..76be71db0 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
@@ -36,7 +36,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io
@@ -86,7 +86,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
@@ -200,7 +200,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshes.kuma.io
 spec:
   group: kuma.io
@@ -250,7 +250,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
@@ -577,7 +577,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
@@ -997,7 +997,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io
@@ -1224,7 +1224,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io
@@ -1578,7 +1578,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io
@@ -1628,7 +1628,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgateways.kuma.io
 spec:
   group: kuma.io
@@ -1678,7 +1678,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
@@ -2060,7 +2060,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
@@ -2728,7 +2728,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
@@ -2778,7 +2778,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
@@ -2828,7 +2828,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
@@ -3400,7 +3400,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
@@ -3692,7 +3692,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -3743,11 +3743,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
@@ -3891,7 +3886,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
@@ -4055,7 +4050,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
@@ -4605,7 +4600,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
@@ -5104,7 +5099,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
@@ -5611,7 +5606,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
@@ -5824,7 +5819,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
@@ -6106,7 +6101,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
@@ -6469,7 +6464,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
@@ -6539,7 +6534,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
@@ -6779,7 +6774,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
@@ -7062,7 +7057,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -7265,7 +7260,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: proxytemplates.kuma.io
 spec:
   group: kuma.io
@@ -7315,7 +7310,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: ratelimits.kuma.io
 spec:
   group: kuma.io
@@ -7365,7 +7360,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: retries.kuma.io
 spec:
   group: kuma.io
@@ -7415,7 +7410,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: serviceinsights.kuma.io
 spec:
   group: kuma.io
@@ -7465,7 +7460,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: timeouts.kuma.io
 spec:
   group: kuma.io
@@ -7515,7 +7510,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficlogs.kuma.io
 spec:
   group: kuma.io
@@ -7565,7 +7560,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -7615,7 +7610,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: externalservices.kuma.io
 spec:
   group: kuma.io
@@ -7665,7 +7660,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficroutes.kuma.io
 spec:
   group: kuma.io
@@ -7715,7 +7710,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: traffictraces.kuma.io
 spec:
   group: kuma.io
@@ -7765,7 +7760,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: virtualoutbounds.kuma.io
 spec:
   group: kuma.io
@@ -7815,7 +7810,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegresses.kuma.io
 spec:
   group: kuma.io
@@ -7871,7 +7866,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegressinsights.kuma.io
 spec:
   group: kuma.io
@@ -7921,7 +7916,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingresses.kuma.io
 spec:
   group: kuma.io
@@ -7977,7 +7972,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingressinsights.kuma.io
 spec:
   group: kuma.io
@@ -8028,7 +8023,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
@@ -8078,7 +8073,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zones.kuma.io
 spec:
   group: kuma.io
@@ -8128,7 +8123,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: faultinjections.kuma.io
 spec:
   group: kuma.io
@@ -8178,7 +8173,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: healthchecks.kuma.io
 spec:
   group: kuma.io
@@ -8228,7 +8223,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
@@ -8300,7 +8295,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
@@ -8857,7 +8852,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
index b6d593c25..2860aab2f 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
@@ -36,7 +36,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io
@@ -86,7 +86,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
@@ -200,7 +200,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshes.kuma.io
 spec:
   group: kuma.io
@@ -250,7 +250,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
@@ -577,7 +577,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
@@ -997,7 +997,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io
@@ -1224,7 +1224,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io
@@ -1578,7 +1578,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io
@@ -1628,7 +1628,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgateways.kuma.io
 spec:
   group: kuma.io
@@ -1678,7 +1678,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
@@ -2060,7 +2060,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
@@ -2728,7 +2728,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
@@ -2778,7 +2778,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
@@ -2828,7 +2828,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
@@ -3400,7 +3400,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
@@ -3692,7 +3692,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -3743,11 +3743,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
@@ -3891,7 +3886,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
@@ -4055,7 +4050,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
@@ -4605,7 +4600,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
@@ -5104,7 +5099,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
@@ -5611,7 +5606,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
@@ -5824,7 +5819,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
@@ -6106,7 +6101,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
@@ -6469,7 +6464,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
@@ -6539,7 +6534,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
@@ -6779,7 +6774,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
@@ -7062,7 +7057,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -7265,7 +7260,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: proxytemplates.kuma.io
 spec:
   group: kuma.io
@@ -7315,7 +7310,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: ratelimits.kuma.io
 spec:
   group: kuma.io
@@ -7365,7 +7360,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: retries.kuma.io
 spec:
   group: kuma.io
@@ -7415,7 +7410,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: serviceinsights.kuma.io
 spec:
   group: kuma.io
@@ -7465,7 +7460,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: timeouts.kuma.io
 spec:
   group: kuma.io
@@ -7515,7 +7510,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficlogs.kuma.io
 spec:
   group: kuma.io
@@ -7565,7 +7560,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -7615,7 +7610,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: externalservices.kuma.io
 spec:
   group: kuma.io
@@ -7665,7 +7660,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficroutes.kuma.io
 spec:
   group: kuma.io
@@ -7715,7 +7710,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: traffictraces.kuma.io
 spec:
   group: kuma.io
@@ -7765,7 +7760,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: virtualoutbounds.kuma.io
 spec:
   group: kuma.io
@@ -7815,7 +7810,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegresses.kuma.io
 spec:
   group: kuma.io
@@ -7871,7 +7866,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegressinsights.kuma.io
 spec:
   group: kuma.io
@@ -7921,7 +7916,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingresses.kuma.io
 spec:
   group: kuma.io
@@ -7977,7 +7972,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingressinsights.kuma.io
 spec:
   group: kuma.io
@@ -8028,7 +8023,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
@@ -8078,7 +8073,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zones.kuma.io
 spec:
   group: kuma.io
@@ -8128,7 +8123,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: faultinjections.kuma.io
 spec:
   group: kuma.io
@@ -8178,7 +8173,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: healthchecks.kuma.io
 spec:
   group: kuma.io
@@ -8228,7 +8223,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
@@ -8300,7 +8295,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
@@ -8857,7 +8852,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
index 78a29e9fc..466c5972f 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
@@ -56,7 +56,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io
@@ -106,7 +106,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
@@ -220,7 +220,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshes.kuma.io
 spec:
   group: kuma.io
@@ -270,7 +270,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
@@ -597,7 +597,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
@@ -1017,7 +1017,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io
@@ -1244,7 +1244,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io
@@ -1598,7 +1598,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io
@@ -1648,7 +1648,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgateways.kuma.io
 spec:
   group: kuma.io
@@ -1698,7 +1698,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
@@ -2080,7 +2080,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
@@ -2748,7 +2748,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
@@ -2798,7 +2798,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
@@ -2848,7 +2848,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
@@ -3420,7 +3420,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
@@ -3712,7 +3712,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -3763,11 +3763,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
@@ -3911,7 +3906,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
@@ -4075,7 +4070,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
@@ -4625,7 +4620,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
@@ -5124,7 +5119,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
@@ -5631,7 +5626,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
@@ -5844,7 +5839,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
@@ -6126,7 +6121,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
@@ -6489,7 +6484,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
@@ -6559,7 +6554,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
@@ -6799,7 +6794,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
@@ -7082,7 +7077,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -7285,7 +7280,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: proxytemplates.kuma.io
 spec:
   group: kuma.io
@@ -7335,7 +7330,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: ratelimits.kuma.io
 spec:
   group: kuma.io
@@ -7385,7 +7380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: retries.kuma.io
 spec:
   group: kuma.io
@@ -7435,7 +7430,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: serviceinsights.kuma.io
 spec:
   group: kuma.io
@@ -7485,7 +7480,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: timeouts.kuma.io
 spec:
   group: kuma.io
@@ -7535,7 +7530,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficlogs.kuma.io
 spec:
   group: kuma.io
@@ -7585,7 +7580,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -7635,7 +7630,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: externalservices.kuma.io
 spec:
   group: kuma.io
@@ -7685,7 +7680,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficroutes.kuma.io
 spec:
   group: kuma.io
@@ -7735,7 +7730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: traffictraces.kuma.io
 spec:
   group: kuma.io
@@ -7785,7 +7780,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: virtualoutbounds.kuma.io
 spec:
   group: kuma.io
@@ -7835,7 +7830,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegresses.kuma.io
 spec:
   group: kuma.io
@@ -7891,7 +7886,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegressinsights.kuma.io
 spec:
   group: kuma.io
@@ -7941,7 +7936,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingresses.kuma.io
 spec:
   group: kuma.io
@@ -7997,7 +7992,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingressinsights.kuma.io
 spec:
   group: kuma.io
@@ -8048,7 +8043,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
@@ -8098,7 +8093,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zones.kuma.io
 spec:
   group: kuma.io
@@ -8148,7 +8143,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: faultinjections.kuma.io
 spec:
   group: kuma.io
@@ -8198,7 +8193,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: healthchecks.kuma.io
 spec:
   group: kuma.io
@@ -8248,7 +8243,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
@@ -8320,7 +8315,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
@@ -8877,7 +8872,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml b/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml
index bc68cce21..a56d63060 100644
--- a/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io
@@ -54,7 +54,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
@@ -168,7 +168,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
@@ -218,7 +218,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
@@ -288,7 +288,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: externalservices.kuma.io
 spec:
   group: kuma.io
@@ -338,7 +338,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: faultinjections.kuma.io
 spec:
   group: kuma.io
@@ -388,7 +388,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: healthchecks.kuma.io
 spec:
   group: kuma.io
@@ -438,7 +438,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
@@ -510,7 +510,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
@@ -1067,7 +1067,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
@@ -1806,7 +1806,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshes.kuma.io
 spec:
   group: kuma.io
@@ -1856,7 +1856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
@@ -2183,7 +2183,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
@@ -2603,7 +2603,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io
@@ -2830,7 +2830,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io
@@ -3184,7 +3184,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io
@@ -3234,7 +3234,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshgateways.kuma.io
 spec:
   group: kuma.io
@@ -3284,7 +3284,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
@@ -3666,7 +3666,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
@@ -4334,7 +4334,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
@@ -4384,7 +4384,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
@@ -4956,7 +4956,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
@@ -5248,7 +5248,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -5299,11 +5299,6 @@ spec:
                     port:
                       format: int32
                       type: integer
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      x-kubernetes-int-or-string: true
                   required:
                   - port
                   type: object
@@ -5447,7 +5442,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
@@ -5611,7 +5606,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
@@ -6161,7 +6156,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
@@ -6660,7 +6655,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshretries.kuma.io
 spec:
   group: kuma.io
@@ -7167,7 +7162,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshservices.kuma.io
 spec:
   group: kuma.io
@@ -7380,7 +7375,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
@@ -7662,7 +7657,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
@@ -8025,7 +8020,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
@@ -8265,7 +8260,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
@@ -8548,7 +8543,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -8751,7 +8746,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: proxytemplates.kuma.io
 spec:
   group: kuma.io
@@ -8801,7 +8796,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: ratelimits.kuma.io
 spec:
   group: kuma.io
@@ -8851,7 +8846,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: retries.kuma.io
 spec:
   group: kuma.io
@@ -8901,7 +8896,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: serviceinsights.kuma.io
 spec:
   group: kuma.io
@@ -8951,7 +8946,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: timeouts.kuma.io
 spec:
   group: kuma.io
@@ -9001,7 +8996,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficlogs.kuma.io
 spec:
   group: kuma.io
@@ -9051,7 +9046,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficpermissions.kuma.io
 spec:
   group: kuma.io
@@ -9101,7 +9096,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: trafficroutes.kuma.io
 spec:
   group: kuma.io
@@ -9151,7 +9146,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: traffictraces.kuma.io
 spec:
   group: kuma.io
@@ -9201,7 +9196,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: virtualoutbounds.kuma.io
 spec:
   group: kuma.io
@@ -9251,7 +9246,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegresses.kuma.io
 spec:
   group: kuma.io
@@ -9307,7 +9302,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneegressinsights.kuma.io
 spec:
   group: kuma.io
@@ -9357,7 +9352,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingresses.kuma.io
 spec:
   group: kuma.io
@@ -9413,7 +9408,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneingressinsights.kuma.io
 spec:
   group: kuma.io
@@ -9464,7 +9459,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
@@ -9514,7 +9509,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: zones.kuma.io
 spec:
   group: kuma.io
diff --git a/pkg/api-server/testdata/base_endpoints/_resources.golden.json b/pkg/api-server/testdata/base_endpoints/_resources.golden.json
index c1fb175e7..fe1b26d38 100644
--- a/pkg/api-server/testdata/base_endpoints/_resources.golden.json
+++ b/pkg/api-server/testdata/base_endpoints/_resources.golden.json
@@ -327,7 +327,7 @@
    "includeInFederation": true,
    "name": "MeshTLS",
    "path": "meshtlses",
-   "pluralDisplayName": "Mesh T L Ss",
+   "pluralDisplayName": "Mesh TLSes",
    "policy": {
     "hasFromTargetRef": true,
     "hasToTargetRef": false,
@@ -335,7 +335,7 @@
    },
    "readOnly": false,
    "scope": "Mesh",
-   "singularDisplayName": "Mesh T L S"
+   "singularDisplayName": "Mesh TLS"
   },
   {
    "includeInFederation": true,
diff --git a/pkg/api-server/testdata/base_endpoints/policies.golden.json b/pkg/api-server/testdata/base_endpoints/policies.golden.json
index 3add9803a..437e41fb8 100644
--- a/pkg/api-server/testdata/base_endpoints/policies.golden.json
+++ b/pkg/api-server/testdata/base_endpoints/policies.golden.json
@@ -180,8 +180,8 @@
    "name": "MeshTLS",
    "readOnly": false,
    "path": "meshtlses",
-   "singularDisplayName": "Mesh T L S",
-   "pluralDisplayName": "Mesh T L Ss",
+   "singularDisplayName": "Mesh TLS",
+   "pluralDisplayName": "Mesh TLSes",
    "isExperimental": false,
    "isTargetRefBased": true,
    "isInbound": true,
diff --git a/pkg/api-server/testdata/resources/crud/put_circuitbreaker_01.golden.json b/pkg/api-server/testdata/resources/crud/put_circuitbreaker_01.golden.json
index d8e18fa41..1cc85552a 100644
--- a/pkg/api-server/testdata/resources/crud/put_circuitbreaker_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_circuitbreaker_01.golden.json
@@ -5,10 +5,7 @@
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
  "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/mesh": "default",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
+  "kuma.io/mesh": "default"
  },
  "sources": [
   {
diff --git a/pkg/api-server/testdata/resources/crud/put_faultinjection_01.golden.json b/pkg/api-server/testdata/resources/crud/put_faultinjection_01.golden.json
index 94bd1be8d..9bae2b425 100644
--- a/pkg/api-server/testdata/resources/crud/put_faultinjection_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_faultinjection_01.golden.json
@@ -5,10 +5,7 @@
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
  "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/mesh": "default",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
+  "kuma.io/mesh": "default"
  },
  "sources": [
   {
diff --git a/pkg/api-server/testdata/resources/crud/put_globalsecret_01.golden.json b/pkg/api-server/testdata/resources/crud/put_globalsecret_01.golden.json
index cb0fd62d3..35907b5c1 100644
--- a/pkg/api-server/testdata/resources/crud/put_globalsecret_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_globalsecret_01.golden.json
@@ -3,10 +3,5 @@
  "name": "sec-1",
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
- "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
- },
  "data": "dGVzdAo="
 }
diff --git a/pkg/api-server/testdata/resources/crud/put_healthcheck_01.golden.json b/pkg/api-server/testdata/resources/crud/put_healthcheck_01.golden.json
index 467d99587..a5d7c806f 100644
--- a/pkg/api-server/testdata/resources/crud/put_healthcheck_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_healthcheck_01.golden.json
@@ -5,10 +5,7 @@
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
  "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/mesh": "default",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
+  "kuma.io/mesh": "default"
  },
  "sources": [
   {
diff --git a/pkg/api-server/testdata/resources/crud/put_secret_01.golden.json b/pkg/api-server/testdata/resources/crud/put_secret_01.golden.json
index 85637cfce..8f6cd2eed 100644
--- a/pkg/api-server/testdata/resources/crud/put_secret_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_secret_01.golden.json
@@ -5,10 +5,7 @@
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
  "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/mesh": "default",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
+  "kuma.io/mesh": "default"
  },
  "data": "dGVzdAo="
 }
diff --git a/pkg/api-server/testdata/resources/crud/put_trafficroute_01.golden.json b/pkg/api-server/testdata/resources/crud/put_trafficroute_01.golden.json
index 0d0ef0d3e..2e5fb763e 100644
--- a/pkg/api-server/testdata/resources/crud/put_trafficroute_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_trafficroute_01.golden.json
@@ -5,10 +5,7 @@
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
  "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/mesh": "default",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
+  "kuma.io/mesh": "default"
  },
  "sources": [
   {
diff --git a/pkg/api-server/testdata/resources/crud/put_traffictrace_01.golden.json b/pkg/api-server/testdata/resources/crud/put_traffictrace_01.golden.json
index b9bf23329..44678837d 100644
--- a/pkg/api-server/testdata/resources/crud/put_traffictrace_01.golden.json
+++ b/pkg/api-server/testdata/resources/crud/put_traffictrace_01.golden.json
@@ -5,10 +5,7 @@
  "creationTime": "0001-01-01T00:00:00Z",
  "modificationTime": "0001-01-01T00:00:00Z",
  "labels": {
-  "kuma.io/env": "universal",
-  "kuma.io/mesh": "default",
-  "kuma.io/origin": "zone",
-  "kuma.io/zone": "default"
+  "kuma.io/mesh": "default"
  },
  "selectors": [
   {
diff --git a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/meshgateway.golden.json b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/meshgateway.golden.json
index 06c6da7be..b3699af80 100644
--- a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/meshgateway.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/meshgateway.golden.json
@@ -32,7 +32,7 @@
         },
         "mesh": "default",
         "name": "mt-on-gateway",
-        "type": "Mesh"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/overriding_meshtimeout.golden.json b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/overriding_meshtimeout.golden.json
index aaca697fe..e39e32000 100644
--- a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/overriding_meshtimeout.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/overriding_meshtimeout.golden.json
@@ -61,7 +61,7 @@
         "labels": {},
         "mesh": "default",
         "name": "default",
-        "type": "Mesh"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout.golden.json b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout.golden.json
index b6e6f1acd..6319bd49b 100644
--- a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout.golden.json
@@ -26,7 +26,7 @@
         "labels": {},
         "mesh": "mesh-1",
         "name": "matched-for-rules-mt-1",
-        "type": "MeshService"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 0
       }
@@ -57,7 +57,7 @@
         "labels": {},
         "mesh": "mesh-1",
         "name": "matched-for-rules-mt-1",
-        "type": "MeshService"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_index.golden.json b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_index.golden.json
index 091cb1e57..f7c535d01 100644
--- a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_index.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_index.golden.json
@@ -26,7 +26,7 @@
         "labels": {},
         "mesh": "mesh-1",
         "name": "matched-for-rules-mt-1",
-        "type": "MeshService"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 1
       }
diff --git a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_section.golden.json b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_section.golden.json
index 7a4f34b76..007b7f5b4 100644
--- a/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_section.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/dataplanes/_rules/resource_rule_meshtimeout_section.golden.json
@@ -26,7 +26,7 @@
         "labels": {},
         "mesh": "mesh-1",
         "name": "matched-for-rules-mt-1",
-        "type": "MeshService"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway.golden.json b/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway.golden.json
index 7349c64ae..a7c84e164 100644
--- a/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway.golden.json
@@ -32,7 +32,7 @@
         },
         "mesh": "default",
         "name": "mt-on-gateway",
-        "type": "Mesh"
+        "type": "MeshTimeout"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway2.golden.json b/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway2.golden.json
index 5577c04e6..511d11d57 100644
--- a/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway2.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshgateway2.golden.json
@@ -151,7 +151,7 @@
         },
         "mesh": "default",
         "name": "http-route-3",
-        "type": "Mesh"
+        "type": "MeshHTTPRoute"
        },
        "ruleIndex": 0
       },
@@ -163,7 +163,7 @@
         },
         "mesh": "default",
         "name": "http-route-2",
-        "type": "Mesh"
+        "type": "MeshHTTPRoute"
        },
        "ruleIndex": 0
       },
@@ -175,7 +175,7 @@
         },
         "mesh": "default",
         "name": "http-route-1",
-        "type": "Mesh"
+        "type": "MeshHTTPRoute"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshhttproute.golden.json b/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshhttproute.golden.json
index 86073d69e..5dbbde022 100644
--- a/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshhttproute.golden.json
+++ b/pkg/api-server/testdata/resources/inspect/meshgateways/_rules/meshhttproute.golden.json
@@ -101,7 +101,7 @@
         },
         "mesh": "default",
         "name": "the-other-http-route",
-        "type": "Mesh"
+        "type": "MeshHTTPRoute"
        },
        "ruleIndex": 0
       },
@@ -113,7 +113,7 @@
         },
         "mesh": "default",
         "name": "the-http-route",
-        "type": "Mesh"
+        "type": "MeshHTTPRoute"
        },
        "ruleIndex": 0
       }
diff --git a/pkg/core/resources/apis/mesh/dataplane_validator_test.go b/pkg/core/resources/apis/mesh/dataplane_validator_test.go
index 232f47ed6..5959bef50 100644
--- a/pkg/core/resources/apis/mesh/dataplane_validator_test.go
+++ b/pkg/core/resources/apis/mesh/dataplane_validator_test.go
@@ -337,6 +337,25 @@ var _ = Describe("Dataplane", func() {
                     labels:
                       kuma.io/test: abc`,
 		),
+		Entry("dataplane with backend ref with labels", `
+            type: Dataplane
+            name: dp-1
+            mesh: default
+            networking:
+              address: 192.168.0.1
+              inbound:
+                - port: 8080
+                  tags:
+                    kuma.io/service: backend
+                    version: "1"
+              outbound:
+                - port: 3333
+                  backendRef:
+                    kind: MeshService
+                    labels:
+                      kuma.io/display-name: redis
+                    port: 8080`,
+		),
 	)
 
 	type testCase struct {
@@ -1237,8 +1256,8 @@ var _ = Describe("Dataplane", func() {
                 violations:
                 - field: networking.outbound[0].backendRef.kind
                   message: 'invalid value. Available values are: MeshExternalService,MeshMultiZoneService,MeshService'
-                - field: networking.outbound[0].backendRef.name
-                  message: cannot be empty
+                - field: networking.outbound[0].backendRef
+                  message:  either 'name' or 'labels' should be specified
                 - field: networking.outbound[0].backendRef.port
                   message: port must be in the range [1, 65535]`,
 		}),
diff --git a/pkg/core/resources/model/display_name_test.go b/pkg/core/resources/model/display_name_test.go
new file mode 100644
index 000000000..b7adc57f1
--- /dev/null
+++ b/pkg/core/resources/model/display_name_test.go
@@ -0,0 +1,46 @@
+package model_test
+
+import (
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
+)
+
+var _ = Describe("PluralType", func() {
+	type testCase struct {
+		name     string
+		expected string
+	}
+
+	DescribeTable("should compute the correct plural name",
+		func(given testCase) {
+			pluralResourceName := core_model.PluralType(given.name)
+			Expect(pluralResourceName).To(Equal(given.expected))
+		},
+		Entry("when S ending", testCase{
+			name:     "MeshTLS",
+			expected: "MeshTLSes",
+		}),
+		Entry("when y ending", testCase{
+			name:     "Meshy",
+			expected: "Meshies",
+		}),
+		Entry("when sh ending", testCase{
+			name:     "Mesh",
+			expected: "Meshes",
+		}),
+		Entry("when s ending", testCase{
+			name:     "MeshTls",
+			expected: "MeshTlses",
+		}),
+		Entry("when ch ending", testCase{
+			name:     "Mech",
+			expected: "Meches",
+		}),
+		Entry("when Y ending", testCase{
+			name:     "MesY",
+			expected: "Mesies",
+		}),
+	)
+})
diff --git a/pkg/core/resources/model/resource_test.go b/pkg/core/resources/model/resource_test.go
index ba66838f9..5f0f9f3d0 100644
--- a/pkg/core/resources/model/resource_test.go
+++ b/pkg/core/resources/model/resource_test.go
@@ -10,12 +10,15 @@ import (
 	kube_meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/config/core"
+	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/kds"
 	"github.com/kumahq/kuma/pkg/kds/context"
 	reconcile_v2 "github.com/kumahq/kuma/pkg/kds/v2/reconcile"
 	policies_api "github.com/kumahq/kuma/pkg/plugins/policies/meshaccesslog/api/v1alpha1"
 	meshtimeout_api "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/api/v1alpha1"
+	"github.com/kumahq/kuma/pkg/test/kds/samples"
 	"github.com/kumahq/kuma/pkg/test/resources/builders"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
 )
@@ -261,3 +264,83 @@ var _ = Describe("ComputePolicyRole", func() {
 		}),
 	)
 })
+
+var _ = Describe("ComputeLabels", func() {
+	type testCase struct {
+		r              core_model.Resource
+		mode           core.CpMode
+		isK8s          bool
+		localZone      string
+		expectedLabels map[string]string
+	}
+
+	DescribeTable("should return correct label map",
+		func(given testCase) {
+			labels, err := core_model.ComputeLabels(given.r, given.mode, given.isK8s, "kuma-system", given.localZone)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(labels).To(Equal(given.expectedLabels))
+		},
+		Entry("plugin originated policy on zone-k8s", testCase{
+			mode:      core.Zone,
+			isK8s:     true,
+			localZone: "zone-1",
+			r: builders.MeshTimeout().
+				WithMesh("mesh-1").WithName("idle-timeout").
+				WithTargetRef(builders.TargetRefMesh()).
+				AddTo(builders.TargetRefMesh(), meshtimeout_api.Conf{
+					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
+				}).
+				Build(),
+			expectedLabels: map[string]string{
+				"kuma.io/env":    "kubernetes",
+				"kuma.io/mesh":   "mesh-1",
+				"kuma.io/origin": "zone",
+				"kuma.io/zone":   "zone-1",
+			},
+		}),
+		Entry("source/destination policy on zone-k8s", testCase{
+			mode:      core.Zone,
+			isK8s:     true,
+			localZone: "zone-1",
+			r: &mesh.TimeoutResource{
+				Spec: samples.Timeout,
+				Meta: &test_model.ResourceMeta{Mesh: "mesh-1", Name: "sample-timeout"},
+			},
+			expectedLabels: map[string]string{
+				"kuma.io/mesh": "mesh-1",
+			},
+		}),
+		Entry("mesh resource on non-federated zone", testCase{
+			mode:      core.Zone,
+			isK8s:     true,
+			localZone: "zone-1",
+			r: &mesh.MeshResource{
+				Spec: samples.Mesh1,
+				Meta: &test_model.ResourceMeta{Mesh: core_model.NoMesh, Name: "mesh-1"},
+			},
+			expectedLabels: map[string]string{},
+		}),
+		Entry("plugin originated policy on zone-k8s on custom namespace", testCase{
+			mode:      core.Zone,
+			isK8s:     true,
+			localZone: "zone-1",
+			r: builders.MeshTimeout().
+				WithMesh("mesh-1").
+				WithName("idle-timeout").
+				WithNamespace("custom-ns").
+				WithTargetRef(builders.TargetRefMesh()).
+				AddTo(builders.TargetRefMesh(), meshtimeout_api.Conf{
+					IdleTimeout: &kube_meta.Duration{Duration: 123 * time.Second},
+				}).
+				Build(),
+			expectedLabels: map[string]string{
+				"k8s.kuma.io/namespace": "custom-ns",
+				"kuma.io/policy-role":   "consumer",
+				"kuma.io/mesh":          "mesh-1",
+				"kuma.io/origin":        "zone",
+				"kuma.io/zone":          "zone-1",
+				"kuma.io/env":           "kubernetes",
+			},
+		}),
+	)
+})
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
index 90460c36d..8b67fe59e 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
@@ -303,7 +303,7 @@ var _ = Describe("MeshHTTPRoute", func() {
 				Meta: &test_model.ResourceMeta{Name: "multi-backend", Mesh: "default"},
 				Spec: &meshmultizoneservice_api.MeshMultiZoneService{
 					Selector: meshmultizoneservice_api.Selector{},
-					Ports: []meshservice_api.Port{{
+					Ports: []meshmultizoneservice_api.Port{{
 						Port:        80,
 						AppProtocol: core_mesh.ProtocolHTTP,
 					}},
@@ -701,6 +701,15 @@ var _ = Describe("MeshHTTPRoute", func() {
 						xds_builders.MatchedPolicies().
 							WithToPolicy(api.MeshHTTPRouteType, core_rules.ToRules{
 								Rules: core_rules.Rules{{
+									Origin: []core_model.ResourceMeta{&test_model.ResourceMeta{Mesh: "default", Name: "http-route"}},
+									BackendRefOriginIndex: map[common_api.MatchesHash]int{
+										api.HashMatches([]api.Match{{Path: &api.PathMatch{Type: api.PathPrefix, Value: "/v1"}}}): 0,
+										api.HashMatches([]api.Match{
+											{Path: &api.PathMatch{Type: api.PathPrefix, Value: "/v2"}},
+											{Path: &api.PathMatch{Type: api.PathPrefix, Value: "/v3"}},
+										}): 0,
+										api.HashMatches([]api.Match{{QueryParams: []api.QueryParamsMatch{{Type: api.ExactQueryMatch, Name: "v1", Value: "true"}}}}): 0,
+									},
 									Conf: api.PolicyDefault{
 										Rules: []api.Rule{{
 											Matches: []api.Match{{
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml
index 68dd0f333..349f9dc73 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.clusters.golden.yaml
@@ -31,7 +31,7 @@ resources:
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
-        sni: afce62f771ed74b78.example.0.default.mes
+        sni: afce62f771ed74b78.example.9090.default.mes
     type: EDS
     typedExtensionProtocolOptions:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
index 90d96d031..769b2dcc2 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
@@ -275,6 +275,12 @@ var _ = Describe("MeshTCPRoute", func() {
 			rules := core_rules.ToRules{
 				Rules: core_rules.Rules{
 					{
+						Origin: []core_model.ResourceMeta{
+							&test_model.ResourceMeta{Mesh: "mesh-1", Name: "tcp-route"},
+						},
+						BackendRefOriginIndex: map[common_api.MatchesHash]int{
+							core_rules.EmptyMatches: 0,
+						},
 						Subset: core_rules.MeshService("backend"),
 						Conf: api.Rule{
 							Default: api.RuleConf{
@@ -651,6 +657,12 @@ var _ = Describe("MeshTCPRoute", func() {
 			rules := core_rules.ToRules{
 				Rules: core_rules.Rules{
 					{
+						Origin: []core_model.ResourceMeta{
+							&test_model.ResourceMeta{Mesh: "mesh-1", Name: "tcp-route"},
+						},
+						BackendRefOriginIndex: map[common_api.MatchesHash]int{
+							core_rules.EmptyMatches: 0,
+						},
 						Subset: core_rules.MeshService("backend"),
 						Conf: api.Rule{
 							Default: api.RuleConf{
@@ -830,6 +842,12 @@ var _ = Describe("MeshTCPRoute", func() {
 			tcpRules := core_rules.ToRules{
 				Rules: core_rules.Rules{
 					{
+						Origin: []core_model.ResourceMeta{
+							&test_model.ResourceMeta{Mesh: "mesh-1", Name: "tcp-route"},
+						},
+						BackendRefOriginIndex: map[common_api.MatchesHash]int{
+							core_rules.EmptyMatches: 0,
+						},
 						Subset: core_rules.MeshService("backend"),
 						Conf: api.Rule{
 							Default: api.RuleConf{
@@ -935,6 +953,12 @@ var _ = Describe("MeshTCPRoute", func() {
 			rules := core_rules.ToRules{
 				Rules: core_rules.Rules{
 					{
+						Origin: []core_model.ResourceMeta{
+							&test_model.ResourceMeta{Mesh: "mesh-1", Name: "tcp-route"},
+						},
+						BackendRefOriginIndex: map[common_api.MatchesHash]int{
+							core_rules.EmptyMatches: 0,
+						},
 						Subset: core_rules.MeshService("backend"),
 						Conf: api.Rule{
 							Default: api.RuleConf{
diff --git a/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin_test.go
index e3ed14089..ab4ad824b 100644
--- a/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshtls/plugin/v1alpha1/plugin_test.go
@@ -1,6 +1,7 @@
 package v1alpha1_test
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path"
@@ -9,19 +10,26 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
 	core_plugins "github.com/kumahq/kuma/pkg/core/plugins"
+	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	xds_types "github.com/kumahq/kuma/pkg/core/xds/types"
 	core_rules "github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
+	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
+	meshhttproute_plugin "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/plugin/v1alpha1"
 	api "github.com/kumahq/kuma/pkg/plugins/policies/meshtls/api/v1alpha1"
 	plugin "github.com/kumahq/kuma/pkg/plugins/policies/meshtls/plugin/v1alpha1"
+	gateway_plugin "github.com/kumahq/kuma/pkg/plugins/runtime/gateway"
 	"github.com/kumahq/kuma/pkg/test/matchers"
 	"github.com/kumahq/kuma/pkg/test/resources/builders"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
 	"github.com/kumahq/kuma/pkg/test/resources/samples"
 	xds_builders "github.com/kumahq/kuma/pkg/test/xds/builders"
+	"github.com/kumahq/kuma/pkg/util/pointer"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
+	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/envoy/clusters"
 	"github.com/kumahq/kuma/pkg/xds/envoy/listeners"
@@ -124,6 +132,98 @@ var _ = Describe("MeshTLS", func() {
 			meshBuilder: samples.MeshMTLSBuilder().WithPermissiveMTLSBackends(),
 		}),
 	)
+
+	DescribeTable("should generate proper Envoy config for builtin Gateway",
+		func(given testCase) {
+			secretsTracker := envoy_common.NewSecretsTracker("default", nil)
+			resources := xds_context.NewResources()
+			resources.MeshLocalResources[core_mesh.MeshGatewayType] = &core_mesh.MeshGatewayResourceList{
+				Items: []*core_mesh.MeshGatewayResource{samples.GatewayResource()},
+			}
+
+			policy := getPolicy(given.caseName)
+
+			xdsCtx := *xds_builders.Context().
+				WithMeshBuilder(samples.MeshMTLSBuilder()).
+				WithResources(resources).
+				Build()
+			proxy := xds_builders.Proxy().
+				WithDataplane(samples.GatewayDataplaneBuilder()).
+				WithSecretsTracker(secretsTracker).
+				WithPolicies(xds_builders.MatchedPolicies().
+					WithGatewayPolicy(api.MeshTLSType, getGatewayRules(policy.Spec.From)).
+					WithGatewayPolicy(meshhttproute_api.MeshHTTPRouteType, core_rules.GatewayRules{
+						ToRules: core_rules.GatewayToRules{
+							ByListenerAndHostname: map[core_rules.InboundListenerHostname]core_rules.Rules{
+								core_rules.NewInboundListenerHostname("192.168.0.1", 8080, "*"): {
+									{
+										Subset: core_rules.MeshSubset(),
+										Conf: meshhttproute_api.PolicyDefault{
+											Rules: []meshhttproute_api.Rule{
+												{
+													Matches: []meshhttproute_api.Match{{
+														Path: &meshhttproute_api.PathMatch{
+															Type:  meshhttproute_api.Exact,
+															Value: "/",
+														},
+													}},
+													Default: meshhttproute_api.RuleConf{
+														BackendRefs: &[]common_api.BackendRef{{
+															TargetRef: builders.TargetRefService("backend"),
+															Weight:    pointer.To(uint(100)),
+														}},
+													},
+												},
+												{
+													Matches: []meshhttproute_api.Match{{
+														Path: &meshhttproute_api.PathMatch{
+															Type:  meshhttproute_api.Exact,
+															Value: "/another-route",
+														},
+														Method: pointer.To[meshhttproute_api.Method]("GET"),
+													}},
+													Default: meshhttproute_api.RuleConf{
+														BackendRefs: &[]common_api.BackendRef{{
+															TargetRef: builders.TargetRefService("backend"),
+															Weight:    pointer.To(uint(100)),
+														}},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					})).
+				Build()
+			for n, p := range core_plugins.Plugins().ProxyPlugins() {
+				Expect(p.Apply(context.Background(), xdsCtx.Mesh, proxy)).To(Succeed(), n)
+			}
+			gatewayGenerator := gateway_plugin.NewGenerator("test-zone")
+			generatedResources, err := gatewayGenerator.Generate(context.Background(), nil, xdsCtx, proxy)
+			Expect(err).NotTo(HaveOccurred())
+
+			httpRoutePlugin := meshhttproute_plugin.NewPlugin().(core_plugins.PolicyPlugin)
+			Expect(httpRoutePlugin.Apply(generatedResources, xdsCtx, proxy)).To(Succeed())
+
+			// when
+			plugin := plugin.NewPlugin().(core_plugins.PolicyPlugin)
+			Expect(plugin.Apply(generatedResources, xdsCtx, proxy)).To(Succeed())
+
+			// then
+			Expect(getResource(generatedResources, envoy_resource.ListenerType)).
+				To(matchers.MatchGoldenYAML(fmt.Sprintf("testdata/%s.listeners.golden.yaml", given.caseName)))
+			Expect(getResource(generatedResources, envoy_resource.ClusterType)).
+				To(matchers.MatchGoldenYAML(fmt.Sprintf("testdata/%s.clusters.golden.yaml", given.caseName)))
+			Expect(getResource(generatedResources, envoy_resource.RouteType)).
+				To(matchers.MatchGoldenYAML(fmt.Sprintf("testdata/%s.routes.golden.yaml", given.caseName)))
+		},
+		Entry("tls version and cypher on gateway", testCase{
+			caseName:    "gateway-tls-version-and-cipher",
+			meshBuilder: samples.MeshDefaultBuilder(),
+		}),
+	)
 })
 
 func getResources(secretsTracker core_xds.SecretsTracker, mesh *builders.MeshBuilder) []*core_xds.Resource {
@@ -211,3 +311,27 @@ func getFromRules(froms []api.From) core_rules.FromRules {
 		},
 	}
 }
+
+func getGatewayRules(froms []api.From) core_rules.GatewayRules {
+	var rules []*core_rules.Rule
+
+	for _, from := range froms {
+		rules = append(rules, &core_rules.Rule{
+			Subset: core_rules.Subset{},
+			Conf:   from.Default,
+		})
+	}
+
+	return core_rules.GatewayRules{
+		FromRules: map[core_rules.InboundListener]core_rules.Rules{
+			{
+				Address: "127.0.0.1",
+				Port:    17777,
+			}: rules,
+			{
+				Address: "127.0.0.1",
+				Port:    17778,
+			}: rules,
+		},
+	}
+}
diff --git a/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.clusters.golden.yaml b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.clusters.golden.yaml
new file mode 100644
index 000000000..7ea55c414
--- /dev/null
+++ b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.clusters.golden.yaml
@@ -0,0 +1,54 @@
+resources:
+- name: backend-26cb64fa4e85e7b7
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    connectTimeout: 5s
+    edsClusterConfig:
+      edsConfig:
+        ads: {}
+        initialFetchTimeout: 0s
+        resourceApiVersion: V3
+    name: backend-26cb64fa4e85e7b7
+    perConnectionBufferLimitBytes: 32768
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - kuma
+          combinedValidationContext:
+            defaultValidationContext:
+              matchTypedSubjectAltNames:
+              - matcher:
+                  exact: spiffe://default/backend
+                sanType: URI
+            validationContextSdsSecretConfig:
+              name: mesh_ca:secret:default
+              sdsConfig:
+                ads: {}
+                resourceApiVersion: V3
+          tlsCertificateSdsSecretConfigs:
+          - name: identity_cert:secret:default
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          tlsParams:
+            cipherSuites:
+            - ECDHE-ECDSA-AES128-GCM-SHA256
+            - ECDHE-ECDSA-AES256-GCM-SHA384
+            - ECDHE-ECDSA-CHACHA20-POLY1305
+            - ECDHE-RSA-AES128-GCM-SHA256
+            - ECDHE-RSA-AES256-GCM-SHA384
+            - ECDHE-RSA-CHACHA20-POLY1305
+            tlsMaximumProtocolVersion: TLSv1_3
+            tlsMinimumProtocolVersion: TLSv1_3
+        sni: backend{mesh=default}
+    type: EDS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        commonHttpProtocolOptions:
+          idleTimeout: 0s
+        explicitHttpConfig:
+          httpProtocolOptions: {}
diff --git a/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.listeners.golden.yaml b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.listeners.golden.yaml
new file mode 100644
index 000000000..d9e3529e6
--- /dev/null
+++ b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.listeners.golden.yaml
@@ -0,0 +1,60 @@
+resources:
+- name: sample-gateway:HTTP:8080
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 192.168.0.1
+        portValue: 8080
+    enableReusePort: true
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          commonHttpProtocolOptions:
+            headersWithUnderscoresAction: REJECT_REQUEST
+            idleTimeout: 300s
+          http2ProtocolOptions:
+            allowConnect: true
+            initialConnectionWindowSize: 1048576
+            initialStreamWindowSize: 65536
+            maxConcurrentStreams: 100
+          httpFilters:
+          - name: envoy.filters.http.local_ratelimit
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
+              statPrefix: rate_limit
+          - name: gzip-compress
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor
+              compressorLibrary:
+                name: gzip
+                typedConfig:
+                  '@type': type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip
+              responseDirectionConfig:
+                disableOnEtagHeader: true
+          - name: envoy.filters.http.router
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          mergeSlashes: true
+          normalizePath: true
+          pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+          rds:
+            configSource:
+              ads: {}
+              initialFetchTimeout: 0s
+              resourceApiVersion: V3
+            routeConfigName: sample-gateway:HTTP:8080:*
+          requestHeadersTimeout: 0.500s
+          serverName: Kuma Gateway
+          statPrefix: sample-gateway
+          streamIdleTimeout: 5s
+          useRemoteAddress: true
+    listenerFilters:
+    - name: envoy.filters.listener.tls_inspector
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+    name: sample-gateway:HTTP:8080
+    perConnectionBufferLimitBytes: 32768
+    trafficDirection: INBOUND
diff --git a/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.policy.yaml b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.policy.yaml
new file mode 100644
index 000000000..3320a35fb
--- /dev/null
+++ b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.policy.yaml
@@ -0,0 +1,16 @@
+targetRef:
+  kind: Mesh
+from:
+  - targetRef:
+      kind: Mesh
+    default:
+      tlsVersion:
+        min: TLS13
+        max: TLS13
+      tlsCiphers:
+        - "ECDHE-ECDSA-AES128-GCM-SHA256"
+        - "ECDHE-ECDSA-AES256-GCM-SHA384"
+        - "ECDHE-ECDSA-CHACHA20-POLY1305"
+        - "ECDHE-RSA-AES128-GCM-SHA256"
+        - "ECDHE-RSA-AES256-GCM-SHA384"
+        - "ECDHE-RSA-CHACHA20-POLY1305"
diff --git a/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.routes.golden.yaml b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.routes.golden.yaml
new file mode 100644
index 000000000..4338c54a1
--- /dev/null
+++ b/pkg/plugins/policies/meshtls/plugin/v1alpha1/testdata/gateway-tls-version-and-cipher.routes.golden.yaml
@@ -0,0 +1,46 @@
+resources:
+- name: sample-gateway:HTTP:8080:*
+  resource:
+    '@type': type.googleapis.com/envoy.config.route.v3.RouteConfiguration
+    ignorePortInHostMatching: true
+    name: sample-gateway:HTTP:8080:*
+    requestHeadersToRemove:
+    - x-kuma-tags
+    validateClusters: false
+    virtualHosts:
+    - domains:
+      - '*'
+      name: '*'
+      routes:
+      - match:
+          headers:
+          - name: :method
+            stringMatch:
+              exact: GET
+          path: /another-route
+        name: L2t9uuHxXPXUg5ULwRirUaoxN4BU/zlqyPK8peSWm2g=
+        route:
+          clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+          idleTimeout: 5s
+          weightedClusters:
+            clusters:
+            - name: backend-26cb64fa4e85e7b7
+              requestHeadersToAdd:
+              - header:
+                  key: x-kuma-tags
+                  value: '&kuma.io/service=sample-gateway&'
+              weight: 100
+      - match:
+          path: /
+        name: JNNc6//C3P17nUsOJm5f4kqG+U3v8pXhS0od9C3+oss=
+        route:
+          clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+          idleTimeout: 5s
+          weightedClusters:
+            clusters:
+            - name: backend-26cb64fa4e85e7b7
+              requestHeadersToAdd:
+              - header:
+                  key: x-kuma-tags
+                  value: '&kuma.io/service=sample-gateway&'
+              weight: 100
diff --git a/pkg/test/resources/builders/meshmultizoneservice_builder.go b/pkg/test/resources/builders/meshmultizoneservice_builder.go
index 203d9b198..4c58b2e5d 100644
--- a/pkg/test/resources/builders/meshmultizoneservice_builder.go
+++ b/pkg/test/resources/builders/meshmultizoneservice_builder.go
@@ -3,11 +3,8 @@ package builders
 import (
 	"context"
 
-	"k8s.io/apimachinery/pkg/util/intstr"
-
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	meshmzservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshmultizoneservice/api/v1alpha1"
-	meshservice_api "github.com/kumahq/kuma/pkg/core/resources/apis/meshservice/api/v1alpha1"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
@@ -60,18 +57,14 @@ func (m *MeshMultiZoneServiceBuilder) AddMatchedMeshServiceName(msID core_model.
 	return m
 }
 
-func (m *MeshMultiZoneServiceBuilder) AddPort(port meshservice_api.Port) *MeshMultiZoneServiceBuilder {
+func (m *MeshMultiZoneServiceBuilder) AddPort(port meshmzservice_api.Port) *MeshMultiZoneServiceBuilder {
 	m.res.Spec.Ports = append(m.res.Spec.Ports, port)
 	return m
 }
 
-func (m *MeshMultiZoneServiceBuilder) AddIntPort(port, target uint32, protocol core_mesh.Protocol) *MeshMultiZoneServiceBuilder {
-	m.res.Spec.Ports = append(m.res.Spec.Ports, meshservice_api.Port{
-		Port: port,
-		TargetPort: intstr.IntOrString{
-			Type:   intstr.Int,
-			IntVal: int32(target),
-		},
+func (m *MeshMultiZoneServiceBuilder) AddIntPort(port uint32, protocol core_mesh.Protocol) *MeshMultiZoneServiceBuilder {
+	m.res.Spec.Ports = append(m.res.Spec.Ports, meshmzservice_api.Port{
+		Port:        port,
 		AppProtocol: protocol,
 	})
 	return m
diff --git a/pkg/test/resources/builders/meshtimeout_builder.go b/pkg/test/resources/builders/meshtimeout_builder.go
index 6339ae420..1854c8651 100644
--- a/pkg/test/resources/builders/meshtimeout_builder.go
+++ b/pkg/test/resources/builders/meshtimeout_builder.go
@@ -2,6 +2,7 @@ package builders
 
 import (
 	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
+	"github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	meshtimeout_api "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/api/v1alpha1"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
@@ -39,6 +40,14 @@ func (m *MeshTimeoutBuilder) WithMesh(mesh string) *MeshTimeoutBuilder {
 	return m
 }
 
+func (m *MeshTimeoutBuilder) WithNamespace(namespace string) *MeshTimeoutBuilder {
+	if m.res.Meta.(*test_model.ResourceMeta).NameExtensions == nil {
+		m.res.Meta.(*test_model.ResourceMeta).NameExtensions = core_model.ResourceNameExtensions{}
+	}
+	m.res.Meta.(*test_model.ResourceMeta).NameExtensions[v1alpha1.KubeNamespaceTag] = namespace
+	return m
+}
+
 func (m *MeshTimeoutBuilder) AddFrom(targetRef common_api.TargetRef, conf meshtimeout_api.Conf) *MeshTimeoutBuilder {
 	m.res.Spec.From = append(m.res.Spec.From, meshtimeout_api.From{
 		TargetRef: targetRef,
diff --git a/pkg/test/resources/samples/meshmultizoneservice_samples.go b/pkg/test/resources/samples/meshmultizoneservice_samples.go
index 1af76e8d7..bf8b3009c 100644
--- a/pkg/test/resources/samples/meshmultizoneservice_samples.go
+++ b/pkg/test/resources/samples/meshmultizoneservice_samples.go
@@ -11,7 +11,7 @@ func MeshMultiZoneServiceBackendBuilder() *builders.MeshMultiZoneServiceBuilder
 		WithServiceLabelSelector(map[string]string{
 			mesh_proto.DisplayName: "backend",
 		}).
-		AddIntPort(builders.FirstInboundPort, builders.FirstInboundPort, "http")
+		AddIntPort(builders.FirstInboundPort, "http")
 }
 
 func MeshMultiZoneServiceBackend() *meshmzservice_api.MeshMultiZoneServiceResource {
diff --git a/test/e2e_env/kubernetes/gateway/gateway.go b/test/e2e_env/kubernetes/gateway/gateway.go
index 9dae37522..9851e972e 100644
--- a/test/e2e_env/kubernetes/gateway/gateway.go
+++ b/test/e2e_env/kubernetes/gateway/gateway.go
@@ -3,6 +3,8 @@ package gateway
 import (
 	"encoding/base64"
 	"fmt"
+	"maps"
+	"slices"
 	"strings"
 	"time"
 
@@ -1039,6 +1041,101 @@ spec:
 		})
 	})
 
+	Context("MeshTLS", func() {
+		httpRoute := fmt.Sprintf(`
+apiVersion: kuma.io/v1alpha1
+kind: MeshHTTPRoute
+metadata:
+  name: http-route-1-mtls
+  namespace: %s
+  labels:
+    kuma.io/mesh: %s
+spec:
+  targetRef:
+    kind: MeshGateway
+    name: simple-gateway
+  to:
+  - targetRef:
+      kind: Mesh
+    rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: "/test"
+      default:
+        backendRefs:
+        - kind: MeshService
+          name: "echo-server_simple-gateway_svc_80"`, Config.KumaNamespace, meshName)
+
+		meshTls := fmt.Sprintf(`
+apiVersion: kuma.io/v1alpha1
+kind: MeshTLS
+metadata:
+  name: mesh-tls-1-gateway
+  namespace: %s
+  labels:
+    kuma.io/mesh: %s
+spec:
+  targetRef:
+    kind: Mesh
+  from:
+    - targetRef:
+        kind: Mesh
+      default:
+        tlsVersion:
+          min: TLS13
+          max: TLS13`, Config.KumaNamespace, meshName)
+
+		BeforeAll(func() {
+			err := NewClusterSetup().
+				Install(YamlK8s(httpRoute)).
+				Setup(kubernetes.Cluster)
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		AfterAll(func() {
+			err := NewClusterSetup().
+				Install(DeleteYamlK8s(meshTls)).
+				Install(DeleteYamlK8s(httpRoute)).
+				Setup(kubernetes.Cluster)
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		It("should not break traffic", func() {
+			// then
+			// can access test-server from a gateway
+			Eventually(func(g Gomega) {
+				response, err := client.CollectEchoResponse(
+					kubernetes.Cluster, "demo-client",
+					"http://simple-gateway.simple-gateway:8080/test",
+					client.WithHeader("host", "example.kuma.io"),
+					client.FromKubernetesPod(clientNamespace, "demo-client"),
+				)
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
+				g.Expect(response.Received.Headers["Host"]).To(ContainElements("example.kuma.io"))
+			}, "30s", "1s").Should(Succeed())
+
+			// when
+			// applied MeshTLS policy to set 1.3 version on all dataplanes
+			Expect(kubernetes.Cluster.Install(YamlK8s(meshTls))).To(Succeed())
+
+			// then
+			// still can access test-server from the gateway
+			Eventually(func(g Gomega) {
+				response, err := client.CollectEchoResponse(
+					kubernetes.Cluster, "demo-client",
+					"http://simple-gateway.simple-gateway:8080/test",
+					client.WithHeader("host", "example.kuma.io"),
+					client.FromKubernetesPod(clientNamespace, "demo-client"),
+				)
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(response.Received.Headers["Host"]).To(HaveLen(1))
+				g.Expect(response.Received.Headers["Host"]).To(ContainElements("example.kuma.io"))
+			}, "30s", "1s").MustPassRepeatedly(5).Should(Succeed())
+		})
+	})
+
 	Context("External Service", func() {
 		externalService := `
 apiVersion: kuma.io/v1alpha1
@@ -1218,6 +1315,9 @@ spec:
 
 				g.Expect(err).ToNot(HaveOccurred())
 				g.Expect(responses).To(HaveLen(1))
+				g.Expect(responses).To(HaveKey(HavePrefix("mes-echo-server")))
+				counts := slices.Collect(maps.Values(responses))
+				g.Expect(counts[0]).To(Equal(10))
 			}, "30s", "1s").MustPassRepeatedly(5).Should(Succeed())
 		})
 	})
diff --git a/test/e2e_env/multizone/meshmultizoneservice/connectivity.go b/test/e2e_env/multizone/meshmultizoneservice/connectivity.go
index bfd319fa4..035ac0077 100644
--- a/test/e2e_env/multizone/meshmultizoneservice/connectivity.go
+++ b/test/e2e_env/multizone/meshmultizoneservice/connectivity.go
@@ -1,9 +1,13 @@
 package meshmultizoneservice
 
 import (
+	"fmt"
+
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/types"
 
+	"github.com/kumahq/kuma/test/e2e_env/kubernetes/gateway"
 	. "github.com/kumahq/kuma/test/framework"
 	"github.com/kumahq/kuma/test/framework/client"
 	"github.com/kumahq/kuma/test/framework/deployments/democlient"
@@ -13,6 +17,7 @@ import (
 
 func Connectivity() {
 	namespace := "mzmsconnectivity"
+	clientNamespace := "mzmsconnectivity-client"
 	meshName := "mzmsconnectivity"
 
 	BeforeAll(func() {
@@ -37,6 +42,52 @@ spec:
 			Setup(multizone.Global)).To(Succeed())
 		Expect(WaitForMesh(meshName, multizone.Zones())).To(Succeed())
 
+		meshGateway := fmt.Sprintf(`
+apiVersion: kuma.io/v1alpha1
+kind: MeshGateway
+metadata:
+  name: edge-gateway
+  labels:
+    kuma.io/origin: zone
+mesh: %s
+spec:
+  selectors:
+  - match:
+      kuma.io/service: edge-gateway_%s_svc
+  conf:
+    listeners:
+    - port: 8080
+      protocol: HTTP
+`, meshName, namespace)
+		gatewayRoute := fmt.Sprintf(`
+apiVersion: kuma.io/v1alpha1
+kind: MeshHTTPRoute
+metadata:
+  name: route
+  namespace: %s
+  labels:
+    kuma.io/mesh: %s
+    kuma.io/origin: zone
+spec:
+  targetRef:
+    kind: MeshGateway
+    name: edge-gateway
+  to:
+    - targetRef:
+        kind: Mesh
+      rules:
+        - matches:
+            - path:
+                type: PathPrefix
+                value: /mmzs
+          default:
+            backendRefs:
+              - kind: MeshMultiZoneService
+                labels:
+                  kuma.io/display-name: test-server
+                port: 80
+                weight: 1
+`, Config.KumaNamespace, meshName)
 		err := NewClusterSetup().
 			Install(NamespaceWithSidecarInjection(namespace)).
 			Install(testserver.Install(
@@ -44,7 +95,15 @@ spec:
 				testserver.WithMesh(meshName),
 				testserver.WithEchoArgs("echo", "--instance", "kube-test-server-1"),
 			)).
+			Install(Namespace(clientNamespace)).
+			Install(testserver.Install(
+				testserver.WithName("demo-client"),
+				testserver.WithNamespace(clientNamespace),
+			)).
 			Install(democlient.Install(democlient.WithNamespace(namespace), democlient.WithMesh(meshName))).
+			Install(YamlK8s(meshGateway)).
+			Install(YamlK8s(gatewayRoute)).
+			Install(YamlK8s(gateway.MkGatewayInstance("edge-gateway", namespace, meshName))).
 			Setup(multizone.KubeZone1)
 		Expect(err).ToNot(HaveOccurred())
 
@@ -95,6 +154,30 @@ spec:
 		}
 	}
 
+	type testCase struct {
+		address       string
+		instanceMatch types.GomegaMatcher
+	}
+
+	DescribeTable("Gateway in Kubernetes",
+		func(given testCase) {
+			Eventually(func(g Gomega) {
+				response, err := client.CollectEchoResponse(
+					multizone.KubeZone1, "demo-client",
+					fmt.Sprintf("http://edge-gateway.%s:8080/%s", namespace, given.address),
+					client.FromKubernetesPod(clientNamespace, "demo-client"),
+				)
+
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(response.Instance).To(given.instanceMatch)
+			}, "30s", "1s").Should(Succeed())
+		},
+		Entry("should access MeshMultiZoneService", testCase{
+			address:       "/mmzs",
+			instanceMatch: Equal("kube-test-server-1"),
+		}),
+	)
+
 	It("should access app from kube cluster and fallback to other zones", func() {
 		// given traffic to local zone only
 		Eventually(responseFromInstance(multizone.KubeZone1), "30s", "1s").