Repository: kumahq/kuma
Pull request #3075 (2021-11-03 14:39:45)

feat(kuma-cp) access to generate zone ingress token
### Summary

Access to generate Zone Ingress token

### Full changelog

* Add access validation to generate zone ingress token
* Remove `tokenType` from generate dp token action since it should be long gone.

### Issues resolved

No issue

### Documentation

- [X] No docs, internal changes in the code. UX stays the same

### Testing

- [X] Unit tests
- [ ] E2E tests
- [ ] Manual testing on Universal
- [ ] Manual testing on Kubernetes 

### Backwards compatibility

- [X] No backporting.


codecov-commenter: # [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) Report
> Merging [#3075](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (f35c573) into [master](https://codecov.io/gh/kumahq/kuma/commit/0f8911b53fd972be72cd6e5ca8bd07b11f5d9aca?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (0f8911b) will **increase** coverage by `0.01%`.
> The diff coverage is `57.89%`.

[![Impacted file tree graph](https://codecov.io/gh/kumahq/kuma/pull/3075/graphs/tree.svg?width=650&height=150&src=pr&token=D7Yvqs6rwV&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)

```diff
@@            Coverage Diff             @@
##           master    #3075      +/-   ##
==========================================
+ Coverage   52.19%   52.20%   +0.01%     
==========================================
  Files         919      919              
  Lines       53116    53124       +8     
==========================================
+ Hits        27725    27735      +10     
+ Misses      23184    23180       -4     
- Partials     2207     2209       +2     
```


| [Impacted Files](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) | Coverage Δ | |
|---|---|---|
| [pkg/core/runtime/runtime.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcnVudGltZS9ydW50aW1lLmdv) | `83.33% <ø> (ø)` | |
| [pkg/tokens/builtin/access/static.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3Rva2Vucy9idWlsdGluL2FjY2Vzcy9zdGF0aWMuZ28=) | `42.85% <16.66%> (-10.09%)` | :arrow_down: |
| [pkg/tokens/builtin/server/webservice.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3Rva2Vucy9idWlsdGluL3NlcnZlci93ZWJzZXJ2aWNlLmdv) | `60.93% <25.00%> (-3.58%)` | :arrow_down: |
| [pkg/api-server/server.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2FwaS1zZXJ2ZXIvc2VydmVyLmdv) | `82.09% <100.00%> (ø)` | |
| [pkg/core/bootstrap/bootstrap.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvYm9vdHN0cmFwL2Jvb3RzdHJhcC5nbw==) | `65.20% <100.00%> (ø)` | |
| [pkg/test/runtime/runtime.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3Rlc3QvcnVudGltZS9ydW50aW1lLmdv) | `90.16% <100.00%> (ø)` | |
| [pkg/tokens/builtin/access/noop.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3Rva2Vucy9idWlsdGluL2FjY2Vzcy9ub29wLmdv) | `100.00% <100.00%> (ø)` | |
| [pkg/plugins/runtime/gateway/route/sorter.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3BsdWdpbnMvcnVudGltZS9nYXRld2F5L3JvdXRlL3NvcnRlci5nbw==) | `61.53% <0.00%> (-5.13%)` | :arrow_down: |
| [pkg/core/resources/manager/cache.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcmVzb3VyY2VzL21hbmFnZXIvY2FjaGUuZ28=) | `83.11% <0.00%> (-2.60%)` | :arrow_down: |
| [pkg/kds/client/sink.go](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2tkcy9jbGllbnQvc2luay5nbw==) | `59.45% <0.00%> (+5.40%)` | :arrow_up: |
| ... and [2 more](https://codecov.io/gh/kumahq/kuma/pull/3075/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Last update [0f8911b...f35c573](https://codecov.io/gh/kumahq/kuma/pull/3075?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).


Patch:
diff --git a/.circleci/config.yml b/.circleci/config.yml
index a6f84e3e6..67b8e7c0b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -605,28 +605,6 @@ jobs:
 
           wait
 
-  dev_golang:
-    docker:
-    - image: *golang_image
-    environment:
-      GO_VERSION: *go_version
-      GO111MODULE: "on"
-    steps:
-    - checkout
-    - run:
-        name: "Install pre-requirements"
-        # `unzip` is necessary to install `protoc`
-        command: apt update && apt install -y unzip
-    - run:
-        name: "Install all development tools"
-        command: make dev/tools
-    - run:
-        name: "Build all binaries"
-        command: make build
-    - run:
-        name: "Run unit tests"
-        command: GO_TEST_OPTS='-p 2' make test
-
   dev_ubuntu:
     docker:
     - image: ubuntu:20.04
@@ -734,40 +712,12 @@ jobs:
         command: make check
 
   test:
-    executor: golang
-    resource_class: medium
+    executor: vm
     parameters:
       target:
         description: The test make target.
         type: string
         default: test
-    steps:
-    - checkout
-    - restore_cache:
-        keys:
-        # prefer the exact match
-        - go.mod-{{ .Branch }}-{{ checksum "go.sum" }}
-    - run:
-        name: "Install pre-requirements"
-        # `unzip` is necessary to install `protoc`
-        command: apt update && apt install -y unzip
-    - run:
-        name: "Install all development tools"
-        command: make dev/tools
-    - run:
-        name: "Run unit tests"
-        command: GO_TEST_OPTS='-p 2' make << parameters.target >>
-    - store_artifacts:
-        path: build/coverage
-        destination: /coverage
-
-  integration:
-    executor: vm
-    parameters:
-      target:
-        description: The integration make target.
-        type: string
-        default: integration
     environment:
       GOPATH: /home/circleci/.go-kuma-go
     steps:
@@ -791,7 +741,7 @@ jobs:
         command: |
           make dev/tools
     - run:
-        name: "Run integration tests"
+        name: "Run tests"
         command: |
           export GINKGO_XUNIT_RESULTS_DIR=/tmp/xunit
           make << parameters.target >>
@@ -1166,12 +1116,10 @@ workflows:
         <<: *commit_workflow_filters
         requires:
         - go_cache
-    - integration:
+    - test:
         <<: *commit_workflow_filters
         requires:
         - check
-        # custom parameters
-        target: -j1 integration test
     - images:
         <<: *commit_workflow_filters
         requires:
@@ -1291,7 +1239,6 @@ workflows:
 
   kuma-master:
     jobs:
-      - dev_golang: *master_workflow_filters
       - dev_mac: *master_workflow_filters
       - dev_ubuntu: *master_workflow_filters
       - go_cache: *master_workflow_filters
@@ -1307,10 +1254,6 @@ workflows:
           <<: *master_workflow_filters
           requires:
             - check
-      - integration:
-          <<: *master_workflow_filters
-          requires:
-            - check
       - images:
           <<: *master_workflow_filters
           requires:
@@ -1393,23 +1336,12 @@ workflows:
         <<: *helm_release_workflow_filters
         requires:
           - go_cache
-        name: test-release
-        target: test/release
-    - test:
-        <<: *release_workflow_filters
-        requires:
-        - go_cache
-    - integration:
-        <<: *release_workflow_filters
-        requires:
-        - go_cache
+        target: test test/release
     - release:
         <<: *release_workflow_filters
         requires:
         - check
         - test
-        - test-release
-        - integration
     - helm-release:
         <<: *helm_release_workflow_filters
         requires:
diff --git a/go.mod b/go.mod
index 67c226cb2..c9a035eaf 100644
--- a/go.mod
+++ b/go.mod
@@ -46,6 +46,7 @@ require (
 	github.com/spiffe/go-spiffe v0.0.0-20190820222348-6adcf1eecbcc
 	github.com/spiffe/spire v0.12.3
 	github.com/spiffe/spire/proto/spire v0.12.0 // indirect
+	github.com/testcontainers/testcontainers-go v0.11.1
 	go.uber.org/multierr v1.7.0
 	go.uber.org/zap v1.19.1
 	golang.org/x/net v0.0.0-20211013171255-e13a2654a71e
diff --git a/go.sum b/go.sum
index a0aa15087..15d7ad8d0 100644
--- a/go.sum
+++ b/go.sum
@@ -142,6 +142,7 @@ github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg3
 github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=
 github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
 github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
+github.com/Microsoft/hcsshim v0.8.21 h1:btRfUDThBE5IKcvI8O8jOiIkujUsAMBSRsYDYmEi6oM=
 github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
@@ -276,6 +277,7 @@ github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8n
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
 github.com/casbin/casbin/v2 v2.31.6/go.mod h1:vByNa/Fchek0KZUgG5wEsl7iFsiviAYKRtgrQfcJqHg=
+github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
 github.com/cenkalti/backoff/v4 v4.0.2/go.mod h1:eEew/i+1Q6OrCDZh3WiXYv3+nJwBASZ8Bog/87DQnVg=
@@ -328,6 +330,7 @@ github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1
 github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
 github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
 github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
+github.com/containerd/cgroups v1.0.1 h1:iJnMvco9XGvKUvNQkv88bE4uJXxRQH18efbKo9w5vHQ=
 github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
 github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
@@ -356,6 +359,7 @@ github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL
 github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
+github.com/containerd/continuity v0.1.0 h1:UFRRY5JemiAhPZrr/uE0n8fMTLcZsUvySPr1+D7pgr8=
 github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
 github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
@@ -426,6 +430,7 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0 h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cyphar/filepath-securejoin v0.2.2 h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
@@ -630,10 +635,13 @@ github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvSc
 github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
 github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
 github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
+github.com/go-redis/redis v6.15.9+incompatible h1:K0pv1D7EQUjfyoMql+r/jZqCLizCGKFlFgcHWWmHQjg=
+github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
@@ -814,6 +822,7 @@ github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2z
 github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
@@ -1161,10 +1170,14 @@ github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
+github.com/moby/sys/mount v0.2.0 h1:WhCW5B355jtxndN5ovugJlMFJawbUODuW8fSnEH6SSM=
+github.com/moby/sys/mount v0.2.0/go.mod h1:aAivFE2LB3W4bACsUXChRHQ0qKWsetY4Y9V7sxOougM=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
+github.com/moby/sys/mountinfo v0.4.1 h1:1O+1cHA1aujwEwwVMa2Xm2l+gIpUHyd3+D+d7LZh1kM=
 github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
+github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
 github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
 github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 h1:dcztxKSvZ4Id8iPpHERQBbIJfabdt4wUm5qy3wOL2Zc=
 github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
@@ -1176,6 +1189,7 @@ github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
@@ -1251,6 +1265,7 @@ github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59P
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
+github.com/opencontainers/runc v1.0.2 h1:opHZMaswlyxz1OuGpBE53Dwe4/xF7EZTY0A2L/FpCOg=
 github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
@@ -1479,6 +1494,8 @@ github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ23RP/odRBOTVjwp2cDyi6I=
+github.com/testcontainers/testcontainers-go v0.11.1 h1:FiYsB83LSGbiawoV8TpAZGfcCUbtaeeg1SXqEKUxh08=
+github.com/testcontainers/testcontainers-go v0.11.1/go.mod h1:/V0UVq+1e7NWYoqTPog179clf0Qp9TOyp4EcXaEFQz8=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
@@ -1573,6 +1590,7 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
@@ -2258,8 +2276,10 @@ gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C
 gorm.io/driver/postgres v1.0.8/go.mod h1:4eOzrI1MUfm6ObJU/UcmbXyiHSs8jSwH95G5P5dxcAg=
 gorm.io/gorm v1.20.12/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
 gorm.io/gorm v1.21.4/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 helm.sh/helm/v3 v3.7.1 h1:kED/HWx09QHHSJhYaJY6ttj/BhmzBmT1oupKslncibY=
 helm.sh/helm/v3 v3.7.1/go.mod h1:3eOeBD3Z+O/ELiuu19zynZSN8jP1ErXLuyP21SZeMq8=
diff --git a/mk/run.mk b/mk/run.mk
index 130c5abdd..366f20f05 100644
--- a/mk/run.mk
+++ b/mk/run.mk
@@ -6,11 +6,12 @@ ENVOY_ADMIN_PORT ?= 9901
 
 POSTGRES_SSL_MODE ?= disable
 
-run/universal/postgres/ssl: POSTGRES_SSL_MODE=verifyCa
-run/universal/postgres/ssl: POSTGRES_SSL_CERT_PATH=$(TOOLS_DIR)/postgres/ssl/certs/postgres.client.crt
-run/universal/postgres/ssl: POSTGRES_SSL_KEY_PATH=$(TOOLS_DIR)/postgres/ssl/certs/postgres.client.key
-run/universal/postgres/ssl: POSTGRES_SSL_ROOT_CERT_PATH=$(TOOLS_DIR)/postgres/ssl/certs/rootCA.crt
-run/universal/postgres/ssl: run/universal/postgres ## Dev: Run Control Plane locally in universal mode with Postgres store and SSL enabled
+run/universal/postgres/ssl: ## Dev: Run Control Plane locally in universal mode with Postgres store and SSL enabled
+	POSTGRES_SSL_MODE=verifyCa \
+	POSTGRES_SSL_CERT_PATH=$(TOOLS_DIR)/postgres/certs/postgres.client.crt \
+	POSTGRES_SSL_KEY_PATH=$(TOOLS_DIR)/postgres/certs/postgres.client.key \
+	POSTGRES_SSL_ROOT_CERT_PATH=$(TOOLS_DIR)/postgres/certs/rootCA.crt \
+	$(MAKE) run/universal/postgres
 
 .PHONY: run/universal/postgres
 run/universal/postgres: ## Dev: Run Control Plane locally in universal mode with Postgres store
@@ -64,7 +65,7 @@ run/universal/memory: ## Dev: Run Control Plane locally in universal mode with i
 
 .PHONY: start/postgres
 start/postgres: ## Boostrap: start Postgres for Control Plane with initial schema
-	docker-compose -f $(TOOLS_DIR)/postgres/docker-compose.yaml up -d
+	docker-compose -f $(TOOLS_DIR)/postgres/docker-compose.yaml up -d --build
 	$(TOOLS_DIR)/postgres/wait-for-postgres.sh 15432
 
 .PHONY: stop/postgres
@@ -73,12 +74,11 @@ stop/postgres: ## Boostrap: stop Postgres
 
 .PHONY: start/postgres/ssl
 start/postgres/ssl: ## Boostrap: start Postgres for Control Plane with initial schema and SSL enabled
-	docker-compose -f $(TOOLS_DIR)/postgres/ssl/docker-compose.yaml up -d
-	$(TOOLS_DIR)/postgres/wait-for-postgres.sh 15432
+	POSTGRES_MODE=tls $(MAKE) start/postgres
 
 .PHONY: stop/postgres/ssl
 stop/postgres/ssl: ## Boostrap: stop Postgres with SSL enabled
-	docker-compose -f $(TOOLS_DIR)/postgres/ssl/docker-compose.yaml stop
+	$(MAKE) stop/postgres
 
 .PHONY: run/kuma-dp
 run/kuma-dp: build/kumactl ## Dev: Run `kuma-dp` locally
diff --git a/pkg/api-server/server.go b/pkg/api-server/server.go
index 1f08767e1..ecbabf3b0 100644
--- a/pkg/api-server/server.go
+++ b/pkg/api-server/server.go
@@ -140,7 +140,7 @@ func NewApiServer(
 		config: *serverConfig,
 	}
 
-	dpWs, err := dataplaneTokenWs(resManager, access.GenerateDataplaneTokenAccess)
+	dpWs, err := dataplaneTokenWs(resManager, access.DataplaneTokenAccess)
 	if err != nil {
 		return nil, err
 	}
@@ -227,7 +227,7 @@ func addResourcesEndpoints(ws *restful.WebService, defs []model.ResourceTypeDesc
 	}
 }
 
-func dataplaneTokenWs(resManager manager.ResourceManager, access tokens_access.GenerateDataplaneTokenAccess) (*restful.WebService, error) {
+func dataplaneTokenWs(resManager manager.ResourceManager, access tokens_access.DataplaneTokenAccess) (*restful.WebService, error) {
 	dpIssuer, err := builtin.NewDataplaneTokenIssuer(resManager)
 	if err != nil {
 		return nil, err
diff --git a/pkg/config/app/kuma-cp/config.go b/pkg/config/app/kuma-cp/config.go
index 5bafcedfa..2d54e2a68 100644
--- a/pkg/config/app/kuma-cp/config.go
+++ b/pkg/config/app/kuma-cp/config.go
@@ -191,7 +191,7 @@ func DefaultConfig() Config {
 			},
 		},
 		Reports: &Reports{
-			Enabled: false,
+			Enabled: true,
 		},
 		General:     DefaultGeneralConfig(),
 		GuiServer:   gui_server.DefaultGuiServerConfig(),
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index 9dae4641b..67aa64f4b 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -290,7 +290,7 @@ metrics:
 # Reports configuration
 reports:
   # If true then usage stats will be reported
-  enabled: false # ENV: KUMA_REPORTS_ENABLED
+  enabled: true # ENV: KUMA_REPORTS_ENABLED
 
 # General configuration
 general:
diff --git a/pkg/core/bootstrap/bootstrap.go b/pkg/core/bootstrap/bootstrap.go
index a0cfe82db..b4bd4d6b9 100644
--- a/pkg/core/bootstrap/bootstrap.go
+++ b/pkg/core/bootstrap/bootstrap.go
@@ -108,8 +108,8 @@ func buildRuntime(appCtx context.Context, cfg kuma_cp.Config) (core_runtime.Runt
 	builder.WithKDSContext(kds_context.DefaultContext(builder.ResourceManager(), cfg.Multizone.Zone.Name))
 
 	builder.WithAccess(core_runtime.Access{
-		ResourceAccess:               resources_access.NewAdminResourceAccess(builder.Config().Access.Static.AdminResources),
-		GenerateDataplaneTokenAccess: tokens_access.NewStaticGenerateDataplaneTokenAccess(builder.Config().Access.Static.GenerateDPToken),
+		ResourceAccess:       resources_access.NewAdminResourceAccess(builder.Config().Access.Static.AdminResources),
+		DataplaneTokenAccess: tokens_access.NewStaticGenerateDataplaneTokenAccess(builder.Config().Access.Static.GenerateDPToken),
 	})
 
 	if err := initializeAPIServerAuthenticator(builder); err != nil {
diff --git a/pkg/core/runtime/runtime.go b/pkg/core/runtime/runtime.go
index fa2cc44d5..eb779d734 100644
--- a/pkg/core/runtime/runtime.go
+++ b/pkg/core/runtime/runtime.go
@@ -71,8 +71,8 @@ type RuntimeContext interface {
 }
 
 type Access struct {
-	ResourceAccess               resources_access.ResourceAccess
-	GenerateDataplaneTokenAccess tokens_access.GenerateDataplaneTokenAccess
+	ResourceAccess       resources_access.ResourceAccess
+	DataplaneTokenAccess tokens_access.DataplaneTokenAccess
 }
 
 var _ Runtime = &runtime{}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
index 27a303412..6acb362fe 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
@@ -353,6 +353,11 @@ func (i *KumaInjector) sidecarEnvVars(mesh string, podAnnotations map[string]str
 			Name:  "KUMA_DNS_CORE_DNS_BINARY_PATH",
 			Value: "coredns",
 		}
+	} else {
+		envVars["KUMA_DNS_ENABLED"] = kube_core.EnvVar{
+			Name:  "KUMA_DNS_ENABLED",
+			Value: "false",
+		}
 	}
 
 	// override defaults with cfg env vars
diff --git a/pkg/tokens/builtin/access/access.go b/pkg/tokens/builtin/access/access.go
index 2919983b8..ef9c32c8e 100644
--- a/pkg/tokens/builtin/access/access.go
+++ b/pkg/tokens/builtin/access/access.go
@@ -4,6 +4,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/user"
 )
 
-type GenerateDataplaneTokenAccess interface {
-	ValidateGenerate(name string, mesh string, tags map[string][]string, tokenType string, user user.User) error
+type DataplaneTokenAccess interface {
+	ValidateGenerateDataplaneToken(name string, mesh string, tags map[string][]string, user user.User) error
+	ValidateGenerateZoneIngressToken(zone string, user user.User) error
 }
diff --git a/pkg/tokens/builtin/access/noop.go b/pkg/tokens/builtin/access/noop.go
index 82d8d3a5f..04838a04c 100644
--- a/pkg/tokens/builtin/access/noop.go
+++ b/pkg/tokens/builtin/access/noop.go
@@ -2,11 +2,15 @@ package access
 
 import "github.com/kumahq/kuma/pkg/core/user"
 
-type NoopGenerateDpTokenAccess struct {
+type NoopDpTokenAccess struct {
 }
 
-var _ GenerateDataplaneTokenAccess = NoopGenerateDpTokenAccess{}
+var _ DataplaneTokenAccess = NoopDpTokenAccess{}
 
-func (n NoopGenerateDpTokenAccess) ValidateGenerate(name string, mesh string, tags map[string][]string, tokenType string, user user.User) error {
+func (n NoopDpTokenAccess) ValidateGenerateDataplaneToken(name string, mesh string, tags map[string][]string, user user.User) error {
+	return nil
+}
+
+func (n NoopDpTokenAccess) ValidateGenerateZoneIngressToken(zone string, user user.User) error {
 	return nil
 }
diff --git a/pkg/tokens/builtin/access/static.go b/pkg/tokens/builtin/access/static.go
index 41c29a063..129a0b5e8 100644
--- a/pkg/tokens/builtin/access/static.go
+++ b/pkg/tokens/builtin/access/static.go
@@ -11,9 +11,9 @@ type staticGenerateDataplaneTokenAccess struct {
 	groups    map[string]bool
 }
 
-var _ GenerateDataplaneTokenAccess = &staticGenerateDataplaneTokenAccess{}
+var _ DataplaneTokenAccess = &staticGenerateDataplaneTokenAccess{}
 
-func NewStaticGenerateDataplaneTokenAccess(cfg config_access.GenerateDPTokenStaticAccessConfig) GenerateDataplaneTokenAccess {
+func NewStaticGenerateDataplaneTokenAccess(cfg config_access.GenerateDPTokenStaticAccessConfig) DataplaneTokenAccess {
 	s := &staticGenerateDataplaneTokenAccess{
 		usernames: map[string]bool{},
 		groups:    map[string]bool{},
@@ -27,13 +27,15 @@ func NewStaticGenerateDataplaneTokenAccess(cfg config_access.GenerateDPTokenStat
 	return s
 }
 
-func (s *staticGenerateDataplaneTokenAccess) ValidateGenerate(
-	name string,
-	mesh string,
-	tags map[string][]string,
-	tokenType string,
-	user user.User,
-) error {
+func (s *staticGenerateDataplaneTokenAccess) ValidateGenerateDataplaneToken(name string, mesh string, tags map[string][]string, user user.User) error {
+	return s.validateAccess(user)
+}
+
+func (s *staticGenerateDataplaneTokenAccess) ValidateGenerateZoneIngressToken(zone string, user user.User) error {
+	return s.validateAccess(user)
+}
+
+func (s *staticGenerateDataplaneTokenAccess) validateAccess(user user.User) error {
 	allowed := s.usernames[user.Name]
 	for _, group := range user.Groups {
 		if s.groups[group] {
diff --git a/pkg/tokens/builtin/server/webservice.go b/pkg/tokens/builtin/server/webservice.go
index 7b102efe1..a2c0c5741 100644
--- a/pkg/tokens/builtin/server/webservice.go
+++ b/pkg/tokens/builtin/server/webservice.go
@@ -21,13 +21,13 @@ var log = core.Log.WithName("dataplane-token-ws")
 type tokenWebService struct {
 	issuer            issuer.DataplaneTokenIssuer
 	zoneIngressIssuer zoneingress.TokenIssuer
-	access            access.GenerateDataplaneTokenAccess
+	access            access.DataplaneTokenAccess
 }
 
 func NewWebservice(
 	issuer issuer.DataplaneTokenIssuer,
 	zoneIngressIssuer zoneingress.TokenIssuer,
-	access access.GenerateDataplaneTokenAccess,
+	access access.DataplaneTokenAccess,
 ) *restful.WebService {
 	ws := tokenWebService{
 		issuer:            issuer,
@@ -63,11 +63,10 @@ func (d *tokenWebService) handleIdentityRequest(request *restful.Request, respon
 		return
 	}
 
-	if err := d.access.ValidateGenerate(
+	if err := d.access.ValidateGenerateDataplaneToken(
 		idReq.Name,
 		idReq.Mesh,
 		idReq.Tags,
-		idReq.Type,
 		user.FromCtx(request.Request.Context()),
 	); err != nil {
 		errors.HandleError(response, err, "Could not issue a token")
@@ -99,6 +98,11 @@ func (d *tokenWebService) handleZoneIngressIdentityRequest(request *restful.Requ
 		return
 	}
 
+	if err := d.access.ValidateGenerateZoneIngressToken(idReq.Zone, user.FromCtx(request.Request.Context())); err != nil {
+		errors.HandleError(response, err, "Could not issue a token")
+		return
+	}
+
 	token, err := d.zoneIngressIssuer.Generate(zoneingress.Identity{
 		Zone: idReq.Zone,
 	})
diff --git a/pkg/xds/envoy/clusters/configurers.go b/pkg/xds/envoy/clusters/configurers.go
index d3d94f94b..28a685487 100644
--- a/pkg/xds/envoy/clusters/configurers.go
+++ b/pkg/xds/envoy/clusters/configurers.go
@@ -53,12 +53,13 @@ func ClientSideTLS(endpoints []core_xds.Endpoint) ClusterBuilderOpt {
 	})
 }
 
-func DNSCluster(name string, address string, port uint32) ClusterBuilderOpt {
+func DNSCluster(name string, address string, port uint32, isHttps bool) ClusterBuilderOpt {
 	return ClusterBuilderOptFunc(func(config *ClusterBuilderConfig) {
 		config.AddV3(&v3.DnsClusterConfigurer{
 			Name:    name,
 			Address: address,
 			Port:    port,
+			IsHttps: isHttps,
 		})
 		config.AddV3(&v3.AltStatNameConfigurer{})
 		config.AddV3(&v3.TimeoutConfigurer{})
diff --git a/pkg/xds/envoy/clusters/v3/dns_cluster_configurer.go b/pkg/xds/envoy/clusters/v3/dns_cluster_configurer.go
index 23efffa86..aa2a4fc63 100644
--- a/pkg/xds/envoy/clusters/v3/dns_cluster_configurer.go
+++ b/pkg/xds/envoy/clusters/v3/dns_cluster_configurer.go
@@ -10,6 +10,7 @@ type DnsClusterConfigurer struct {
 	Name    string
 	Address string
 	Port    uint32
+	IsHttps bool
 }
 
 var _ ClusterConfigurer = &DnsClusterConfigurer{}
@@ -19,5 +20,8 @@ func (e *DnsClusterConfigurer) Configure(c *envoy_cluster.Cluster) error {
 	c.ClusterDiscoveryType = &envoy_cluster.Cluster_Type{Type: envoy_cluster.Cluster_STRICT_DNS}
 	c.LbPolicy = envoy_cluster.Cluster_ROUND_ROBIN
 	c.LoadAssignment = endpoints.CreateStaticEndpoint(e.Name, e.Address, e.Port)
+	if e.IsHttps {
+		c.TransportSocket = endpoints.UpgradeClusterTlsUpstream(e.Address)
+	}
 	return nil
 }
diff --git a/pkg/xds/envoy/endpoints/v3/endpoints.go b/pkg/xds/envoy/endpoints/v3/endpoints.go
index 38a718c35..d30d6b0c3 100644
--- a/pkg/xds/envoy/endpoints/v3/endpoints.go
+++ b/pkg/xds/envoy/endpoints/v3/endpoints.go
@@ -5,9 +5,11 @@ import (
 
 	envoy_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	envoy_endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	envoy_tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 	proto_wrappers "google.golang.org/protobuf/types/known/wrapperspb"
 
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
+	"github.com/kumahq/kuma/pkg/util/proto"
 	envoy "github.com/kumahq/kuma/pkg/xds/envoy/metadata/v3"
 )
 
@@ -36,6 +38,24 @@ func CreateStaticEndpoint(clusterName string, address string, port uint32) *envo
 	}
 }
 
+func UpgradeClusterTlsUpstream(address string) *envoy_core.TransportSocket {
+	tlsContext := &envoy_tls.UpstreamTlsContext{
+		AllowRenegotiation: true,
+		Sni:                address,
+	}
+
+	pbst, err := proto.MarshalAnyDeterministic(tlsContext)
+	if err != nil {
+		return nil
+	}
+	return &envoy_core.TransportSocket{
+		Name: "envoy.transport_sockets.tls",
+		ConfigType: &envoy_core.TransportSocket_TypedConfig{
+			TypedConfig: pbst,
+		},
+	}
+}
+
 func CreateStaticEndpointUnixSocket(clusterName string, path string) *envoy_endpoint.ClusterLoadAssignment {
 	return &envoy_endpoint.ClusterLoadAssignment{
 		ClusterName: clusterName,
diff --git a/pkg/xds/generator/tracing_proxy_generator.go b/pkg/xds/generator/tracing_proxy_generator.go
index fdc5e941c..88f0d49c5 100644
--- a/pkg/xds/generator/tracing_proxy_generator.go
+++ b/pkg/xds/generator/tracing_proxy_generator.go
@@ -3,6 +3,7 @@ package generator
 import (
 	net_url "net/url"
 	"strconv"
+	"strings"
 
 	"github.com/pkg/errors"
 
@@ -60,9 +61,11 @@ func (t TracingProxyGenerator) zipkinCluster(backend *mesh_proto.TracingBackend,
 		return nil, err
 	}
 
+	isHttps := strings.HasPrefix(cfg.Url, "https://")
+
 	clusterName := names.GetTracingClusterName(backend.Name)
 	cluster, err := clusters.NewClusterBuilder(apiVersion).
-		Configure(clusters.DNSCluster(clusterName, url.Hostname(), uint32(port))).
+		Configure(clusters.DNSCluster(clusterName, url.Hostname(), uint32(port), isHttps)).
 		Build()
 	if err != nil {
 		return nil, err
@@ -84,10 +87,11 @@ func (t TracingProxyGenerator) datadogCluster(backend *mesh_proto.TracingBackend
 	if cfg.Port > 0xFFFF || cfg.Port < 1 {
 		return nil, errors.Errorf("invalid Datadog port number %d. Must be in range 1-65535", cfg.Port)
 	}
+	isHttps := strings.HasPrefix(cfg.Address, "https://")
 
 	clusterName := names.GetTracingClusterName(backend.Name)
 	cluster, err := clusters.NewClusterBuilder(apiVersion).
-		Configure(clusters.DNSCluster(clusterName, cfg.Address, cfg.Port)).
+		Configure(clusters.DNSCluster(clusterName, cfg.Address, cfg.Port, isHttps)).
 		Build()
 	if err != nil {
 		return nil, err
diff --git a/tools/postgres/Dockerfile b/tools/postgres/Dockerfile
new file mode 100644
index 000000000..8c2c4bff3
--- /dev/null
+++ b/tools/postgres/Dockerfile
@@ -0,0 +1,12 @@
+ARG MODE
+FROM postgres:latest AS pg-tls
+COPY pg_hba.conf /var/lib/postgresql/pg_hba.conf
+COPY certs/rootCA.crt /var/lib/postgresql/rootCA.crt
+COPY certs/postgres.server.crt /var/lib/postgresql/postgres.server.crt
+COPY certs/postgres.server.key /var/lib/postgresql/postgres.server.key
+RUN chown postgres /var/lib/postgresql/postgres.server.key && \
+    chmod 600 /var/lib/postgresql/postgres.server.key
+CMD ["-c", "ssl=on", "-c", "ssl_cert_file=/var/lib/postgresql/postgres.server.crt", "-c", "ssl_key_file=/var/lib/postgresql/postgres.server.key", "-c", "ssl_ca_file=/var/lib/postgresql/rootCA.crt", "-c", "hba_file=/var/lib/postgresql/pg_hba.conf"]
+FROM postgres:latest AS pg-standard
+
+FROM pg-${MODE}
diff --git a/tools/postgres/ssl/certs/generate.sh b/tools/postgres/certs/generate.sh
similarity index 100%
rename from tools/postgres/ssl/certs/generate.sh
rename to tools/postgres/certs/generate.sh
diff --git a/tools/postgres/ssl/certs/postgres.client.crt b/tools/postgres/certs/postgres.client.crt
similarity index 100%
rename from tools/postgres/ssl/certs/postgres.client.crt
rename to tools/postgres/certs/postgres.client.crt
diff --git a/tools/postgres/ssl/certs/postgres.client.csr b/tools/postgres/certs/postgres.client.csr
similarity index 100%
rename from tools/postgres/ssl/certs/postgres.client.csr
rename to tools/postgres/certs/postgres.client.csr
diff --git a/tools/postgres/ssl/certs/postgres.client.key b/tools/postgres/certs/postgres.client.key
similarity index 100%
rename from tools/postgres/ssl/certs/postgres.client.key
rename to tools/postgres/certs/postgres.client.key
diff --git a/tools/postgres/ssl/certs/postgres.server.crt b/tools/postgres/certs/postgres.server.crt
similarity index 100%
rename from tools/postgres/ssl/certs/postgres.server.crt
rename to tools/postgres/certs/postgres.server.crt
diff --git a/tools/postgres/ssl/certs/postgres.server.csr b/tools/postgres/certs/postgres.server.csr
similarity index 100%
rename from tools/postgres/ssl/certs/postgres.server.csr
rename to tools/postgres/certs/postgres.server.csr
diff --git a/tools/postgres/ssl/certs/postgres.server.key b/tools/postgres/certs/postgres.server.key
similarity index 100%
rename from tools/postgres/ssl/certs/postgres.server.key
rename to tools/postgres/certs/postgres.server.key
diff --git a/tools/postgres/ssl/certs/rootCA.crt b/tools/postgres/certs/rootCA.crt
similarity index 100%
rename from tools/postgres/ssl/certs/rootCA.crt
rename to tools/postgres/certs/rootCA.crt
diff --git a/tools/postgres/ssl/certs/rootCA.key b/tools/postgres/certs/rootCA.key
similarity index 100%
rename from tools/postgres/ssl/certs/rootCA.key
rename to tools/postgres/certs/rootCA.key
diff --git a/tools/postgres/ssl/certs/rootCA.srl b/tools/postgres/certs/rootCA.srl
similarity index 100%
rename from tools/postgres/ssl/certs/rootCA.srl
rename to tools/postgres/certs/rootCA.srl
diff --git a/tools/postgres/docker-compose.yaml b/tools/postgres/docker-compose.yaml
index 95bce0a0d..6024067d2 100644
--- a/tools/postgres/docker-compose.yaml
+++ b/tools/postgres/docker-compose.yaml
@@ -1,11 +1,14 @@
 version: '3.5'
 services:
   db:
-    image: postgres
+    build:
+      context: .
+      args:
+        MODE: ${POSTGRES_MODE:-standard}
     restart: always
     environment:
       POSTGRES_USER: ${KUMA_STORE_POSTGRES_USER:-kuma}
       POSTGRES_PASSWORD: ${KUMA_STORE_POSTGRES_PASSWORD:-kuma}
       POSTGRES_DB: ${KUMA_STORE_POSTGRES_DB_NAME:-kuma}
     ports:
-      - ${KUMA_STORE_POSTGRES_PORT:-15432}:5432
\ No newline at end of file
+      - ${KUMA_STORE_POSTGRES_PORT:-15432}:5432
diff --git a/tools/postgres/ssl/pg_hba.conf b/tools/postgres/pg_hba.conf
similarity index 100%
rename from tools/postgres/ssl/pg_hba.conf
rename to tools/postgres/pg_hba.conf
diff --git a/tools/postgres/ssl/Dockerfile b/tools/postgres/ssl/Dockerfile
deleted file mode 100644
index b25d82e60..000000000
--- a/tools/postgres/ssl/Dockerfile
+++ /dev/null
@@ -1,4 +0,0 @@
-FROM postgres:latest
-COPY certs/postgres.server.key /var/lib/postgresql/postgres.server.key
-RUN chown postgres /var/lib/postgresql/postgres.server.key && \
-    chmod 600 /var/lib/postgresql/postgres.server.key
diff --git a/tools/postgres/ssl/docker-compose.yaml b/tools/postgres/ssl/docker-compose.yaml
deleted file mode 100644
index ba24fdaba..000000000
--- a/tools/postgres/ssl/docker-compose.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-version: '3.5'
-services:
-  db:
-    build: .
-    command: -c ssl=on -c ssl_cert_file=/var/lib/postgresql/postgres.server.crt -c ssl_key_file=/var/lib/postgresql/postgres.server.key -c ssl_ca_file=/var/lib/postgresql/rootCA.crt -c hba_file=/var/lib/postgresql/pg_hba.conf
-    restart: always
-    environment:
-      POSTGRES_USER: ${KUMA_STORE_POSTGRES_USER:-kuma}
-      POSTGRES_PASSWORD: ${KUMA_STORE_POSTGRES_PASSWORD:-kuma}
-      POSTGRES_DB: ${KUMA_STORE_POSTGRES_DB_NAME:-kuma}
-    ports:
-      - ${KUMA_STORE_POSTGRES_PORT:-15432}:5432
-    volumes:
-      - ./certs/rootCA.crt:/var/lib/postgresql/rootCA.crt:ro
-      - ./certs/postgres.server.crt:/var/lib/postgresql/postgres.server.crt:ro
-      # certs/postgres.server.key is provided via ../Dockerfile, because there is no way to mount it with 600 permission
-      - ./pg_hba.conf:/var/lib/postgresql/pg_hba.conf


Test patch:
diff --git a/app/kuma-cp/cmd/cmd_standalone_postgres_test.go b/app/kuma-cp/cmd/cmd_standalone_postgres_test.go
index cc4ba7be1..e10c8fe28 100644
--- a/app/kuma-cp/cmd/cmd_standalone_postgres_test.go
+++ b/app/kuma-cp/cmd/cmd_standalone_postgres_test.go
@@ -1,30 +1,43 @@
-//go:build integration
-// +build integration
-
 package cmd
 
 import (
-	"github.com/kumahq/kuma/pkg/config"
-	kuma_cp "github.com/kumahq/kuma/pkg/config/app/kuma-cp"
-	"github.com/kumahq/kuma/pkg/config/core/resources/store"
+	"fmt"
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
+	"github.com/kumahq/kuma/pkg/config"
+	kuma_cp "github.com/kumahq/kuma/pkg/config/app/kuma-cp"
+	"github.com/kumahq/kuma/pkg/config/core/resources/store"
+	"github.com/kumahq/kuma/pkg/config/plugins/resources/postgres"
+	test_postgres "github.com/kumahq/kuma/pkg/test/store/postgres"
 )
 
 var _ = Describe("Standalone Postgres test", func() {
+	var c test_postgres.PostgresContainer
+	var pgCfg *postgres.PostgresStoreConfig
 
 	BeforeEach(func() {
 		// setup migrate DB
+		var err error
+		c = test_postgres.PostgresContainer{}
+		Expect(c.Start()).To(Succeed())
+		pgCfg, err = c.Config()
+		Expect(err).ToNot(HaveOccurred())
 		cfg := kuma_cp.DefaultConfig()
-		err := config.Load("", &cfg)
 		cfg.Store.Type = store.PostgresStore
+		cfg.Store.Postgres = pgCfg
+		err = config.Load("", &cfg)
 		Expect(err).ToNot(HaveOccurred())
 		err = migrate(cfg)
 		Expect(err).ToNot(HaveOccurred())
 	})
+	AfterEach(func() {
+		Expect(c.Stop()).To(Succeed())
+	})
 
-	RunSmokeTest(StaticConfig(`
+	RunSmokeTest(ConfigFactoryFunc(func() string {
+		return fmt.Sprintf(`
 general:
   workDir: ./kuma-workdir
 apiServer:
@@ -37,7 +50,11 @@ dnsServer:
 environment: universal
 store:
   type: postgres
+  postgres:
+    host: %s
+    port: %d
 diagnostics:
-  serverPort: %d
-`), "./kuma-workdir")
+  serverPort: %%d
+`, pgCfg.Host, pgCfg.Port)
+	}), "./kuma-workdir")
 })
diff --git a/app/kuma-cp/cmd/cmd_suite_test.go b/app/kuma-cp/cmd/cmd_suite_test.go
index eaa03663c..d8ef1bd74 100644
--- a/app/kuma-cp/cmd/cmd_suite_test.go
+++ b/app/kuma-cp/cmd/cmd_suite_test.go
@@ -19,9 +19,12 @@ package cmd
 import (
 	"testing"
 
+	"github.com/testcontainers/testcontainers-go"
+
 	"github.com/kumahq/kuma/pkg/test"
 )
 
 func TestCmd(t *testing.T) {
+	testcontainers.SkipIfProviderIsNotHealthy(t)
 	test.RunSpecs(t, "CMD Suite")
 }
diff --git a/app/kumactl/pkg/tokens/client_test.go b/app/kumactl/pkg/tokens/client_test.go
index c208fe754..23e6516b8 100644
--- a/app/kumactl/pkg/tokens/client_test.go
+++ b/app/kumactl/pkg/tokens/client_test.go
@@ -37,7 +37,7 @@ var _ = Describe("Tokens Client", func() {
 
 	BeforeEach(func() {
 		container := restful.NewContainer()
-		container.Add(tokens_server.NewWebservice(&staticTokenIssuer{}, &zoneIngressStaticTokenIssuer{}, access.NoopGenerateDpTokenAccess{}))
+		container.Add(tokens_server.NewWebservice(&staticTokenIssuer{}, &zoneIngressStaticTokenIssuer{}, access.NoopDpTokenAccess{}))
 		server = httptest.NewServer(container.ServeMux)
 	})
 
diff --git a/app/kumactl/pkg/tokens/zoneingress_client_test.go b/app/kumactl/pkg/tokens/zoneingress_client_test.go
index 738c74633..6cc96815d 100644
--- a/app/kumactl/pkg/tokens/zoneingress_client_test.go
+++ b/app/kumactl/pkg/tokens/zoneingress_client_test.go
@@ -37,7 +37,7 @@ var _ = Describe("Zone Ingress Tokens Client", func() {
 
 	BeforeEach(func() {
 		container := restful.NewContainer()
-		container.Add(tokens_server.NewWebservice(&staticTokenIssuer{}, &zoneIngressStaticTokenIssuer{}, access.NoopGenerateDpTokenAccess{}))
+		container.Add(tokens_server.NewWebservice(&staticTokenIssuer{}, &zoneIngressStaticTokenIssuer{}, access.NoopDpTokenAccess{}))
 		server = httptest.NewServer(container.ServeMux)
 	})
 
diff --git a/mk/test.mk b/mk/test.mk
index 000fd7372..65009f9df 100644
--- a/mk/test.mk
+++ b/mk/test.mk
@@ -9,9 +9,6 @@ BUILD_COVERAGE_DIR ?= $(BUILD_DIR)/coverage
 COVERAGE_PROFILE := $(BUILD_COVERAGE_DIR)/coverage.out
 COVERAGE_REPORT_HTML := $(BUILD_COVERAGE_DIR)/coverage.html
 
-COVERAGE_INTEGRATION_PROFILE := $(BUILD_COVERAGE_DIR)/coverage-integration.out
-COVERAGE_INTEGRATION_REPORT_HTML := $(BUILD_COVERAGE_DIR)/coverage-integration.html
-
 # exports below are required for K8S unit tests
 export TEST_ASSET_KUBE_APISERVER=$(KUBE_APISERVER_PATH)
 export TEST_ASSET_ETCD=$(ETCD_PATH)
@@ -41,14 +38,6 @@ test/kuma-dp: test/kuma ## Dev: Run `kuma-dp` tests only
 test/kumactl: PKG_LIST=./app/kumactl/... ./pkg/config/app/kumactl/...
 test/kumactl: test/kuma ## Dev: Run `kumactl` tests only
 
-${COVERAGE_INTEGRATION_PROFILE}:
-	mkdir -p "$(shell dirname "$(COVERAGE_INTEGRATION_PROFILE)")"
-
 .PHONY: test/release
 test/release: # Dev: Run release tests
 	$(GO_TEST) $(GO_TEST_OPTS) -tags=release ./test/release/...
-
-.PHONY: integration
-integration: ${COVERAGE_INTEGRATION_PROFILE} ## Dev: Run integration tests
-	tools/test/run-integration-tests.sh '$(GO_TEST) -tags=integration,gateway -race -covermode=atomic -count=1 -coverpkg=./... -coverprofile=$(COVERAGE_INTEGRATION_PROFILE) $(PKG_LIST)'
-	GOFLAGS='${GOFLAGS}' go tool cover -html="$(COVERAGE_INTEGRATION_PROFILE)" -o "$(COVERAGE_INTEGRATION_REPORT_HTML)"
diff --git a/pkg/api-server/config_ws_test.go b/pkg/api-server/config_ws_test.go
index 5e6465ebf..1286c8567 100644
--- a/pkg/api-server/config_ws_test.go
+++ b/pkg/api-server/config_ws_test.go
@@ -176,7 +176,7 @@ var _ = Describe("Config WS", func() {
 			}
 		  },
 		  "reports": {
-			"enabled": false
+			"enabled": true
 		  },
 		  "runtime": {
 			"kubernetes": {
diff --git a/pkg/api-server/customization/customization_suite_test.go b/pkg/api-server/customization/customization_suite_test.go
index 606a2d1c3..67d4eef4d 100644
--- a/pkg/api-server/customization/customization_suite_test.go
+++ b/pkg/api-server/customization/customization_suite_test.go
@@ -57,8 +57,8 @@ func createTestApiServer(store store.ResourceStore, config *config_api_server.Ap
 		func() string { return "cluster-id" },
 		certs.ClientCertAuthenticator,
 		runtime.Access{
-			ResourceAccess:               resources_access.NewAdminResourceAccess(cfg.Access.Static.AdminResources),
-			GenerateDataplaneTokenAccess: nil,
+			ResourceAccess:       resources_access.NewAdminResourceAccess(cfg.Access.Static.AdminResources),
+			DataplaneTokenAccess: nil,
 		},
 	)
 	Expect(err).ToNot(HaveOccurred())
diff --git a/pkg/api-server/resource_api_client_test.go b/pkg/api-server/resource_api_client_test.go
index f42504cc1..71e285034 100644
--- a/pkg/api-server/resource_api_client_test.go
+++ b/pkg/api-server/resource_api_client_test.go
@@ -132,8 +132,8 @@ func createTestApiServer(store store.ResourceStore, config *config_api_server.Ap
 		func() string { return "cluster-id" },
 		certs.ClientCertAuthenticator,
 		runtime.Access{
-			ResourceAccess:               resources_access.NewAdminResourceAccess(cfg.Access.Static.AdminResources),
-			GenerateDataplaneTokenAccess: nil,
+			ResourceAccess:       resources_access.NewAdminResourceAccess(cfg.Access.Static.AdminResources),
+			DataplaneTokenAccess: nil,
 		},
 	)
 	Expect(err).ToNot(HaveOccurred())
diff --git a/pkg/plugins/common/postgres/test_random_db.go b/pkg/plugins/common/postgres/test_random_db.go
deleted file mode 100644
index f89a46341..000000000
--- a/pkg/plugins/common/postgres/test_random_db.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package postgres
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/kumahq/kuma/pkg/config/plugins/resources/postgres"
-	"github.com/kumahq/kuma/pkg/core"
-)
-
-func CreateRandomDb(cfg postgres.PostgresStoreConfig) (string, error) {
-	db, err := ConnectToDb(cfg)
-	if err != nil {
-		return "", err
-	}
-	dbName := fmt.Sprintf("kuma_%s", strings.ReplaceAll(core.NewUUID(), "-", ""))
-	statement := fmt.Sprintf("CREATE DATABASE %s", dbName)
-	if _, err = db.Exec(statement); err != nil {
-		return "", err
-	}
-	if err = db.Close(); err != nil {
-		return "", err
-	}
-	return dbName, err
-}
diff --git a/pkg/plugins/leader/postgres/leader_elector_test.go b/pkg/plugins/leader/postgres/leader_elector_test.go
index 3d609b05d..33aa34427 100644
--- a/pkg/plugins/leader/postgres/leader_elector_test.go
+++ b/pkg/plugins/leader/postgres/leader_elector_test.go
@@ -1,6 +1,3 @@
-//go:build integration
-// +build integration
-
 package postgres_test
 
 import (
@@ -11,39 +8,22 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/kumahq/kuma/pkg/config"
-	"github.com/kumahq/kuma/pkg/config/plugins/resources/postgres"
 	"github.com/kumahq/kuma/pkg/core/runtime/component"
 	common_postgres "github.com/kumahq/kuma/pkg/plugins/common/postgres"
 	leader_postgres "github.com/kumahq/kuma/pkg/plugins/leader/postgres"
 	"github.com/kumahq/kuma/pkg/test"
+	test_postgres "github.com/kumahq/kuma/pkg/test/store/postgres"
 )
 
 var _ = Describe("postgresLeaderElector", func() {
-
+	var c test_postgres.PostgresContainer
 	var electors map[string]component.LeaderElector
-
-	BeforeSuite(func() {
-		// wait for postgres
-		cfg := postgres.PostgresStoreConfig{}
-		err := config.Load("", &cfg)
-		Expect(err).ToNot(HaveOccurred())
-		Eventually(func() error {
-			_, err := common_postgres.ConnectToDb(cfg)
-			return err
-		}, "5s", "100ms").ShouldNot(HaveOccurred())
-	})
-
 	BeforeEach(func() {
-		cfg := postgres.PostgresStoreConfig{}
-		err := config.Load("", &cfg)
+		c = test_postgres.PostgresContainer{WithTLS: true}
+		Expect(c.Start()).To(Succeed())
+		cfg, err := c.Config()
 		Expect(err).ToNot(HaveOccurred())
-
-		dbName, err := common_postgres.CreateRandomDb(cfg)
-		Expect(err).ToNot(HaveOccurred())
-		cfg.DbName = dbName
-
-		sql, err := common_postgres.ConnectToDb(cfg)
+		sql, err := common_postgres.ConnectToDb(*cfg)
 		Expect(err).ToNot(HaveOccurred())
 
 		createElector := func(name string) component.LeaderElector {
@@ -65,6 +45,9 @@ var _ = Describe("postgresLeaderElector", func() {
 			electors[name] = createElector(name)
 		}
 	})
+	AfterEach(func() {
+		Expect(c.Stop()).To(Succeed())
+	})
 
 	It("should elect only one leader", test.Within(30*time.Second, func() {
 		// given
diff --git a/pkg/plugins/leader/postgres/postgres_suite_test.go b/pkg/plugins/leader/postgres/postgres_suite_test.go
index a1b7b8f25..a37149ba9 100644
--- a/pkg/plugins/leader/postgres/postgres_suite_test.go
+++ b/pkg/plugins/leader/postgres/postgres_suite_test.go
@@ -3,9 +3,12 @@ package postgres
 import (
 	"testing"
 
+	"github.com/testcontainers/testcontainers-go"
+
 	"github.com/kumahq/kuma/pkg/test"
 )
 
 func TestPostgresLeader(t *testing.T) {
+	testcontainers.SkipIfProviderIsNotHealthy(t)
 	test.RunSpecs(t, "Postgres Leader Suite")
 }
diff --git a/pkg/plugins/resources/postgres/migrate_test.go b/pkg/plugins/resources/postgres/migrate_test.go
index 5ae5185a1..e1f7621ba 100644
--- a/pkg/plugins/resources/postgres/migrate_test.go
+++ b/pkg/plugins/resources/postgres/migrate_test.go
@@ -1,16 +1,13 @@
-//go:build integration
-// +build integration
-
 package postgres
 
 import (
-	"github.com/kumahq/kuma/pkg/config"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
 	"github.com/kumahq/kuma/pkg/config/plugins/resources/postgres"
 	"github.com/kumahq/kuma/pkg/core/plugins"
 	common_postgres "github.com/kumahq/kuma/pkg/plugins/common/postgres"
-
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	test_postgres "github.com/kumahq/kuma/pkg/test/store/postgres"
 )
 
 var _ = Describe("Migrate", func() {
@@ -18,13 +15,9 @@ var _ = Describe("Migrate", func() {
 	var cfg postgres.PostgresStoreConfig
 
 	BeforeEach(func() {
-		// setup with random db
-		err := config.Load("", &cfg)
-		Expect(err).ToNot(HaveOccurred())
-
-		dbName, err := common_postgres.CreateRandomDb(cfg)
+		c, err := c.Config(test_postgres.WithRandomDb)
 		Expect(err).ToNot(HaveOccurred())
-		cfg.DbName = dbName
+		cfg = *c
 	})
 
 	It("should migrate DB", func() {
diff --git a/pkg/plugins/resources/postgres/store_suite_test.go b/pkg/plugins/resources/postgres/store_suite_test.go
index b20e40b32..d11a01fb6 100644
--- a/pkg/plugins/resources/postgres/store_suite_test.go
+++ b/pkg/plugins/resources/postgres/store_suite_test.go
@@ -3,9 +3,24 @@ package postgres
 import (
 	"testing"
 
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"github.com/testcontainers/testcontainers-go"
+
 	"github.com/kumahq/kuma/pkg/test"
+	test_postgres "github.com/kumahq/kuma/pkg/test/store/postgres"
 )
 
+var c test_postgres.PostgresContainer
+
 func TestPostgresStore(t *testing.T) {
+	testcontainers.SkipIfProviderIsNotHealthy(t)
+	BeforeSuite(func() {
+		c = test_postgres.PostgresContainer{WithTLS: true}
+		Expect(c.Start()).To(Succeed())
+	})
+	AfterSuite(func() {
+		Expect(c.Stop()).To(Succeed())
+	})
 	test.RunSpecs(t, "Postgres Resource Store Suite")
 }
diff --git a/pkg/plugins/resources/postgres/store_template_test.go b/pkg/plugins/resources/postgres/store_template_test.go
index 1cc884811..9b4b64508 100644
--- a/pkg/plugins/resources/postgres/store_template_test.go
+++ b/pkg/plugins/resources/postgres/store_template_test.go
@@ -1,37 +1,27 @@
-//go:build integration
-// +build integration
-
 package postgres
 
 import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/kumahq/kuma/pkg/config"
-	"github.com/kumahq/kuma/pkg/config/plugins/resources/postgres"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
-	common_postgres "github.com/kumahq/kuma/pkg/plugins/common/postgres"
 	test_store "github.com/kumahq/kuma/pkg/test/store"
+	test_postgres "github.com/kumahq/kuma/pkg/test/store/postgres"
 )
 
 var _ = Describe("PostgresStore template", func() {
 	createStore := func() store.ResourceStore {
-		cfg := postgres.PostgresStoreConfig{}
-		err := config.Load("", &cfg)
+		cfg, err := c.Config(test_postgres.WithRandomDb)
 		Expect(err).ToNot(HaveOccurred())
 
 		metrics, err := core_metrics.NewMetrics("Standalone")
 		Expect(err).ToNot(HaveOccurred())
 
-		dbName, err := common_postgres.CreateRandomDb(cfg)
-		Expect(err).ToNot(HaveOccurred())
-		cfg.DbName = dbName
-
-		_, err = migrateDb(cfg)
+		_, err = migrateDb(*cfg)
 		Expect(err).ToNot(HaveOccurred())
 
-		pStore, err := NewStore(metrics, cfg)
+		pStore, err := NewStore(metrics, *cfg)
 		Expect(err).ToNot(HaveOccurred())
 
 		return pStore
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index 4b9e7f6b6..00d975cf8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -78,6 +78,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index 590ac122c..291023f75 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -79,6 +79,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index 980e65407..f17ab7b5a 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -138,6 +138,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index 6faabdce5..53fe6b6f9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -78,6 +78,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index c02a4972f..87de6af12 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -75,6 +75,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index 13ad2b726..8eca4e06f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -79,6 +79,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index 4b9e7f6b6..00d975cf8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -78,6 +78,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index f3ddc2941..3f12102ca 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -81,6 +81,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index c6f2dfc0c..4e8ebeee7 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -80,6 +80,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index 3836ac8af..e3e6108c2 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -79,6 +79,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index 7db2a3105..65d7ac47e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -78,6 +78,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 392bd8cd5..621e5ed42 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -78,6 +78,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
index a0d5e9d69..13f5fc31c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
@@ -90,6 +90,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
index 7c4b14753..e5cab1049 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
@@ -90,6 +90,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
index a61a0b785..c36a033f6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
@@ -90,6 +90,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
index 60da6d3ac..553cfd494 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -80,6 +80,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
index 2f762c6b1..de50dec80 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -80,6 +80,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
index 50e592c94..7b78f27e6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -80,6 +80,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
index a61a0b785..c36a033f6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
@@ -90,6 +90,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
index a0d5e9d69..13f5fc31c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
@@ -90,6 +90,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
index 14372172b..3ba1a76a1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
@@ -95,6 +95,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     image: kuma/kuma-sidecar:latest
     imagePullPolicy: IfNotPresent
     livenessProbe:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
index dc51f5287..26fc2c96b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
@@ -80,6 +80,8 @@ spec:
       value: $(POD_NAME).$(POD_NAMESPACE)
     - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
       value: /some/other/path
+    - name: KUMA_DNS_ENABLED
+      value: "false"
     - name: NEW_ENV_VAR
       value: "123"
     - name: TEST_ENV_VAR
diff --git a/pkg/test/runtime/runtime.go b/pkg/test/runtime/runtime.go
index 1608b8e1a..f93e46faa 100644
--- a/pkg/test/runtime/runtime.go
+++ b/pkg/test/runtime/runtime.go
@@ -85,8 +85,8 @@ func BuilderFor(appCtx context.Context, cfg kuma_cp.Config) (*core_runtime.Build
 	builder.WithCAProvider(secrets.NewCaProvider(builder.CaManagers()))
 	builder.WithAPIServerAuthenticator(certs.ClientCertAuthenticator)
 	builder.WithAccess(core_runtime.Access{
-		ResourceAccess:               resources_access.NewAdminResourceAccess(builder.Config().Access.Static.AdminResources),
-		GenerateDataplaneTokenAccess: tokens_access.NewStaticGenerateDataplaneTokenAccess(builder.Config().Access.Static.GenerateDPToken),
+		ResourceAccess:       resources_access.NewAdminResourceAccess(builder.Config().Access.Static.AdminResources),
+		DataplaneTokenAccess: tokens_access.NewStaticGenerateDataplaneTokenAccess(builder.Config().Access.Static.GenerateDPToken),
 	})
 
 	_ = initializeConfigManager(cfg, builder)
diff --git a/pkg/test/store/postgres/test_container.go b/pkg/test/store/postgres/test_container.go
new file mode 100644
index 000000000..91cd7b391
--- /dev/null
+++ b/pkg/test/store/postgres/test_container.go
@@ -0,0 +1,123 @@
+package postgres
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+
+	"github.com/kumahq/kuma/pkg/config"
+	pg_config "github.com/kumahq/kuma/pkg/config/plugins/resources/postgres"
+	"github.com/kumahq/kuma/pkg/core"
+	"github.com/kumahq/kuma/pkg/plugins/common/postgres"
+)
+
+type PostgresContainer struct {
+	container testcontainers.Container
+	WithTLS   bool
+}
+
+func resourceDir() string {
+	dir, _ := os.Getwd()
+	for path.Base(dir) != "pkg" && path.Base(dir) != "app" {
+		dir = path.Dir(dir)
+	}
+	rDir := path.Join(path.Dir(dir), "tools/postgres")
+	err := os.Chmod(path.Join(rDir, "certs/postgres.client.key"), 0600)
+	if err != nil {
+		panic(err)
+	}
+	return rDir
+}
+
+func (v *PostgresContainer) Start() error {
+	ctx := context.Background()
+	buildArgs := map[string]*string{}
+	mode := "standard"
+	if v.WithTLS {
+		mode = "tls"
+	}
+	buildArgs["MODE"] = &mode
+	req := testcontainers.ContainerRequest{
+		FromDockerfile: testcontainers.FromDockerfile{
+			Context:   resourceDir(),
+			BuildArgs: buildArgs,
+		},
+		Env: map[string]string{
+			"POSTGRES_USER":     "kuma",
+			"POSTGRES_PASSWORD": "kuma",
+			"POSTGRES_DB":       "kuma",
+		},
+		ExposedPorts: []string{"5432/tcp"},
+		WaitingFor:   wait.ForListeningPort("5432"),
+	}
+	c, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		return err
+	}
+	v.container = c
+	return nil
+}
+
+func (v *PostgresContainer) Stop() error {
+	if v.container != nil {
+		return v.container.Terminate(context.Background())
+	}
+	return nil
+}
+
+type DbOption string
+
+const (
+	WithRandomDb DbOption = "random-db"
+)
+
+func (v *PostgresContainer) Config(dbOpts ...DbOption) (*pg_config.PostgresStoreConfig, error) {
+	cfg := pg_config.DefaultPostgresStoreConfig()
+	ip, err := v.container.Host(context.Background())
+	if err != nil {
+		return nil, err
+	}
+	port, err := v.container.MappedPort(context.Background(), "5432")
+	if err != nil {
+		return nil, err
+	}
+	cfg.Host = ip
+	cfg.Port = port.Int()
+	rDir := resourceDir()
+	if v.WithTLS {
+		cfg.TLS.Mode = pg_config.VerifyCa
+		cfg.TLS.KeyPath = path.Join(rDir, "certs/postgres.client.key")
+		cfg.TLS.CertPath = path.Join(rDir, "certs/postgres.client.crt")
+		cfg.TLS.CAPath = path.Join(rDir, "certs/rootCA.crt")
+	}
+	if err := config.Load("", cfg); err != nil {
+		return nil, err
+	}
+	for _, o := range dbOpts {
+		switch o {
+		case WithRandomDb:
+			db, err := postgres.ConnectToDb(*cfg)
+			if err != nil {
+				return nil, err
+			}
+			dbName := fmt.Sprintf("kuma_%s", strings.ReplaceAll(core.NewUUID(), "-", ""))
+			statement := fmt.Sprintf("CREATE DATABASE %s", dbName)
+			if _, err = db.Exec(statement); err != nil {
+				return nil, err
+			}
+			if err = db.Close(); err != nil {
+				return nil, err
+			}
+			cfg.DbName = dbName
+		}
+	}
+	return cfg, nil
+}
diff --git a/pkg/tokens/builtin/server/webservice_test.go b/pkg/tokens/builtin/server/webservice_test.go
index 927257499..87a97aedc 100644
--- a/pkg/tokens/builtin/server/webservice_test.go
+++ b/pkg/tokens/builtin/server/webservice_test.go
@@ -55,7 +55,7 @@ var _ = Describe("Dataplane Token Webservice", func() {
 	var url string
 
 	BeforeEach(func() {
-		ws := server.NewWebservice(&staticTokenIssuer{credentials}, &zoneIngressStaticTokenIssuer{}, &access.NoopGenerateDpTokenAccess{})
+		ws := server.NewWebservice(&staticTokenIssuer{credentials}, &zoneIngressStaticTokenIssuer{}, &access.NoopDpTokenAccess{})
 
 		container := restful.NewContainer()
 		container.Add(ws)
diff --git a/pkg/xds/envoy/clusters/v3/dns_cluster_configurer_test.go b/pkg/xds/envoy/clusters/v3/dns_cluster_configurer_test.go
index b8f1ab3f9..57dd6d0e6 100644
--- a/pkg/xds/envoy/clusters/v3/dns_cluster_configurer_test.go
+++ b/pkg/xds/envoy/clusters/v3/dns_cluster_configurer_test.go
@@ -2,6 +2,7 @@ package clusters_test
 
 import (
 	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/extensions/table"
 	. "github.com/onsi/gomega"
 
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
@@ -12,12 +13,36 @@ import (
 
 var _ = Describe("DNSClusterConfigurer", func() {
 
-	It("should generate proper Envoy config", func() {
-		// given
-		clusterName := "test:cluster"
-		address := "google.com"
-		port := uint32(80)
-		expected := `
+	type testCase struct {
+		clusterName string
+		address     string
+		port        int32
+		expected    string
+		isHttps     bool
+	}
+
+	DescribeTable("should generate proper Envoy config",
+		func(given testCase) {
+			// when
+			cluster, err := clusters.NewClusterBuilder(envoy.APIV3).
+				Configure(clusters.DNSCluster(given.clusterName, given.address, uint32(given.port), given.isHttps)).
+				Configure(clusters.Timeout(core_mesh.ProtocolTCP, DefaultTimeout())).
+				Build()
+
+			// then
+			Expect(err).ToNot(HaveOccurred())
+
+			actual, err := util_proto.ToYAML(cluster)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(actual).To(MatchYAML(given.expected))
+		},
+		Entry("should generate proper Envoy config", testCase{
+			// given
+			clusterName: "test:cluster",
+			address:     "google.com",
+			port:        80,
+			isHttps:     false,
+			expected: `
         altStatName: test_cluster
         connectTimeout: 5s
         loadAssignment:
@@ -30,19 +55,35 @@ var _ = Describe("DNSClusterConfigurer", func() {
                     address: google.com
                     portValue: 80
         name: test:cluster
-        type: STRICT_DNS`
-
-		// when
-		cluster, err := clusters.NewClusterBuilder(envoy.APIV3).
-			Configure(clusters.DNSCluster(clusterName, address, port)).
-			Configure(clusters.Timeout(core_mesh.ProtocolTCP, DefaultTimeout())).
-			Build()
-
-		// then
-		Expect(err).ToNot(HaveOccurred())
-
-		actual, err := util_proto.ToYAML(cluster)
-		Expect(err).ToNot(HaveOccurred())
-		Expect(actual).To(MatchYAML(expected))
-	})
+        type: STRICT_DNS`,
+		}),
+		Entry("should generate proper Envoy config for https", testCase{
+			// given
+			clusterName: "test:cluster",
+			address:     "google.com",
+			port:        80,
+			isHttps:     true,
+			expected: `
+        altStatName: test_cluster
+        connectTimeout: 5s
+        loadAssignment:
+          clusterName: test:cluster
+          endpoints:
+          - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: google.com
+                    portValue: 80
+        name: test:cluster
+        type: STRICT_DNS
+        transportSocket:
+          name: envoy.transport_sockets.tls
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+            allowRenegotiation: true
+            sni: google.com
+        `,
+		}),
+	)
 })
diff --git a/pkg/xds/generator/testdata/tracing/zipkin.envoy-config-https.golden.yaml b/pkg/xds/generator/testdata/tracing/zipkin.envoy-config-https.golden.yaml
new file mode 100644
index 000000000..b36bceb50
--- /dev/null
+++ b/pkg/xds/generator/testdata/tracing/zipkin.envoy-config-https.golden.yaml
@@ -0,0 +1,23 @@
+resources:
+- name: tracing:zipkin
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: tracing_zipkin
+    connectTimeout: 10s
+    loadAssignment:
+      clusterName: tracing:zipkin
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: zipkin.us
+                portValue: 9090
+    name: tracing:zipkin
+    type: STRICT_DNS
+    transportSocket:
+          name: envoy.transport_sockets.tls
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+            allowRenegotiation: true
+            sni: zipkin.us
diff --git a/pkg/xds/generator/tracing_generator_test.go b/pkg/xds/generator/tracing_generator_test.go
index e775806e1..39452d4e0 100644
--- a/pkg/xds/generator/tracing_generator_test.go
+++ b/pkg/xds/generator/tracing_generator_test.go
@@ -98,5 +98,32 @@ var _ = Describe("TracingProxyGenerator", func() {
 			},
 			expected: "zipkin.envoy-config.golden.yaml",
 		}),
+		Entry("should create cluster for Zipkin with tls sni", testCase{
+			proxy: &core_xds.Proxy{
+				Id: *core_xds.BuildProxyId("", "demo.https-backend-01"),
+				Dataplane: &core_mesh.DataplaneResource{
+					Meta: &test_model.ResourceMeta{
+						Name: "https-backend-01",
+						Mesh: "demo",
+					},
+					Spec: &mesh_proto.Dataplane{
+						Networking: &mesh_proto.Dataplane_Networking{
+							Address: "192.168.0.1",
+						},
+					},
+				},
+				APIVersion: envoy_common.APIV3,
+				Policies: core_xds.MatchedPolicies{
+					TracingBackend: &mesh_proto.TracingBackend{
+						Name: "zipkin",
+						Type: mesh_proto.TracingZipkinType,
+						Conf: util_proto.MustToStruct(&mesh_proto.ZipkinTracingBackendConfig{
+							Url: "https://zipkin.us:9090/v2/spans",
+						}),
+					},
+				},
+			},
+			expected: "zipkin.envoy-config-https.golden.yaml",
+		}),
 	)
 })
diff --git a/tools/test/run-integration-tests.sh b/tools/test/run-integration-tests.sh
deleted file mode 100755
index 0ffbf488f..000000000
--- a/tools/test/run-integration-tests.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/bash
-
-set -eE
-
-function get_unused_port() {
-  for port in $(seq 10000 65000);
-  do
-    nc -z localhost ${port} > /dev/null 2>&1;
-    [[ $? -eq 1 ]] && echo "$port" && break;
-  done
-}
-
-# Takes a path argument and returns it as an absolute path.
-function to_abs_path() {
-  echo "$(cd "$(dirname "$1")"; pwd)/$(basename "$1")"
-}
-
-dockerComposeSslDir="$(to_abs_path $(dirname $0)/../postgres/ssl)"
-
-chmod 600 $dockerComposeSslDir/certs/postgres.client.key
-
-export KUMA_STORE_POSTGRES_HOST=localhost
-export KUMA_STORE_POSTGRES_PORT=$(get_unused_port)
-export KUMA_STORE_POSTGRES_USER=kuma
-export KUMA_STORE_POSTGRES_PASSWORD=kuma
-export KUMA_STORE_POSTGRES_DB_NAME=kuma
-export KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL=10s
-export KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL=60s
-export KUMA_STORE_POSTGRES_TLS_MODE=verifyCa
-export KUMA_STORE_POSTGRES_TLS_CERT_PATH=$dockerComposeSslDir/certs/postgres.client.crt
-export KUMA_STORE_POSTGRES_TLS_KEY_PATH=$dockerComposeSslDir/certs/postgres.client.key
-export KUMA_STORE_POSTGRES_TLS_CA_PATH=$dockerComposeSslDir/certs/rootCA.crt
-
-dockerCompose="$dockerComposeSslDir/docker-compose.yaml"
-
-docker-compose -f ${dockerCompose} up --build --no-start
-docker-compose -f ${dockerCompose} up -d
-trap "docker-compose -f ${dockerCompose} down" EXIT
-
-# wait for postgres
-$(dirname "$0")/../postgres/wait-for-postgres.sh ${KUMA_STORE_POSTGRES_PORT}
-
-# run tests
-eval $1
-
-docker-compose -f ${dockerCompose} down
\ No newline at end of file