Repository: kumahq/kuma
Pull request #9675 (2024-03-20 12:33:53)

feat(pgx): configure idle timeout
### Checklist prior to review

- add environment variable `KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME` as duration to configure pgx connection idle time
- default connection idle time equal 30m, the same as in pgx

- [ ] [Link to relevant issue][1] as well as docs and UI issues --
- [ ] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS --
- [ ] Tests (Unit test, E2E tests, manual test on universal and k8s) --
  - Don't forget `ci/` labels to run additional/fewer tests
- [ ] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)? --
- [ ] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label) --

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword



Patch:
diff --git a/api/common/v1alpha1/ref.go b/api/common/v1alpha1/ref.go
index 7e00df8e0..f8ed8f9c8 100644
--- a/api/common/v1alpha1/ref.go
+++ b/api/common/v1alpha1/ref.go
@@ -42,6 +42,10 @@ func (k TargetRefKind) Less(o TargetRefKind) bool {
 	return order[k] < order[o]
 }
 
+func AllTargetRefKinds() []TargetRefKind {
+	return maps.Keys(order)
+}
+
 // TargetRef defines structure that allows attaching policy to various objects
 type TargetRef struct {
 	// Kind of the referenced resource
diff --git a/api/mesh/v1alpha1/service_insight.pb.go b/api/mesh/v1alpha1/service_insight.pb.go
index c19b2346b..bbfee2949 100644
--- a/api/mesh/v1alpha1/service_insight.pb.go
+++ b/api/mesh/v1alpha1/service_insight.pb.go
@@ -185,6 +185,7 @@ type ServiceInsight_Service struct {
 	IssuedBackends map[string]uint32                     `protobuf:"bytes,3,rep,name=issuedBackends,proto3" json:"issuedBackends,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
 	ServiceType    ServiceInsight_Service_Type           `protobuf:"varint,4,opt,name=serviceType,proto3,enum=kuma.mesh.v1alpha1.ServiceInsight_Service_Type" json:"serviceType,omitempty"`
 	AddressPort    string                                `protobuf:"bytes,5,opt,name=addressPort,proto3" json:"addressPort,omitempty"`
+	Zones          []string                              `protobuf:"bytes,6,rep,name=zones,proto3" json:"zones,omitempty"`
 }
 
 func (x *ServiceInsight_Service) Reset() {
@@ -254,6 +255,13 @@ func (x *ServiceInsight_Service) GetAddressPort() string {
 	return ""
 }
 
+func (x *ServiceInsight_Service) GetZones() []string {
+	if x != nil {
+		return x.Zones
+	}
+	return nil
+}
+
 type ServiceInsight_Service_DataplaneStat struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -325,13 +333,13 @@ var file_api_mesh_v1alpha1_service_insight_proto_rawDesc = []byte{
 	0x67, 0x68, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x6b, 0x75, 0x6d, 0x61, 0x2e,
 	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x16, 0x61,
 	0x70, 0x69, 0x2f, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe2, 0x08, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xf8, 0x08, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x49, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74, 0x12, 0x4c, 0x0a, 0x08, 0x73, 0x65, 0x72, 0x76,
 	0x69, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x6b, 0x75, 0x6d,
 	0x61, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
 	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74, 0x2e, 0x53,
 	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x1a, 0xa3, 0x06, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x1a, 0xb9, 0x06, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69,
 	0x63, 0x65, 0x12, 0x49, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x0e, 0x32, 0x31, 0x2e, 0x6b, 0x75, 0x6d, 0x61, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76,
 	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49,
@@ -356,49 +364,51 @@ var file_api_mesh_v1alpha1_service_insight_proto_rawDesc = []byte{
 	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x54, 0x79,
 	0x70, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x72,
 	0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
-	0x50, 0x6f, 0x72, 0x74, 0x1a, 0x57, 0x0a, 0x0d, 0x44, 0x61, 0x74, 0x61, 0x70, 0x6c, 0x61, 0x6e,
-	0x65, 0x53, 0x74, 0x61, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x6f,
-	0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x6f, 0x6e, 0x6c,
-	0x69, 0x6e, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x1a, 0x41, 0x0a,
-	0x13, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x73, 0x45,
-	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
-	0x22, 0x56, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x08, 0x0a, 0x04, 0x6e, 0x6f,
-	0x6e, 0x65, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x10,
-	0x01, 0x12, 0x16, 0x0a, 0x12, 0x70, 0x61, 0x72, 0x74, 0x69, 0x61, 0x6c, 0x6c, 0x79, 0x5f, 0x64,
-	0x65, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x6f, 0x6e, 0x6c,
-	0x69, 0x6e, 0x65, 0x10, 0x03, 0x12, 0x11, 0x0a, 0x0d, 0x6e, 0x6f, 0x74, 0x5f, 0x61, 0x76, 0x61,
-	0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x10, 0x04, 0x22, 0x4e, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x0c, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x10, 0x00, 0x12, 0x0c,
-	0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x10, 0x01, 0x12, 0x15, 0x0a, 0x11,
-	0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x5f, 0x64, 0x65, 0x6c, 0x65, 0x67, 0x61, 0x74, 0x65,
-	0x64, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f, 0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x5f, 0x62,
-	0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x10, 0x03, 0x3a, 0x52, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x19,
-	0x0a, 0x17, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x76, 0x65, 0x72, 0x76, 0x69, 0x65,
-	0x77, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x11, 0x12,
-	0x0f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x76, 0x65, 0x72, 0x76, 0x69, 0x65, 0x77,
-	0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x06, 0x22, 0x04, 0x6d, 0x65, 0x73, 0x68, 0xaa, 0x8c, 0x89, 0xa6,
-	0x01, 0x02, 0x30, 0x01, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x02, 0x60, 0x01, 0x1a, 0x67, 0x0a, 0x0d,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
-	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x40, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
-	0x2e, 0x6b, 0x75, 0x6d, 0x61, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x69, 0x67,
-	0x68, 0x74, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x3a, 0x6d, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x18, 0x0a, 0x16, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x10, 0x12, 0x0e, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74, 0xaa, 0x8c, 0x89, 0xa6, 0x01,
-	0x06, 0x22, 0x04, 0x6d, 0x65, 0x73, 0x68, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x04, 0x52, 0x02, 0x10,
-	0x01, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x13, 0x3a, 0x11, 0x0a, 0x0f, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x2d, 0x69, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x04,
-	0x3a, 0x02, 0x18, 0x01, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x42, 0x2a, 0x5a, 0x28, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6b, 0x75, 0x6d, 0x61, 0x68, 0x71, 0x2f,
-	0x6b, 0x75, 0x6d, 0x61, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x50, 0x6f, 0x72, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x06, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x05, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x1a, 0x57, 0x0a, 0x0d, 0x44, 0x61,
+	0x74, 0x61, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74,
+	0x6f, 0x74, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61,
+	0x6c, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x06, 0x6f, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x66, 0x66,
+	0x6c, 0x69, 0x6e, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x6f, 0x66, 0x66, 0x6c,
+	0x69, 0x6e, 0x65, 0x1a, 0x41, 0x0a, 0x13, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x42, 0x61, 0x63,
+	0x6b, 0x65, 0x6e, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x56, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x08, 0x0a, 0x04, 0x6e, 0x6f, 0x6e, 0x65, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x6f, 0x66,
+	0x66, 0x6c, 0x69, 0x6e, 0x65, 0x10, 0x01, 0x12, 0x16, 0x0a, 0x12, 0x70, 0x61, 0x72, 0x74, 0x69,
+	0x61, 0x6c, 0x6c, 0x79, 0x5f, 0x64, 0x65, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x10, 0x02, 0x12,
+	0x0a, 0x0a, 0x06, 0x6f, 0x6e, 0x6c, 0x69, 0x6e, 0x65, 0x10, 0x03, 0x12, 0x11, 0x0a, 0x0d, 0x6e,
+	0x6f, 0x74, 0x5f, 0x61, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x10, 0x04, 0x22, 0x4e,
+	0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0c, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x10, 0x01, 0x12, 0x15, 0x0a, 0x11, 0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x5f, 0x64, 0x65,
+	0x6c, 0x65, 0x67, 0x61, 0x74, 0x65, 0x64, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f, 0x67, 0x61, 0x74,
+	0x65, 0x77, 0x61, 0x79, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x10, 0x03, 0x3a, 0x52,
+	0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x19, 0x0a, 0x17, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f,
+	0x76, 0x65, 0x72, 0x76, 0x69, 0x65, 0x77, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xaa,
+	0x8c, 0x89, 0xa6, 0x01, 0x11, 0x12, 0x0f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x76,
+	0x65, 0x72, 0x76, 0x69, 0x65, 0x77, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x06, 0x22, 0x04, 0x6d, 0x65,
+	0x73, 0x68, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x02, 0x30, 0x01, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x02,
+	0x60, 0x01, 0x1a, 0x67, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x40, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x6b, 0x75, 0x6d, 0x61, 0x2e, 0x6d, 0x65, 0x73, 0x68,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x49, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x3a, 0x6d, 0xaa, 0x8c, 0x89,
+	0xa6, 0x01, 0x18, 0x0a, 0x16, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x69,
+	0x67, 0x68, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0xaa, 0x8c, 0x89, 0xa6, 0x01,
+	0x10, 0x12, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x73, 0x69, 0x67, 0x68,
+	0x74, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x06, 0x22, 0x04, 0x6d, 0x65, 0x73, 0x68, 0xaa, 0x8c, 0x89,
+	0xa6, 0x01, 0x04, 0x52, 0x02, 0x10, 0x01, 0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x13, 0x3a, 0x11, 0x0a,
+	0x0f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2d, 0x69, 0x6e, 0x73, 0x69, 0x67, 0x68, 0x74,
+	0xaa, 0x8c, 0x89, 0xa6, 0x01, 0x04, 0x3a, 0x02, 0x18, 0x01, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02,
+	0x42, 0x2a, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6b,
+	0x75, 0x6d, 0x61, 0x68, 0x71, 0x2f, 0x6b, 0x75, 0x6d, 0x61, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6d,
+	0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/api/mesh/v1alpha1/service_insight.proto b/api/mesh/v1alpha1/service_insight.proto
index eddb41242..7a72a2c05 100644
--- a/api/mesh/v1alpha1/service_insight.proto
+++ b/api/mesh/v1alpha1/service_insight.proto
@@ -52,6 +52,8 @@ message ServiceInsight {
     }
     Type serviceType = 4;
     string addressPort = 5;
+
+    repeated string zones = 6;
   }
 
   map<string, Service> services = 2;
diff --git a/app/kuma-cp/cmd/run.go b/app/kuma-cp/cmd/run.go
index 73b851b2f..c33309690 100644
--- a/app/kuma-cp/cmd/run.go
+++ b/app/kuma-cp/cmd/run.go
@@ -86,7 +86,7 @@ func newRunCmdWithOpts(opts kuma_cmd.RunCmdOpts) *cobra.Command {
 
 			if limit, _ := os.CurrentFileLimit(); limit < minOpenFileLimit {
 				runLog.Info("for better performance, raise the open file limit",
-					"minimim-open-files", minOpenFileLimit)
+					"minimum-open-files", minOpenFileLimit)
 			}
 
 			if err := mads_server.SetupServer(rt); err != nil {
diff --git a/deployments/charts/kuma/templates/_helpers.tpl b/deployments/charts/kuma/templates/_helpers.tpl
index 4d636e106..6a0f2675f 100644
--- a/deployments/charts/kuma/templates/_helpers.tpl
+++ b/deployments/charts/kuma/templates/_helpers.tpl
@@ -376,6 +376,8 @@ env:
 - name: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
   value: /var/run/secrets/kuma.io/kds-server-tls-cert/tls.key
 {{- end }}
+- name: KUMA_STORE_POSTGRES_TLS_MODE
+  value: {{ .Values.postgres.tls.mode }}
 {{- if or (eq .Values.postgres.tls.mode "verifyCa") (eq .Values.postgres.tls.mode "verifyFull") }}
 {{- if empty .Values.postgres.tls.caSecretName }}
 {{ fail "if mode is 'verifyCa' or 'verifyFull' then you must provide .Values.postgres.tls.caSecretName" }}
@@ -390,8 +392,6 @@ env:
 - name: KUMA_STORE_POSTGRES_TLS_CA_PATH
   value: /var/run/secrets/kuma.io/postgres-tls-cert/ca.crt
 {{- end }}
-- name: KUMA_STORE_POSTGRES_TLS_MODE
-  value: {{ .Values.postgres.tls.mode }}
 {{- if .Values.postgres.tls.disableSSLSNI }}
 - name: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
   value: {{ .Values.postgres.tls.disableSSLSNI }}
diff --git a/docs/generated/raw/kuma-cp.yaml b/docs/generated/raw/kuma-cp.yaml
index e82d35a3b..f9562902b 100644
--- a/docs/generated/raw/kuma-cp.yaml
+++ b/docs/generated/raw/kuma-cp.yaml
@@ -26,6 +26,8 @@ store:
     driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
     # Connection Timeout to the DB in seconds
     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
+    # MaxConnectionIdleTime (applied only when driverName=pgx) is the duration after which an idle connection will be automatically closed by the health check.
+    maxConnectionIdleTime: "30m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME
     # MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
     maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
     # MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after maxConnectionLifetime to randomly decide to close a connection.
diff --git a/docs/generated/raw/protos/ServiceInsight.json b/docs/generated/raw/protos/ServiceInsight.json
index 21a33e559..cea90daa0 100644
--- a/docs/generated/raw/protos/ServiceInsight.json
+++ b/docs/generated/raw/protos/ServiceInsight.json
@@ -74,6 +74,12 @@
                 },
                 "addressPort": {
                     "type": "string"
+                },
+                "zones": {
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
                 }
             },
             "additionalProperties": true,
diff --git a/go.mod b/go.mod
index 727d052fe..b7e6f949b 100644
--- a/go.mod
+++ b/go.mod
@@ -47,7 +47,6 @@ require (
 	github.com/sethvargo/go-retry v0.2.4
 	github.com/shopspring/decimal v1.3.1
 	github.com/slok/go-http-metrics v0.11.0
-	github.com/soheilhy/cmux v0.1.5
 	github.com/spf13/cobra v1.8.0
 	github.com/spiffe/go-spiffe/v2 v2.1.7
 	github.com/testcontainers/testcontainers-go v0.29.1
@@ -114,7 +113,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.5.0 // indirect
-	github.com/docker/docker v25.0.3+incompatible // indirect
+	github.com/docker/docker v25.0.5+incompatible // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
diff --git a/go.sum b/go.sum
index 0e67732ff..877a8de60 100644
--- a/go.sum
+++ b/go.sum
@@ -82,8 +82,8 @@ github.com/dhui/dktest v0.4.0 h1:z05UmuXZHO/bgj/ds2bGMBu8FI4WA+Ag/m3ghL+om7M=
 github.com/dhui/dktest v0.4.0/go.mod h1:v/Dbz1LgCBOi2Uki2nUqLBGa83hWBGFMu5MrgMDCc78=
 github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
 github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v25.0.3+incompatible h1:D5fy/lYmY7bvZa0XTZ5/UJPljor41F+vdyJG5luQLfQ=
-github.com/docker/docker v25.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v25.0.5+incompatible h1:UmQydMduGkrD5nQde1mecF/YnSbTOaPeFIeP5C4W+DE=
+github.com/docker/docker v25.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -420,8 +420,6 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/slok/go-http-metrics v0.11.0 h1:ABJUpekCZSkQT1wQrFvS4kGbhea/w6ndFJaWJeh3zL0=
 github.com/slok/go-http-metrics v0.11.0/go.mod h1:ZGKeYG1ET6TEJpQx18BqAJAvxw9jBAZXCHU7bWQqqAc=
-github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
-github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
@@ -549,7 +547,6 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
diff --git a/pkg/api-server/server.go b/pkg/api-server/server.go
index 087d3457b..226735042 100644
--- a/pkg/api-server/server.go
+++ b/pkg/api-server/server.go
@@ -15,6 +15,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/bakito/go-log-logr-adapter/adapter"
@@ -49,6 +50,7 @@ import (
 	secrets_k8s "github.com/kumahq/kuma/pkg/plugins/secrets/k8s"
 	"github.com/kumahq/kuma/pkg/tokens/builtin"
 	tokens_server "github.com/kumahq/kuma/pkg/tokens/builtin/server"
+	kuma_srv "github.com/kumahq/kuma/pkg/util/http/server"
 	util_prometheus "github.com/kumahq/kuma/pkg/util/prometheus"
 	"github.com/kumahq/kuma/pkg/version"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
@@ -58,8 +60,10 @@ import (
 var log = core.Log.WithName("api-server")
 
 type ApiServer struct {
-	mux    *http.ServeMux
-	config api_server.ApiServerConfig
+	mux        *http.ServeMux
+	config     api_server.ApiServerConfig
+	httpReady  atomic.Bool
+	httpsReady atomic.Bool
 }
 
 func (a *ApiServer) NeedLeaderElection() bool {
@@ -326,23 +330,50 @@ func ShouldBeReadOnly(kdsFlag model.KDSFlagType, cfg *kuma_cp.Config) bool {
 	return false
 }
 
+func (a *ApiServer) Ready() bool {
+	return a.httpReady.Load() && a.httpsReady.Load()
+}
+
 func (a *ApiServer) Start(stop <-chan struct{}) error {
 	errChan := make(chan error)
 
 	var httpServer, httpsServer *http.Server
 	if a.config.HTTP.Enabled {
-		httpServer = a.startHttpServer(errChan)
+		httpServer = &http.Server{
+			ReadHeaderTimeout: time.Second,
+			Addr:              net.JoinHostPort(a.config.HTTP.Interface, strconv.FormatUint(uint64(a.config.HTTP.Port), 10)),
+			Handler:           a.mux,
+			ErrorLog:          adapter.ToStd(log),
+		}
+		if err := kuma_srv.StartServer(log, httpServer, &a.httpReady, errChan); err != nil {
+			return err
+		}
+	} else {
+		a.httpReady.Store(true)
 	}
 	if a.config.HTTPS.Enabled {
-		var err error
-		httpsServer, err = a.startHttpsServer(errChan)
+		tlsConfig, err := configureTLS(a.config)
 		if err != nil {
 			return err
 		}
+		httpsServer = &http.Server{
+			ReadHeaderTimeout: time.Second,
+			Addr:              net.JoinHostPort(a.config.HTTPS.Interface, strconv.FormatUint(uint64(a.config.HTTPS.Port), 10)),
+			Handler:           a.mux,
+			TLSConfig:         tlsConfig,
+			ErrorLog:          adapter.ToStd(log),
+		}
+		if err := kuma_srv.StartServer(log, httpsServer, &a.httpsReady, errChan); err != nil {
+			return err
+		}
+	} else {
+		a.httpsReady.Store(true)
 	}
 	select {
 	case <-stop:
 		log.Info("stopping down API Server")
+		a.httpReady.Store(false)
+		a.httpsReady.Store(false)
 		if httpServer != nil {
 			return httpServer.Shutdown(context.Background())
 		}
@@ -355,80 +386,29 @@ func (a *ApiServer) Start(stop <-chan struct{}) error {
 	return nil
 }
 
-func (a *ApiServer) startHttpServer(errChan chan error) *http.Server {
-	server := &http.Server{
-		ReadHeaderTimeout: time.Second,
-		Addr:              net.JoinHostPort(a.config.HTTP.Interface, strconv.FormatUint(uint64(a.config.HTTP.Port), 10)),
-		Handler:           a.mux,
-		ErrorLog:          adapter.ToStd(log),
+func configureTLS(cfg api_server.ApiServerConfig) (*tls.Config, error) {
+	cert, err := tls.LoadX509KeyPair(cfg.HTTPS.TlsCertFile, cfg.HTTPS.TlsKeyFile)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to load TLS certificate")
 	}
-
-	go func() {
-		err := server.ListenAndServe()
-		if err != nil {
-			switch err {
-			case http.ErrServerClosed:
-				log.Info("shutting down server")
-			default:
-				log.Error(err, "could not start an HTTP Server")
-				errChan <- err
-			}
-		}
-	}()
-	log.Info("starting", "interface", a.config.HTTP.Interface, "port", a.config.HTTP.Port)
-	return server
-}
-
-func (a *ApiServer) startHttpsServer(errChan chan error) (*http.Server, error) {
 	tlsConfig := &tls.Config{
-		MinVersion: tls.VersionTLS12, // to pass gosec (in practice it's always set after.
-	}
-	var err error
-	tlsConfig.MinVersion, err = config_types.TLSVersion(a.config.HTTPS.TlsMinVersion)
-	if err != nil {
-		return nil, err
+		Certificates: []tls.Certificate{cert},
+		MinVersion:   tls.VersionTLS12, // to pass gosec (in practice it's always set after.
 	}
-	tlsConfig.CipherSuites, err = config_types.TLSCiphers(a.config.HTTPS.TlsCipherSuites)
+	tlsConfig.MinVersion, err = config_types.TLSVersion(cfg.HTTPS.TlsMinVersion)
 	if err != nil {
 		return nil, err
 	}
-
-	err = configureMTLS(tlsConfig, a.config)
+	tlsConfig.CipherSuites, err = config_types.TLSCiphers(cfg.HTTPS.TlsCipherSuites)
 	if err != nil {
 		return nil, err
 	}
-
-	server := &http.Server{
-		ReadHeaderTimeout: time.Second,
-		Addr:              net.JoinHostPort(a.config.HTTPS.Interface, strconv.FormatUint(uint64(a.config.HTTPS.Port), 10)),
-		Handler:           a.mux,
-		TLSConfig:         tlsConfig,
-		ErrorLog:          adapter.ToStd(log),
-	}
-
-	go func() {
-		err := server.ListenAndServeTLS(a.config.HTTPS.TlsCertFile, a.config.HTTPS.TlsKeyFile)
-		if err != nil {
-			switch err {
-			case http.ErrServerClosed:
-				log.Info("shutting down server")
-			default:
-				log.Error(err, "could not start an HTTPS Server")
-				errChan <- err
-			}
-		}
-	}()
-	log.Info("starting", "interface", a.config.HTTPS.Interface, "port", a.config.HTTPS.Port, "tls", true)
-	return server, nil
-}
-
-func configureMTLS(tlsConfig *tls.Config, cfg api_server.ApiServerConfig) error {
 	clientCertPool := x509.NewCertPool()
 	if cfg.Auth.ClientCertsDir != "" {
 		log.Info("loading client certificates")
 		files, err := os.ReadDir(cfg.Auth.ClientCertsDir)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		for _, file := range files {
 			if file.IsDir() {
@@ -442,20 +422,20 @@ func configureMTLS(tlsConfig *tls.Config, cfg api_server.ApiServerConfig) error
 			path := filepath.Join(cfg.Auth.ClientCertsDir, file.Name())
 			caCert, err := os.ReadFile(path)
 			if err != nil {
-				return errors.Wrapf(err, "could not read certificate %q", path)
+				return nil, errors.Wrapf(err, "could not read certificate %q", path)
 			}
 			if !clientCertPool.AppendCertsFromPEM(caCert) {
-				return errors.Errorf("failed to load PEM client certificate from %q", path)
+				return nil, errors.Errorf("failed to load PEM client certificate from %q", path)
 			}
 		}
 	}
 	if cfg.HTTPS.TlsCaFile != "" {
 		file, err := os.ReadFile(cfg.HTTPS.TlsCaFile)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		if !clientCertPool.AppendCertsFromPEM(file) {
-			return errors.Errorf("failed to load PEM client certificate from %q", cfg.HTTPS.TlsCaFile)
+			return nil, errors.Errorf("failed to load PEM client certificate from %q", cfg.HTTPS.TlsCaFile)
 		}
 	}
 
@@ -465,7 +445,7 @@ func configureMTLS(tlsConfig *tls.Config, cfg api_server.ApiServerConfig) error
 	} else if cfg.Authn.Type == certs.PluginName {
 		tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven // client certs are required only for some endpoints when using admin client cert
 	}
-	return nil
+	return tlsConfig, nil
 }
 
 func SetupServer(rt runtime.Runtime) error {
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index e82d35a3b..f9562902b 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -26,6 +26,8 @@ store:
     driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
     # Connection Timeout to the DB in seconds
     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
+    # MaxConnectionIdleTime (applied only when driverName=pgx) is the duration after which an idle connection will be automatically closed by the health check.
+    maxConnectionIdleTime: "30m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME
     # MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
     maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
     # MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after maxConnectionLifetime to randomly decide to close a connection.
diff --git a/pkg/config/plugins/resources/postgres/config.go b/pkg/config/plugins/resources/postgres/config.go
index a91d3f05c..cf0e6a8e0 100644
--- a/pkg/config/plugins/resources/postgres/config.go
+++ b/pkg/config/plugins/resources/postgres/config.go
@@ -15,6 +15,7 @@ import (
 const (
 	DriverNamePgx             = "pgx"
 	DriverNamePq              = "postgres"
+	DefaultConnectionTimeout  = 5
 	DefaultMaxIdleConnections = 50
 	DefaultMinOpenConnections = 0
 )
@@ -30,6 +31,7 @@ var (
 	DefaultMaxConnectionLifetime       = config_types.Duration{Duration: time.Hour}
 	DefaultMaxConnectionLifetimeJitter = config_types.Duration{Duration: 1 * time.Minute}
 	DefaultHealthCheckInterval         = config_types.Duration{Duration: 30 * time.Second}
+	DefaultMaxConnectionIdleTime       = config_types.Duration{Duration: 30 * time.Minute}
 	// some of the above settings taken from pgx https://github.com/jackc/pgx/blob/ca022267dbbfe7a8ba7070557352a5cd08f6cb37/pgxpool/pool.go#L18-L22
 )
 
@@ -51,6 +53,8 @@ type PostgresStoreConfig struct {
 	DriverName string `json:"driverName" envconfig:"kuma_store_postgres_driver_name"`
 	// Connection Timeout to the DB in seconds
 	ConnectionTimeout int `json:"connectionTimeout" envconfig:"kuma_store_postgres_connection_timeout"`
+	// MaxConnectionIdleTime (applied only when driverName=pgx) is the duration after which an idle connection will be automatically closed by the health check.
+	MaxConnectionIdleTime config_types.Duration `json:"maxConnectionIdleTime" envconfig:"kuma_store_postgres_max_connection_idle_time"`
 	// MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
 	MaxConnectionLifetime config_types.Duration `json:"maxConnectionLifetime" envconfig:"kuma_store_postgres_max_connection_lifetime"`
 	// MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after MaxConnectionLifetime to randomly decide to close a connection.
@@ -292,7 +296,7 @@ func DefaultPostgresStoreConfig() *PostgresStoreConfig {
 		Password:                    "kuma",
 		DbName:                      "kuma",
 		DriverName:                  DriverNamePgx,
-		ConnectionTimeout:           5,
+		ConnectionTimeout:           DefaultConnectionTimeout,
 		MaxOpenConnections:          50,                        // 0 for unlimited
 		MaxIdleConnections:          DefaultMaxIdleConnections, // 0 for unlimited
 		TLS:                         DefaultTLSPostgresStoreConfig(),
@@ -307,6 +311,7 @@ func DefaultPostgresStoreConfig() *PostgresStoreConfig {
 			Port:  5432,
 			Ratio: 100,
 		},
+		MaxConnectionIdleTime: DefaultMaxConnectionIdleTime,
 	}
 }
 
diff --git a/pkg/core/runtime/component/component.go b/pkg/core/runtime/component/component.go
index b86cf353b..71f2bd043 100644
--- a/pkg/core/runtime/component/component.go
+++ b/pkg/core/runtime/component/component.go
@@ -22,6 +22,14 @@ type Component interface {
 	NeedLeaderElection() bool
 }
 
+type ReadyComponent interface {
+	Component
+
+	// Ready returns true if the component is ready to serve traffic.
+	// This is useful to read this for a readiness probe
+	Ready() bool
+}
+
 // GracefulComponent is a component that supports waiting until it's finished.
 // It's useful if there is cleanup logic that has to be executed before the process exits
 // (i.e. sending SIGTERM signals to subprocesses started by this component).
@@ -66,6 +74,8 @@ type Manager interface {
 	// Returns an error if there is an error starting any component.
 	// If there are any GracefulComponent, it waits until all components are done.
 	Start(<-chan struct{}) error
+
+	Ready() bool
 }
 
 var _ Manager = &manager{}
@@ -88,6 +98,20 @@ type manager struct {
 	errCh      chan error
 }
 
+func (cm *manager) Ready() bool {
+	cm.Lock()
+	defer cm.Unlock()
+
+	for _, component := range cm.components {
+		if ready, ok := component.(ReadyComponent); ok {
+			if !ready.Ready() {
+				return false
+			}
+		}
+	}
+	return true
+}
+
 func (cm *manager) Add(c ...Component) error {
 	cm.Lock()
 	defer cm.Unlock()
diff --git a/pkg/diagnostics/components.go b/pkg/diagnostics/components.go
index 6fa0171e1..38409a22a 100644
--- a/pkg/diagnostics/components.go
+++ b/pkg/diagnostics/components.go
@@ -7,6 +7,7 @@ import (
 func SetupServer(rt core_runtime.Runtime) error {
 	return rt.Add(
 		&diagnosticsServer{
+			isReady: rt.Ready,
 			config:  rt.Config().Diagnostics,
 			metrics: rt.Metrics(),
 		},
diff --git a/pkg/diagnostics/server.go b/pkg/diagnostics/server.go
index 383513e8f..b3e6a37f8 100644
--- a/pkg/diagnostics/server.go
+++ b/pkg/diagnostics/server.go
@@ -5,7 +5,8 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net/http"
-	pprof "net/http/pprof"
+	"net/http/pprof"
+	"sync/atomic"
 	"time"
 
 	"github.com/bakito/go-log-logr-adapter/adapter"
@@ -17,13 +18,16 @@ import (
 	"github.com/kumahq/kuma/pkg/core"
 	"github.com/kumahq/kuma/pkg/core/runtime/component"
 	"github.com/kumahq/kuma/pkg/metrics"
+	kuma_srv "github.com/kumahq/kuma/pkg/util/http/server"
 )
 
 var diagnosticsServerLog = core.Log.WithName("xds-server").WithName("diagnostics")
 
 type diagnosticsServer struct {
+	isReady func() bool
 	config  *diagnostics_config.DiagnosticsConfig
 	metrics metrics.Metrics
+	ready   atomic.Bool
 }
 
 func (s *diagnosticsServer) NeedLeaderElection() bool {
@@ -38,7 +42,11 @@ var (
 func (s *diagnosticsServer) Start(stop <-chan struct{}) error {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/ready", func(resp http.ResponseWriter, _ *http.Request) {
-		resp.WriteHeader(http.StatusOK)
+		if s.isReady() {
+			resp.WriteHeader(http.StatusOK)
+		} else {
+			resp.WriteHeader(http.StatusServiceUnavailable)
+		}
 	})
 	mux.HandleFunc("/healthy", func(resp http.ResponseWriter, _ *http.Request) {
 		resp.WriteHeader(http.StatusOK)
@@ -51,20 +59,13 @@ func (s *diagnosticsServer) Start(stop <-chan struct{}) error {
 		mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
 		mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
 	}
-
-	httpServer := &http.Server{
-		Addr:              fmt.Sprintf(":%d", s.config.ServerPort),
-		Handler:           mux,
-		ReadHeaderTimeout: time.Second,
-		ErrorLog:          adapter.ToStd(diagnosticsServerLog),
-	}
-
+	var tlsConfig *tls.Config
 	if s.config.TlsEnabled {
 		cert, err := tls.LoadX509KeyPair(s.config.TlsCertFile, s.config.TlsKeyFile)
 		if err != nil {
 			return errors.Wrap(err, "failed to load TLS certificate")
 		}
-		tlsConfig := &tls.Config{
+		tlsConfig = &tls.Config{
 			Certificates: []tls.Certificate{cert},
 			MinVersion:   tls.VersionTLS12, // Make gosec pass, (In practice it's always set after).
 		}
@@ -77,41 +78,27 @@ func (s *diagnosticsServer) Start(stop <-chan struct{}) error {
 		if tlsConfig.CipherSuites, err = config_types.TLSCiphers(s.config.TlsCipherSuites); err != nil {
 			return err
 		}
-		httpServer.TLSConfig = tlsConfig
 	}
 
-	diagnosticsServerLog.Info("starting diagnostic server", "interface", "0.0.0.0", "port", s.config.ServerPort, "tls", s.config.TlsEnabled)
+	httpServer := &http.Server{
+		TLSConfig:         tlsConfig,
+		Addr:              fmt.Sprintf(":%d", s.config.ServerPort),
+		Handler:           mux,
+		ReadHeaderTimeout: time.Second,
+		ErrorLog:          adapter.ToStd(diagnosticsServerLog),
+	}
 	errChan := make(chan error)
-	go func() {
-		defer close(errChan)
-		var err error
-		if s.config.TlsEnabled {
-			err = httpServer.ListenAndServeTLS(s.config.TlsCertFile, s.config.TlsKeyFile)
-		} else {
-			err = httpServer.ListenAndServe()
-		}
-		if err != nil {
-			switch err {
-			case http.ErrServerClosed:
-				diagnosticsServerLog.Info("shutting down server")
-			default:
-				if s.config.TlsEnabled {
-					diagnosticsServerLog.Error(err, "could not start HTTPS Server")
-				} else {
-					diagnosticsServerLog.Error(err, "could not start HTTP Server")
-				}
-				errChan <- err
-			}
-			return
-		}
-		diagnosticsServerLog.Info("terminated normally")
-	}()
+	if err := kuma_srv.StartServer(diagnosticsServerLog, httpServer, &s.ready, errChan); err != nil {
+		return err
+	}
 
 	select {
 	case <-stop:
+		s.ready.Store(false)
 		diagnosticsServerLog.Info("stopping")
 		return httpServer.Shutdown(context.Background())
 	case err := <-errChan:
+		s.ready.Store(false)
 		return err
 	}
 }
diff --git a/pkg/dp-server/server/server.go b/pkg/dp-server/server/server.go
index fa3f3c520..a1c095805 100644
--- a/pkg/dp-server/server/server.go
+++ b/pkg/dp-server/server/server.go
@@ -4,11 +4,14 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
+	"net"
 	"net/http"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/bakito/go-log-logr-adapter/adapter"
+	"github.com/pkg/errors"
 	http_prometheus "github.com/slok/go-http-metrics/metrics/prometheus"
 	"github.com/slok/go-http-metrics/middleware"
 	"github.com/slok/go-http-metrics/middleware/std"
@@ -37,6 +40,7 @@ type DpServer struct {
 	grpcServer     *grpc.Server
 	filter         Filter
 	promMiddleware middleware.Middleware
+	ready          atomic.Bool
 }
 
 var _ component.Component = &DpServer{}
@@ -72,9 +76,17 @@ func NewDpServer(config dp_server.DpServerConfig, metrics metrics.Metrics, filte
 	}
 }
 
+func (d *DpServer) Ready() bool {
+	return d.ready.Load()
+}
+
 func (d *DpServer) Start(stop <-chan struct{}) error {
 	var err error
-	tlsConfig := &tls.Config{MinVersion: tls.VersionTLS12} // To make gosec pass this is always set after
+	cert, err := tls.LoadX509KeyPair(d.config.TlsCertFile, d.config.TlsKeyFile)
+	if err != nil {
+		return errors.Wrap(err, "failed to load TLS certificate")
+	}
+	tlsConfig := &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12} // To make gosec happy
 	if tlsConfig.MinVersion, err = config_types.TLSVersion(d.config.TlsMinVersion); err != nil {
 		return err
 	}
@@ -91,27 +103,34 @@ func (d *DpServer) Start(stop <-chan struct{}) error {
 		TLSConfig:         tlsConfig,
 		ErrorLog:          adapter.ToStd(log),
 	}
+	l, err := net.Listen("tcp", server.Addr)
+	if err != nil {
+		return err
+	}
 
 	errChan := make(chan error)
 
 	go func() {
 		defer close(errChan)
-		if err := server.ListenAndServeTLS(d.config.TlsCertFile, d.config.TlsKeyFile); err != nil {
-			if err != http.ErrServerClosed {
+		d.ready.Store(true)
+		if err := server.ServeTLS(l, d.config.TlsCertFile, d.config.TlsKeyFile); err != nil {
+			if errors.Is(err, http.ErrServerClosed) {
+				log.Info("terminated normally")
+			} else {
 				log.Error(err, "terminated with an error")
 				errChan <- err
-				return
 			}
 		}
-		log.Info("terminated normally")
 	}()
 	log.Info("starting", "interface", "0.0.0.0", "port", d.config.Port, "tls", true)
 
 	select {
 	case <-stop:
 		log.Info("stopping")
+		d.ready.Store(false)
 		return server.Shutdown(context.Background())
 	case err := <-errChan:
+		d.ready.Store(false)
 		return err
 	}
 }
diff --git a/pkg/insights/resyncer.go b/pkg/insights/resyncer.go
index 1506df552..f992e10c4 100644
--- a/pkg/insights/resyncer.go
+++ b/pkg/insights/resyncer.go
@@ -464,6 +464,16 @@ func (r *resyncer) createOrUpdateServiceInsight(
 		Services: map[string]*mesh_proto.ServiceInsight_Service{},
 	}
 
+	zonesMap := map[string]map[string]struct{}{}
+	addSvcToZones := func(svc, zone string) {
+		if zone == "" {
+			return
+		}
+		if _, ok := zonesMap[svc]; !ok {
+			zonesMap[svc] = map[string]struct{}{}
+		}
+		zonesMap[svc][zone] = struct{}{}
+	}
 	for _, dpOverview := range dpOverviews {
 		status, _ := dpOverview.GetStatus()
 		networking := dpOverview.Spec.GetDataplane().GetNetworking()
@@ -478,6 +488,7 @@ func (r *resyncer) createOrUpdateServiceInsight(
 				svcType = mesh_proto.ServiceInsight_Service_gateway_delegated
 			}
 			populateInsight(svcType, insight, gw.GetTags()[mesh_proto.ServiceTag], status, backend, "")
+			addSvcToZones(gw.GetTags()[mesh_proto.ServiceTag], gw.GetTags()[mesh_proto.ZoneTag])
 		}
 
 		for _, inbound := range networking.GetInbound() {
@@ -486,14 +497,16 @@ func (r *resyncer) createOrUpdateServiceInsight(
 			}
 			// address port is empty to save space in the resource. It will be filled by the server on API response
 			populateInsight(mesh_proto.ServiceInsight_Service_internal, insight, inbound.GetService(), status, backend, "")
+			addSvcToZones(inbound.GetService(), inbound.GetTags()[mesh_proto.ZoneTag])
 		}
 	}
 
 	for _, es := range externalServices {
 		populateInsight(mesh_proto.ServiceInsight_Service_external, insight, es.Spec.GetService(), "", "", es.Spec.Networking.GetAddress())
+		addSvcToZones(es.Spec.GetService(), es.Spec.GetTags()[mesh_proto.ZoneTag])
 	}
 
-	for _, svc := range insight.Services {
+	for svcName, svc := range insight.Services {
 		online := svc.Dataplanes.Online
 		total := svc.Dataplanes.Online + svc.Dataplanes.Offline
 
@@ -507,6 +520,9 @@ func (r *resyncer) createOrUpdateServiceInsight(
 		case online < total:
 			svc.Status = mesh_proto.ServiceInsight_Service_partially_degraded
 		}
+		if zones, ok := zonesMap[svcName]; ok {
+			svc.Zones = util_maps.SortedKeys(zones)
+		}
 	}
 
 	key := ServiceInsightKey(mesh)
diff --git a/pkg/intercp/server/server.go b/pkg/intercp/server/server.go
index 0b4d4b4c9..46fd0a926 100644
--- a/pkg/intercp/server/server.go
+++ b/pkg/intercp/server/server.go
@@ -6,8 +6,10 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"sync/atomic"
 	"time"
 
+	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -31,6 +33,7 @@ type InterCpServer struct {
 	config     intercp.InterCpServerConfig
 	grpcServer *grpc.Server
 	instanceId string
+	ready      atomic.Bool
 }
 
 var _ component.Component = &InterCpServer{}
@@ -85,6 +88,10 @@ func New(
 	}, nil
 }
 
+func (d *InterCpServer) Ready() bool {
+	return d.ready.Load()
+}
+
 func (d *InterCpServer) Start(stop <-chan struct{}) error {
 	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", d.config.Port))
 	if err != nil {
@@ -95,27 +102,29 @@ func (d *InterCpServer) Start(stop <-chan struct{}) error {
 		d.instanceId,
 	)
 
+	log.Info("starting", "interface", "0.0.0.0", "port", d.config.Port, "tls", true)
 	errChan := make(chan error)
 	go func() {
 		defer close(errChan)
+		d.ready.Store(true)
 		if err := d.grpcServer.Serve(lis); err != nil {
-			if err != http.ErrServerClosed {
+			if !errors.Is(err, http.ErrServerClosed) {
 				log.Error(err, "terminated with an error")
 				errChan <- err
-				return
 			}
 		}
-		log.Info("terminated normally")
+		log.Info("shutting down server")
 	}()
-	log.Info("starting", "interface", "0.0.0.0", "port", d.config.Port, "tls", true)
 
 	select {
 	case <-stop:
 		log.Info("stopping gracefully")
+		d.ready.Store(false)
 		d.grpcServer.GracefulStop()
 		log.Info("stopped")
 		return nil
 	case err := <-errChan:
+		d.ready.Store(false)
 		return err
 	}
 }
diff --git a/pkg/mads/server/server.go b/pkg/mads/server/server.go
index 6dd57c586..c0481606f 100644
--- a/pkg/mads/server/server.go
+++ b/pkg/mads/server/server.go
@@ -1,11 +1,11 @@
 package server
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
-	"net"
 	"net/http"
-	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/bakito/go-log-logr-adapter/adapter"
@@ -13,7 +13,6 @@ import (
 	"github.com/pkg/errors"
 	http_prometheus "github.com/slok/go-http-metrics/metrics/prometheus"
 	"github.com/slok/go-http-metrics/middleware"
-	"github.com/soheilhy/cmux"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	config_core "github.com/kumahq/kuma/pkg/config/core"
@@ -25,6 +24,7 @@ import (
 	"github.com/kumahq/kuma/pkg/mads"
 	mads_v1 "github.com/kumahq/kuma/pkg/mads/v1/service"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
+	kuma_srv "github.com/kumahq/kuma/pkg/util/http/server"
 	util_prometheus "github.com/kumahq/kuma/pkg/util/prometheus"
 )
 
@@ -36,6 +36,7 @@ type muxServer struct {
 	httpServices []HttpService
 	config       *mads_config.MonitoringAssignmentServerConfig
 	metrics      core_metrics.Metrics
+	ready        atomic.Bool
 	mesh_proto.UnimplementedMultiplexServiceServer
 }
 
@@ -65,23 +66,18 @@ func (s *muxServer) createHttpServicesHandler() http.Handler {
 	return container
 }
 
-func (s *muxServer) Start(stop <-chan struct{}) error {
-	l, err := net.Listen("tcp", fmt.Sprintf(":%d", s.config.Port))
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err := l.Close(); err != nil {
-			log.Error(err, "unable to close the listener")
-		}
-	}()
+func (s *muxServer) Ready() bool {
+	return s.ready.Load()
+}
 
+func (s *muxServer) Start(stop <-chan struct{}) error {
+	var tlsConfig *tls.Config
 	if s.config.TlsEnabled {
 		cert, err := tls.LoadX509KeyPair(s.config.TlsCertFile, s.config.TlsKeyFile)
 		if err != nil {
 			return errors.Wrap(err, "failed to load TLS certificate")
 		}
-		tlsConfig := &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12} // To make gosec happy
+		tlsConfig = &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12} // To make gosec happy
 		if tlsConfig.MinVersion, err = config_types.TLSVersion(s.config.TlsMinVersion); err != nil {
 			return err
 		}
@@ -91,55 +87,25 @@ func (s *muxServer) Start(stop <-chan struct{}) error {
 		if tlsConfig.CipherSuites, err = config_types.TLSCiphers(s.config.TlsCipherSuites); err != nil {
 			return err
 		}
-		l = tls.NewListener(l, tlsConfig)
 	}
-	m := cmux.New(l)
-
-	httpL := m.Match(cmux.Any())
+	errChan := make(chan error)
 	httpS := &http.Server{
+		Addr:              fmt.Sprintf(":%d", s.config.Port),
 		ReadHeaderTimeout: time.Second,
+		TLSConfig:         tlsConfig,
 		Handler:           s.createHttpServicesHandler(),
 		ErrorLog:          adapter.ToStd(log),
 	}
-	errChanHttp := make(chan error)
-	go func() {
-		defer close(errChanHttp)
-		if err := httpS.Serve(httpL); err != nil {
-			switch err {
-			case cmux.ErrServerClosed:
-				log.Info("shutting down an HTTP Server")
-			default:
-				log.Error(err, "could not start an HTTP Server")
-				errChanHttp <- err
-			}
-		}
-	}()
-
-	errChan := make(chan error)
-	go func() {
-		defer close(errChan)
-		err := m.Serve()
-		if err != nil {
-			if strings.Contains(err.Error(), "use of closed network connection") {
-				log.Info("shutting down a mux server")
-			} else {
-				log.Error(err, "could not start a mux Server")
-				errChan <- err
-			}
-		}
-	}()
-
-	log.Info("starting", "interface", "0.0.0.0", "port", s.config.Port)
-
-	defer m.Close()
-
+	if err := kuma_srv.StartServer(log, httpS, &s.ready, errChan); err != nil {
+		return err
+	}
 	select {
 	case <-stop:
 		log.Info("stopping gracefully")
-		return nil
-	case err := <-errChanHttp:
-		return err
+		s.ready.Store(false)
+		return httpS.Shutdown(context.Background())
 	case err := <-errChan:
+		s.ready.Store(false)
 		return err
 	}
 }
diff --git a/pkg/plugins/bootstrap/k8s/plugin.go b/pkg/plugins/bootstrap/k8s/plugin.go
index c3fa637de..8f2923082 100644
--- a/pkg/plugins/bootstrap/k8s/plugin.go
+++ b/pkg/plugins/bootstrap/k8s/plugin.go
@@ -185,7 +185,7 @@ func (p *plugin) Order() int {
 
 type kubeComponentManager struct {
 	kube_ctrl.Manager
-	gracefulComponents []component.GracefulComponent
+	components []component.Component
 }
 
 var _ component.Manager = &kubeComponentManager{}
@@ -212,9 +212,7 @@ var _ kube_manager.LeaderElectionRunnable = component.ComponentFunc(func(i <-cha
 
 func (k *kubeComponentManager) Add(components ...component.Component) error {
 	for _, c := range components {
-		if gc, ok := c.(component.GracefulComponent); ok {
-			k.gracefulComponents = append(k.gracefulComponents, gc)
-		}
+		k.components = append(k.components, c)
 		if err := k.Manager.Add(&componentRunnableAdaptor{Component: c}); err != nil {
 			return err
 		}
@@ -222,9 +220,20 @@ func (k *kubeComponentManager) Add(components ...component.Component) error {
 	return nil
 }
 
+func (k *kubeComponentManager) Ready() bool {
+	for _, c := range k.components {
+		if rc, ok := c.(component.ReadyComponent); ok && !rc.Ready() {
+			return false
+		}
+	}
+	return true
+}
+
 func (k *kubeComponentManager) waitForDone() {
-	for _, gc := range k.gracefulComponents {
-		gc.WaitForDone()
+	for _, c := range k.components {
+		if gc, ok := c.(component.GracefulComponent); ok {
+			gc.WaitForDone()
+		}
 	}
 }
 
@@ -241,6 +250,13 @@ func (c componentRunnableAdaptor) NeedLeaderElection() bool {
 	return c.Component.NeedLeaderElection()
 }
 
+func (c componentRunnableAdaptor) Ready() bool {
+	if ready, ok := c.Component.(component.ReadyComponent); ok {
+		return ready.Ready()
+	}
+	return true
+}
+
 var (
 	_ kube_manager.LeaderElectionRunnable = &componentRunnableAdaptor{}
 	_ kube_manager.Runnable               = &componentRunnableAdaptor{}
diff --git a/pkg/plugins/common/postgres/connection.go b/pkg/plugins/common/postgres/connection.go
index a7693a214..e50ef05a0 100644
--- a/pkg/plugins/common/postgres/connection.go
+++ b/pkg/plugins/common/postgres/connection.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"database/sql"
 	"math"
-	"time"
 
 	"github.com/exaring/otelpgx"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -55,8 +54,8 @@ func ConnectToDbPgx(postgresStoreConfig config.PostgresStoreConfig, customizers
 	} else {
 		pgxConfig.MaxConns = int32(postgresStoreConfig.MaxOpenConnections)
 	}
+	pgxConfig.MaxConnIdleTime = postgresStoreConfig.MaxConnectionIdleTime.Duration
 	pgxConfig.MinConns = int32(postgresStoreConfig.MinOpenConnections)
-	pgxConfig.MaxConnIdleTime = time.Duration(postgresStoreConfig.ConnectionTimeout) * time.Second
 	pgxConfig.MaxConnLifetime = postgresStoreConfig.MaxConnectionLifetime.Duration
 	pgxConfig.MaxConnLifetimeJitter = postgresStoreConfig.MaxConnectionLifetimeJitter.Duration
 	pgxConfig.HealthCheckPeriod = postgresStoreConfig.HealthCheckInterval.Duration
diff --git a/pkg/plugins/policies/meshhttproute/xds/configurer.go b/pkg/plugins/policies/meshhttproute/xds/configurer.go
index e9ddc3487..e006b7a6d 100644
--- a/pkg/plugins/policies/meshhttproute/xds/configurer.go
+++ b/pkg/plugins/policies/meshhttproute/xds/configurer.go
@@ -119,7 +119,25 @@ func (c RoutesConfigurer) routePathMatch(match api.PathMatch) []*envoy_route.Rou
 			}}
 		}
 		// This case forces us to create two different envoy matches to
-		// replicate the "path-separated prefixes only" semantics
+		// replicate the "path-separated prefixes only" semantics.
+		//
+		// It needs to be replicated instead of using envoy's native
+		// `path_separated_prefix` (https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routematch-path-separated-prefix)
+		// because of an edge case, when if we want to drop the prefix:
+		//
+		//   ```
+		//   - match:
+		//       path_separated_prefix: "/prefix"
+		//     route:
+		//       prefix_rewrite: "/"
+		//   ```
+		//
+		// results in the rewrites:
+		//
+		//   * `/prefix` -> `/`
+		//   * `/prefix/path` -> `//path`
+		//
+		// ref. https://github.com/envoyproxy/envoy/issues/23130
 		trimmed := strings.TrimSuffix(match.Value, "/")
 		return []*envoy_route.RouteMatch{{
 			PathSpecifier: &envoy_route.RouteMatch_Path{
diff --git a/pkg/plugins/runtime/k8s/containers/factory.go b/pkg/plugins/runtime/k8s/containers/factory.go
index 53e52c5ff..71afbbbdf 100644
--- a/pkg/plugins/runtime/k8s/containers/factory.go
+++ b/pkg/plugins/runtime/k8s/containers/factory.go
@@ -129,6 +129,11 @@ func (i *DataplaneProxyFactory) NewContainer(
 		SecurityContext: &kube_core.SecurityContext{
 			RunAsUser:  &i.ContainerConfig.UID,
 			RunAsGroup: &i.ContainerConfig.GID,
+			Capabilities: &kube_core.Capabilities{
+				Drop: []kube_core.Capability{
+					"ALL",
+				},
+			},
 		},
 		LivenessProbe: &kube_core.Probe{
 			ProbeHandler: kube_core.ProbeHandler{
diff --git a/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go b/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go
index 67f31b9ce..a628d0a40 100644
--- a/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go
@@ -266,8 +266,11 @@ func (r *GatewayInstanceReconciler) createOrUpdateDeployment(
 			)
 
 			container.SecurityContext.AllowPrivilegeEscalation = pointer.To(false)
+			container.SecurityContext.Capabilities.Add = []kube_core.Capability{
+				"NET_BIND_SERVICE",
+			}
 
-			securityContext := &kube_core.PodSecurityContext{
+			podSecurityContext := &kube_core.PodSecurityContext{
 				Sysctls: []kube_core.Sysctl{{
 					Name:  "net.ipv4.ip_unprivileged_port_start",
 					Value: "0",
@@ -275,7 +278,7 @@ func (r *GatewayInstanceReconciler) createOrUpdateDeployment(
 			}
 
 			if fsGroup := gatewayInstance.Spec.PodTemplate.Spec.PodSecurityContext.FSGroup; fsGroup != nil {
-				securityContext.FSGroup = fsGroup
+				podSecurityContext.FSGroup = fsGroup
 			}
 
 			container.SecurityContext.ReadOnlyRootFilesystem = gatewayInstance.Spec.PodTemplate.Spec.Container.SecurityContext.ReadOnlyRootFilesystem
@@ -288,7 +291,7 @@ func (r *GatewayInstanceReconciler) createOrUpdateDeployment(
 			}
 
 			podSpec := kube_core.PodSpec{
-				SecurityContext: securityContext,
+				SecurityContext: podSecurityContext,
 				Containers:      []kube_core.Container{container},
 			}
 			podSpec.ServiceAccountName = gatewayInstance.Spec.PodTemplate.Spec.ServiceAccountName
diff --git a/pkg/plugins/runtime/k8s/controllers/gatewayapi/mesh_http_route_conversion.go b/pkg/plugins/runtime/k8s/controllers/gatewayapi/mesh_http_route_conversion.go
index b9c1e60d1..665ad03bd 100644
--- a/pkg/plugins/runtime/k8s/controllers/gatewayapi/mesh_http_route_conversion.go
+++ b/pkg/plugins/runtime/k8s/controllers/gatewayapi/mesh_http_route_conversion.go
@@ -192,6 +192,21 @@ func (r *HTTPRouteReconciler) gapiToKumaMeshMatch(gapiMatch gatewayapi.HTTPRoute
 		Value: *gapiMatch.Path.Value,
 	}
 
+	// Matches based on a URL path prefix split by `/`. Matching is
+	// case-sensitive and done on a path element by element basis. A
+	// path element refers to the list of labels in the path split by
+	// the `/` separator. When specified, a trailing `/` is ignored.
+	//
+	// For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match
+	// the prefix `/abc`, but the path `/abcd` would not.
+	//
+	// ref. https://github.com/kubernetes-sigs/gateway-api/blob/50091d071226d4ab2dbdb115ae65e27cf3fd5b85/apis/v1/httproute_types.go#L357-L367
+	//
+	// Necessary as MehHTTPRoute validator won't allow value with trailing `/`
+	if match.Path.Type == v1alpha1.PathPrefix && match.Path.Value != "/" {
+		match.Path.Value = strings.TrimSuffix(match.Path.Value, "/")
+	}
+
 	for _, gapiHeader := range gapiMatch.Headers {
 		header := common_api.HeaderMatch{
 			Type: pointer.To(common_api.HeaderMatchType(*gapiHeader.Type)),
diff --git a/pkg/util/http/server/server.go b/pkg/util/http/server/server.go
new file mode 100644
index 000000000..61e073ba3
--- /dev/null
+++ b/pkg/util/http/server/server.go
@@ -0,0 +1,36 @@
+package server
+
+import (
+	"crypto/tls"
+	"errors"
+	"net"
+	"net/http"
+	"sync/atomic"
+
+	"github.com/go-logr/logr"
+)
+
+func StartServer(log logr.Logger, server *http.Server, ready *atomic.Bool, errChan chan error) error {
+	l := log.WithValues("tls", server.TLSConfig != nil, "interface", server.Addr)
+	listener, err := net.Listen("tcp", server.Addr)
+	if err != nil {
+		return err
+	}
+	if server.TLSConfig != nil {
+		listener = tls.NewListener(listener, server.TLSConfig)
+	}
+
+	l.Info("starting server")
+	go func() {
+		ready.Store(true)
+		if err := server.Serve(listener); err != nil {
+			if errors.Is(err, http.ErrServerClosed) {
+				l.Info("shutting down server")
+			} else {
+				l.Error(err, "could not start server")
+				errChan <- err
+			}
+		}
+	}()
+	return nil
+}


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
index 7e30ddb4f..d25df3020 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.zone-universal-on-k8s.golden.yaml
@@ -156,6 +156,8 @@ spec:
               value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_STORE_POSTGRES_PORT
               value: "5432"
+            - name: KUMA_STORE_POSTGRES_TLS_MODE
+              value: "disable"
             - name: KUMA_STORE_TYPE
               value: "postgres"
           args:
@@ -200,6 +202,8 @@ spec:
               value: "meshaccesslogs,meshcircuitbreakers,meshfaultinjections,meshhealthchecks,meshhttproutes,meshloadbalancingstrategies,meshmetrics,meshproxypatches,meshratelimits,meshretries,meshtcproutes,meshtimeouts,meshtraces,meshtrafficpermissions"
             - name: KUMA_STORE_POSTGRES_PORT
               value: "5432"
+            - name: KUMA_STORE_POSTGRES_TLS_MODE
+              value: "disable"
             - name: KUMA_STORE_TYPE
               value: "postgres"
             - name: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
diff --git a/pkg/api-server/auth_test.go b/pkg/api-server/auth_test.go
index 33a711ec3..0b0f88035 100644
--- a/pkg/api-server/auth_test.go
+++ b/pkg/api-server/auth_test.go
@@ -58,17 +58,14 @@ var _ = Describe("Auth test", func() {
 		Expect(http2.ConfigureMTLS(httpsClientWithoutCerts, certPath, "", "")).To(Succeed())
 
 		// wait for both http and https server
-		Eventually(func() bool {
+		Eventually(func(g Gomega) {
 			resp, err := httpsClient.Get(fmt.Sprintf("https://localhost:%d/secrets", httpsPort))
-			if err != nil || resp.StatusCode != 200 {
-				return false
-			}
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(resp).To(HaveHTTPStatus(200))
 			resp, err = http.Get(fmt.Sprintf("http://localhost:%d/secrets", httpPort))
-			if err != nil || resp.StatusCode != 200 {
-				return false
-			}
-			return true
-		}, "5s", "100ms").Should(BeTrue())
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(resp).To(HaveHTTPStatus(200))
+		}, "5s", "100ms").Should(Succeed())
 	})
 
 	AfterEach(func() {
diff --git a/pkg/config/loader_test.go b/pkg/config/loader_test.go
index 9a42fa395..115290a58 100644
--- a/pkg/config/loader_test.go
+++ b/pkg/config/loader_test.go
@@ -107,6 +107,7 @@ var _ = Describe("Config loader", func() {
 			Expect(cfg.Store.Postgres.MinReconnectInterval.Duration).To(Equal(44 * time.Second))
 			Expect(cfg.Store.Postgres.MaxReconnectInterval.Duration).To(Equal(55 * time.Second))
 			Expect(cfg.Store.Postgres.MaxListQueryElements).To(Equal(uint32(111)))
+			Expect(cfg.Store.Postgres.MaxConnectionIdleTime.Duration).To(Equal(99 * time.Second))
 
 			Expect(cfg.Store.Kubernetes.SystemNamespace).To(Equal("test-namespace"))
 
@@ -391,6 +392,7 @@ store:
     minReconnectInterval: 44s
     maxReconnectInterval: 55s
     maxListQueryElements: 111
+    maxConnectionIdleTime: 99s
     tls:
       mode: verifyFull
       certPath: /path/to/cert
@@ -772,6 +774,7 @@ tracing:
 				"KUMA_STORE_POSTGRES_READ_REPLICA_HOST":                                                    "ro.host",
 				"KUMA_STORE_POSTGRES_READ_REPLICA_PORT":                                                    "35432",
 				"KUMA_STORE_POSTGRES_READ_REPLICA_RATIO":                                                   "80",
+				"KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME":                                             "99s",
 				"KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE":                                                   "test-namespace",
 				"KUMA_STORE_CACHE_ENABLED":                                                                 "false",
 				"KUMA_STORE_CACHE_EXPIRATION_TIME":                                                         "3s",
diff --git a/pkg/insights/resyncer_test.go b/pkg/insights/resyncer_test.go
index 7e693a3f9..229896373 100644
--- a/pkg/insights/resyncer_test.go
+++ b/pkg/insights/resyncer_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test/kds/samples"
 	test_metrics "github.com/kumahq/kuma/pkg/test/metrics"
+	samples2 "github.com/kumahq/kuma/pkg/test/resources/samples"
 )
 
 var _ = Describe("Insight Persistence", func() {
@@ -1038,6 +1039,43 @@ var _ = Describe("Insight Persistence", func() {
 		}).Should(Succeed())
 	})
 
+	It("should return zones in service insights", func() {
+		// given
+		err := rm.Create(context.Background(), core_mesh.NewMeshResource(), store.CreateByKey("default", model.NoMesh))
+		Expect(err).ToNot(HaveOccurred())
+
+		err = samples2.DataplaneBackendBuilder().
+			WithName("dp-east-1").
+			WithInboundOfTags("kuma.io/service", "backend", "kuma.io/zone", "east").
+			Create(rm)
+		Expect(err).ToNot(HaveOccurred())
+		err = samples2.DataplaneBackendBuilder().
+			WithName("dp-west-1").
+			WithInboundOfTags("kuma.io/service", "backend", "kuma.io/zone", "west").
+			Create(rm)
+		Expect(err).ToNot(HaveOccurred())
+		err = samples2.DataplaneBackendBuilder().
+			WithName("dp-west-2").
+			WithInboundOfTags("kuma.io/service", "backend", "kuma.io/zone", "west").
+			Create(rm)
+		Expect(err).ToNot(HaveOccurred())
+		err = samples2.DataplaneWebBuilder().Create(rm)
+		Expect(err).ToNot(HaveOccurred())
+
+		// when
+		step(stepsToResync)
+
+		// then
+		Eventually(func(g Gomega) {
+			serviceInsight := core_mesh.NewServiceInsightResource()
+			err := rm.Get(context.Background(), serviceInsight, store.GetBy(insights.ServiceInsightKey("default")))
+			g.Expect(err).ToNot(HaveOccurred())
+			g.Expect(serviceInsight.Spec.Services).To(HaveKey("backend"))
+			g.Expect(serviceInsight.Spec.Services["backend"].Zones).To(Equal([]string{"east", "west"}))
+			g.Expect(serviceInsight.Spec.Services["web"].Zones).To(BeEmpty())
+		}).Should(Succeed())
+	})
+
 	It("should sync on events", func() {
 		err := rm.Create(context.Background(), core_mesh.NewMeshResource(), store.CreateByKey("mesh-1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
diff --git a/pkg/mads/server/server_test.go b/pkg/mads/server/server_test.go
index 1aabdd887..1367e38d9 100644
--- a/pkg/mads/server/server_test.go
+++ b/pkg/mads/server/server_test.go
@@ -119,13 +119,13 @@ var _ = Describe("MADS Server", func() {
 		request.Header.Add("Content-Type", "application/json")
 		request.Header.Add("Accept", "application/json")
 
-		Eventually(func() bool {
+		Eventually(func(g Gomega) {
 			response, err := client.Do(request)
-			ok := err == nil && response.StatusCode == 200
+			Expect(err).ToNot(HaveOccurred())
+			Expect(response).To(HaveHTTPStatus(200))
 			if response != nil {
 				Expect(response.Body.Close()).To(Succeed())
 			}
-			return ok
-		}, "10s", "100ms").Should(BeTrue())
+		}, "10s", "100ms").Should(Succeed())
 	})
 })
diff --git a/pkg/plugins/runtime/k8s/controllers/testdata/04.dataplane.yaml b/pkg/plugins/runtime/k8s/controllers/testdata/04.dataplane.yaml
index 5c08a0c27..802ef6d31 100644
--- a/pkg/plugins/runtime/k8s/controllers/testdata/04.dataplane.yaml
+++ b/pkg/plugins/runtime/k8s/controllers/testdata/04.dataplane.yaml
@@ -31,8 +31,8 @@ spec:
       tags:
         kuma.io/service: test-app_playground_svc_80
     transparentProxying:
-      ipFamilyMode: DualStack
       directAccessServices:
       - '*'
+      ipFamilyMode: DualStack
       redirectPortInbound: 15006
       redirectPortOutbound: 15001
diff --git a/pkg/plugins/runtime/k8s/controllers/testdata/05.dataplane.yaml b/pkg/plugins/runtime/k8s/controllers/testdata/05.dataplane.yaml
index ecc2a6dd0..87baef581 100644
--- a/pkg/plugins/runtime/k8s/controllers/testdata/05.dataplane.yaml
+++ b/pkg/plugins/runtime/k8s/controllers/testdata/05.dataplane.yaml
@@ -31,9 +31,9 @@ spec:
       tags:
         kuma.io/service: test-app_playground_svc_80
     transparentProxying:
-      ipFamilyMode: DualStack
       directAccessServices:
       - test-app_playground_svc_80
       - test-app_playground_svc_443
+      ipFamilyMode: DualStack
       redirectPortInbound: 15006
       redirectPortOutbound: 15001
diff --git a/pkg/plugins/runtime/k8s/controllers/testdata/24.dataplane.yaml b/pkg/plugins/runtime/k8s/controllers/testdata/24.dataplane.yaml
index ec1cadd66..072d4a856 100644
--- a/pkg/plugins/runtime/k8s/controllers/testdata/24.dataplane.yaml
+++ b/pkg/plugins/runtime/k8s/controllers/testdata/24.dataplane.yaml
@@ -18,6 +18,6 @@ spec:
         kuma.io/zone: zone-1
         version: "0.1"
     transparentProxying:
+      ipFamilyMode: IPv4
       redirectPortInbound: 15006
       redirectPortOutbound: 15001
-      ipFamilyMode: IPv4
diff --git a/pkg/plugins/runtime/k8s/controllers/testdata/25.dataplane.yaml b/pkg/plugins/runtime/k8s/controllers/testdata/25.dataplane.yaml
index ec1cadd66..072d4a856 100644
--- a/pkg/plugins/runtime/k8s/controllers/testdata/25.dataplane.yaml
+++ b/pkg/plugins/runtime/k8s/controllers/testdata/25.dataplane.yaml
@@ -18,6 +18,6 @@ spec:
         kuma.io/zone: zone-1
         version: "0.1"
     transparentProxying:
+      ipFamilyMode: IPv4
       redirectPortInbound: 15006
       redirectPortOutbound: 15001
-      ipFamilyMode: IPv4
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index 32cd0b75e..715d9bd1b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index d5207b463..1cae6cdff 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -104,6 +104,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index 855fdf5f3..53cc77ab8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -111,6 +111,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index 29b1fc522..4a93adc15 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index efd0a07f0..37a48df16 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -104,6 +104,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index 333e0c071..7cc36be68 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -104,6 +104,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index 32cd0b75e..715d9bd1b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index a19f5151c..16aed0788 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -106,6 +106,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index 6b7f2e0f5..9b24408b4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -105,6 +105,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
index 437c74678..780d83438 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
@@ -104,6 +104,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index 8f32a4ec7..b81272b8f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index e3e9e17c5..94b8e6606 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 8335ee410..d41575a69 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
index f8adfc303..402625fe9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
index 459fe8174..51a1ead65 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
index 3502d7145..04138a19c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
@@ -105,6 +105,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
index 79ad5aa63..3022fa059 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -105,6 +105,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
index 908c9a3fd..44f03e61c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -105,6 +105,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
index 61a436cca..3a994d11d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
index d0d0b6fae..01e351e5c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
index 52e0525e0..d623ce969 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
index 9b2b41571..5de5a5eb4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
@@ -109,6 +109,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
index 92617ec02..a66a0e8e1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
@@ -120,6 +120,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
index c924f74d6..4f53b7695 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
@@ -121,6 +121,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
index 7db3f4a03..06ab752fe 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
@@ -120,6 +120,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
index 1fc7aa568..62844a89f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
@@ -105,6 +105,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
index 73ab7bcda..bd209a759 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
@@ -104,6 +104,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
index 9f4c0861c..59a76753f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
@@ -108,6 +108,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       privileged: false
       readOnlyRootFilesystem: true
       runAsGroup: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
index c9c53c8b0..68a05b823 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
@@ -116,6 +116,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
index 82a4032be..17a6a39f7 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
@@ -108,6 +108,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
index 54f5cbad8..bfc6fb852 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
index 5bffdf894..66a7f9d87 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
@@ -104,6 +104,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
index 59882acdd..14e35f795 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
@@ -103,6 +103,9 @@ spec:
         ephemeral-storage: 50M
         memory: 164Mi
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
index 47dd02352..6f6018dd2 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
index fc9ce1392..c7d52770b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
@@ -156,6 +156,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
index 095b69a8f..7fba4b57a 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
@@ -210,6 +210,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
index 60993e775..8765df778 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
index f7b72bc04..b8447a482 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
@@ -145,6 +145,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
index e307bdb15..5abe37989 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
@@ -149,6 +149,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
index 47dd02352..6f6018dd2 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
index 6845ffa82..27a53e69e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
@@ -151,6 +151,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
index bcd4f4e8f..49c06cdae 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
@@ -150,6 +150,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
index 0f0d382ba..d337afb81 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
@@ -149,6 +149,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
index 2df5200bf..2ef7e704e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
index 8f53cca39..24d4fc889 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
index bbb8b7190..082c1bbcb 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
@@ -160,6 +160,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
index fa6094a13..d29cdd6b6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
@@ -160,6 +160,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
index dafb17faa..700960682 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
@@ -160,6 +160,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
index 2f2246aa1..d13f09931 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
@@ -157,6 +157,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
index 64d2354c6..d159c95d6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
@@ -157,6 +157,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
index f51901182..fc518c0b5 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
@@ -157,6 +157,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
index ad1582e74..f9e7333fb 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
@@ -166,6 +166,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
index 45dfeaf78..8b9b26a57 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
@@ -166,6 +166,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
index 8817b9945..d66a281e5 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
@@ -173,6 +173,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
index 1118de055..ec02d00c0 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
@@ -161,6 +161,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
index c0629ad69..5b6cce4a9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
@@ -175,6 +175,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
index 12d2e613b..4781e93b2 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
@@ -176,6 +176,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
index de821059b..58067cdaf 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
@@ -175,6 +175,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
index bc0a6a71d..c2674e8e9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
@@ -146,6 +146,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
index 07f56c3b3..94a8b8c67 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
@@ -145,6 +145,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
index cecbfabc8..13396b015 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       privileged: false
       readOnlyRootFilesystem: true
       runAsGroup: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
index 5c9eb435a..1e1c9972d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
@@ -160,6 +160,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
index 22b92fead..076779bf8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
@@ -169,6 +169,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
index 2e095c64e..d2f23256e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
@@ -155,6 +155,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
index 309e575ba..8d60a2430 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
@@ -148,6 +148,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
index 3f611dc2d..01e169839 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
@@ -155,6 +155,9 @@ spec:
         memory: 164Mi
     restartPolicy: Always
     securityContext:
+      capabilities:
+        drop:
+        - ALL
       readOnlyRootFilesystem: true
       runAsGroup: 5678
       runAsUser: 5678
diff --git a/pkg/test/kds/setup/server.go b/pkg/test/kds/setup/server.go
index 2f7d5a073..fd9a73ae0 100644
--- a/pkg/test/kds/setup/server.go
+++ b/pkg/test/kds/setup/server.go
@@ -189,6 +189,15 @@ func (t *testRuntimeContext) APIWebServiceCustomize() func(*restful.WebService)
 	return func(*restful.WebService) error { return nil }
 }
 
+func (t *testRuntimeContext) Ready() bool {
+	for _, c := range t.components {
+		if rc, ok := c.(component.ReadyComponent); ok && !rc.Ready() {
+			return false
+		}
+	}
+	return true
+}
+
 func (t *testRuntimeContext) Add(c ...component.Component) error {
 	t.components = append(t.components, c...)
 	return nil
diff --git a/pkg/xds/generator/testdata/transparent-proxy/05.envoy.golden.yaml b/pkg/xds/generator/testdata/transparent-proxy/05.envoy.golden.yaml
index b9a46fd5f..2042eda50 100644
--- a/pkg/xds/generator/testdata/transparent-proxy/05.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/transparent-proxy/05.envoy.golden.yaml
@@ -1,111 +1,111 @@
 resources:
-  - name: inbound:passthrough:ipv4
-    resource:
-      '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-      altStatName: inbound_passthrough_ipv4
-      connectTimeout: 5s
-      lbPolicy: CLUSTER_PROVIDED
-      name: inbound:passthrough:ipv4
-      type: ORIGINAL_DST
-      upstreamBindConfig:
-        sourceAddress:
-          address: 127.0.0.6
-          portValue: 0
-  - name: inbound:passthrough:ipv6
-    resource:
-      '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-      altStatName: inbound_passthrough_ipv6
-      connectTimeout: 5s
-      lbPolicy: CLUSTER_PROVIDED
-      name: inbound:passthrough:ipv6
-      type: ORIGINAL_DST
-      upstreamBindConfig:
-        sourceAddress:
-          address: ::6
-          portValue: 0
-  - name: outbound:passthrough:ipv4
-    resource:
-      '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-      altStatName: outbound_passthrough_ipv4
-      connectTimeout: 5s
-      lbPolicy: CLUSTER_PROVIDED
-      name: outbound:passthrough:ipv4
-      type: ORIGINAL_DST
-  - name: outbound:passthrough:ipv6
-    resource:
-      '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
-      altStatName: outbound_passthrough_ipv6
-      connectTimeout: 5s
-      lbPolicy: CLUSTER_PROVIDED
-      name: outbound:passthrough:ipv6
-      type: ORIGINAL_DST
-  - name: inbound:passthrough:ipv4
-    resource:
-      '@type': type.googleapis.com/envoy.config.listener.v3.Listener
-      address:
-        socketAddress:
-          address: 0.0.0.0
-          portValue: 15006
-      enableReusePort: false
-      filterChains:
-        - filters:
-            - name: envoy.filters.network.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-                cluster: inbound:passthrough:ipv4
-                statPrefix: inbound_passthrough_ipv4
-      name: inbound:passthrough:ipv4
-      trafficDirection: INBOUND
-      useOriginalDst: true
-  - name: inbound:passthrough:ipv6
-    resource:
-      '@type': type.googleapis.com/envoy.config.listener.v3.Listener
-      address:
-        socketAddress:
-          address: '::'
-          portValue: 15066
-      enableReusePort: false
-      filterChains:
-        - filters:
-            - name: envoy.filters.network.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-                cluster: inbound:passthrough:ipv6
-                statPrefix: inbound_passthrough_ipv6
-      name: inbound:passthrough:ipv6
-      trafficDirection: INBOUND
-      useOriginalDst: true
-  - name: outbound:passthrough:ipv4
-    resource:
-      '@type': type.googleapis.com/envoy.config.listener.v3.Listener
-      address:
-        socketAddress:
-          address: 0.0.0.0
-          portValue: 15001
-      filterChains:
-        - filters:
-            - name: envoy.filters.network.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-                cluster: outbound:passthrough:ipv4
-                statPrefix: outbound_passthrough_ipv4
-      name: outbound:passthrough:ipv4
-      trafficDirection: OUTBOUND
-      useOriginalDst: true
-  - name: outbound:passthrough:ipv6
-    resource:
-      '@type': type.googleapis.com/envoy.config.listener.v3.Listener
-      address:
-        socketAddress:
-          address: '::'
-          portValue: 15001
-      filterChains:
-        - filters:
-            - name: envoy.filters.network.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
-                cluster: outbound:passthrough:ipv6
-                statPrefix: outbound_passthrough_ipv6
-      name: outbound:passthrough:ipv6
-      trafficDirection: OUTBOUND
-      useOriginalDst: true
+- name: inbound:passthrough:ipv4
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: inbound_passthrough_ipv4
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: inbound:passthrough:ipv4
+    type: ORIGINAL_DST
+    upstreamBindConfig:
+      sourceAddress:
+        address: 127.0.0.6
+        portValue: 0
+- name: inbound:passthrough:ipv6
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: inbound_passthrough_ipv6
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: inbound:passthrough:ipv6
+    type: ORIGINAL_DST
+    upstreamBindConfig:
+      sourceAddress:
+        address: ::6
+        portValue: 0
+- name: outbound:passthrough:ipv4
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: outbound_passthrough_ipv4
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: outbound:passthrough:ipv4
+    type: ORIGINAL_DST
+- name: outbound:passthrough:ipv6
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: outbound_passthrough_ipv6
+    connectTimeout: 5s
+    lbPolicy: CLUSTER_PROVIDED
+    name: outbound:passthrough:ipv6
+    type: ORIGINAL_DST
+- name: inbound:passthrough:ipv4
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 15006
+    enableReusePort: false
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: inbound:passthrough:ipv4
+          statPrefix: inbound_passthrough_ipv4
+    name: inbound:passthrough:ipv4
+    trafficDirection: INBOUND
+    useOriginalDst: true
+- name: inbound:passthrough:ipv6
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: '::'
+        portValue: 15066
+    enableReusePort: false
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: inbound:passthrough:ipv6
+          statPrefix: inbound_passthrough_ipv6
+    name: inbound:passthrough:ipv6
+    trafficDirection: INBOUND
+    useOriginalDst: true
+- name: outbound:passthrough:ipv4
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 15001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: outbound:passthrough:ipv4
+          statPrefix: outbound_passthrough_ipv4
+    name: outbound:passthrough:ipv4
+    trafficDirection: OUTBOUND
+    useOriginalDst: true
+- name: outbound:passthrough:ipv6
+  resource:
+    '@type': type.googleapis.com/envoy.config.listener.v3.Listener
+    address:
+      socketAddress:
+        address: '::'
+        portValue: 15001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: outbound:passthrough:ipv6
+          statPrefix: outbound_passthrough_ipv6
+    name: outbound:passthrough:ipv6
+    trafficDirection: OUTBOUND
+    useOriginalDst: true
diff --git a/test/e2e_env/kubernetes/gateway/delegated/meshmetric.go b/test/e2e_env/kubernetes/gateway/delegated/meshmetric.go
index 5b4d2ca01..583fdbe31 100644
--- a/test/e2e_env/kubernetes/gateway/delegated/meshmetric.go
+++ b/test/e2e_env/kubernetes/gateway/delegated/meshmetric.go
@@ -71,7 +71,7 @@ spec:
 						config.Mesh,
 					)),
 				))
-			}, "2m", "15s").Should(Succeed())
+			}, "3m", "5s").Should(Succeed())
 		})
 	}
 }
diff --git a/test/e2e_env/kubernetes/meshmetric/meshmetric.go b/test/e2e_env/kubernetes/meshmetric/meshmetric.go
index 6dd423599..b10860e4a 100644
--- a/test/e2e_env/kubernetes/meshmetric/meshmetric.go
+++ b/test/e2e_env/kubernetes/meshmetric/meshmetric.go
@@ -518,7 +518,7 @@ func MeshMetric() {
 			)
 			g.Expect(err).ToNot(HaveOccurred())
 			g.Expect(stdout).To(ContainSubstring("envoy_cluster_external_upstream_rq_time_bucket"))
-		}, "2m", "3s").Should(Succeed())
+		}, "3m", "5s").Should(Succeed())
 	})
 
 	XIt("MeshMetric with OpenTelemetry and usedonly/filter", func() {
@@ -536,7 +536,7 @@ func MeshMetric() {
 			g.Expect(err).ToNot(HaveOccurred())
 			g.Expect(stdout).To(Not(ContainSubstring("envoy_cluster_client_ssl_socket_factory_upstream_context_secrets_not_ready"))) // unused
 			g.Expect(stdout).To(ContainSubstring("envoy_cluster_external_upstream_rq_time_bucket"))                                  // used
-		}, "2m", "3s").Should(Succeed())
+		}, "3m", "5s").Should(Succeed())
 	})
 
 	XIt("MeshMetric with OpenTelemetry and Prometheus enabled", func() {
@@ -565,7 +565,7 @@ func MeshMetric() {
 			g.Expect(err).ToNot(HaveOccurred())
 			g.Expect(stdout).ToNot(BeNil())
 			g.Expect(stdout).To(ContainSubstring("envoy_http_downstream_rq_xx"))
-		}, "2m", "3s").Should(Succeed())
+		}, "3m", "5s").Should(Succeed())
 	})
 
 	XIt("MeshMetric with multiple OpenTelemetry backends", func() {
@@ -593,7 +593,7 @@ func MeshMetric() {
 			)
 			g.Expect(err).ToNot(HaveOccurred())
 			g.Expect(stdout).To(ContainSubstring("envoy_cluster_external_upstream_rq_time_bucket"))
-		}, "2m", "3s").Should(Succeed())
+		}, "3m", "5s").Should(Succeed())
 	})
 }