Repository: kumahq/kuma
Pull request #8828 (2024-01-12 09:28:41)

feat(toggles): add plugin policy toggles
alternative to https://github.com/kumahq/kuma/pull/8760

### Checklist prior to review

<!--
Each of these sections need to be filled by the author when opening the PR.

If something doesn't apply please check the box and add a justification after the `--`
-->

- [x] [Link to relevant issue][1] as well as docs and UI issues --
- [ ] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS --
- [ ] Tests (Unit test, E2E tests, manual test on universal and k8s) --
  - Don't forget `ci/` labels to run additional/fewer tests
- [ ] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)? --
- [ ] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label) --

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword


slonka: /format
slonka: /golden_files

Patch:
diff --git a/api/system/v1alpha1/zone_insight.pb.go b/api/system/v1alpha1/zone_insight.pb.go
index 9e1d3c055..25d661063 100644
--- a/api/system/v1alpha1/zone_insight.pb.go
+++ b/api/system/v1alpha1/zone_insight.pb.go
@@ -189,7 +189,8 @@ type KDSSubscription struct {
 	Config string `protobuf:"bytes,8,opt,name=config,proto3" json:"config,omitempty"`
 	// Indicates if subscription provided auth token
 	AuthTokenProvided bool `protobuf:"varint,9,opt,name=auth_token_provided,json=authTokenProvided,proto3" json:"auth_token_provided,omitempty"`
-	// Zone CP instance that handled the given subscription (This is the leader at time of connection).
+	// Zone CP instance that handled the given subscription (This is the leader at
+	// time of connection).
 	ZoneInstanceId string `protobuf:"bytes,10,opt,name=zone_instance_id,json=zoneInstanceId,proto3" json:"zone_instance_id,omitempty"`
 }
 
diff --git a/api/system/v1alpha1/zone_insight.proto b/api/system/v1alpha1/zone_insight.proto
index 4df49b1a3..d0ef9f157 100644
--- a/api/system/v1alpha1/zone_insight.proto
+++ b/api/system/v1alpha1/zone_insight.proto
@@ -77,7 +77,8 @@ message KDSSubscription {
   // Indicates if subscription provided auth token
   bool auth_token_provided = 9;
 
-  // Zone CP instance that handled the given subscription (This is the leader at time of connection).
+  // Zone CP instance that handled the given subscription (This is the leader at
+  // time of connection).
   string zone_instance_id = 10;
 }
 
diff --git a/app/kumactl/cmd/root.go b/app/kumactl/cmd/root.go
index dabf40a15..94979fcb8 100644
--- a/app/kumactl/cmd/root.go
+++ b/app/kumactl/cmd/root.go
@@ -24,7 +24,7 @@ import (
 	kuma_cmd "github.com/kumahq/kuma/pkg/cmd"
 	"github.com/kumahq/kuma/pkg/core"
 	kuma_log "github.com/kumahq/kuma/pkg/log"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
+	"github.com/kumahq/kuma/pkg/plugins/policies"
 	// Register gateway resources.
 	_ "github.com/kumahq/kuma/pkg/plugins/runtime/gateway/register"
 	// import Envoy protobuf definitions so (un)marshaling Envoy protobuf works
@@ -112,3 +112,7 @@ func Execute() {
 		os.Exit(1)
 	}
 }
+
+func init() {
+	policies.InitAllPolicies()
+}
diff --git a/deployments/charts/kuma/templates/_helpers.tpl b/deployments/charts/kuma/templates/_helpers.tpl
index b71b3f8bc..dbe5845af 100644
--- a/deployments/charts/kuma/templates/_helpers.tpl
+++ b/deployments/charts/kuma/templates/_helpers.tpl
@@ -184,6 +184,16 @@ returns: formatted image string
 {{- define "kuma.parentSecrets" -}}
 {{- end -}}
 
+{{- define "kuma.pluginPoliciesEnabled" -}}
+{{- $list := list -}}
+{{- range $k, $v := .Values.plugins.policies -}}
+{{- if $v -}}
+{{- $list = append $list (printf "%s" $k) -}}
+{{- end -}}
+{{- end -}}
+{{ join "," $list }}
+{{- end -}}
+
 {{- define "kuma.defaultEnv" -}}
 env:
 {{ include "kuma.parentEnv" . }}
@@ -287,6 +297,8 @@ env:
 - name: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
   value: "true"
 {{- end }}
+- name: KUMA_PLUGIN_POLICIES_ENABLED
+  value: {{ include "kuma.pluginPoliciesEnabled" . | quote }}
 {{- end }}
 
 {{- define "kuma.controlPlane.tls.general.caSecretName" -}}
@@ -304,6 +316,8 @@ env:
 {{ end }}
 
 env:
+- name: KUMA_PLUGIN_POLICIES_ENABLED
+  value: {{ include "kuma.pluginPoliciesEnabled" . | quote }}
 - name: KUMA_GENERAL_WORK_DIR
   value: "/tmp/kuma"
 - name: KUMA_ENVIRONMENT
diff --git a/deployments/charts/kuma/templates/cp-rbac.yaml b/deployments/charts/kuma/templates/cp-rbac.yaml
index 365a260a2..d3efa8842 100644
--- a/deployments/charts/kuma/templates/cp-rbac.yaml
+++ b/deployments/charts/kuma/templates/cp-rbac.yaml
@@ -147,8 +147,10 @@ rules:
   {{- if .Values.experimental.gatewayAPI }}
       - meshgatewayconfigs
   {{- end }}
-  {{- range $policy, $empty := .Values.plugins.policies }}
+  {{- range $policy, $v := .Values.plugins.policies }}
+  {{- if $v }}
       - {{ $policy }}
+  {{- end}}
   {{- end}}
     verbs:
       - get
diff --git a/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml b/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml
index c249ba15d..f17b02855 100644
--- a/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml
+++ b/deployments/charts/kuma/templates/cp-webhooks-and-secrets.yaml
@@ -79,9 +79,11 @@ webhooks:
           - UPDATE
         resources:
           - meshes
-        {{- range $policy, $empty := .Values.plugins.policies }}
+        {{- range $policy, $v := .Values.plugins.policies }}
+        {{- if $v }}
           - {{ $policy }}
         {{- end}}
+        {{- end}}
     sideEffects: None
   - name: owner-reference.kuma-admission.kuma.io
     admissionReviewVersions: ["v1"]
@@ -120,9 +122,11 @@ webhooks:
           - trafficroutes
           - traffictraces
           - virtualoutbounds
-        {{- range $policy, $empty := .Values.plugins.policies }}
+        {{- range $policy, $v := .Values.plugins.policies }}
+        {{- if $v }}
           - {{ $policy }}
         {{- end}}
+        {{- end}}
   {{ .Values.controlPlane.webhooks.ownerReference.additionalRules | nindent 6 }}
     sideEffects: None
   {{- if ne .Values.controlPlane.mode "global" }}
@@ -232,9 +236,11 @@ webhooks:
           - virtualoutbounds
           - zones
           - containerpatches
-        {{- range $policy, $empty := .Values.plugins.policies }}
+        {{- range $policy, $v := .Values.plugins.policies }}
+        {{- if $v }}
           - {{ $policy }}
         {{- end}}
+        {{- end}}
     {{ .Values.controlPlane.webhooks.validator.additionalRules | nindent 6 }}
     sideEffects: None
   {{- if ne .Values.controlPlane.mode "global" }}
diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
index d2f9a3242..613065e33 100644
--- a/deployments/charts/kuma/values.yaml
+++ b/deployments/charts/kuma/values.yaml
@@ -722,17 +722,17 @@ postgres:
 # @ignored for helm-docs
 plugins:
   policies:
-    meshaccesslogs: {}
-    meshcircuitbreakers: {}
-    meshfaultinjections: {}
-    meshhealthchecks: {}
-    meshhttproutes: {}
-    meshloadbalancingstrategies: {}
-    meshmetrics: {}
-    meshproxypatches: {}
-    meshratelimits: {}
-    meshretries: {}
-    meshtcproutes: {}
-    meshtimeouts: {}
-    meshtraces: {}
-    meshtrafficpermissions: {}
+    meshaccesslogs: true
+    meshcircuitbreakers: true
+    meshfaultinjections: true
+    meshhealthchecks: true
+    meshhttproutes: true
+    meshloadbalancingstrategies: true
+    meshmetrics: true
+    meshproxypatches: true
+    meshratelimits: true
+    meshretries: true
+    meshtcproutes: true
+    meshtimeouts: true
+    meshtraces: true
+    meshtrafficpermissions: true
diff --git a/docs/generated/raw/helm-values.yaml b/docs/generated/raw/helm-values.yaml
index d2f9a3242..613065e33 100644
--- a/docs/generated/raw/helm-values.yaml
+++ b/docs/generated/raw/helm-values.yaml
@@ -722,17 +722,17 @@ postgres:
 # @ignored for helm-docs
 plugins:
   policies:
-    meshaccesslogs: {}
-    meshcircuitbreakers: {}
-    meshfaultinjections: {}
-    meshhealthchecks: {}
-    meshhttproutes: {}
-    meshloadbalancingstrategies: {}
-    meshmetrics: {}
-    meshproxypatches: {}
-    meshratelimits: {}
-    meshretries: {}
-    meshtcproutes: {}
-    meshtimeouts: {}
-    meshtraces: {}
-    meshtrafficpermissions: {}
+    meshaccesslogs: true
+    meshcircuitbreakers: true
+    meshfaultinjections: true
+    meshhealthchecks: true
+    meshhttproutes: true
+    meshloadbalancingstrategies: true
+    meshmetrics: true
+    meshproxypatches: true
+    meshratelimits: true
+    meshretries: true
+    meshtcproutes: true
+    meshtimeouts: true
+    meshtraces: true
+    meshtrafficpermissions: true
diff --git a/docs/generated/raw/kuma-cp.yaml b/docs/generated/raw/kuma-cp.yaml
index 4d74920c7..d1f063f11 100644
--- a/docs/generated/raw/kuma-cp.yaml
+++ b/docs/generated/raw/kuma-cp.yaml
@@ -2,17 +2,14 @@
 environment: universal # ENV: KUMA_ENVIRONMENT
 # Mode in which Kuma CP is running. Available values are: "global", "zone", "standalone" (deprecated, use "zone")
 mode: zone # ENV: KUMA_MODE
-
 # Resource Store configuration
 store:
   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
   type: memory # ENV: KUMA_STORE_TYPE
-
   # Kubernetes Store configuration (used when store.type=kubernetes)
   kubernetes:
     # Namespace where Control Plane is installed to.
     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
-
   # Postgres Store configuration (used when store.type=postgres)
   postgres:
     # Host of the Postgres DB
@@ -44,7 +41,7 @@ store:
     # MaxIdleConnections is the maximum number of connections in the idle connection pool
     # <0 value means no idle connections and 0 means default max idle connections.
     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
-    maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
+    maxIdleConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
     # MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
     maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
     # TLS settings
@@ -76,14 +73,12 @@ store:
       port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
       # Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
       ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
-
   # Cache for read only operations. This cache is local to the instance of the control plane.
   cache:
     # If true then cache is enabled
     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
     # Expiration time for elements in cache.
     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
-
   # Upsert (get and update) configuration
   upsert:
     # Base time for exponential backoff on upsert operations when retry is enabled
@@ -92,11 +87,9 @@ store:
     conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
     # Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
     conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
-
   # If true, skips validation of resource delete.
   # For example you don't have to delete all Dataplane objects before you delete a Mesh
   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
-
 # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
 bootstrapServer:
   # Parameters of bootstrap configuration
@@ -113,7 +106,6 @@ bootstrapServer:
     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
     # Connection timeout to the XDS Server
     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
-
 #  Monitoring Assignment Discovery Service (MADS) server configuration
 monitoringAssignmentServer:
   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
@@ -134,7 +126,6 @@ monitoringAssignmentServer:
   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
-
 # Envoy XDS server configuration
 xdsServer:
   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
@@ -149,7 +140,6 @@ xdsServer:
   # Disabling this may cause race conditions that one instance of CP removes proxy object
   # while proxy is connected to another instance of the CP.
   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
-
 # API Server configuration
 apiServer:
   # HTTP configuration of the API Server
@@ -211,7 +201,6 @@ apiServer:
         # - kid: 2
         #   keyFile: /keys/public.pem
         publicKeys: []
-
   # If true, then API Server will operate in read only mode (serving GET requests)
   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
@@ -229,7 +218,6 @@ apiServer:
     rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
     # The path to serve the GUI from
     basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
-
 # Environment-specific configuration
 runtime:
   # Kubernetes-specific configuration
@@ -273,7 +261,7 @@ runtime:
       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
-      caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
+      caCertFile: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
       # SidecarContainer defines configuration of the Kuma sidecar container.
       sidecarContainer:
         # Image name.
@@ -337,15 +325,15 @@ runtime:
         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
       # ContainerPatches is an optional list of ContainerPatch names which will be applied
       # to init and sidecar containers if workload is not annotated with a patch list.
-      containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
+      containerPatches: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
       # Configuration for a traffic that is intercepted by sidecar
       sidecarTraffic:
         # List of inbound ports that will be excluded from interception.
         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
-        excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
+        excludeInboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
         # List of outbound ports that will be excluded from interception.
         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
-        excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
+        excludeOutboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
       builtinDNS:
         # Use the built-in DNS
         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
@@ -402,7 +390,6 @@ runtime:
     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
     # VIPRefreshInterval defines how often all meshes' VIPs should be recomputed
     vipRefreshInterval: 500ms # ENV: KUMA_RUNTIME_UNIVERSAL_VIP_REFRESH_INTERVAL
-
 # Default Kuma entities configuration
 defaults:
   # If true, it skips creating the default Mesh
@@ -411,7 +398,6 @@ defaults:
   skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
   # If true, it creates the default routing (TrafficPermisson and TrafficRoute) resources for a new Mesh
   createMeshRoutingResources: false # ENV: KUMA_DEFAULTS_CREATE_MESH_ROUTING_RESOURCES
-
 # Metrics configuration
 metrics:
   dataplane:
@@ -438,12 +424,10 @@ metrics:
   controlPlane:
     # If true metrics show number of resources in the system should be reported
     reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
-
 # Reports configuration
 reports:
   # If true then usage stats will be reported
   enabled: false # ENV: KUMA_REPORTS_ENABLED
-
 # General configuration
 general:
   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
@@ -462,7 +446,6 @@ general:
   # Kuma stores in this directory autogenerated entities like certificates.
   # If empty then the working directory is $HOME/.kuma
   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
-
 # DNS Server configuration
 dnsServer:
   # The domain that the server will resolve the services for
@@ -473,7 +456,6 @@ dnsServer:
   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
   # The port to use along with the `<kuma.io/service>.mesh` dns entry
   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
-
 # Multizone mode
 multizone:
   global:
@@ -534,7 +516,6 @@ multizone:
       responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
     # disableOriginLabelValidation disables validation of the origin label when applying resources on Zone CP
     disableOriginLabelValidation: false # ENV: KUMA_MULTIZONE_ZONE_DISABLE_ORIGIN_LABEL_VALIDATION
-
 # Diagnostics configuration
 diagnostics:
   # Port of Diagnostic Server for checking health and readiness of the Control Plane
@@ -553,7 +534,6 @@ diagnostics:
   tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
   # TlsCipherSuites the list of cipher suites
   tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
-
 # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
 dpServer:
   # Port of the DP Server
@@ -657,7 +637,6 @@ dpServer:
       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
-
 # Intercommunication CP configuration
 interCp:
   # Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
@@ -678,8 +657,7 @@ interCp:
     # TlsMaxVersion the maximum version of TLS
     tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
     # TlsCipherSuites the list of cipher suites
-    tlsCipherSuites: [ ] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
-
+    tlsCipherSuites: [] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
 # Access Control configuration
 access:
   # Type of access strategy (available values: "static")
@@ -712,20 +690,19 @@ access:
       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
     viewConfigDump:
       # List of users that are allowed to get envoy config dump
-      users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
+      users: [] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
       # List of groups that are allowed to get envoy config dump
-      groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
+      groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
     viewStats:
       # List of users that are allowed to get envoy stats
-      users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
+      users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
       # List of groups that are allowed to get envoy stats
-      groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
+      groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
     viewClusters:
       # List of users that are allowed to get envoy clusters
-      users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
+      users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
       # List of groups that are allowed to get envoy clusters
-      groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
-
+      groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
 # Configuration of experimental features of Kuma
 experimental:
   # If true, experimental Gateway API is enabled
@@ -759,19 +736,33 @@ experimental:
   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
   # Lack of MeshTrafficPermission is treated as Deny the traffic.
   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
-
 proxy:
   gateway:
     # Sets the envoy runtime value to limit maximum number of incoming
     # connections to a builtin gateway data plane proxy
     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS
-
 tracing:
   openTelemetry:
     endpoint: "" # e.g. otel-collector:4317
-
 # Configuration of the event bus which is local to one instance of CP
 eventBus:
   # BufferSize controls the buffer for every single event listener.
   # If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
   bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE
+policies:
+  # PluginPoliciesEnabled controls which policy plugins are enabled
+  pluginPoliciesEnabled: # ENV: KUMA_PLUGIN_POLICIES_ENABLED
+    - meshaccesslogs
+    - meshcircuitbreakers
+    - meshfaultinjections
+    - meshhealthchecks
+    - meshhttproutes
+    - meshloadbalancingstrategies
+    - meshmetrics
+    - meshproxypatches
+    - meshratelimits
+    - meshretries
+    - meshtcproutes
+    - meshtimeouts
+    - meshtraces
+    - meshtrafficpermissions
diff --git a/mk/generate.mk b/mk/generate.mk
index 1975868b2..2372e8a88 100644
--- a/mk/generate.mk
+++ b/mk/generate.mk
@@ -50,8 +50,9 @@ POLICIES_DIR := pkg/plugins/policies
 COMMON_DIR := api/common
 
 policies = $(foreach dir,$(shell find pkg/plugins/policies -maxdepth 1 -mindepth 1 -type d | grep -v -e core | sort),$(notdir $(dir)))
+kuma_policies = $(foreach dir,$(shell find $(KUMA_DIR)/pkg/plugins/policies -maxdepth 1 -mindepth 1 -type d | grep -v -e core | sort),$(notdir $(dir)))
 
-generate/policies: generate/deep-copy/common $(addprefix generate/policy/,$(policies)) generate/policy-import generate/policy-helm ## Generate all policies written as plugins
+generate/policies: generate/deep-copy/common $(addprefix generate/policy/,$(policies)) generate/policy-import generate/policy-config generate/policy-defaults generate/policy-helm ## Generate all policies written as plugins
 
 .PHONY: clean/policies
 clean/policies: $(addprefix clean/policy/,$(policies))
@@ -75,7 +76,13 @@ generate/schema/%: generate/controller-gen/%
 	done
 
 generate/policy-import:
-	$(TOOLS_DIR)/policy-gen/generate-policy-import.sh $(GO_MODULE) $(policies)
+	./tools/policy-gen/generate-policy-import.sh $(GO_MODULE) $(policies)
+
+generate/policy-config:
+	./tools/policy-gen/generate-policy-config.sh $(policies)
+
+generate/policy-defaults:
+	./tools/policy-gen/generate-policy-defaults.sh $(KUMA_DIR) $(kuma_policies) $(policies)
 
 generate/policy-helm:
 	PATH=$(CI_TOOLS_BIN_DIR):$$PATH $(TOOLS_DIR)/policy-gen/generate-policy-helm.sh $(HELM_VALUES_FILE) $(HELM_CRD_DIR) $(HELM_VALUES_FILE_POLICY_PATH) $(policies)
diff --git a/pkg/config/app/kuma-cp/config.go b/pkg/config/app/kuma-cp/config.go
index 2d6561745..f6c62e866 100644
--- a/pkg/config/app/kuma-cp/config.go
+++ b/pkg/config/app/kuma-cp/config.go
@@ -18,6 +18,7 @@ import (
 	"github.com/kumahq/kuma/pkg/config/intercp"
 	"github.com/kumahq/kuma/pkg/config/mads"
 	"github.com/kumahq/kuma/pkg/config/multizone"
+	"github.com/kumahq/kuma/pkg/config/plugins/policies"
 	"github.com/kumahq/kuma/pkg/config/plugins/runtime"
 	"github.com/kumahq/kuma/pkg/config/tracing"
 	config_types "github.com/kumahq/kuma/pkg/config/types"
@@ -170,6 +171,8 @@ type Config struct {
 	Tracing tracing.Config `json:"tracing"`
 	// EventBus is a configuration of the event bus which is local to one instance of CP.
 	EventBus eventbus.Config `json:"eventBus"`
+	// Policies is a configuration of plugin policies like MeshAccessLog, MeshTrace etc.
+	Policies *policies.Config `json:"policies"`
 }
 
 func (c Config) IsFederatedZoneCP() bool {
@@ -193,6 +196,7 @@ func (c *Config) Sanitize() {
 	c.DNSServer.Sanitize()
 	c.Multizone.Sanitize()
 	c.Diagnostics.Sanitize()
+	c.Policies.Sanitize()
 }
 
 func (c *Config) PostProcess() error {
@@ -209,6 +213,7 @@ func (c *Config) PostProcess() error {
 		c.DNSServer.PostProcess(),
 		c.Multizone.PostProcess(),
 		c.Diagnostics.PostProcess(),
+		c.Policies.PostProcess(),
 	)
 }
 
@@ -267,6 +272,7 @@ var DefaultConfig = func() Config {
 		Proxy:    xds.DefaultProxyConfig(),
 		InterCp:  intercp.DefaultInterCpConfig(),
 		EventBus: eventbus.Default(),
+		Policies: policies.DefaultPoliciesConfig(),
 	}
 }
 
@@ -326,6 +332,9 @@ func (c *Config) Validate() error {
 	if err := c.Tracing.Validate(); err != nil {
 		return errors.Wrap(err, "Tracing validation failed")
 	}
+	if err := c.Policies.Validate(); err != nil {
+		return errors.Wrap(err, "Policies validation failed")
+	}
 	return nil
 }
 
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index 4d74920c7..d1f063f11 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -2,17 +2,14 @@
 environment: universal # ENV: KUMA_ENVIRONMENT
 # Mode in which Kuma CP is running. Available values are: "global", "zone", "standalone" (deprecated, use "zone")
 mode: zone # ENV: KUMA_MODE
-
 # Resource Store configuration
 store:
   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
   type: memory # ENV: KUMA_STORE_TYPE
-
   # Kubernetes Store configuration (used when store.type=kubernetes)
   kubernetes:
     # Namespace where Control Plane is installed to.
     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
-
   # Postgres Store configuration (used when store.type=postgres)
   postgres:
     # Host of the Postgres DB
@@ -44,7 +41,7 @@ store:
     # MaxIdleConnections is the maximum number of connections in the idle connection pool
     # <0 value means no idle connections and 0 means default max idle connections.
     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
-    maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
+    maxIdleConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
     # MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
     maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
     # TLS settings
@@ -76,14 +73,12 @@ store:
       port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
       # Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
       ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
-
   # Cache for read only operations. This cache is local to the instance of the control plane.
   cache:
     # If true then cache is enabled
     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
     # Expiration time for elements in cache.
     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
-
   # Upsert (get and update) configuration
   upsert:
     # Base time for exponential backoff on upsert operations when retry is enabled
@@ -92,11 +87,9 @@ store:
     conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
     # Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
     conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
-
   # If true, skips validation of resource delete.
   # For example you don't have to delete all Dataplane objects before you delete a Mesh
   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
-
 # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
 bootstrapServer:
   # Parameters of bootstrap configuration
@@ -113,7 +106,6 @@ bootstrapServer:
     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
     # Connection timeout to the XDS Server
     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
-
 #  Monitoring Assignment Discovery Service (MADS) server configuration
 monitoringAssignmentServer:
   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
@@ -134,7 +126,6 @@ monitoringAssignmentServer:
   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
-
 # Envoy XDS server configuration
 xdsServer:
   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
@@ -149,7 +140,6 @@ xdsServer:
   # Disabling this may cause race conditions that one instance of CP removes proxy object
   # while proxy is connected to another instance of the CP.
   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
-
 # API Server configuration
 apiServer:
   # HTTP configuration of the API Server
@@ -211,7 +201,6 @@ apiServer:
         # - kid: 2
         #   keyFile: /keys/public.pem
         publicKeys: []
-
   # If true, then API Server will operate in read only mode (serving GET requests)
   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
@@ -229,7 +218,6 @@ apiServer:
     rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
     # The path to serve the GUI from
     basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
-
 # Environment-specific configuration
 runtime:
   # Kubernetes-specific configuration
@@ -273,7 +261,7 @@ runtime:
       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
-      caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
+      caCertFile: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
       # SidecarContainer defines configuration of the Kuma sidecar container.
       sidecarContainer:
         # Image name.
@@ -337,15 +325,15 @@ runtime:
         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
       # ContainerPatches is an optional list of ContainerPatch names which will be applied
       # to init and sidecar containers if workload is not annotated with a patch list.
-      containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
+      containerPatches: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
       # Configuration for a traffic that is intercepted by sidecar
       sidecarTraffic:
         # List of inbound ports that will be excluded from interception.
         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
-        excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
+        excludeInboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
         # List of outbound ports that will be excluded from interception.
         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
-        excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
+        excludeOutboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
       builtinDNS:
         # Use the built-in DNS
         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
@@ -402,7 +390,6 @@ runtime:
     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
     # VIPRefreshInterval defines how often all meshes' VIPs should be recomputed
     vipRefreshInterval: 500ms # ENV: KUMA_RUNTIME_UNIVERSAL_VIP_REFRESH_INTERVAL
-
 # Default Kuma entities configuration
 defaults:
   # If true, it skips creating the default Mesh
@@ -411,7 +398,6 @@ defaults:
   skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
   # If true, it creates the default routing (TrafficPermisson and TrafficRoute) resources for a new Mesh
   createMeshRoutingResources: false # ENV: KUMA_DEFAULTS_CREATE_MESH_ROUTING_RESOURCES
-
 # Metrics configuration
 metrics:
   dataplane:
@@ -438,12 +424,10 @@ metrics:
   controlPlane:
     # If true metrics show number of resources in the system should be reported
     reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
-
 # Reports configuration
 reports:
   # If true then usage stats will be reported
   enabled: false # ENV: KUMA_REPORTS_ENABLED
-
 # General configuration
 general:
   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
@@ -462,7 +446,6 @@ general:
   # Kuma stores in this directory autogenerated entities like certificates.
   # If empty then the working directory is $HOME/.kuma
   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
-
 # DNS Server configuration
 dnsServer:
   # The domain that the server will resolve the services for
@@ -473,7 +456,6 @@ dnsServer:
   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
   # The port to use along with the `<kuma.io/service>.mesh` dns entry
   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
-
 # Multizone mode
 multizone:
   global:
@@ -534,7 +516,6 @@ multizone:
       responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
     # disableOriginLabelValidation disables validation of the origin label when applying resources on Zone CP
     disableOriginLabelValidation: false # ENV: KUMA_MULTIZONE_ZONE_DISABLE_ORIGIN_LABEL_VALIDATION
-
 # Diagnostics configuration
 diagnostics:
   # Port of Diagnostic Server for checking health and readiness of the Control Plane
@@ -553,7 +534,6 @@ diagnostics:
   tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
   # TlsCipherSuites the list of cipher suites
   tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
-
 # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
 dpServer:
   # Port of the DP Server
@@ -657,7 +637,6 @@ dpServer:
       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
-
 # Intercommunication CP configuration
 interCp:
   # Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
@@ -678,8 +657,7 @@ interCp:
     # TlsMaxVersion the maximum version of TLS
     tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
     # TlsCipherSuites the list of cipher suites
-    tlsCipherSuites: [ ] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
-
+    tlsCipherSuites: [] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
 # Access Control configuration
 access:
   # Type of access strategy (available values: "static")
@@ -712,20 +690,19 @@ access:
       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
     viewConfigDump:
       # List of users that are allowed to get envoy config dump
-      users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
+      users: [] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
       # List of groups that are allowed to get envoy config dump
-      groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
+      groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
     viewStats:
       # List of users that are allowed to get envoy stats
-      users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
+      users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
       # List of groups that are allowed to get envoy stats
-      groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
+      groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
     viewClusters:
       # List of users that are allowed to get envoy clusters
-      users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
+      users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
       # List of groups that are allowed to get envoy clusters
-      groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
-
+      groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
 # Configuration of experimental features of Kuma
 experimental:
   # If true, experimental Gateway API is enabled
@@ -759,19 +736,33 @@ experimental:
   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
   # Lack of MeshTrafficPermission is treated as Deny the traffic.
   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
-
 proxy:
   gateway:
     # Sets the envoy runtime value to limit maximum number of incoming
     # connections to a builtin gateway data plane proxy
     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS
-
 tracing:
   openTelemetry:
     endpoint: "" # e.g. otel-collector:4317
-
 # Configuration of the event bus which is local to one instance of CP
 eventBus:
   # BufferSize controls the buffer for every single event listener.
   # If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
   bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE
+policies:
+  # PluginPoliciesEnabled controls which policy plugins are enabled
+  pluginPoliciesEnabled: # ENV: KUMA_PLUGIN_POLICIES_ENABLED
+    - meshaccesslogs
+    - meshcircuitbreakers
+    - meshfaultinjections
+    - meshhealthchecks
+    - meshhttproutes
+    - meshloadbalancingstrategies
+    - meshmetrics
+    - meshproxypatches
+    - meshratelimits
+    - meshretries
+    - meshtcproutes
+    - meshtimeouts
+    - meshtraces
+    - meshtrafficpermissions
diff --git a/pkg/config/plugins/policies/config.go b/pkg/config/plugins/policies/config.go
new file mode 100644
index 000000000..b22c429fc
--- /dev/null
+++ b/pkg/config/plugins/policies/config.go
@@ -0,0 +1,16 @@
+package policies
+
+type Config struct {
+	PluginPoliciesEnabled []string `json:"pluginPoliciesEnabled" envconfig:"KUMA_PLUGIN_POLICIES_ENABLED" default:""`
+}
+
+func (c *Config) PostProcess() error {
+	return nil
+}
+
+func (c *Config) Sanitize() {
+}
+
+func (c *Config) Validate() error {
+	return nil
+}
diff --git a/pkg/config/plugins/policies/policies.go b/pkg/config/plugins/policies/policies.go
new file mode 100644
index 000000000..59568ae34
--- /dev/null
+++ b/pkg/config/plugins/policies/policies.go
@@ -0,0 +1,27 @@
+package policies
+
+import "golang.org/x/exp/slices"
+
+var DefaultPluginPoliciesEnabled = []string{
+	"meshaccesslogs",
+	"meshcircuitbreakers",
+	"meshfaultinjections",
+	"meshhealthchecks",
+	"meshhttproutes",
+	"meshloadbalancingstrategies",
+	"meshmetrics",
+	"meshproxypatches",
+	"meshratelimits",
+	"meshretries",
+	"meshtcproutes",
+	"meshtimeouts",
+	"meshtraces",
+	"meshtrafficpermissions",
+}
+
+func DefaultPoliciesConfig() *Config {
+	slices.Sort(DefaultPluginPoliciesEnabled)
+	return &Config{
+		PluginPoliciesEnabled: DefaultPluginPoliciesEnabled,
+	}
+}
diff --git a/pkg/core/bootstrap/bootstrap.go b/pkg/core/bootstrap/bootstrap.go
index 545c00322..33885ddf6 100644
--- a/pkg/core/bootstrap/bootstrap.go
+++ b/pkg/core/bootstrap/bootstrap.go
@@ -49,6 +49,7 @@ import (
 	"github.com/kumahq/kuma/pkg/metrics"
 	metrics_store "github.com/kumahq/kuma/pkg/metrics/store"
 	"github.com/kumahq/kuma/pkg/multitenant"
+	"github.com/kumahq/kuma/pkg/plugins/policies"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission/graph"
 	"github.com/kumahq/kuma/pkg/plugins/resources/postgres/config"
 	"github.com/kumahq/kuma/pkg/tokens/builtin"
@@ -73,6 +74,7 @@ func buildRuntime(appCtx context.Context, cfg kuma_cp.Config) (core_runtime.Runt
 	if err != nil {
 		return nil, err
 	}
+	policies.InitPolicies(cfg.Policies.PluginPoliciesEnabled)
 	builder.WithMultitenancy(multitenant.SingleTenant)
 	builder.WithPgxConfigCustomizationFn(config.NoopPgxConfigCustomizationFn)
 	for _, plugin := range core_plugins.Plugins().BootstrapPlugins() {
diff --git a/pkg/core/bootstrap/plugins.go b/pkg/core/bootstrap/plugins.go
index 352b903b8..f9b1380b1 100644
--- a/pkg/core/bootstrap/plugins.go
+++ b/pkg/core/bootstrap/plugins.go
@@ -10,7 +10,6 @@ import (
 	_ "github.com/kumahq/kuma/pkg/plugins/ca/provided"
 	_ "github.com/kumahq/kuma/pkg/plugins/config/k8s"
 	_ "github.com/kumahq/kuma/pkg/plugins/config/universal"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	_ "github.com/kumahq/kuma/pkg/plugins/resources/k8s"
 	_ "github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	_ "github.com/kumahq/kuma/pkg/plugins/resources/postgres"
diff --git a/pkg/plugins/policies/imports.go b/pkg/plugins/policies/imports.go
index be54b22af..a42711c77 100644
--- a/pkg/plugins/policies/imports.go
+++ b/pkg/plugins/policies/imports.go
@@ -1,18 +1,61 @@
 package policies
 
 import (
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshaccesslog"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshcircuitbreaker"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshfaultinjection"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshhealthcheck"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshloadbalancingstrategy"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshmetric"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshproxypatch"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshratelimit"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshretry"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshtcproute"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshtrace"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshaccesslog"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshcircuitbreaker"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshfaultinjection"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshhealthcheck"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshloadbalancingstrategy"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshmetric"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshproxypatch"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshratelimit"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshretry"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshtcproute"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshtrace"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission"
 )
+
+type PluginInitializer struct {
+	InitFn      func()
+	Initialized bool
+}
+
+var NameToModule = map[string]*PluginInitializer{
+	"meshaccesslogs":              {InitFn: meshaccesslog.InitPlugin, Initialized: false},
+	"meshcircuitbreakers":         {InitFn: meshcircuitbreaker.InitPlugin, Initialized: false},
+	"meshfaultinjections":         {InitFn: meshfaultinjection.InitPlugin, Initialized: false},
+	"meshhealthchecks":            {InitFn: meshhealthcheck.InitPlugin, Initialized: false},
+	"meshhttproutes":              {InitFn: meshhttproute.InitPlugin, Initialized: false},
+	"meshloadbalancingstrategies": {InitFn: meshloadbalancingstrategy.InitPlugin, Initialized: false},
+	"meshmetrics":                 {InitFn: meshmetric.InitPlugin, Initialized: false},
+	"meshproxypatches":            {InitFn: meshproxypatch.InitPlugin, Initialized: false},
+	"meshratelimits":              {InitFn: meshratelimit.InitPlugin, Initialized: false},
+	"meshretries":                 {InitFn: meshretry.InitPlugin, Initialized: false},
+	"meshtcproutes":               {InitFn: meshtcproute.InitPlugin, Initialized: false},
+	"meshtimeouts":                {InitFn: meshtimeout.InitPlugin, Initialized: false},
+	"meshtraces":                  {InitFn: meshtrace.InitPlugin, Initialized: false},
+	"meshtrafficpermissions":      {InitFn: meshtrafficpermission.InitPlugin, Initialized: false},
+}
+
+func InitAllPolicies() {
+	for _, initializer := range NameToModule {
+		if !initializer.Initialized {
+			initializer.InitFn()
+			initializer.Initialized = true
+		}
+	}
+}
+
+func InitPolicies(enabledPluginPolicies []string) {
+	for _, policy := range enabledPluginPolicies {
+		initializer, ok := NameToModule[policy]
+		if ok && !initializer.Initialized {
+			initializer.InitFn()
+			initializer.Initialized = true
+		} else {
+			panic("policy " + policy + " not found")
+		}
+	}
+}
diff --git a/pkg/plugins/policies/meshaccesslog/zz_generated.plugin.go b/pkg/plugins/policies/meshaccesslog/zz_generated.plugin.go
index ccf2cbd1b..b00bca401 100644
--- a/pkg/plugins/policies/meshaccesslog/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshaccesslog/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshaccesslog/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshAccessLogResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshcircuitbreaker/zz_generated.plugin.go b/pkg/plugins/policies/meshcircuitbreaker/zz_generated.plugin.go
index f9d2e6bb2..ed7e1c3c5 100644
--- a/pkg/plugins/policies/meshcircuitbreaker/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshcircuitbreaker/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshcircuitbreaker/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshCircuitBreakerResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshfaultinjection/zz_generated.plugin.go b/pkg/plugins/policies/meshfaultinjection/zz_generated.plugin.go
index 0f1df8bee..a9e65b95d 100644
--- a/pkg/plugins/policies/meshfaultinjection/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshfaultinjection/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshfaultinjection/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshFaultInjectionResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshhealthcheck/zz_generated.plugin.go b/pkg/plugins/policies/meshhealthcheck/zz_generated.plugin.go
index 53a89c255..04d98493c 100644
--- a/pkg/plugins/policies/meshhealthcheck/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshhealthcheck/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshhealthcheck/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshHealthCheckResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshhttproute/zz_generated.plugin.go b/pkg/plugins/policies/meshhttproute/zz_generated.plugin.go
index 119b29d1e..e781d0882 100644
--- a/pkg/plugins/policies/meshhttproute/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshhttproute/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshHTTPRouteResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/zz_generated.plugin.go b/pkg/plugins/policies/meshloadbalancingstrategy/zz_generated.plugin.go
index 8858cfe46..9add6f7e6 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshLoadBalancingStrategyResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshmetric/zz_generated.plugin.go b/pkg/plugins/policies/meshmetric/zz_generated.plugin.go
index 36b0badfc..3850c9bcf 100644
--- a/pkg/plugins/policies/meshmetric/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshmetric/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshmetric/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshMetricResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshproxypatch/zz_generated.plugin.go b/pkg/plugins/policies/meshproxypatch/zz_generated.plugin.go
index dc8ac2124..229cc227b 100644
--- a/pkg/plugins/policies/meshproxypatch/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshproxypatch/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshproxypatch/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshProxyPatchResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshratelimit/zz_generated.plugin.go b/pkg/plugins/policies/meshratelimit/zz_generated.plugin.go
index 446bc1995..be24590cd 100644
--- a/pkg/plugins/policies/meshratelimit/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshratelimit/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshratelimit/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshRateLimitResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshretry/zz_generated.plugin.go b/pkg/plugins/policies/meshretry/zz_generated.plugin.go
index 2d678728a..239ad51e2 100644
--- a/pkg/plugins/policies/meshretry/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshretry/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshretry/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshRetryResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshtcproute/zz_generated.plugin.go b/pkg/plugins/policies/meshtcproute/zz_generated.plugin.go
index 8432bf6e5..7ec5cbebe 100644
--- a/pkg/plugins/policies/meshtcproute/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshtcproute/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshtcproute/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshTCPRouteResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshtimeout/zz_generated.plugin.go b/pkg/plugins/policies/meshtimeout/zz_generated.plugin.go
index a5e211b5b..f5b20f030 100644
--- a/pkg/plugins/policies/meshtimeout/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshtimeout/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshTimeoutResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshtrace/zz_generated.plugin.go b/pkg/plugins/policies/meshtrace/zz_generated.plugin.go
index 61d4ecda7..ef7eef501 100644
--- a/pkg/plugins/policies/meshtrace/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshtrace/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshtrace/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshTraceResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/pkg/plugins/policies/meshtrafficpermission/zz_generated.plugin.go b/pkg/plugins/policies/meshtrafficpermission/zz_generated.plugin.go
index e11386ff2..91da29f3e 100644
--- a/pkg/plugins/policies/meshtrafficpermission/zz_generated.plugin.go
+++ b/pkg/plugins/policies/meshtrafficpermission/zz_generated.plugin.go
@@ -7,7 +7,7 @@ import (
 	plugin_v1alpha1 "github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission/plugin/v1alpha1"
 )
 
-func init() {
+func InitPlugin() {
 	core.Register(
 		api_v1alpha1.MeshTrafficPermissionResourceTypeDescriptor,
 		k8s_v1alpha1.AddToScheme,
diff --git a/tools/policy-gen/generate-policy-config.sh b/tools/policy-gen/generate-policy-config.sh
new file mode 100755
index 000000000..af92c7f55
--- /dev/null
+++ b/tools/policy-gen/generate-policy-config.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -e
+
+POLICIES_FILE="pkg/config/plugins/policies/policies.go"
+
+policies=$(for i in "${@:1}"; do
+  if [[ -f pkg/plugins/policies/${i}/zz_generated.plugin.go ]]; then
+    policy_dir="pkg/plugins/policies/${i}"
+    policy_crd_dir="${policy_dir}/k8s/crd"
+    policy_crd_file="$(find "${policy_crd_dir}" -type f)"
+    plural=$(yq e '.spec.names.plural' "$policy_crd_file")
+    echo "\"$plural\","
+  fi
+done)
+
+if [[ $policies == "" ]]; then
+  rm -f "${POLICIES_FILE}"
+  exit 0
+fi
+
+echo "package policies
+
+import \"golang.org/x/exp/slices\"
+
+var DefaultPluginPoliciesEnabled = []string{
+  $policies
+}
+
+func DefaultPoliciesConfig() *Config {
+	slices.Sort(DefaultPluginPoliciesEnabled)
+	return &Config{
+		PluginPoliciesEnabled: DefaultPluginPoliciesEnabled,
+	}
+}
+" > "${POLICIES_FILE}"
+
+gofmt -w "${POLICIES_FILE}"
diff --git a/tools/policy-gen/generate-policy-defaults.sh b/tools/policy-gen/generate-policy-defaults.sh
new file mode 100755
index 000000000..cc1dc3810
--- /dev/null
+++ b/tools/policy-gen/generate-policy-defaults.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e
+
+policies=$(for i in "${@:3}"; do
+  if [[ -f pkg/plugins/policies/${i}/zz_generated.plugin.go ]]; then
+    policy_dir="pkg/plugins/policies/${i}"
+    policy_crd_dir="${policy_dir}/k8s/crd"
+    policy_crd_file="$(find "${policy_crd_dir}" -type f)"
+    plural=$(yq e '.spec.names.plural' "$policy_crd_file")
+    echo "\"$plural\","
+  fi
+done | sort | uniq)
+
+KUMA_DEFAULTS_FILE="pkg/config/app/kuma-cp/kuma-cp.defaults.yaml"
+
+policies_no_newlines=$(echo -n "$policies" | tr -d '\n')
+# shellcheck disable=SC2001
+policies_no_last_char=$(echo "$policies_no_newlines" | sed 's/.$//')
+echo "$policies_no_last_char"
+
+yq e -i ".policies.pluginPoliciesEnabled = [$policies_no_last_char]" $KUMA_DEFAULTS_FILE
diff --git a/tools/policy-gen/generate-policy-helm.sh b/tools/policy-gen/generate-policy-helm.sh
index d88f0b0bc..1e3ce2988 100755
--- a/tools/policy-gen/generate-policy-helm.sh
+++ b/tools/policy-gen/generate-policy-helm.sh
@@ -39,7 +39,7 @@ done
 # yq_patch preserves indentation and blank lines of the original file
 cp "${HELM_VALUES_FILE}" "${HELM_VALUES_FILE}.noblank"
 # shellcheck disable=SC2016
-policies="${policies}" yq "${VALUES_FILE_POLICY_PATH}"' |= ((env(policies) | trim | split(" "))[] as $item ireduce ({}; .[$item] = {}))' "${HELM_VALUES_FILE}" | \
+policies="${policies}" yq "${VALUES_FILE_POLICY_PATH}"' |= ((env(policies) | trim | split(" "))[] as $item ireduce ({}; .[$item] = true))' "${HELM_VALUES_FILE}" | \
   diff --ignore-all-space --ignore-blank-lines "${HELM_VALUES_FILE}.noblank" - | \
   patch --force --no-backup-if-mismatch "${HELM_VALUES_FILE}" -
 rm -f "${HELM_VALUES_FILE}.noblank"
diff --git a/tools/policy-gen/generate-policy-import.sh b/tools/policy-gen/generate-policy-import.sh
index cd068b7da..c8d7d1654 100755
--- a/tools/policy-gen/generate-policy-import.sh
+++ b/tools/policy-gen/generate-policy-import.sh
@@ -5,17 +5,57 @@ GO_MODULE=$1
 
 IMPORTS_FILE="pkg/plugins/policies/imports.go"
 
-imports=$(for i in "${@:2}"; do [[ -f pkg/plugins/policies/${i}/zz_generated.plugin.go ]] && echo "_ \"${GO_MODULE}/pkg/plugins/policies/${i}\""; done)
+imports=$(for i in "${@:2}"; do [[ -f pkg/plugins/policies/${i}/zz_generated.plugin.go ]] && echo "\"${GO_MODULE}/pkg/plugins/policies/${i}\""; done)
 if [[ $imports == "" ]]; then
   rm -f "${IMPORTS_FILE}"
   exit 0
 fi
 
+mappings=$(for i in "${@:2}"; do
+  if [[ -f pkg/plugins/policies/${i}/zz_generated.plugin.go ]]; then
+    policy_dir="pkg/plugins/policies/${i}"
+    policy_crd_dir="${policy_dir}/k8s/crd"
+    policy_crd_file="$(find "${policy_crd_dir}" -type f)"
+    plural=$(yq e '.spec.names.plural' "$policy_crd_file")
+    echo "\"$plural\": {InitFn: ${i}.InitPlugin, Initialized: false},"
+  fi
+done)
+
 echo "package policies
 
 import (
-$imports
+  $imports
 )
+
+type PluginInitializer struct {
+	InitFn      func()
+	Initialized bool
+}
+
+var NameToModule = map[string]*PluginInitializer{
+  $mappings
+}
+
+func InitAllPolicies() {
+	for _, initializer := range NameToModule {
+		if !initializer.Initialized {
+			initializer.InitFn()
+			initializer.Initialized = true
+		}
+	}
+}
+
+func InitPolicies(enabledPluginPolicies []string) {
+	for _, policy := range enabledPluginPolicies {
+		initializer, ok := NameToModule[policy]
+		if ok && !initializer.Initialized {
+			initializer.InitFn()
+			initializer.Initialized = true
+		} else {
+			panic(\"policy \" + policy + \" not found\")
+		}
+	}
+}
 " > "${IMPORTS_FILE}"
 
 gofmt -w "${IMPORTS_FILE}"
diff --git a/tools/policy-gen/generator/cmd/pluginfile.go b/tools/policy-gen/generator/cmd/pluginfile.go
index 9083e199c..cd5b8fc66 100644
--- a/tools/policy-gen/generator/cmd/pluginfile.go
+++ b/tools/policy-gen/generator/cmd/pluginfile.go
@@ -79,7 +79,7 @@ import (
 {{- end}}
 )
 
-func init() {
+func InitPlugin() {
 	{{- range $idx, $version := .Versions}}
 	core.Register(
 		api_{{ $version }}.{{ $name }}ResourceTypeDescriptor,


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
index d910bf6e6..9a52db4ff 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
@@ -626,6 +626,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
index 6693cee12..280178f74 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
@@ -7860,6 +7860,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
index d2f9a3242..613065e33 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
@@ -722,17 +722,17 @@ postgres:
 # @ignored for helm-docs
 plugins:
   policies:
-    meshaccesslogs: {}
-    meshcircuitbreakers: {}
-    meshfaultinjections: {}
-    meshhealthchecks: {}
-    meshhttproutes: {}
-    meshloadbalancingstrategies: {}
-    meshmetrics: {}
-    meshproxypatches: {}
-    meshratelimits: {}
-    meshretries: {}
-    meshtcproutes: {}
-    meshtimeouts: {}
-    meshtraces: {}
-    meshtrafficpermissions: {}
+    meshaccesslogs: true
+    meshcircuitbreakers: true
+    meshfaultinjections: true
+    meshhealthchecks: true
+    meshhttproutes: true
+    meshloadbalancingstrategies: true
+    meshmetrics: true
+    meshproxypatches: true
+    meshratelimits: true
+    meshretries: true
+    meshtcproutes: true
+    meshtimeouts: true
+    meshtraces: true
+    meshtrafficpermissions: true
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml
index 6693cee12..280178f74 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml
@@ -7860,6 +7860,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
index f06548af4..7b19440fe 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
@@ -8087,6 +8087,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml
index 6e9aaa41f..44e9d87bc 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.global-universal-on-k8s.golden.yaml
@@ -160,6 +160,8 @@ spec:
               value: "/tmp/kuma"
             - name: KUMA_MODE
               value: "global"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_STORE_POSTGRES_PORT
               value: "5432"
             - name: KUMA_STORE_POSTGRES_TLS_CA_PATH
@@ -202,6 +204,8 @@ spec:
               value: "/tmp/kuma"
             - name: KUMA_MODE
               value: "global"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_STORE_POSTGRES_PORT
               value: "5432"
             - name: KUMA_STORE_POSTGRES_TLS_CA_PATH
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
index 71c138669..caa5db212 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
@@ -428,6 +428,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "global"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
index 3f6698336..00889b0f0 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
@@ -412,6 +412,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
index 3d4715df5..dd2a407f1 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
@@ -428,6 +428,8 @@ spec:
               value: "/var/run/secrets/kuma.io/kds-client-tls-cert/ca.crt"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml
index b15b95f3d..0ffe62e52 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml
@@ -412,6 +412,8 @@ spec:
               value: "gcr.io/octo/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
index d3a92f004..fd50a85c7 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
@@ -412,6 +412,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml
index b39c09f0c..b4699aa61 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml
@@ -443,6 +443,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
index d2a63b20d..0643503ce 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
@@ -7926,6 +7926,8 @@ spec:
               value: "grpcs://foo.com"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml
index b39af642d..ee061718a 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml
@@ -412,6 +412,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
index 0105f01c0..6929b2540 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
@@ -447,6 +447,8 @@ spec:
               value: "grpcs://192.168.0.1:5685"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
index c8fb47739..7e30ddb4f 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
@@ -152,6 +152,8 @@ spec:
               value: "grpcs://192.168.0.1:5685"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_STORE_POSTGRES_PORT
               value: "5432"
             - name: KUMA_STORE_TYPE
@@ -194,6 +196,8 @@ spec:
               value: "grpcs://192.168.0.1:5685"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_STORE_POSTGRES_PORT
               value: "5432"
             - name: KUMA_STORE_TYPE
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
index 7a130a159..71ff9d6a4 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
@@ -416,6 +416,8 @@ spec:
               value: "grpcs://192.168.0.1:5685"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.golden.yaml
index db684c245..58f70d025 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.golden.yaml
@@ -411,6 +411,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml
index c7288e887..754287c53 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml
@@ -412,6 +412,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml
index f5294bf4d..49c5ecdf7 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml
@@ -435,6 +435,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml
index 0e75a0a39..8cf5eb533 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4496.golden.yaml
@@ -458,6 +458,8 @@ spec:
               value: "grpcs://foo.com:3456"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "east"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml
index 3e98ebfa6..35589e9b5 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix4935.golden.yaml
@@ -702,6 +702,8 @@ spec:
               value: "grpcs://localhost:5678"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml
index e0826b32d..75cf14f50 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix5978.golden.yaml
@@ -478,6 +478,8 @@ spec:
               value: "grpcs://foo.com:3456"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "east"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml
index 05a87793a..6c276bc8a 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml
@@ -415,6 +415,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml
index a7e4bc8fe..1c013922f 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/fix7824.golden.yaml
@@ -493,6 +493,8 @@ spec:
               value: "grpcs://foo.com:3456"
             - name: KUMA_MULTIZONE_ZONE_NAME
               value: "zone-1"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml
index 045bb8412..3271ac00f 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml
@@ -412,6 +412,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml b/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml
index 743f784ad..7a3afe836 100644
--- a/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml
@@ -413,6 +413,8 @@ spec:
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
               value: "zone"
+            - name: KUMA_PLUGIN_POLICIES_ENABLED
+              value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
diff --git a/pkg/api-server/inspect_endpoints_test.go b/pkg/api-server/inspect_endpoints_test.go
index acfd4f3a8..7fa880a5f 100644
--- a/pkg/api-server/inspect_endpoints_test.go
+++ b/pkg/api-server/inspect_endpoints_test.go
@@ -21,7 +21,6 @@ import (
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test/kds/samples"
diff --git a/pkg/config/app/kuma-cp/default_config_test.go b/pkg/config/app/kuma-cp/default_config_test.go
index 9075a3555..4a22dc943 100644
--- a/pkg/config/app/kuma-cp/default_config_test.go
+++ b/pkg/config/app/kuma-cp/default_config_test.go
@@ -1,4 +1,4 @@
-package kuma_cp
+package kuma_cp_test
 
 import (
 	"os"
@@ -8,6 +8,7 @@ import (
 	. "github.com/onsi/gomega"
 
 	"github.com/kumahq/kuma/pkg/config"
+	kuma_cp "github.com/kumahq/kuma/pkg/config/app/kuma-cp"
 )
 
 var _ = Describe("Default config", func() {
@@ -21,18 +22,18 @@ var _ = Describe("Default config", func() {
 			}
 		}()
 		// given
-		cfg := Config{}
+		cfg := kuma_cp.Config{}
 
 		// when
 		err := config.Load("kuma-cp.defaults.yaml", &cfg)
 
 		// then
 		Expect(err).ToNot(HaveOccurred())
-		Expect(DefaultConfig()).To(Equal(cfg), "The default config generated by Kuma and kuma-cp.defaults.yaml config file are different. Please update the kuma-cp.defaults.yaml file.")
+		Expect(kuma_cp.DefaultConfig()).To(Equal(cfg), "The default config generated by Kuma and kuma-cp.defaults.yaml config file are different. Please update the kuma-cp.defaults.yaml file.")
 	})
 
 	It("kuma-cp.defaults.yaml should not have extra keys", func() {
-		cfg := Config{}
+		cfg := kuma_cp.Config{}
 		err := config.LoadWithOption("kuma-cp.defaults.yaml", &cfg, true, false, false)
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/pkg/config/app/kuma-cp/suite_test.go b/pkg/config/app/kuma-cp/suite_test.go
index 89e9e03b5..303914bd6 100644
--- a/pkg/config/app/kuma-cp/suite_test.go
+++ b/pkg/config/app/kuma-cp/suite_test.go
@@ -1,4 +1,4 @@
-package kuma_cp
+package kuma_cp_test
 
 import (
 	"testing"
diff --git a/pkg/config/loader_test.go b/pkg/config/loader_test.go
index 2aafcc07c..c665c429a 100644
--- a/pkg/config/loader_test.go
+++ b/pkg/config/loader_test.go
@@ -714,6 +714,10 @@ proxy:
     globalDownstreamMaxConnections: 1
 eventBus:
   bufferSize: 30
+policies:
+  pluginPoliciesEnabled:
+    - meshaccesslog
+    - meshcircuitbreaker
 tracing:
   openTelemetry:
     enabled: true
@@ -983,6 +987,7 @@ tracing:
 				"KUMA_TRACING_OPENTELEMETRY_ENDPOINT":                                                      "otel-collector:4317",
 				"KUMA_TRACING_OPENTELEMETRY_ENABLED":                                                       "true",
 				"KUMA_EVENT_BUS_BUFFER_SIZE":                                                               "30",
+				"KUMA_PLUGIN_POLICIES_ENABLED":                                                             "meshaccesslog,meshcircuitbreaker",
 			},
 			yamlFileConfig: "",
 		}),
diff --git a/pkg/core/permissions/matcher_suite_test.go b/pkg/core/permissions/matcher_suite_test.go
index 6cc90aff4..1754b29b1 100644
--- a/pkg/core/permissions/matcher_suite_test.go
+++ b/pkg/core/permissions/matcher_suite_test.go
@@ -1,4 +1,4 @@
-package permissions
+package permissions_test
 
 import (
 	"testing"
diff --git a/pkg/intercp/catalog/discovery_suite_test.go b/pkg/intercp/catalog/discovery_suite_test.go
index aeb4c7754..2ab69b86e 100644
--- a/pkg/intercp/catalog/discovery_suite_test.go
+++ b/pkg/intercp/catalog/discovery_suite_test.go
@@ -1,4 +1,4 @@
-package catalog
+package catalog_test
 
 import (
 	"testing"
diff --git a/pkg/kds/server/server_test.go b/pkg/kds/server/server_test.go
index f433d1ab4..fa3d5f2e1 100644
--- a/pkg/kds/server/server_test.go
+++ b/pkg/kds/server/server_test.go
@@ -7,7 +7,6 @@ import (
 
 	envoy_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	envoy_sd "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
-	protov1 "github.com/golang/protobuf/proto"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
@@ -64,34 +63,7 @@ var _ = Describe("KDS Server", func() {
 		ctx := context.Background()
 		// Do not forget to update this test after updating protobuf `KumaKdsOptions`.
 		Expect(registry.Global().ObjectTypes(model.HasKdsEnabled())).
-			To(HaveLen(len([]protov1.Message{
-				kds_samples.CircuitBreaker,
-				kds_samples.Dataplane,
-				kds_samples.DataplaneInsight,
-				kds_samples.ServiceInsight,
-				kds_samples.ExternalService,
-				kds_samples.FaultInjection,
-				kds_samples.GlobalSecret,
-				kds_samples.HealthCheck,
-				kds_samples.Mesh1,
-				kds_samples.ProxyTemplate,
-				kds_samples.RateLimit,
-				kds_samples.Retry,
-				kds_samples.Secret,
-				kds_samples.Timeout,
-				kds_samples.TrafficLog,
-				kds_samples.TrafficPermission,
-				kds_samples.TrafficRoute,
-				kds_samples.TrafficTrace,
-				kds_samples.ZoneIngress,
-				kds_samples.ZoneIngressInsight,
-				kds_samples.ZoneEgress,
-				kds_samples.ZoneEgressInsight,
-				kds_samples.Config,
-				kds_samples.VirtualOutbound,
-				kds_samples.Gateway,
-				kds_samples.GatewayRoute,
-			})))
+			To(HaveLen(40)) // old policies plus plugins
 
 		vrf := kds_verifier.New().
 			// NOTE: The resources all have to be created before any DiscoveryRequests are made.
diff --git a/pkg/mads/v1/reconcile/snapshot_generator_test.go b/pkg/mads/v1/reconcile/snapshot_generator_test.go
index e676d3c2b..eb5a928a6 100644
--- a/pkg/mads/v1/reconcile/snapshot_generator_test.go
+++ b/pkg/mads/v1/reconcile/snapshot_generator_test.go
@@ -24,8 +24,7 @@ import (
 	mads_generator "github.com/kumahq/kuma/pkg/mads/v1/generator"
 	. "github.com/kumahq/kuma/pkg/mads/v1/reconcile"
 	"github.com/kumahq/kuma/pkg/metrics"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute" // to match any custom policy resource type you need to register MeshHTTPRoute manually
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshmetric"    // to match custom policy resource type like MeshMetric you need to register it manually in tests
+	// to match custom policy resource type like you need to register them manually in tests
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshmetric/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test/resources/builders"
diff --git a/pkg/plugins/policies/core/matchers/dataplane_test.go b/pkg/plugins/policies/core/matchers/dataplane_test.go
index 1254e7120..eeef24fd6 100644
--- a/pkg/plugins/policies/core/matchers/dataplane_test.go
+++ b/pkg/plugins/policies/core/matchers/dataplane_test.go
@@ -14,7 +14,6 @@ import (
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/registry"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	"github.com/kumahq/kuma/pkg/plugins/policies/core/matchers"
 	meshaccesslog_api "github.com/kumahq/kuma/pkg/plugins/policies/meshaccesslog/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
diff --git a/pkg/plugins/policies/core/rules/rules_test.go b/pkg/plugins/policies/core/rules/rules_test.go
index dcdc6a641..ec7e476e1 100644
--- a/pkg/plugins/policies/core/rules/rules_test.go
+++ b/pkg/plugins/policies/core/rules/rules_test.go
@@ -10,7 +10,6 @@ import (
 
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	core_rules "github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
 	meshtrafficpermission_api "github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1"
diff --git a/pkg/plugins/policies/meshmetric/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshmetric/plugin/v1alpha1/plugin_test.go
index 2ff801016..aa3c28c95 100644
--- a/pkg/plugins/policies/meshmetric/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshmetric/plugin/v1alpha1/plugin_test.go
@@ -1,4 +1,4 @@
-package v1alpha1
+package v1alpha1_test
 
 import (
 	"path/filepath"
@@ -12,6 +12,7 @@ import (
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	core_rules "github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
 	api "github.com/kumahq/kuma/pkg/plugins/policies/meshmetric/api/v1alpha1"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshmetric/plugin/v1alpha1"
 	"github.com/kumahq/kuma/pkg/test/matchers"
 	"github.com/kumahq/kuma/pkg/test/resources/samples"
 	xds_builders "github.com/kumahq/kuma/pkg/test/xds/builders"
@@ -38,7 +39,7 @@ var _ = Describe("MeshMetric", func() {
 
 	DescribeTable("Apply to sidecar Dataplane", func(given testCase) {
 		resources := core_xds.NewResourceSet()
-		plugin := NewPlugin().(core_plugins.PolicyPlugin)
+		plugin := v1alpha1.NewPlugin().(core_plugins.PolicyPlugin)
 
 		Expect(plugin.Apply(resources, given.context, given.proxy)).To(Succeed())
 
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
index bbdac90d4..996d99ffc 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
@@ -23,7 +23,6 @@ import (
 	secret_store "github.com/kumahq/kuma/pkg/core/secrets/store"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/metrics"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	core_rules "github.com/kumahq/kuma/pkg/plugins/policies/core/rules"
 	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
 	api "github.com/kumahq/kuma/pkg/plugins/policies/meshtcproute/api/v1alpha1"
diff --git a/pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin_test.go
index a61876bba..77a2de895 100644
--- a/pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin_test.go
@@ -1,4 +1,4 @@
-package v1alpha1
+package v1alpha1_test
 
 import (
 	"context"
@@ -19,6 +19,7 @@ import (
 	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
 	meshhttproute_xds "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/xds"
 	api "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/api/v1alpha1"
+	"github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/plugin/v1alpha1"
 	gateway_plugin "github.com/kumahq/kuma/pkg/plugins/runtime/gateway"
 	"github.com/kumahq/kuma/pkg/test"
 	"github.com/kumahq/kuma/pkg/test/matchers"
@@ -79,7 +80,7 @@ var _ = Describe("MeshTimeout", func() {
 			Build()
 
 		// when
-		plugin := NewPlugin().(core_plugins.PolicyPlugin)
+		plugin := v1alpha1.NewPlugin().(core_plugins.PolicyPlugin)
 		Expect(plugin.Apply(resourceSet, context, proxy)).To(Succeed())
 
 		// then
@@ -446,7 +447,7 @@ var _ = Describe("MeshTimeout", func() {
 		Expect(err).NotTo(HaveOccurred())
 
 		// when
-		plugin := NewPlugin().(core_plugins.PolicyPlugin)
+		plugin := v1alpha1.NewPlugin().(core_plugins.PolicyPlugin)
 		Expect(plugin.Apply(generatedResources, xdsCtx, proxy)).To(Succeed())
 
 		nameSplit := strings.Split(GinkgoT().Name(), " ")
diff --git a/pkg/plugins/policies/meshtrafficpermission/graph/reachable_services_graph_test.go b/pkg/plugins/policies/meshtrafficpermission/graph/reachable_services_graph_test.go
index af94e8149..9f5e08c86 100644
--- a/pkg/plugins/policies/meshtrafficpermission/graph/reachable_services_graph_test.go
+++ b/pkg/plugins/policies/meshtrafficpermission/graph/reachable_services_graph_test.go
@@ -7,7 +7,6 @@ import (
 	common_api "github.com/kumahq/kuma/api/common/v1alpha1"
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshtrafficpermission/graph"
 	"github.com/kumahq/kuma/pkg/test/resources/builders"
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/circuitbreaker_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/circuitbreaker_types_test.go
index e1f7bbb9d..6412e5aca 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/circuitbreaker_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/circuitbreaker_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("CircuitBreaker", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *CircuitBreaker
+		created, fetched *v1alpha1.CircuitBreaker
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("CircuitBreaker", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &CircuitBreaker{
+			created = &v1alpha1.CircuitBreaker{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("CircuitBreaker", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &CircuitBreaker{}
+			fetched = &v1alpha1.CircuitBreaker{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_insight_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_insight_types_test.go
index 2dc9427c3..339921088 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_insight_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_insight_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("DataplaneInsight", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *DataplaneInsight
+		created, fetched *v1alpha1.DataplaneInsight
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("DataplaneInsight", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &DataplaneInsight{
+			created = &v1alpha1.DataplaneInsight{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("DataplaneInsight", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &DataplaneInsight{}
+			fetched = &v1alpha1.DataplaneInsight{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_types_test.go
index cd8f8163a..a4ec9602e 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/dataplane_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("Dataplane", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *Dataplane
+		created, fetched *v1alpha1.Dataplane
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("Dataplane", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &Dataplane{
+			created = &v1alpha1.Dataplane{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("Dataplane", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &Dataplane{}
+			fetched = &v1alpha1.Dataplane{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/externalservice_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/externalservice_types_test.go
index d4b25f16c..0adbe3f94 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/externalservice_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/externalservice_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("ExternalService", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *ExternalService
+		created, fetched *v1alpha1.ExternalService
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("ExternalService", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &ExternalService{
+			created = &v1alpha1.ExternalService{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("ExternalService", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &ExternalService{}
+			fetched = &v1alpha1.ExternalService{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/healthcheck_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/healthcheck_types_test.go
index c36c85dc5..4f532f5ba 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/healthcheck_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/healthcheck_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("HealthCheck", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *HealthCheck
+		created, fetched *v1alpha1.HealthCheck
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("HealthCheck", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &HealthCheck{
+			created = &v1alpha1.HealthCheck{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("HealthCheck", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &HealthCheck{}
+			fetched = &v1alpha1.HealthCheck{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_test.go
index d63992839..89939f022 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("Mesh", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *Mesh
+		created, fetched *v1alpha1.Mesh
 	)
 
 	BeforeEach(func() {
@@ -47,7 +49,7 @@ var _ = Describe("Mesh", func() {
 			key = types.NamespacedName{
 				Name: "foo",
 			}
-			created = &Mesh{
+			created = &v1alpha1.Mesh{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "foo",
 				},
@@ -56,7 +58,7 @@ var _ = Describe("Mesh", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &Mesh{}
+			fetched = &v1alpha1.Mesh{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/proxytemplate_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/proxytemplate_types_test.go
index b1125d36e..0e7137e2e 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/proxytemplate_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/proxytemplate_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("ProxyTemplate", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *ProxyTemplate
+		created, fetched *v1alpha1.ProxyTemplate
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("ProxyTemplate", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &ProxyTemplate{
+			created = &v1alpha1.ProxyTemplate{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("ProxyTemplate", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &ProxyTemplate{}
+			fetched = &v1alpha1.ProxyTemplate{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/retry_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/retry_types_test.go
index 22c263f3d..ae0701d7a 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/retry_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/retry_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("Retry", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *Retry
+		created, fetched *v1alpha1.Retry
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("Retry", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &Retry{
+			created = &v1alpha1.Retry{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("Retry", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &Retry{}
+			fetched = &v1alpha1.Retry{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/suite_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/suite_test.go
index c14732108..c3dbbb442 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/suite_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/suite_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	"path/filepath"
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/pkg/model"
 	"github.com/kumahq/kuma/pkg/test"
 )
@@ -50,7 +51,7 @@ var _ = BeforeSuite(test.Within(time.Minute, func() {
 		},
 	}
 
-	err := SchemeBuilder.AddToScheme(scheme.Scheme)
+	err := v1alpha1.SchemeBuilder.AddToScheme(scheme.Scheme)
 	Expect(err).NotTo(HaveOccurred())
 
 	cfg, err = testEnv.Start()
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/trafficroute_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/trafficroute_types_test.go
index 10f2c4730..17e2e63e4 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/trafficroute_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/trafficroute_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("TrafficRoute", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *TrafficRoute
+		created, fetched *v1alpha1.TrafficRoute
 	)
 
 	BeforeEach(func() {
@@ -48,7 +50,7 @@ var _ = Describe("TrafficRoute", func() {
 				Name:      "foo",
 				Namespace: "default",
 			}
-			created = &TrafficRoute{
+			created = &v1alpha1.TrafficRoute{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "foo",
 					Namespace: "default",
@@ -58,7 +60,7 @@ var _ = Describe("TrafficRoute", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &TrafficRoute{}
+			fetched = &v1alpha1.TrafficRoute{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/zone_insight_types_test.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/zone_insight_types_test.go
index 606fb397a..2fffd4ab6 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/zone_insight_types_test.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/zone_insight_types_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha1
+package v1alpha1_test
 
 import (
 	. "github.com/onsi/ginkgo/v2"
@@ -22,12 +22,14 @@ import (
 	"golang.org/x/net/context"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 )
 
 var _ = Describe("ZoneInsight", func() {
 	var (
 		key              types.NamespacedName
-		created, fetched *ZoneInsight
+		created, fetched *v1alpha1.ZoneInsight
 	)
 
 	BeforeEach(func() {
@@ -47,7 +49,7 @@ var _ = Describe("ZoneInsight", func() {
 			key = types.NamespacedName{
 				Name: "foo",
 			}
-			created = &ZoneInsight{
+			created = &v1alpha1.ZoneInsight{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "foo",
 				},
@@ -56,7 +58,7 @@ var _ = Describe("ZoneInsight", func() {
 			By("creating an API obj")
 			Expect(k8sClient.Create(context.TODO(), created)).To(Succeed())
 
-			fetched = &ZoneInsight{}
+			fetched = &v1alpha1.ZoneInsight{}
 			Expect(k8sClient.Get(context.TODO(), key, fetched)).To(Succeed())
 			Expect(fetched).To(Equal(created))
 
diff --git a/pkg/test/ginkgo.go b/pkg/test/ginkgo.go
index 6b5104734..766fcad92 100644
--- a/pkg/test/ginkgo.go
+++ b/pkg/test/ginkgo.go
@@ -15,10 +15,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	"github.com/kumahq/kuma/pkg/core"
+	"github.com/kumahq/kuma/pkg/plugins/policies"
 )
 
 // RunSpecs wraps ginkgo+gomega test suite initialization.
 func RunSpecs(t *testing.T, description string) {
+	policies.InitAllPolicies()
 	format.TruncatedDiff = false
 	if strings.HasPrefix(description, "E2E") {
 		panic("Use RunE2ESpecs for e2e tests!")
@@ -27,6 +29,7 @@ func RunSpecs(t *testing.T, description string) {
 }
 
 func RunE2ESpecs(t *testing.T, description string) {
+	policies.InitAllPolicies()
 	gomega.SetDefaultConsistentlyDuration(time.Second * 5)
 	gomega.SetDefaultConsistentlyPollingInterval(time.Millisecond * 200)
 	gomega.SetDefaultEventuallyPollingInterval(time.Millisecond * 500)
diff --git a/pkg/xds/generator/egress/generator_test.go b/pkg/xds/generator/egress/generator_test.go
index d6b8d5939..ef5083aaa 100644
--- a/pkg/xds/generator/egress/generator_test.go
+++ b/pkg/xds/generator/egress/generator_test.go
@@ -15,7 +15,6 @@ import (
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	rest_types "github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
 	. "github.com/kumahq/kuma/pkg/test/matchers"
 	"github.com/kumahq/kuma/pkg/test/xds"
diff --git a/pkg/xds/generator/ingress_generator_test.go b/pkg/xds/generator/ingress_generator_test.go
index 472ac5710..6814415eb 100644
--- a/pkg/xds/generator/ingress_generator_test.go
+++ b/pkg/xds/generator/ingress_generator_test.go
@@ -12,7 +12,6 @@ import (
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute"
 	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
 	meshtcproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshtcproute/api/v1alpha1"
 	. "github.com/kumahq/kuma/pkg/test/matchers"
diff --git a/pkg/xds/generator/proxy_template_profile_source_test.go b/pkg/xds/generator/proxy_template_profile_source_test.go
index 6b098023c..ccfd7663c 100644
--- a/pkg/xds/generator/proxy_template_profile_source_test.go
+++ b/pkg/xds/generator/proxy_template_profile_source_test.go
@@ -11,7 +11,6 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	. "github.com/kumahq/kuma/pkg/test/matchers"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
 	"github.com/kumahq/kuma/pkg/test/xds"
diff --git a/pkg/xds/server/v3/reconcile_test.go b/pkg/xds/server/v3/reconcile_test.go
index 8e9a6a57d..a7d01ef0d 100644
--- a/pkg/xds/server/v3/reconcile_test.go
+++ b/pkg/xds/server/v3/reconcile_test.go
@@ -21,7 +21,6 @@ import (
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	xds_model "github.com/kumahq/kuma/pkg/core/xds"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
 	"github.com/kumahq/kuma/pkg/util/proto"
 	util_xds "github.com/kumahq/kuma/pkg/util/xds"
diff --git a/pkg/xds/sync/proxy_builder_test.go b/pkg/xds/sync/proxy_builder_test.go
index 3ecde51bc..6dc4b6ebc 100644
--- a/pkg/xds/sync/proxy_builder_test.go
+++ b/pkg/xds/sync/proxy_builder_test.go
@@ -21,7 +21,6 @@ import (
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/dns/vips"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
-	_ "github.com/kumahq/kuma/pkg/plugins/policies"
 	"github.com/kumahq/kuma/pkg/test/matchers"
 	test_runtime "github.com/kumahq/kuma/pkg/test/runtime"
 	"github.com/kumahq/kuma/pkg/xds/cache/mesh"