Repository: kumahq/kuma
Pull request #1136 (2020-11-09 13:26:42)

fix(*) validate the token in kuma-dp
### Summary

Validate the DP token in `kuma-dp`


Patch:
diff --git a/app/kuma-dp/cmd/run.go b/app/kuma-dp/cmd/run.go
index 756bc4933..844860ec5 100644
--- a/app/kuma-dp/cmd/run.go
+++ b/app/kuma-dp/cmd/run.go
@@ -8,10 +8,11 @@ import (
 	"path/filepath"
 	"time"
 
+	kumadp_config "github.com/kumahq/kuma/app/kuma-dp/pkg/config"
+
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 
-	kumadp_config "github.com/kumahq/kuma/app/kuma-dp/pkg/config"
 	"github.com/kumahq/kuma/app/kuma-dp/pkg/dataplane/accesslogs"
 	"github.com/kumahq/kuma/app/kuma-dp/pkg/dataplane/envoy"
 	"github.com/kumahq/kuma/pkg/catalog/client"
@@ -92,11 +93,6 @@ func newRunCmd() *cobra.Command {
 				runLog.Info("generated Envoy configuration will be stored in a temporary directory", "dir", tmpDir)
 			}
 
-			if cfg.DataplaneRuntime.TokenPath != "" {
-				if err := kumadp_config.ValidateTokenPath(cfg.DataplaneRuntime.TokenPath); err != nil {
-					return err
-				}
-			}
 			if cfg.DataplaneRuntime.Token != "" {
 				path := filepath.Join(cfg.DataplaneRuntime.ConfigDir, cfg.Dataplane.Name)
 				if err := writeFile(path, []byte(cfg.DataplaneRuntime.Token), 0600); err != nil {
@@ -106,6 +102,12 @@ func newRunCmd() *cobra.Command {
 				cfg.DataplaneRuntime.TokenPath = path
 			}
 
+			if cfg.DataplaneRuntime.TokenPath != "" {
+				if err := kumadp_config.ValidateTokenPath(cfg.DataplaneRuntime.TokenPath); err != nil {
+					return err
+				}
+			}
+
 			if cfg.ControlPlane.CaCert == "" && cfg.ControlPlane.CaCertFile != "" {
 				cert, err := ioutil.ReadFile(cfg.ControlPlane.CaCertFile)
 				if err != nil {
diff --git a/app/kuma-dp/pkg/config/validate.go b/app/kuma-dp/pkg/config/validate.go
index 62c89d07c..5b7e16a09 100644
--- a/app/kuma-dp/pkg/config/validate.go
+++ b/app/kuma-dp/pkg/config/validate.go
@@ -1,6 +1,9 @@
 package config
 
 import (
+	"io/ioutil"
+
+	"github.com/dgrijalva/jwt-go"
 	"github.com/pkg/errors"
 
 	util_files "github.com/kumahq/kuma/pkg/util/files"
@@ -12,10 +15,21 @@ func ValidateTokenPath(path string) error {
 	}
 	empty, err := util_files.FileEmpty(path)
 	if err != nil {
-		return errors.Wrap(err, "could not read file")
+		return errors.Wrapf(err, "could not read file %s", path)
 	}
 	if empty {
 		return errors.Errorf("token under file %s is empty", path)
 	}
+
+	rawToken, err := ioutil.ReadFile(path)
+	if err != nil {
+		return errors.Wrapf(err, "could not read the token in the file %s", path)
+	}
+
+	_, _, err = new(jwt.Parser).ParseUnverified(string(rawToken), &jwt.MapClaims{})
+	if err != nil {
+		return errors.Wrapf(err, "token in the file %s is not valid JWT token. Double check blank characters in the file", path)
+	}
+
 	return nil
 }
diff --git a/app/kumactl/cmd/delete/delete.go b/app/kumactl/cmd/delete/delete.go
index 04f2023e4..7f8d47476 100644
--- a/app/kumactl/cmd/delete/delete.go
+++ b/app/kumactl/cmd/delete/delete.go
@@ -9,7 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	kumactl_cmd "github.com/kumahq/kuma/app/kumactl/pkg/cmd"
-	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/registry"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
@@ -29,27 +29,27 @@ func NewDeleteCmd(pctx *kumactl_cmd.RootContext) *cobra.Command {
 			var resourceType model.ResourceType
 			switch resourceTypeArg {
 			case "mesh":
-				resourceType = mesh.MeshType
+				resourceType = core_mesh.MeshType
 			case "dataplane":
-				resourceType = mesh.DataplaneType
+				resourceType = core_mesh.DataplaneType
 			case "externalservice":
-				resourceType = mesh.ExternalServiceType
+				resourceType = core_mesh.ExternalServiceType
 			case "healthcheck":
-				resourceType = mesh.HealthCheckType
+				resourceType = core_mesh.HealthCheckType
 			case "proxytemplate":
-				resourceType = mesh.ProxyTemplateType
+				resourceType = core_mesh.ProxyTemplateType
 			case "traffic-log":
-				resourceType = mesh.TrafficLogType
+				resourceType = core_mesh.TrafficLogType
 			case "traffic-permission":
-				resourceType = mesh.TrafficPermissionType
+				resourceType = core_mesh.TrafficPermissionType
 			case "traffic-route":
-				resourceType = mesh.TrafficRouteType
+				resourceType = core_mesh.TrafficRouteType
 			case "traffic-trace":
-				resourceType = mesh.TrafficTraceType
+				resourceType = core_mesh.TrafficTraceType
 			case "fault-injection":
-				resourceType = mesh.FaultInjectionType
+				resourceType = core_mesh.FaultInjectionType
 			case "circuit-breaker":
-				resourceType = mesh.CircuitBreakerType
+				resourceType = core_mesh.CircuitBreakerType
 			case "secret":
 				resourceType = system.SecretType
 			case "zone":
@@ -58,14 +58,6 @@ func NewDeleteCmd(pctx *kumactl_cmd.RootContext) *cobra.Command {
 				return errors.Errorf("unknown TYPE: %s. Allowed values: mesh, dataplane, healthcheck, proxytemplate, traffic-log, traffic-permission, traffic-route, traffic-trace, fault-injection, circuit-breaker, secret, zone", resourceTypeArg)
 			}
 
-			currentMesh := pctx.CurrentMesh()
-			switch resourceType {
-			case mesh.MeshType:
-				currentMesh = name
-			case system.ZoneType:
-				currentMesh = "default"
-			}
-
 			rs, err := pctx.CurrentResourceStore()
 			if err != nil {
 				return err
@@ -75,7 +67,12 @@ func NewDeleteCmd(pctx *kumactl_cmd.RootContext) *cobra.Command {
 				return err
 			}
 
-			if err := deleteResource(name, currentMesh, resource, resourceType, rs); err != nil {
+			mesh := model.NoMesh
+			if resource.Scope() == model.ScopeMesh {
+				mesh = pctx.CurrentMesh()
+			}
+
+			if err := deleteResource(name, mesh, resource, resourceType, rs); err != nil {
 				return err
 			}
 
diff --git a/app/kumactl/cmd/get/get_mesh.go b/app/kumactl/cmd/get/get_mesh.go
index dfe7c517c..4512bb712 100644
--- a/app/kumactl/cmd/get/get_mesh.go
+++ b/app/kumactl/cmd/get/get_mesh.go
@@ -6,6 +6,7 @@ import (
 	"github.com/pkg/errors"
 
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 
 	"github.com/spf13/cobra"
 
@@ -27,13 +28,12 @@ func newGetMeshCmd(pctx *getContext) *cobra.Command {
 				return err
 			}
 			name := args[0]
-			currentMesh := name
 			mesh := &core_mesh.MeshResource{}
-			if err := rs.Get(context.Background(), mesh, store.GetByKey(name, currentMesh)); err != nil {
+			if err := rs.Get(context.Background(), mesh, store.GetByKey(name, model.NoMesh)); err != nil {
 				if store.IsResourceNotFound(err) {
-					return errors.Errorf("No resources found in %s mesh", currentMesh)
+					return errors.Errorf("No resources found in %s mesh", name)
 				}
-				return errors.Wrapf(err, "failed to get mesh %s", currentMesh)
+				return errors.Wrapf(err, "failed to get mesh %s", name)
 			}
 			meshes := &core_mesh.MeshResourceList{
 				Items: []*core_mesh.MeshResource{mesh},
diff --git a/app/kumactl/cmd/get/get_zone.go b/app/kumactl/cmd/get/get_zone.go
index 43b3a3a16..85e1529fa 100644
--- a/app/kumactl/cmd/get/get_zone.go
+++ b/app/kumactl/cmd/get/get_zone.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 
 	"github.com/pkg/errors"
 
@@ -28,7 +29,7 @@ func newGetZoneCmd(pctx *getContext) *cobra.Command {
 			}
 			name := args[0]
 			zone := &system.ZoneResource{}
-			if err := rs.Get(context.Background(), zone, store.GetByKey(name, "default")); err != nil {
+			if err := rs.Get(context.Background(), zone, store.GetByKey(name, model.NoMesh)); err != nil {
 				if store.IsResourceNotFound(err) {
 					return errors.Errorf("No zone resources found")
 				}
diff --git a/app/kumactl/cmd/get/get_zones.go b/app/kumactl/cmd/get/get_zones.go
index f6a0f6ff3..a6837846b 100644
--- a/app/kumactl/cmd/get/get_zones.go
+++ b/app/kumactl/cmd/get/get_zones.go
@@ -30,7 +30,7 @@ func newGetZonesCmd(pctx *listContext) *cobra.Command {
 			}
 
 			zones := system.ZoneResourceList{}
-			if err := rs.List(context.Background(), &zones, core_store.ListByMesh(pctx.CurrentMesh()), core_store.ListByPage(pctx.args.size, pctx.args.offset)); err != nil {
+			if err := rs.List(context.Background(), &zones, core_store.ListByPage(pctx.args.size, pctx.args.offset)); err != nil {
 				return errors.Wrapf(err, "failed to list Zone")
 			}
 
diff --git a/mk/run.mk b/mk/run.mk
index 486bd2143..b6dee8033 100644
--- a/mk/run.mk
+++ b/mk/run.mk
@@ -67,11 +67,19 @@ start/postgres: ## Boostrap: start Postgres for Control Plane with initial schem
 	docker-compose -f $(TOOLS_DIR)/postgres/docker-compose.yaml up -d
 	$(TOOLS_DIR)/postgres/wait-for-postgres.sh 15432
 
+.PHONY: stop/postgres
+stop/postgres: ## Boostrap: stop Postgres
+	docker-compose -f $(TOOLS_DIR)/postgres/docker-compose.yaml down
+
 .PHONY: start/postgres/ssl
 start/postgres/ssl: ## Boostrap: start Postgres for Control Plane with initial schema and SSL enabled
 	docker-compose -f $(TOOLS_DIR)/postgres/ssl/docker-compose.yaml up -d
 	$(TOOLS_DIR)/postgres/wait-for-postgres.sh 15432
 
+.PHONY: stop/postgres/ssl
+stop/postgres/ssl: ## Boostrap: stop Postgres with SSL enabled
+	docker-compose -f $(TOOLS_DIR)/postgres/ssl/docker-compose.yaml stop
+
 .PHONY: run/kuma-dp
 run/kuma-dp: build/kumactl ## Dev: Run `kuma-dp` locally
 	${BUILD_ARTIFACTS_DIR}/kumactl/kumactl generate dataplane-token --dataplane=$(EXAMPLE_DATAPLANE_NAME) --mesh=$(EXAMPLE_DATAPLANE_MESH) > /tmp/kuma-dp-$(EXAMPLE_DATAPLANE_NAME)-$(EXAMPLE_DATAPLANE_MESH)-token
diff --git a/pkg/api-server/resource_endpoints.go b/pkg/api-server/resource_endpoints.go
index bd3519167..887fc42a0 100644
--- a/pkg/api-server/resource_endpoints.go
+++ b/pkg/api-server/resource_endpoints.go
@@ -21,8 +21,6 @@ import (
 	"github.com/kumahq/kuma/pkg/core/validators"
 )
 
-type meshFromRequestFn = func(*restful.Request) string
-
 const (
 	k8sReadOnlyMessage = "On Kubernetes you cannot change the state of Kuma resources with 'kumactl apply' or via the HTTP API." +
 		" As a best practice, you should always be using 'kubectl apply' instead." +
@@ -33,17 +31,10 @@ const (
 		" You can still use 'kumactl' or the HTTP API to modify the rest of the resource on the global control plane.\n"
 )
 
-func meshFromPathParam(param string) meshFromRequestFn {
-	return func(request *restful.Request) string {
-		return request.PathParameter(param)
-	}
-}
-
 type resourceEndpoints struct {
-	mode            config_core.CpMode
-	publicURL       string
-	resManager      manager.ResourceManager
-	meshFromRequest meshFromRequestFn
+	mode       config_core.CpMode
+	publicURL  string
+	resManager manager.ResourceManager
 	definitions.ResourceWsDefinition
 	adminAuth authz.AdminAuth
 }
@@ -116,12 +107,18 @@ func (r *resourceEndpoints) listResources(request *restful.Request, response *re
 }
 
 func (r *resourceEndpoints) addCreateOrUpdateEndpoint(ws *restful.WebService, pathPrefix string) {
-	ws.Route(ws.PUT(pathPrefix+"/{name}").To(r.createOrUpdateResource).
-		Filter(r.auth()).
-		Doc(fmt.Sprintf("Updates a %s", r.Name)).
-		Param(ws.PathParameter("name", fmt.Sprintf("Name of the %s", r.Name)).DataType("string")).
-		Returns(200, "OK", nil).
-		Returns(201, "Created", nil))
+	if r.ReadOnly {
+		ws.Route(ws.PUT(pathPrefix+"/{name}").To(r.createOrUpdateResourceReadOnly).
+			Doc("Not allowed in read-only mode.").
+			Returns(http.StatusMethodNotAllowed, "Not allowed in read-only mode.", restful.ServiceError{}))
+	} else {
+		ws.Route(ws.PUT(pathPrefix+"/{name}").To(r.createOrUpdateResource).
+			Filter(r.auth()).
+			Doc(fmt.Sprintf("Updates a %s", r.Name)).
+			Param(ws.PathParameter("name", fmt.Sprintf("Name of the %s", r.Name)).DataType("string")).
+			Returns(200, "OK", nil).
+			Returns(201, "Created", nil))
+	}
 }
 
 func (r *resourceEndpoints) createOrUpdateResource(request *restful.Request, response *restful.Response) {
@@ -173,12 +170,6 @@ func (r *resourceEndpoints) updateResource(ctx context.Context, res model.Resour
 	}
 }
 
-func (r *resourceEndpoints) addCreateOrUpdateEndpointReadOnly(ws *restful.WebService, pathPrefix string) {
-	ws.Route(ws.PUT(pathPrefix+"/{name}").To(r.createOrUpdateResourceReadOnly).
-		Doc("Not allowed in read-only mode.").
-		Returns(http.StatusMethodNotAllowed, "Not allowed in read-only mode.", restful.ServiceError{}))
-}
-
 func (r *resourceEndpoints) createOrUpdateResourceReadOnly(request *restful.Request, response *restful.Response) {
 	err := response.WriteErrorString(http.StatusMethodNotAllowed, r.readOnlyMessage())
 	if err != nil {
@@ -187,11 +178,17 @@ func (r *resourceEndpoints) createOrUpdateResourceReadOnly(request *restful.Requ
 }
 
 func (r *resourceEndpoints) addDeleteEndpoint(ws *restful.WebService, pathPrefix string) {
-	ws.Route(ws.DELETE(pathPrefix+"/{name}").To(r.deleteResource).
-		Filter(r.auth()).
-		Doc(fmt.Sprintf("Deletes a %s", r.Name)).
-		Param(ws.PathParameter("name", fmt.Sprintf("Name of a %s", r.Name)).DataType("string")).
-		Returns(200, "OK", nil))
+	if r.ReadOnly {
+		ws.Route(ws.DELETE(pathPrefix+"/{name}").To(r.deleteResourceReadOnly).
+			Doc("Not allowed in read-only mode.").
+			Returns(http.StatusMethodNotAllowed, "Not allowed in read-only mode.", restful.ServiceError{}))
+	} else {
+		ws.Route(ws.DELETE(pathPrefix+"/{name}").To(r.deleteResource).
+			Filter(r.auth()).
+			Doc(fmt.Sprintf("Deletes a %s", r.Name)).
+			Param(ws.PathParameter("name", fmt.Sprintf("Name of a %s", r.Name)).DataType("string")).
+			Returns(200, "OK", nil))
+	}
 }
 
 func (r *resourceEndpoints) deleteResource(request *restful.Request, response *restful.Response) {
@@ -204,12 +201,6 @@ func (r *resourceEndpoints) deleteResource(request *restful.Request, response *r
 	}
 }
 
-func (r *resourceEndpoints) addDeleteEndpointReadOnly(ws *restful.WebService, pathPrefix string) {
-	ws.Route(ws.DELETE(pathPrefix+"/{name}").To(r.deleteResourceReadOnly).
-		Doc("Not allowed in read-only mode.").
-		Returns(http.StatusMethodNotAllowed, "Not allowed in read-only mode.", restful.ServiceError{}))
-}
-
 func (r *resourceEndpoints) deleteResourceReadOnly(request *restful.Request, response *restful.Response) {
 	err := response.WriteErrorString(http.StatusMethodNotAllowed, r.readOnlyMessage())
 	if err != nil {
@@ -221,6 +212,7 @@ func (r *resourceEndpoints) validateResourceRequest(request *restful.Request, re
 	var err validators.ValidationError
 	name := request.PathParameter("name")
 	meshName := r.meshFromRequest(request)
+
 	if name != resource.Meta.Name {
 		err.AddViolation("name", "name from the URL has to be the same as in body")
 	}
@@ -234,6 +226,13 @@ func (r *resourceEndpoints) validateResourceRequest(request *restful.Request, re
 	return err.OrNil()
 }
 
+func (r *resourceEndpoints) meshFromRequest(request *restful.Request) string {
+	if r.ResourceFactory().Scope() == model.ScopeMesh {
+		return request.PathParameter("mesh")
+	}
+	return ""
+}
+
 func (r *resourceEndpoints) readOnlyMessage() string {
 	switch r.mode {
 	case config_core.Global:
diff --git a/pkg/api-server/server.go b/pkg/api-server/server.go
index 757ca46a5..faa4207aa 100644
--- a/pkg/api-server/server.go
+++ b/pkg/api-server/server.go
@@ -27,8 +27,8 @@ import (
 	config_core "github.com/kumahq/kuma/pkg/config/core"
 	"github.com/kumahq/kuma/pkg/core"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
-	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/runtime"
 	"github.com/kumahq/kuma/pkg/metrics"
 	"github.com/kumahq/kuma/pkg/tokens/builtin"
@@ -140,13 +140,13 @@ func NewApiServer(resManager manager.ResourceManager, defs []definitions.Resourc
 
 func addResourcesEndpoints(ws *restful.WebService, defs []definitions.ResourceWsDefinition, resManager manager.ResourceManager, cfg *kuma_cp.Config) {
 	config := cfg.ApiServer
-	endpoints := dataplaneOverviewEndpoints{
+	dpOverviewEndpoints := dataplaneOverviewEndpoints{
 		publicURL:  config.Catalog.ApiServer.Url,
 		resManager: resManager,
 	}
-	endpoints.addListEndpoint(ws, "/meshes/{mesh}")
-	endpoints.addFindEndpoint(ws, "/meshes/{mesh}")
-	endpoints.addListEndpoint(ws, "") // listing all resources in all meshes
+	dpOverviewEndpoints.addListEndpoint(ws, "/meshes/{mesh}")
+	dpOverviewEndpoints.addFindEndpoint(ws, "/meshes/{mesh}")
+	dpOverviewEndpoints.addListEndpoint(ws, "") // listing all resources in all meshes
 
 	zoneOverviewEndpoints := zoneOverviewEndpoints{
 		publicURL:  config.Catalog.ApiServer.Url,
@@ -156,62 +156,30 @@ func addResourcesEndpoints(ws *restful.WebService, defs []definitions.ResourceWs
 	zoneOverviewEndpoints.addListEndpoint(ws)
 
 	for _, definition := range defs {
-		switch definition.ResourceFactory().GetType() {
-		case mesh.MeshType:
-			endpoints := resourceEndpoints{
-				mode:                 cfg.Mode,
-				publicURL:            config.Catalog.ApiServer.Url,
-				resManager:           resManager,
-				ResourceWsDefinition: definition,
-				meshFromRequest:      meshFromPathParam("name"),
-				adminAuth:            authz.AdminAuth{AllowFromLocalhost: cfg.ApiServer.Auth.AllowFromLocalhost},
-			}
-			if config.ReadOnly || definition.ReadOnly {
-				endpoints.addCreateOrUpdateEndpointReadOnly(ws, "/meshes")
-				endpoints.addDeleteEndpointReadOnly(ws, "/meshes")
-			} else {
-				endpoints.addCreateOrUpdateEndpoint(ws, "/meshes")
-				endpoints.addDeleteEndpoint(ws, "/meshes")
-			}
-			endpoints.addFindEndpoint(ws, "/meshes")
-			endpoints.addListEndpoint(ws, "/meshes")
-		case system.ZoneType:
-			endpoints := resourceEndpoints{
-				publicURL:            config.Catalog.ApiServer.Url,
-				resManager:           resManager,
-				ResourceWsDefinition: definition,
-				meshFromRequest: func(request *restful.Request) string {
-					return "default"
-				},
-				adminAuth: authz.AdminAuth{AllowFromLocalhost: cfg.ApiServer.Auth.AllowFromLocalhost},
-			}
-			if config.ReadOnly || definition.ReadOnly {
-				endpoints.addCreateOrUpdateEndpointReadOnly(ws, "/zones")
-				endpoints.addDeleteEndpointReadOnly(ws, "/zones")
-			} else {
-				endpoints.addCreateOrUpdateEndpoint(ws, "/zones")
-				endpoints.addDeleteEndpoint(ws, "/zones")
-			}
-			endpoints.addFindEndpoint(ws, "/zones")
-			endpoints.addListEndpoint(ws, "/zones")
-		default:
-			endpoints := resourceEndpoints{
-				publicURL:            config.Catalog.ApiServer.Url,
-				resManager:           resManager,
-				ResourceWsDefinition: definition,
-				meshFromRequest:      meshFromPathParam("mesh"),
-				adminAuth:            authz.AdminAuth{AllowFromLocalhost: cfg.ApiServer.Auth.AllowFromLocalhost},
-			}
-			if config.ReadOnly || definition.ReadOnly {
-				endpoints.addCreateOrUpdateEndpointReadOnly(ws, "/meshes/{mesh}/"+definition.Path)
-				endpoints.addDeleteEndpointReadOnly(ws, "/meshes/{mesh}/"+definition.Path)
-			} else {
-				endpoints.addCreateOrUpdateEndpoint(ws, "/meshes/{mesh}/"+definition.Path)
-				endpoints.addDeleteEndpoint(ws, "/meshes/{mesh}/"+definition.Path)
-			}
+		if config.ReadOnly {
+			definition.ReadOnly = true
+		}
+		endpoints := resourceEndpoints{
+			mode:                 cfg.Mode,
+			publicURL:            config.Catalog.ApiServer.Url,
+			resManager:           resManager,
+			ResourceWsDefinition: definition,
+			adminAuth: authz.AdminAuth{
+				AllowFromLocalhost: cfg.ApiServer.Auth.AllowFromLocalhost,
+			},
+		}
+		switch definition.ResourceFactory().Scope() {
+		case model.ScopeMesh:
+			endpoints.addCreateOrUpdateEndpoint(ws, "/meshes/{mesh}/"+definition.Path)
+			endpoints.addDeleteEndpoint(ws, "/meshes/{mesh}/"+definition.Path)
 			endpoints.addFindEndpoint(ws, "/meshes/{mesh}/"+definition.Path)
 			endpoints.addListEndpoint(ws, "/meshes/{mesh}/"+definition.Path)
 			endpoints.addListEndpoint(ws, "/"+definition.Path) // listing all resources in all meshes
+		case model.ScopeGlobal:
+			endpoints.addCreateOrUpdateEndpoint(ws, "/"+definition.Path)
+			endpoints.addDeleteEndpoint(ws, "/"+definition.Path)
+			endpoints.addFindEndpoint(ws, "/"+definition.Path)
+			endpoints.addListEndpoint(ws, "/"+definition.Path)
 		}
 	}
 }
diff --git a/pkg/api-server/zone_overview_endpoints.go b/pkg/api-server/zone_overview_endpoints.go
index e4a3c9b72..a7d4148c5 100644
--- a/pkg/api-server/zone_overview_endpoints.go
+++ b/pkg/api-server/zone_overview_endpoints.go
@@ -9,7 +9,7 @@ import (
 	system_proto "github.com/kumahq/kuma/api/system/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
-	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	rest_errors "github.com/kumahq/kuma/pkg/core/rest/errors"
@@ -51,12 +51,12 @@ func (r *zoneOverviewEndpoints) inspectZone(request *restful.Request, response *
 
 func (r *zoneOverviewEndpoints) fetchOverview(ctx context.Context, name string) (*system.ZoneOverviewResource, error) {
 	zone := system.ZoneResource{}
-	if err := r.resManager.Get(ctx, &zone, store.GetByKey(name, core_model.DefaultMesh)); err != nil {
+	if err := r.resManager.Get(ctx, &zone, store.GetByKey(name, model.NoMesh)); err != nil {
 		return nil, err
 	}
 
 	insight := system.ZoneInsightResource{}
-	err := r.resManager.Get(ctx, &insight, store.GetByKey(name, core_model.DefaultMesh))
+	err := r.resManager.Get(ctx, &insight, store.GetByKey(name, model.NoMesh))
 	if err != nil && !store.IsResourceNotFound(err) { // It's fine to have zone without insight
 		return nil, err
 	}
@@ -77,7 +77,7 @@ func (r *zoneOverviewEndpoints) inspectZones(request *restful.Request, response
 		return
 	}
 
-	overviews, err := r.fetchOverviews(request.Request.Context(), page, core_model.DefaultMesh)
+	overviews, err := r.fetchOverviews(request.Request.Context(), page)
 	if err != nil {
 		rest_errors.HandleError(response, err, "Could not retrieve dataplane overviews")
 		return
@@ -97,15 +97,15 @@ func (r *zoneOverviewEndpoints) inspectZones(request *restful.Request, response
 	}
 }
 
-func (r *zoneOverviewEndpoints) fetchOverviews(ctx context.Context, p page, meshName string) (system.ZoneOverviewResourceList, error) {
+func (r *zoneOverviewEndpoints) fetchOverviews(ctx context.Context, p page) (system.ZoneOverviewResourceList, error) {
 	zones := system.ZoneResourceList{}
-	if err := r.resManager.List(ctx, &zones, store.ListByMesh(meshName), store.ListByPage(p.size, p.offset)); err != nil {
+	if err := r.resManager.List(ctx, &zones, store.ListByPage(p.size, p.offset)); err != nil {
 		return system.ZoneOverviewResourceList{}, err
 	}
 
 	// we cannot paginate insights since there is no guarantee that the elements will be the same as dataplanes
 	insights := system.ZoneInsightResourceList{}
-	if err := r.resManager.List(ctx, &insights, store.ListByMesh(meshName)); err != nil {
+	if err := r.resManager.List(ctx, &insights); err != nil {
 		return system.ZoneOverviewResourceList{}, err
 	}
 
diff --git a/pkg/api-server/zones_ws.go b/pkg/api-server/zones_ws.go
index 49f36f8ac..6cbf314de 100644
--- a/pkg/api-server/zones_ws.go
+++ b/pkg/api-server/zones_ws.go
@@ -7,8 +7,6 @@ import (
 
 	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
-	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
-	"github.com/kumahq/kuma/pkg/core/resources/store"
 	rest_errors "github.com/kumahq/kuma/pkg/core/rest/errors"
 )
 
@@ -36,13 +34,13 @@ func zonesWs(resManager manager.ResourceManager) *restful.WebService {
 
 func fetchOverviews(resManager manager.ResourceManager, ctx context.Context) (system.ZoneOverviewResourceList, error) {
 	zones := system.ZoneResourceList{}
-	if err := resManager.List(ctx, &zones, store.ListByMesh(core_model.DefaultMesh)); err != nil {
+	if err := resManager.List(ctx, &zones); err != nil {
 		return system.ZoneOverviewResourceList{}, err
 	}
 
 	// we cannot paginate insights since there is no guarantee that the elements will be the same as dataplanes
 	insights := system.ZoneInsightResourceList{}
-	if err := resManager.List(ctx, &insights, store.ListByMesh(core_model.DefaultMesh)); err != nil {
+	if err := resManager.List(ctx, &insights); err != nil {
 		return system.ZoneOverviewResourceList{}, err
 	}
 
diff --git a/pkg/core/logs/matcher.go b/pkg/core/logs/matcher.go
index 90e8814a7..148b7d303 100644
--- a/pkg/core/logs/matcher.go
+++ b/pkg/core/logs/matcher.go
@@ -8,6 +8,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/policy"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 
@@ -34,7 +35,7 @@ func (m *TrafficLogsMatcher) Match(ctx context.Context, dataplane *mesh_core.Dat
 		return nil, errors.Wrap(err, "could not retrieve traffic logs")
 	}
 	mesh := mesh_core.MeshResource{}
-	if err := m.ResourceManager.Get(ctx, &mesh, store.GetByKey(dataplane.GetMeta().GetMesh(), dataplane.GetMeta().GetMesh())); err != nil {
+	if err := m.ResourceManager.Get(ctx, &mesh, store.GetByKey(dataplane.GetMeta().GetMesh(), model.NoMesh)); err != nil {
 		return nil, err
 	}
 	return BuildTrafficLogMap(dataplane, &mesh, logs.Items), nil
diff --git a/pkg/core/managers/apis/dataplane/dataplane_manager.go b/pkg/core/managers/apis/dataplane/dataplane_manager.go
index bd0923487..de9be8430 100644
--- a/pkg/core/managers/apis/dataplane/dataplane_manager.go
+++ b/pkg/core/managers/apis/dataplane/dataplane_manager.go
@@ -43,7 +43,7 @@ func (m *dataplaneManager) Create(ctx context.Context, resource core_model.Resou
 
 	opts := core_store.NewCreateOptions(fs...)
 	owner := &core_mesh.MeshResource{}
-	if err := m.store.Get(ctx, owner, core_store.GetByKey(opts.Mesh, opts.Mesh)); err != nil {
+	if err := m.store.Get(ctx, owner, core_store.GetByKey(opts.Mesh, core_model.NoMesh)); err != nil {
 		return core_manager.MeshNotFound(opts.Mesh)
 	}
 
diff --git a/pkg/core/managers/apis/zoneinsight/zone_insight_manager.go b/pkg/core/managers/apis/zoneinsight/zone_insight_manager.go
index 78072c23c..d5fbc0637 100644
--- a/pkg/core/managers/apis/zoneinsight/zone_insight_manager.go
+++ b/pkg/core/managers/apis/zoneinsight/zone_insight_manager.go
@@ -37,7 +37,7 @@ func (m *zoneInsightManager) Create(ctx context.Context, resource core_model.Res
 	m.limitSubscription(resource.(*system.ZoneInsightResource))
 
 	zone := system.ZoneResource{}
-	if err := m.store.Get(ctx, &zone, core_store.GetByKey(opts.Name, opts.Mesh)); err != nil {
+	if err := m.store.Get(ctx, &zone, core_store.GetByKey(opts.Name, core_model.NoMesh)); err != nil {
 		return err
 	}
 	return m.store.Create(ctx, resource, append(fs, core_store.CreatedAt(core.Now()), core_store.CreateWithOwner(&zone))...)
diff --git a/pkg/core/resources/manager/manager.go b/pkg/core/resources/manager/manager.go
index fa0abce31..7ec651545 100644
--- a/pkg/core/resources/manager/manager.go
+++ b/pkg/core/resources/manager/manager.go
@@ -51,9 +51,9 @@ func (r *resourcesManager) Create(ctx context.Context, resource model.Resource,
 	opts := store.NewCreateOptions(fs...)
 
 	var owner model.Resource
-	if resource.GetType() != core_mesh.MeshType {
+	if resource.Scope() == model.ScopeMesh {
 		owner = &core_mesh.MeshResource{}
-		if err := r.Store.Get(ctx, owner, store.GetByKey(opts.Mesh, opts.Mesh)); err != nil {
+		if err := r.Store.Get(ctx, owner, store.GetByKey(opts.Mesh, model.NoMesh)); err != nil {
 			return MeshNotFound(opts.Mesh)
 		}
 	}
diff --git a/pkg/core/resources/model/resource.go b/pkg/core/resources/model/resource.go
index f5c08b767..f68adb4e7 100644
--- a/pkg/core/resources/model/resource.go
+++ b/pkg/core/resources/model/resource.go
@@ -10,6 +10,9 @@ import (
 
 const (
 	DefaultMesh = "default"
+	// NoMesh defines a marker that resource is not bound to a Mesh.
+	// Resources not bound to a mesh (ScopeGlobal) should have an empty string in Mesh field.
+	NoMesh = ""
 )
 
 var (
diff --git a/pkg/core/resources/store/store.go b/pkg/core/resources/store/store.go
index fa69629b8..f74e92b3a 100644
--- a/pkg/core/resources/store/store.go
+++ b/pkg/core/resources/store/store.go
@@ -46,7 +46,7 @@ func (s *strictResourceStore) Create(ctx context.Context, r model.Resource, fs .
 	if opts.Name == "" {
 		return fmt.Errorf("ResourceStore.Create() requires options.Name to be a non-empty value")
 	}
-	if opts.Mesh == "" {
+	if r.Scope() == model.ScopeMesh && opts.Mesh == "" {
 		return fmt.Errorf("ResourceStore.Create() requires options.Mesh to be a non-empty value")
 	}
 	return s.delegate.Create(ctx, r, fs...)
@@ -68,7 +68,7 @@ func (s *strictResourceStore) Delete(ctx context.Context, r model.Resource, fs .
 	if opts.Name == "" {
 		return fmt.Errorf("ResourceStore.Delete() requires options.Name to be a non-empty value")
 	}
-	if opts.Mesh == "" {
+	if r.Scope() == model.ScopeMesh && opts.Mesh == "" {
 		return fmt.Errorf("ResourceStore.Delete() requires options.Mesh to be a non-empty value")
 	}
 	if r.GetMeta() != nil {
@@ -92,7 +92,7 @@ func (s *strictResourceStore) Get(ctx context.Context, r model.Resource, fs ...G
 	if opts.Name == "" {
 		return fmt.Errorf("ResourceStore.Get() requires options.Name to be a non-empty value")
 	}
-	if opts.Mesh == "" {
+	if r.Scope() == model.ScopeMesh && opts.Mesh == "" {
 		return fmt.Errorf("ResourceStore.Get() requires options.Mesh to be a non-empty value")
 	}
 	return s.delegate.Get(ctx, r, fs...)
diff --git a/pkg/core/secrets/manager/validator.go b/pkg/core/secrets/manager/validator.go
index cf428b63a..d5b5a1ae1 100644
--- a/pkg/core/secrets/manager/validator.go
+++ b/pkg/core/secrets/manager/validator.go
@@ -10,6 +10,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core"
 	"github.com/kumahq/kuma/pkg/core/ca"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/core/validators"
 )
@@ -40,7 +41,7 @@ type secretValidator struct {
 
 func (s *secretValidator) ValidateDelete(ctx context.Context, name string, mesh string) error {
 	meshRes := &mesh_core.MeshResource{}
-	err := s.store.Get(ctx, meshRes, core_store.GetByKey(mesh, mesh))
+	err := s.store.Get(ctx, meshRes, core_store.GetByKey(mesh, model.NoMesh))
 	if err != nil {
 		return err
 	}
diff --git a/pkg/defaults/mesh.go b/pkg/defaults/mesh.go
index cac4a3904..98679a306 100644
--- a/pkg/defaults/mesh.go
+++ b/pkg/defaults/mesh.go
@@ -9,7 +9,6 @@ import (
 )
 
 var defaultMeshKey = core_model.ResourceKey{
-	Mesh: core_model.DefaultMesh,
 	Name: core_model.DefaultMesh,
 }
 
diff --git a/pkg/kds/global/components.go b/pkg/kds/global/components.go
index 3fb541e71..27535105e 100644
--- a/pkg/kds/global/components.go
+++ b/pkg/kds/global/components.go
@@ -83,12 +83,12 @@ func Setup(rt runtime.Runtime) (err error) {
 
 func createZoneIfAbsent(name string, resManager manager.ResourceManager) (*system.ZoneResource, error) {
 	zone := &system.ZoneResource{}
-	if err := resManager.Get(context.Background(), zone, store.GetByKey(name, model.DefaultMesh)); err != nil {
+	if err := resManager.Get(context.Background(), zone, store.GetByKey(name, model.NoMesh)); err != nil {
 		if !store.IsResourceNotFound(err) {
 			return nil, err
 		}
 		kdsGlobalLog.Info("creating zone", "name", name)
-		err := resManager.Create(context.Background(), zone, store.CreateByKey(name, model.DefaultMesh))
+		err := resManager.Create(context.Background(), zone, store.CreateByKey(name, model.NoMesh))
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/kds/server/status_sink.go b/pkg/kds/server/status_sink.go
index 762a6c6b0..13c766e94 100644
--- a/pkg/kds/server/status_sink.go
+++ b/pkg/kds/server/status_sink.go
@@ -83,7 +83,6 @@ type zoneInsightStore struct {
 
 func (s *zoneInsightStore) Upsert(zone string, subscription *system_proto.KDSSubscription) error {
 	key := core_model.ResourceKey{
-		Mesh: core_model.DefaultMesh,
 		Name: zone,
 	}
 	zoneInsight := &system.ZoneInsightResource{}
diff --git a/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_helpers.go b/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_helpers.go
index 33b96b0de..44ffc57ee 100644
--- a/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_helpers.go
+++ b/pkg/plugins/resources/k8s/native/api/v1alpha1/mesh_types_helpers.go
@@ -17,7 +17,7 @@ func (pt *Mesh) SetObjectMeta(m *metav1.ObjectMeta) {
 }
 
 func (pt *Mesh) GetMesh() string {
-	return pt.Name
+	return ""
 }
 
 func (pt *Mesh) SetMesh(mesh string) {
diff --git a/pkg/plugins/resources/memory/store.go b/pkg/plugins/resources/memory/store.go
index 727bb3bea..986d174ac 100644
--- a/pkg/plugins/resources/memory/store.go
+++ b/pkg/plugins/resources/memory/store.go
@@ -7,12 +7,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
-
 	"github.com/kumahq/kuma/pkg/core/resources/registry"
 
-	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
-
 	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
@@ -93,12 +89,6 @@ func (c *memoryStore) Create(_ context.Context, r model.Resource, fs ...store.Cr
 	defer c.mu.Unlock()
 
 	opts := store.NewCreateOptions(fs...)
-	switch r.GetType() {
-	case mesh.MeshType:
-		opts.Mesh = opts.Name
-	case system.ZoneType:
-		opts.Mesh = "default"
-	}
 	// Name must be provided via CreateOptions
 	if _, record := c.findRecord(string(r.GetType()), opts.Name, opts.Mesh); record != nil {
 		return store.ErrorResourceAlreadyExists(r.GetType(), opts.Name, opts.Mesh)
@@ -214,12 +204,6 @@ func (c *memoryStore) Get(_ context.Context, r model.Resource, fs ...store.GetOp
 	defer c.mu.RUnlock()
 
 	opts := store.NewGetOptions(fs...)
-	switch r.GetType() {
-	case mesh.MeshType:
-		opts.Mesh = opts.Name
-	case system.ZoneType:
-		opts.Mesh = "default"
-	}
 	// Name must be provided via GetOptions
 	_, record := c.findRecord(string(r.GetType()), opts.Name, opts.Mesh)
 	if record == nil {
diff --git a/pkg/plugins/resources/postgres/migrations/data/1604501001_adjust_global_resources.up.sql b/pkg/plugins/resources/postgres/migrations/data/1604501001_adjust_global_resources.up.sql
new file mode 100644
index 000000000..28c0d249e
--- /dev/null
+++ b/pkg/plugins/resources/postgres/migrations/data/1604501001_adjust_global_resources.up.sql
@@ -0,0 +1,6 @@
+-- Global resources (Mesh and Zone for now) needs to have an empty value in mesh column. This migration updates those resources
+ALTER TABLE resources DROP CONSTRAINT owner_fk; -- drop constraint so we can update resources;
+UPDATE resources SET mesh = '' WHERE type = 'Mesh' OR type = 'Zone';
+UPDATE resources SET owner_mesh = '' WHERE owner_type = 'Mesh' OR owner_type = 'Zone';
+ALTER TABLE resources ADD CONSTRAINT owner_fk FOREIGN KEY (owner_name, owner_mesh, owner_type) REFERENCES resources (name, mesh, type) ON DELETE CASCADE; -- apply the constraint again;
+
diff --git a/pkg/plugins/resources/postgres/migrations/migrations_vfsdata.go b/pkg/plugins/resources/postgres/migrations/migrations_vfsdata.go
index badfdf777..e29f18fc5 100644
--- a/pkg/plugins/resources/postgres/migrations/migrations_vfsdata.go
+++ b/pkg/plugins/resources/postgres/migrations/migrations_vfsdata.go
@@ -21,35 +21,42 @@ var Migrations = func() http.FileSystem {
 	fs := vfsgen۰FS{
 		"/": &vfsgen۰DirInfo{
 			name:    "/",
-			modTime: time.Date(2020, 6, 15, 14, 49, 38, 390867092, time.UTC),
+			modTime: time.Date(2020, 11, 4, 15, 9, 0, 681114736, time.UTC),
 		},
 		"/1579518998_create_resources.up.sql": &vfsgen۰CompressedFileInfo{
 			name:             "1579518998_create_resources.up.sql",
-			modTime:          time.Date(2020, 4, 2, 12, 24, 0, 540178165, time.UTC),
+			modTime:          time.Date(2020, 7, 13, 13, 16, 3, 35337832, time.UTC),
 			uncompressedSize: 299,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x8c\x8e\x4f\x0b\x82\x40\x10\x47\xef\x7e\x8a\xdf\x51\x61\x0f\x76\xee\x64\xb1\x81\x64\x16\xba\x41\x1e\x97\x65\x48\x0f\xea\xb2\xb3\x49\x7d\xfb\x68\xfb\x07\x1d\xc2\x39\x0e\x6f\xde\xbc\x75\x25\x33\x25\xa1\xb2\x55\x21\x91\x6f\x50\xee\x15\xe4\x29\xaf\x55\x0d\x47\x3c\x5e\x9c\x21\x46\x1c\x01\xc0\xa0\x7b\xc2\x6b\x26\xed\x4c\xab\x5d\xbc\x48\xd3\x24\xdc\x94\xc7\xa2\x10\x1f\x8c\xad\x36\xf4\x1f\xeb\x89\xdb\x19\x36\x7f\xb3\x73\x9e\x4e\xe4\xb8\x1b\x87\x80\x75\x83\xa7\x33\xb9\x1f\x82\x2d\x99\xb7\xc8\xd3\xd5\x3f\xb7\x87\x2a\xdf\x65\x55\x83\xad\x6c\x10\x3f\xca\xc5\xb7\x5f\x84\x46\x11\x12\x92\x28\x59\xde\x03\x00\x00\xff\xff\x88\x1c\x8d\x52\x2b\x01\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x8c\x8e\x4f\x0b\x82\x40\x10\x47\xef\x7e\x8a\xdf\x51\x61\x0f\x76\xee\x64\xb1\x81\x64\x16\xba\x41\x1e\x97\x65\x48\x0f\xea\xb2\xb3\x49\x7d\xfb\x68\xfb\x07\x1d\xc2\x39\x0e\x6f\xde\xbc\x75\x25\x33\x25\xa1\xb2\x55\x21\x91\x6f\x50\xee\x15\xe4\x29\xaf\x55\x0d\x47\x3c\x5e\x9c\x21\x46\x1c\x01\xc0\xa0\x7b\xc2\x6b\x26\xed\x4c\xab\x5d\xbc\x48\xd3\x24\xdc\x94\xc7\xa2\x10\x1f\x8c\xad\x36\xf4\x1f\xeb\x89\xdb\x19\x36\x7f\xb3\x73\x9e\x4e\xe4\xb8\x1b\x87\x80\x75\x83\xa7\x33\xb9\x1f\x82\x2d\x99\xb7\xc8\xd3\xd5\x3f\xb7\x87\x2a\xdf\x65\x55\x83\xad\x6c\x10\x3f\xca\xc5\xb7\x5f\x84\x46\x11\x12\x92\x28\x59\xde\x03\x00\x00\xff\xff\x88\x1c\x8d\x52\x2b\x01\x00\x00"),
 		},
 		"/1580128050_add_creation_modification_time.up.sql": &vfsgen۰CompressedFileInfo{
 			name:             "1580128050_add_creation_modification_time.up.sql",
-			modTime:          time.Date(2020, 4, 2, 12, 24, 0, 540282811, time.UTC),
+			modTime:          time.Date(2020, 7, 13, 13, 16, 3, 35430740, time.UTC),
 			uncompressedSize: 165,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x72\xf4\x09\x71\x0d\x52\x08\x71\x74\xf2\x71\x55\x28\x4a\x2d\xce\x2f\x2d\x4a\x4e\x2d\x56\x70\x74\x71\x51\x70\xf6\xf7\x09\xf5\xf5\x53\x48\x2e\x4a\x4d\x2c\xc9\xcc\xcf\x8b\x2f\xc9\xcc\x4d\x55\x08\xf1\xf4\x75\x0d\x0e\x71\xf4\x0d\x50\xf0\xf3\x0f\x51\xf0\x0b\xf5\xf1\x51\x70\x71\x75\x73\x0c\xf5\x09\x51\xc8\xcb\x2f\xd7\xd0\xb4\xe6\x22\x68\x60\x6e\x7e\x4a\x66\x5a\x66\x32\x29\x86\x02\x02\x00\x00\xff\xff\x56\x69\x01\xb8\xa5\x00\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x72\xf4\x09\x71\x0d\x52\x08\x71\x74\xf2\x71\x55\x28\x4a\x2d\xce\x2f\x2d\x4a\x4e\x2d\x56\x70\x74\x71\x51\x70\xf6\xf7\x09\xf5\xf5\x53\x48\x2e\x4a\x4d\x2c\xc9\xcc\xcf\x8b\x2f\xc9\xcc\x4d\x55\x08\xf1\xf4\x75\x0d\x0e\x71\xf4\x0d\x50\xf0\xf3\x0f\x51\xf0\x0b\xf5\xf1\x51\x70\x71\x75\x73\x0c\xf5\x09\x51\xc8\xcb\x2f\xd7\xd0\xb4\xe6\x22\x68\x60\x6e\x7e\x4a\x66\x5a\x66\x32\x29\x86\x02\x02\x00\x00\xff\xff\x56\x69\x01\xb8\xa5\x00\x00\x00"),
 		},
 		"/1589041445_add_unique_id_and_owner.up.sql": &vfsgen۰CompressedFileInfo{
 			name:             "1589041445_add_unique_id_and_owner.up.sql",
-			modTime:          time.Date(2020, 5, 12, 16, 39, 56, 292245031, time.UTC),
+			modTime:          time.Date(2020, 7, 13, 13, 16, 3, 35527816, time.UTC),
 			uncompressedSize: 973,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x9c\x91\xc1\x6e\xdb\x30\x10\x44\xef\xfc\x8a\xe9\xc9\x31\x20\x17\x71\xae\x46\x0e\xac\x49\xb7\x42\x25\xca\xa0\x64\x14\x39\x05\x84\xb2\xb1\x8c\x28\x92\x40\x2a\x4d\xf3\xf7\x85\x28\xa5\x66\x52\xd7\x45\x7b\xdd\xe5\xec\xbc\x19\xf2\xa4\x90\x1a\x05\xff\x94\x48\x58\x72\xed\x93\x2d\xc9\x31\x00\x10\x3a\xdb\x62\x9d\xa9\xbc\xd0\x3c\x56\xc5\x71\x7b\xdb\x3d\xd0\x4b\xe4\xdf\x70\x21\xfe\xfc\x04\x5b\x1d\xa7\x5c\xdf\xe0\xab\xbc\xc1\x45\x63\x1e\x29\xc2\x23\xb9\x2a\x42\xff\xd2\xd1\x7c\xc5\xfe\xea\x9d\xec\x52\x85\x41\xe8\x3a\x53\xd2\x39\xc1\x08\xe2\xdf\xb7\xcf\x0d\xd9\xdb\x41\x85\xef\xc6\x96\x95\xb1\x17\xcb\xcb\xcb\xb3\x76\xbf\xa9\x07\xcc\xff\x57\x0f\xf1\xfe\x51\xfd\xab\xc2\xf1\xc2\xfd\x03\x36\x99\x96\xf1\x67\x35\x96\x77\xcc\x14\x05\x84\x51\xe0\x37\x87\x96\x1b\xa9\xa5\x5a\xcb\xfc\xe8\x70\xa2\x76\x64\x0a\x42\x26\xb2\x90\x58\xf3\x7c\xcd\x85\x5c\x31\x36\x0e\xd8\x46\x67\x69\x80\xf7\xed\x8b\xd4\xd2\xab\x70\x8d\x99\x30\xbd\xe9\x6a\xd3\x50\xdc\xb8\xc3\xbe\xea\x67\x2b\xc6\x16\x0b\x38\xea\x47\x0c\xdc\xb7\x16\xa6\xae\x03\x77\xfa\x51\x52\xd7\x23\x25\x57\xb1\xdd\x56\xf0\x22\x08\x0f\xbb\x64\xb9\x2c\xc2\xef\xba\x86\xbd\xfa\xe8\x81\x7d\x33\xc1\x57\xf8\x8d\x0f\x11\x6c\x5e\xc1\x86\xf3\xb3\x77\xec\xb0\x57\x13\xfe\x74\x72\x38\xb1\xf4\x27\x18\xc0\x95\x18\xe6\x6f\x0f\x4c\xe3\xe5\x38\xfe\xf0\x3a\xf7\x29\x17\xb8\xa3\x9a\x7a\xc2\x9d\x69\xf6\xf5\xa1\xd9\x87\x15\xb7\x0d\x39\x3c\x1f\xfa\xaa\x7d\x9a\xaa\x98\x9f\x2d\x34\x48\x1c\xe7\x50\xbb\x24\x99\xbc\x83\xc0\xa7\x16\x9e\xeb\xed\xe2\x1d\xea\xcf\x00\x00\x00\xff\xff\x17\x5c\x38\xd4\xcd\x03\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x9c\x91\x51\x4f\xdb\x30\x14\x85\xdf\xfd\x2b\xce\x9e\x4a\xa5\x74\xa2\xbc\x56\x3c\x78\xb1\xbb\x45\x4b\x9c\xca\x49\x35\xf1\x84\xac\x70\x69\x2a\x42\x12\xd9\x61\x8c\x7f\x3f\xc5\x09\xab\x41\x8c\x89\xbd\xde\xeb\x73\xee\x77\x8e\x79\x5a\x4a\x8d\x92\x7f\x49\x25\x2c\xb9\xee\xc1\x56\xe4\x18\x00\x08\x9d\xef\x10\xe7\xaa\x28\x35\x4f\x54\x79\xda\x5e\xf7\x77\xf4\x14\xf9\x37\x5c\x88\xbf\x3f\xc1\x4e\x27\x19\xd7\x57\xf8\x2e\xaf\x70\xd6\x9a\x7b\x8a\x70\x4f\xae\x8e\x30\x3c\xf5\xb4\xdc\xb0\x7f\xde\x4e\xf7\x99\xc2\x28\x74\xbd\xa9\xe8\x3d\xc1\x04\xe2\xdf\x77\x8f\x2d\xd9\xeb\x51\x85\x9f\xc6\x56\xb5\xb1\x67\xeb\xf3\xf3\xe5\x87\xd4\x23\xe6\xff\xab\xc7\x78\x1f\x54\xff\xa9\x70\x72\xb8\xbd\xc3\x36\xd7\x32\xf9\xaa\xa6\xf2\x4e\x99\xa2\x80\x30\x0a\xee\x2d\xa1\xe5\x56\x6a\xa9\x62\x59\x9c\x2e\xbc\x51\x3b\x72\x05\x21\x53\x59\x4a\xc4\xbc\x88\xb9\x90\x1b\xc6\xa6\x01\xdb\xea\x3c\x0b\xf0\x7e\x7c\x93\x5a\x7a\x15\x2e\xb1\x10\x66\x30\x7d\x63\x5a\x4a\x5a\x77\x3c\xd4\xc3\x62\xc3\xd8\x6a\x05\x47\xc3\x84\x81\xdb\xce\xc2\x34\x4d\x70\x9d\x7e\x55\xd4\x0f\xc8\xc8\xd5\x6c\xbf\x13\xbc\x0c\xc2\xc3\xae\x59\x21\xcb\xf0\xbb\x2e\x61\x2f\x3e\x7b\x60\xdf\x4c\xf0\x15\x7e\xe3\x43\x04\x9b\x67\xb0\xd1\x7e\xf1\x8a\x1d\xf6\x62\xc6\x9f\x2d\x47\x8b\xb5\xb7\x60\x00\x57\x62\x9c\xbf\x34\x98\xc7\xeb\x69\xfc\xe9\x79\xee\x53\xae\x70\x43\x0d\x0d\x84\x1b\xd3\x1e\x9a\x63\x7b\x08\x2b\xee\x5a\x72\x78\x3c\x0e\x75\xf7\x30\x57\xb1\x7c\xb7\xd0\x20\x71\x52\x40\xed\xd3\x74\xbe\x1d\x04\x7e\x6b\xe1\xb9\x5e\x2e\x5e\xa1\xfe\x0e\x00\x00\xff\xff\x17\x5c\x38\xd4\xcd\x03\x00\x00"),
 		},
 		"/1592232449_add_leader_table.up.sql": &vfsgen۰CompressedFileInfo{
 			name:             "1592232449_add_leader_table.up.sql",
-			modTime:          time.Date(2020, 6, 15, 14, 49, 38, 390783584, time.UTC),
+			modTime:          time.Date(2020, 7, 13, 13, 16, 3, 35623294, time.UTC),
 			uncompressedSize: 217,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\x8e\x31\xab\xc2\x30\x1c\xc4\xf7\x7c\x8a\x1b\x5b\x78\xbc\xe1\x41\xa7\x4e\x49\xde\x9f\x1a\xd4\xa8\x31\x2a\x99\x4a\x6d\x33\x88\x36\x81\x54\xeb\xd7\x17\x6c\x47\x1d\xef\xf8\x71\xf7\x93\x86\xb8\x25\x58\x2e\x56\x84\x5b\x6c\xaf\x03\x32\x06\x00\xa1\xe9\x3d\xe4\x82\x1b\x2e\x2d\x19\x1c\xb9\x71\x4a\x57\xd9\x5f\x51\xe4\xd8\x1a\xb5\xe6\xc6\x61\x49\xee\xe7\x0d\x27\xdf\xc6\xd4\xd5\xa3\x4f\xc3\x25\x86\x3a\x3c\xfa\xb3\x4f\x10\xaa\x52\xda\x4e\x44\xd7\xdc\x1b\x08\x67\x89\x4f\x39\x3e\x83\x4f\x5f\xf6\x59\x5e\x32\x36\x8b\xed\x69\x77\x20\x2d\x67\xb7\x3a\x8d\x01\x9b\x93\xa6\x7f\x08\x37\x55\xbf\x1f\xbf\x4b\xf6\x0a\x00\x00\xff\xff\x9b\x4e\x1b\xbc\xd9\x00\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x74\x8e\x31\xab\xc2\x30\x1c\xc4\xf7\x7c\x8a\x1b\x5b\x78\xbc\xe1\x41\xa7\x4e\x49\xde\x9f\x1a\xd4\xa8\x31\x2a\x99\x4a\x6d\x33\x88\x36\x81\x54\xeb\xd7\x17\x6c\x47\x1d\xef\xf8\x71\xf7\x93\x86\xb8\x25\x58\x2e\x56\x84\x5b\x6c\xaf\x03\x32\x06\x00\xa1\xe9\x3d\xe4\x82\x1b\x2e\x2d\x19\x1c\xb9\x71\x4a\x57\xd9\x5f\x51\xe4\xd8\x1a\xb5\xe6\xc6\x61\x49\xee\xe7\x0d\x27\xdf\xc6\xd4\xd5\xa3\x4f\xc3\x25\x86\x3a\x3c\xfa\xb3\x4f\x10\xaa\x52\xda\x4e\x44\xd7\xdc\x1b\x08\x67\x89\x4f\x39\x3e\x83\x4f\x5f\xf6\x59\x5e\x32\x36\x8b\xed\x69\x77\x20\x2d\x67\xb7\x3a\x8d\x01\x9b\x93\xa6\x7f\x08\x37\x55\xbf\x1f\xbf\x4b\xf6\x0a\x00\x00\xff\xff\x9b\x4e\x1b\xbc\xd9\x00\x00\x00"),
+		},
+		"/1604501001_adjust_global_resources.up.sql": &vfsgen۰CompressedFileInfo{
+			name:             "1604501001_adjust_global_resources.up.sql",
+			modTime:          time.Date(2020, 11, 4, 15, 9, 0, 681031205, time.UTC),
+			uncompressedSize: 565,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x74\x91\x41\x6f\xab\x30\x10\x84\xef\xfc\x8a\xb9\x91\x48\xe1\xfd\x81\xe8\x1d\x78\xb0\xc9\x8b\x9a\x42\x64\x5c\x55\xed\xa5\x72\x61\x13\x50\xc1\x46\xd8\x24\xca\xbf\xaf\x28\x6d\x43\xdb\xf4\xe8\xd1\xee\x37\x33\xeb\x20\xc0\xba\x36\xcf\xaa\x46\xc7\xd6\xf4\x5d\xce\x16\xb3\x5b\xb6\x25\x94\x2e\xf0\x68\x34\x63\x6f\x3a\x68\x73\x9a\x43\x33\x17\x16\xce\xa0\x54\x47\x86\xd2\xe0\xa6\x75\x67\x1c\x55\xdd\x33\x2a\x8d\x66\x58\xcb\x4d\xdd\x37\xfa\x0f\x64\x59\x59\x34\xd5\xa1\x53\xae\x32\x1a\x7d\x5b\x28\xc7\x16\xae\x34\x96\x2f\x5e\x5e\xb8\x95\x24\x20\xc3\x7f\x5b\x9a\x24\x88\x45\xba\x43\x94\x26\x99\x14\xe1\x26\x91\x30\x27\xcd\xdd\xd3\xfe\x65\x89\x20\x40\xd1\x99\x16\xb9\xd1\xd6\x75\xaa\xd2\x0e\xd6\xe0\xc4\xc8\xd5\x87\xc9\x85\xb3\xf4\xee\x76\x71\x28\xa7\xe4\x8c\xe4\x98\xf3\x2f\x7c\x1f\xf7\xff\x49\x10\xdc\xb9\xe5\xe1\x3d\xd4\xf6\x91\x8a\x4f\x61\xa8\xef\xff\x02\x19\x23\x7d\x47\x8d\xea\x0f\xe0\x57\xf9\x1d\x7b\xbd\x7a\x18\xc7\xd7\x9a\x63\x95\x0a\xda\xac\x13\xdc\xd0\x03\x66\xa3\xaa\x55\xc3\x8b\x49\x90\xc5\xc4\x67\x0e\x41\x2b\x12\x94\x44\x94\x4d\xbf\x76\xdc\x19\xa7\xc7\xb9\x34\x41\x4c\x5b\x92\x84\x28\xcc\xa2\x30\xa6\xb7\x23\xab\xb6\xad\xcf\x70\x25\x4f\x2f\xad\x0e\xaa\xd2\x4b\xcf\x7b\x0d\x00\x00\xff\xff\xfc\xc8\xa8\xa1\x35\x02\x00\x00"),
 		},
 	}
 	fs["/"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
@@ -57,6 +64,7 @@ var Migrations = func() http.FileSystem {
 		fs["/1580128050_add_creation_modification_time.up.sql"].(os.FileInfo),
 		fs["/1589041445_add_unique_id_and_owner.up.sql"].(os.FileInfo),
 		fs["/1592232449_add_leader_table.up.sql"].(os.FileInfo),
+		fs["/1604501001_adjust_global_resources.up.sql"].(os.FileInfo),
 	}
 
 	return fs
diff --git a/pkg/sds/provider/ca/provider.go b/pkg/sds/provider/ca/provider.go
index e88f539df..b356cbb12 100644
--- a/pkg/sds/provider/ca/provider.go
+++ b/pkg/sds/provider/ca/provider.go
@@ -8,6 +8,7 @@ import (
 	core_ca "github.com/kumahq/kuma/pkg/core/ca"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	sds_provider "github.com/kumahq/kuma/pkg/sds/provider"
 )
@@ -32,7 +33,7 @@ func (s *meshCaProvider) Get(ctx context.Context, resource string, requestor sds
 	meshName := requestor.Mesh
 
 	meshRes := &core_mesh.MeshResource{}
-	if err := s.resourceManager.Get(ctx, meshRes, core_store.GetByKey(meshName, meshName)); err != nil {
+	if err := s.resourceManager.Get(ctx, meshRes, core_store.GetByKey(meshName, model.NoMesh)); err != nil {
 		return nil, errors.Wrapf(err, "failed to find a Mesh %q", meshName)
 	}
 
diff --git a/pkg/sds/provider/identity/provider.go b/pkg/sds/provider/identity/provider.go
index 053026147..4139ece1d 100644
--- a/pkg/sds/provider/identity/provider.go
+++ b/pkg/sds/provider/identity/provider.go
@@ -8,6 +8,7 @@ import (
 	core_ca "github.com/kumahq/kuma/pkg/core/ca"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	sds_provider "github.com/kumahq/kuma/pkg/sds/provider"
 )
@@ -32,7 +33,7 @@ func (s *identityCertProvider) Get(ctx context.Context, name string, requestor s
 	meshName := requestor.Mesh
 
 	meshRes := &core_mesh.MeshResource{}
-	if err := s.resourceManager.Get(ctx, meshRes, core_store.GetByKey(meshName, meshName)); err != nil {
+	if err := s.resourceManager.Get(ctx, meshRes, core_store.GetByKey(meshName, model.NoMesh)); err != nil {
 		return nil, errors.Wrapf(err, "failed to find a Mesh %q", meshName)
 	}
 
diff --git a/pkg/sds/server/reconciler.go b/pkg/sds/server/reconciler.go
index c1876bc38..68592dc8a 100644
--- a/pkg/sds/server/reconciler.go
+++ b/pkg/sds/server/reconciler.go
@@ -67,7 +67,7 @@ func (d *DataplaneReconciler) Reconcile(dataplaneId core_model.ResourceKey) erro
 	}
 
 	mesh := &mesh_core.MeshResource{}
-	if err := d.readOnlyResManager.Get(context.Background(), mesh, core_store.GetByKey(dataplane.GetMeta().GetMesh(), dataplane.GetMeta().GetMesh())); err != nil {
+	if err := d.readOnlyResManager.Get(context.Background(), mesh, core_store.GetByKey(dataplane.GetMeta().GetMesh(), core_model.NoMesh)); err != nil {
 		return errors.Wrap(err, "could not retrieve a mesh")
 	}
 
diff --git a/pkg/xds/bootstrap/generator.go b/pkg/xds/bootstrap/generator.go
index 9fb76b846..25af96b89 100644
--- a/pkg/xds/bootstrap/generator.go
+++ b/pkg/xds/bootstrap/generator.go
@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"text/template"
 
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/validators"
 
@@ -117,7 +118,7 @@ func (b *bootstrapGenerator) dataplaneFor(ctx context.Context, request types.Boo
 }
 
 func (b *bootstrapGenerator) validateMeshExist(ctx context.Context, mesh string) error {
-	if err := b.resManager.Get(ctx, &core_mesh.MeshResource{}, core_store.GetByKey(mesh, mesh)); err != nil {
+	if err := b.resManager.Get(ctx, &core_mesh.MeshResource{}, core_store.GetByKey(mesh, model.NoMesh)); err != nil {
 		if core_store.IsResourceNotFound(err) {
 			verr := validators.ValidationError{}
 			verr.AddViolation("mesh", fmt.Sprintf("mesh %q does not exist", mesh))
diff --git a/pkg/xds/cache/cla/cache.go b/pkg/xds/cache/cla/cache.go
index 7627d1aa8..9cef4108c 100644
--- a/pkg/xds/cache/cla/cache.go
+++ b/pkg/xds/cache/cla/cache.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/prometheus/client_golang/prometheus"
 
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/metrics"
 
 	envoy_api_v2 "github.com/envoyproxy/go-control-plane/envoy/api/v2"
@@ -78,7 +79,7 @@ func (c *Cache) GetCLA(ctx context.Context, meshName, service string) (*envoy_ap
 			return nil, err
 		}
 		mesh := &core_mesh.MeshResource{}
-		if err := c.rm.Get(ctx, mesh, core_store.GetByKey(meshName, meshName)); err != nil {
+		if err := c.rm.Get(ctx, mesh, core_store.GetByKey(meshName, model.NoMesh)); err != nil {
 			return nil, err
 		}
 		externalServices := &core_mesh.ExternalServiceResourceList{}
diff --git a/pkg/xds/cache/mesh/snapshot.go b/pkg/xds/cache/mesh/snapshot.go
index 5fd247f1e..a4c15efa4 100644
--- a/pkg/xds/cache/mesh/snapshot.go
+++ b/pkg/xds/cache/mesh/snapshot.go
@@ -29,7 +29,7 @@ func GetMeshSnapshot(ctx context.Context, meshName string, rm manager.ReadOnlyRe
 	}
 
 	mesh := &core_mesh.MeshResource{}
-	if err := rm.Get(ctx, mesh, core_store.GetByKey(meshName, meshName)); err != nil {
+	if err := rm.Get(ctx, mesh, core_store.GetByKey(meshName, core_model.NoMesh)); err != nil {
 		return nil, err
 	}
 	snapshot.mesh = mesh
diff --git a/pkg/xds/generator/outbound_proxy_generator.go b/pkg/xds/generator/outbound_proxy_generator.go
index d85433305..e2aab7dac 100644
--- a/pkg/xds/generator/outbound_proxy_generator.go
+++ b/pkg/xds/generator/outbound_proxy_generator.go
@@ -152,7 +152,7 @@ func (o OutboundProxyGenerator) generateCDS(ctx xds_context.Context, proxy *mode
 		}
 		edsCluster, err := edsClusterBuilder.Build()
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrapf(err, "build CDS for cluster %s failed", clusterName)
 		}
 		resources.Add(&model.Resource{
 			Name:     clusterName,
@@ -184,9 +184,9 @@ func (_ OutboundProxyGenerator) generateEDS(ctx xds_context.Context, proxy *mode
 		// We are not allowed to add endpoints with DNS names through EDS.
 		if !clusters.Get(clusterName).HasExternalService() {
 			serviceName := clusters.Tags(clusterName)[0][kuma_mesh.ServiceTag]
-			loadAssignment, err := proxy.CLACache.GetCLA(context.Background(), ctx.Mesh.Resource.Meta.GetMesh(), serviceName)
+			loadAssignment, err := proxy.CLACache.GetCLA(context.Background(), ctx.Mesh.Resource.Meta.GetName(), serviceName)
 			if err != nil {
-				return nil, err
+				return nil, errors.Wrapf(err, "could not get ClusterLoadAssingment for %s", serviceName)
 			}
 			resources.Add(&model.Resource{
 				Name:     clusterName,
diff --git a/pkg/xds/generator/resource_generator.go b/pkg/xds/generator/resource_generator.go
index 5d1aadaaa..8b075515f 100644
--- a/pkg/xds/generator/resource_generator.go
+++ b/pkg/xds/generator/resource_generator.go
@@ -1,6 +1,8 @@
 package generator
 
 import (
+	"github.com/pkg/errors"
+
 	model "github.com/kumahq/kuma/pkg/core/xds"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 )
@@ -16,7 +18,7 @@ func (c CompositeResourceGenerator) Generate(ctx xds_context.Context, proxy *mod
 	for _, gen := range c {
 		rs, err := gen.Generate(ctx, proxy)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrapf(err, "%T failed", gen)
 		}
 		resources.AddSet(rs)
 	}
diff --git a/pkg/xds/server/components.go b/pkg/xds/server/components.go
index b1e190f27..3368f4f6a 100644
--- a/pkg/xds/server/components.go
+++ b/pkg/xds/server/components.go
@@ -260,7 +260,7 @@ func DefaultDataplaneSyncTracker(rt core_runtime.Runtime, reconciler, ingressRec
 				prevHash = snapshotHash
 
 				mesh := &core_mesh.MeshResource{}
-				if err := rt.ReadOnlyResourceManager().Get(ctx, mesh, core_store.GetByKey(proxyID.Mesh, proxyID.Mesh)); err != nil {
+				if err := rt.ReadOnlyResourceManager().Get(ctx, mesh, core_store.GetByKey(proxyID.Mesh, core_model.NoMesh)); err != nil {
 					return err
 				}
 


Test patch:
diff --git a/app/kuma-dp/pkg/config/validate_test.go b/app/kuma-dp/pkg/config/validate_test.go
index a412038f8..904ab1d06 100644
--- a/app/kuma-dp/pkg/config/validate_test.go
+++ b/app/kuma-dp/pkg/config/validate_test.go
@@ -46,7 +46,7 @@ var _ = Describe("ValidateTokenPath", func() {
 		err := config.ValidateTokenPath("nonexistingfile")
 
 		// then
-		Expect(err).To(MatchError("could not read file: stat nonexistingfile: no such file or directory"))
+		Expect(err).To(MatchError("could not read file nonexistingfile: stat nonexistingfile: no such file or directory"))
 	})
 
 	It("should fail for empty file", func() {
@@ -56,4 +56,19 @@ var _ = Describe("ValidateTokenPath", func() {
 		// then
 		Expect(err).To(MatchError(fmt.Sprintf("token under file %s is empty", tokenFile.Name())))
 	})
+
+	It("should fail for invalid token", func() {
+		// setup
+		invalidTokenFile, err := ioutil.TempFile("", "")
+		Expect(err).ToNot(HaveOccurred())
+
+		_, err = invalidTokenFile.Write([]byte("invalid.token.file"))
+		Expect(err).ToNot(HaveOccurred())
+
+		// when
+		err = config.ValidateTokenPath(invalidTokenFile.Name())
+
+		// then
+		Expect(err).To(HaveOccurred())
+	})
 })
diff --git a/app/kumactl/cmd/apply/apply_test.go b/app/kumactl/cmd/apply/apply_test.go
index 1d2bae9d6..7e3da16b9 100644
--- a/app/kumactl/cmd/apply/apply_test.go
+++ b/app/kumactl/cmd/apply/apply_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 
 	"github.com/kumahq/kuma/api/mesh/v1alpha1"
 	"github.com/kumahq/kuma/app/kumactl/cmd"
@@ -187,7 +188,7 @@ var _ = Describe("kumactl apply", func() {
 
 		// then
 		Expect(resource.Meta.GetName()).To(Equal("sample"))
-		Expect(resource.Meta.GetMesh()).To(Equal("sample"))
+		Expect(resource.Meta.GetMesh()).To(Equal(core_model.NoMesh))
 	})
 
 	It("should apply a Secret resource", func() {
@@ -274,7 +275,7 @@ var _ = Describe("kumactl apply", func() {
 
 		// then
 		Expect(resource.Meta.GetName()).To(Equal("meshinit"))
-		Expect(resource.Meta.GetMesh()).To(Equal("meshinit"))
+		Expect(resource.Meta.GetMesh()).To(Equal(core_model.NoMesh))
 	})
 
 	It("should apply multiple resources of same type", func() {
diff --git a/app/kumactl/cmd/delete/delete_meshes_test.go b/app/kumactl/cmd/delete/delete_meshes_test.go
index f2692fbc4..33bd3afb3 100644
--- a/app/kumactl/cmd/delete/delete_meshes_test.go
+++ b/app/kumactl/cmd/delete/delete_meshes_test.go
@@ -25,13 +25,11 @@ var _ = Describe("kumactl delete mesh", func() {
 	sampleMeshes := []*mesh.MeshResource{
 		{
 			Meta: &test_model.ResourceMeta{
-				Mesh: "mesh1",
 				Name: "mesh1",
 			},
 		},
 		{
 			Meta: &test_model.ResourceMeta{
-				Mesh: "mesh2",
 				Name: "mesh2",
 			},
 		},
@@ -127,13 +125,13 @@ var _ = Describe("kumactl delete mesh", func() {
 
 			By("verifying that resource under test was actually deleted")
 			// when
-			err = store.Get(context.Background(), &mesh.MeshResource{}, core_store.GetBy(core_model.ResourceKey{Mesh: "mesh2", Name: "mesh2"}))
+			err = store.Get(context.Background(), &mesh.MeshResource{}, core_store.GetBy(core_model.ResourceKey{Name: "mesh2"}))
 			// then
 			Expect(core_store.IsResourceNotFound(err)).To(BeTrue())
 
 			By("verifying that another mesh wasn't affected")
 			// when
-			err = store.Get(context.Background(), &mesh.MeshResource{}, core_store.GetBy(core_model.ResourceKey{Mesh: "mesh1", Name: "mesh1"}))
+			err = store.Get(context.Background(), &mesh.MeshResource{}, core_store.GetBy(core_model.ResourceKey{Name: "mesh1"}))
 			// then
 			Expect(err).ToNot(HaveOccurred())
 		})
diff --git a/app/kumactl/cmd/get/get_meshes_test.go b/app/kumactl/cmd/get/get_meshes_test.go
index be3ac7e97..a4c2df983 100644
--- a/app/kumactl/cmd/get/get_meshes_test.go
+++ b/app/kumactl/cmd/get/get_meshes_test.go
@@ -106,7 +106,6 @@ var _ = Describe("kumactl get meshes", func() {
 				},
 			},
 			Meta: &test_model.ResourceMeta{
-				Mesh: "mesh1",
 				Name: "mesh1",
 			},
 		},
@@ -123,7 +122,6 @@ var _ = Describe("kumactl get meshes", func() {
 				},
 			},
 			Meta: &test_model.ResourceMeta{
-				Mesh: "mesh2",
 				Name: "mesh2",
 			},
 		},
diff --git a/pkg/api-server/auth_test.go b/pkg/api-server/auth_test.go
index 3df752360..aa06e2b4e 100644
--- a/pkg/api-server/auth_test.go
+++ b/pkg/api-server/auth_test.go
@@ -151,7 +151,9 @@ func getExternalIP() string {
 		return ""
 	}
 	for _, address := range addrs {
-		if ipnet, ok := address.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
+		if ipnet, ok := address.(*net.IPNet); ok &&
+			!ipnet.IP.IsLoopback() &&
+			ipnet.IP.To4() != nil {
 			return ipnet.IP.String()
 		}
 	}
diff --git a/pkg/api-server/circuit_breaker_endpoints_test.go b/pkg/api-server/circuit_breaker_endpoints_test.go
index d754e6c5b..369467d0e 100644
--- a/pkg/api-server/circuit_breaker_endpoints_test.go
+++ b/pkg/api-server/circuit_breaker_endpoints_test.go
@@ -14,6 +14,7 @@ import (
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	"github.com/kumahq/kuma/pkg/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
@@ -55,7 +56,7 @@ var _ = Describe("CircuitBreaker Endpoints", func() {
 
 	BeforeEach(func() {
 		// when
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		// then
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/pkg/api-server/dataplane_overview_endpoints_test.go b/pkg/api-server/dataplane_overview_endpoints_test.go
index d71b9b425..557263c0c 100644
--- a/pkg/api-server/dataplane_overview_endpoints_test.go
+++ b/pkg/api-server/dataplane_overview_endpoints_test.go
@@ -15,6 +15,7 @@ import (
 	api_server "github.com/kumahq/kuma/pkg/api-server"
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
@@ -49,7 +50,7 @@ var _ = Describe("Dataplane Overview Endpoints", func() {
 	})
 
 	BeforeEach(func() {
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("mesh1", "mesh1"), store.CreatedAt(t1))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("mesh1", model.NoMesh), store.CreatedAt(t1))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/pkg/api-server/fault_injection_endpoints_test.go b/pkg/api-server/fault_injection_endpoints_test.go
index 89e592830..4a91905dc 100644
--- a/pkg/api-server/fault_injection_endpoints_test.go
+++ b/pkg/api-server/fault_injection_endpoints_test.go
@@ -14,6 +14,7 @@ import (
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	"github.com/kumahq/kuma/pkg/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
@@ -55,7 +56,7 @@ var _ = Describe("FaultInjection Endpoints", func() {
 
 	BeforeEach(func() {
 		// when
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		// then
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/pkg/api-server/health_check_endpoints_test.go b/pkg/api-server/health_check_endpoints_test.go
index 4afbb6f3d..c129d3bd6 100644
--- a/pkg/api-server/health_check_endpoints_test.go
+++ b/pkg/api-server/health_check_endpoints_test.go
@@ -15,6 +15,7 @@ import (
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	"github.com/kumahq/kuma/pkg/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
@@ -56,7 +57,7 @@ var _ = Describe("HealthCheck Endpoints", func() {
 
 	BeforeEach(func() {
 		// when
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		// then
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/pkg/api-server/mesh_endpoints_test.go b/pkg/api-server/mesh_endpoints_test.go
index 8d5652725..406d89556 100644
--- a/pkg/api-server/mesh_endpoints_test.go
+++ b/pkg/api-server/mesh_endpoints_test.go
@@ -13,6 +13,7 @@ import (
 	api_server "github.com/kumahq/kuma/pkg/api-server"
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
@@ -160,7 +161,7 @@ var _ = Describe("Resource Endpoints", func() {
 
 			// then
 			resource := mesh.MeshResource{}
-			err := resourceStore.Get(context.Background(), &resource, store.GetByKey(name, name))
+			err := resourceStore.Get(context.Background(), &resource, store.GetByKey(name, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(resource.Spec.Tracing.Backends[0].Name).To(Equal("zipkin-us"))
 		})
@@ -244,6 +245,6 @@ var _ = Describe("Resource Endpoints", func() {
 
 func putMeshIntoStore(resourceStore store.ResourceStore, name string, createdAt time.Time) {
 	resource := mesh.MeshResource{}
-	err := resourceStore.Create(context.Background(), &resource, store.CreateByKey(name, name), store.CreatedAt(createdAt))
+	err := resourceStore.Create(context.Background(), &resource, store.CreateByKey(name, model.NoMesh), store.CreatedAt(createdAt))
 	Expect(err).NotTo(HaveOccurred())
 }
diff --git a/pkg/api-server/resource_endpoints_test.go b/pkg/api-server/resource_endpoints_test.go
index 1607a1abd..51a8f36e3 100644
--- a/pkg/api-server/resource_endpoints_test.go
+++ b/pkg/api-server/resource_endpoints_test.go
@@ -13,6 +13,7 @@ import (
 	api_server "github.com/kumahq/kuma/pkg/api-server"
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	mesh_res "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
@@ -60,7 +61,7 @@ var _ = Describe("Resource Endpoints", func() {
 
 	BeforeEach(func() {
 		// create default mesh
-		err := resourceStore.Create(context.Background(), &mesh_res.MeshResource{}, store.CreateByKey(mesh, mesh))
+		err := resourceStore.Create(context.Background(), &mesh_res.MeshResource{}, store.CreateByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
@@ -565,7 +566,7 @@ var _ = Describe("Resource Endpoints", func() {
 
 		It("should return 400 when mesh does not exist", func() {
 			// setup
-			err := resourceStore.Delete(context.Background(), &mesh_res.MeshResource{}, store.DeleteByKey("default", "default"))
+			err := resourceStore.Delete(context.Background(), &mesh_res.MeshResource{}, store.DeleteByKey(model.DefaultMesh, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			// given
diff --git a/pkg/api-server/traffic_route_endpoints_test.go b/pkg/api-server/traffic_route_endpoints_test.go
index 821a8ced2..68977d033 100644
--- a/pkg/api-server/traffic_route_endpoints_test.go
+++ b/pkg/api-server/traffic_route_endpoints_test.go
@@ -15,6 +15,7 @@ import (
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	"github.com/kumahq/kuma/pkg/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
@@ -56,7 +57,7 @@ var _ = Describe("TrafficRoute Endpoints", func() {
 
 	BeforeEach(func() {
 		// when
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		// then
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/pkg/api-server/traffic_trace_endpoints_test.go b/pkg/api-server/traffic_trace_endpoints_test.go
index 54812e83e..e90aabf2f 100644
--- a/pkg/api-server/traffic_trace_endpoints_test.go
+++ b/pkg/api-server/traffic_trace_endpoints_test.go
@@ -15,6 +15,7 @@ import (
 	config "github.com/kumahq/kuma/pkg/config/api-server"
 	"github.com/kumahq/kuma/pkg/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/metrics"
@@ -56,7 +57,7 @@ var _ = Describe("TrafficTrace Endpoints", func() {
 
 	BeforeEach(func() {
 		// when
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		// then
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/pkg/api-server/zone_overview_endpoints_test.go b/pkg/api-server/zone_overview_endpoints_test.go
index ba7bb70ca..f76a7ffef 100644
--- a/pkg/api-server/zone_overview_endpoints_test.go
+++ b/pkg/api-server/zone_overview_endpoints_test.go
@@ -50,7 +50,7 @@ var _ = Describe("Zone Overview Endpoints", func() {
 	})
 
 	BeforeEach(func() {
-		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(core_model.DefaultMesh, core_model.DefaultMesh), store.CreatedAt(t1))
+		err := resourceStore.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(core_model.DefaultMesh, core_model.NoMesh), store.CreatedAt(t1))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
@@ -58,7 +58,7 @@ var _ = Describe("Zone Overview Endpoints", func() {
 		zoneResource := system.ZoneResource{
 			Spec: zone,
 		}
-		err := resourceStore.Create(context.Background(), &zoneResource, store.CreateByKey(name, core_model.DefaultMesh), store.CreatedAt(t1))
+		err := resourceStore.Create(context.Background(), &zoneResource, store.CreateByKey(name, core_model.NoMesh), store.CreatedAt(t1))
 		Expect(err).ToNot(HaveOccurred())
 
 		sampleTime, _ := time.Parse(time.RFC3339, "2019-07-01T00:00:00+00:00")
@@ -74,7 +74,7 @@ var _ = Describe("Zone Overview Endpoints", func() {
 				},
 			},
 		}
-		err = resourceStore.Create(context.Background(), &insightResource, store.CreateByKey(name, core_model.DefaultMesh))
+		err = resourceStore.Create(context.Background(), &insightResource, store.CreateByKey(name, core_model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 	}
 
diff --git a/pkg/core/faultinjections/matcher_test.go b/pkg/core/faultinjections/matcher_test.go
index 58caabe29..83dfc9dd3 100644
--- a/pkg/core/faultinjections/matcher_test.go
+++ b/pkg/core/faultinjections/matcher_test.go
@@ -4,8 +4,6 @@ import (
 	"context"
 	"time"
 
-	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-
 	"github.com/golang/protobuf/ptypes/duration"
 	"github.com/golang/protobuf/ptypes/wrappers"
 	. "github.com/onsi/ginkgo"
@@ -16,7 +14,9 @@ import (
 	. "github.com/kumahq/kuma/pkg/core/faultinjections"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test/resources/model"
 )
@@ -74,7 +74,7 @@ var _ = Describe("Match", func() {
 			matcher := FaultInjectionMatcher{ResourceManager: manager}
 
 			mesh := &mesh.MeshResource{}
-			err := manager.Create(context.Background(), mesh, store.CreateByKey("default", "default"))
+			err := manager.Create(context.Background(), mesh, store.CreateByKey(core_model.DefaultMesh, core_model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			for _, p := range given.policies {
diff --git a/pkg/core/logs/matcher_test.go b/pkg/core/logs/matcher_test.go
index 67aa409db..a24500cb1 100644
--- a/pkg/core/logs/matcher_test.go
+++ b/pkg/core/logs/matcher_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/logs"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/util/proto"
@@ -59,7 +60,7 @@ var _ = Describe("Matcher", func() {
 				},
 			},
 		}
-		err := manager.Create(context.Background(), &meshRes, store.CreateByKey("sample", "sample"))
+		err := manager.Create(context.Background(), &meshRes, store.CreateByKey("sample", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// and
diff --git a/pkg/core/managers/apis/dataplane/dataplane_manager_test.go b/pkg/core/managers/apis/dataplane/dataplane_manager_test.go
index e9079148c..8651026cb 100644
--- a/pkg/core/managers/apis/dataplane/dataplane_manager_test.go
+++ b/pkg/core/managers/apis/dataplane/dataplane_manager_test.go
@@ -3,13 +3,13 @@ package dataplane_test
 import (
 	"context"
 
-	"github.com/kumahq/kuma/pkg/core/managers/apis/dataplane"
-
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/core/managers/apis/dataplane"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 )
@@ -20,7 +20,7 @@ var _ = Describe("Dataplane Manager", func() {
 		// setup
 		s := memory.NewStore()
 		manager := dataplane.NewDataplaneManager(s, "zone-1")
-		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// given
@@ -58,7 +58,7 @@ var _ = Describe("Dataplane Manager", func() {
 		// setup
 		s := memory.NewStore()
 		manager := dataplane.NewDataplaneManager(s, "zone-1")
-		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// given
@@ -106,7 +106,7 @@ var _ = Describe("Dataplane Manager", func() {
 		// setup
 		s := memory.NewStore()
 		manager := dataplane.NewDataplaneManager(s, "zone-1")
-		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// given
@@ -140,7 +140,7 @@ var _ = Describe("Dataplane Manager", func() {
 		// setup
 		s := memory.NewStore()
 		manager := dataplane.NewDataplaneManager(s, "zone-1")
-		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey("default", "default"))
+		err := s.Create(context.Background(), &mesh_core.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// given
diff --git a/pkg/core/managers/apis/zoneinsight/zone_insight_manager_test.go b/pkg/core/managers/apis/zoneinsight/zone_insight_manager_test.go
index 998104c68..66864adec 100644
--- a/pkg/core/managers/apis/zoneinsight/zone_insight_manager_test.go
+++ b/pkg/core/managers/apis/zoneinsight/zone_insight_manager_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/kumahq/kuma/api/system/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/system"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
@@ -27,7 +28,7 @@ var _ = Describe("ZoneInsight Manager", func() {
 		}
 		manager := zoneinsight.NewZoneInsightManager(s, cfg)
 
-		err := s.Create(context.Background(), &system.ZoneResource{}, store.CreateByKey("di1", "default"))
+		err := s.Create(context.Background(), &system.ZoneResource{}, store.CreateByKey("di1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		input := system.ZoneInsightResource{}
@@ -38,11 +39,11 @@ var _ = Describe("ZoneInsight Manager", func() {
 		}
 
 		// when
-		err = manager.Create(context.Background(), &input, store.CreateByKey("di1", "default"))
+		err = manager.Create(context.Background(), &input, store.CreateByKey("di1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		actual := system.ZoneInsightResource{}
-		err = s.Get(context.Background(), &actual, store.GetByKey("di1", "default"))
+		err = s.Get(context.Background(), &actual, store.GetByKey("di1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// then
@@ -60,7 +61,7 @@ var _ = Describe("ZoneInsight Manager", func() {
 		}
 		manager := zoneinsight.NewZoneInsightManager(s, cfg)
 
-		err := s.Create(context.Background(), &system.ZoneResource{}, store.CreateByKey("di1", "default"))
+		err := s.Create(context.Background(), &system.ZoneResource{}, store.CreateByKey("di1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		input := system.ZoneInsightResource{}
@@ -71,11 +72,11 @@ var _ = Describe("ZoneInsight Manager", func() {
 		}
 
 		// when
-		err = manager.Create(context.Background(), &input, store.CreateByKey("di1", "default"))
+		err = manager.Create(context.Background(), &input, store.CreateByKey("di1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		actual := system.ZoneInsightResource{}
-		err = s.Get(context.Background(), &actual, store.GetByKey("di1", "default"))
+		err = s.Get(context.Background(), &actual, store.GetByKey("di1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// then
diff --git a/pkg/core/permissions/matcher_test.go b/pkg/core/permissions/matcher_test.go
index 85bf46e80..ed9c6536d 100644
--- a/pkg/core/permissions/matcher_test.go
+++ b/pkg/core/permissions/matcher_test.go
@@ -3,8 +3,6 @@ package permissions_test
 import (
 	"context"
 
-	util_proto "github.com/kumahq/kuma/pkg/util/proto"
-
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
 	. "github.com/onsi/gomega"
@@ -13,9 +11,11 @@ import (
 	"github.com/kumahq/kuma/pkg/core/permissions"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test/resources/model"
+	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 )
 
 var _ = Describe("Match", func() {
@@ -32,7 +32,7 @@ var _ = Describe("Match", func() {
 			manager := core_manager.NewResourceManager(memory.NewStore())
 			matcher := permissions.TrafficPermissionsMatcher{ResourceManager: manager}
 
-			err := manager.Create(context.Background(), &core_mesh.MeshResource{}, store.CreateByKey("default", "default"))
+			err := manager.Create(context.Background(), &core_mesh.MeshResource{}, store.CreateByKey(core_model.DefaultMesh, core_model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			for _, p := range given.policies {
@@ -50,7 +50,6 @@ var _ = Describe("Match", func() {
 		Entry("2 inbounds dataplane with additional service, 2 policies", testCase{
 			mesh: &core_mesh.MeshResource{
 				Meta: &model.ResourceMeta{
-					Mesh: "default",
 					Name: "default",
 				},
 				Spec: mesh_proto.Mesh{
diff --git a/pkg/core/resources/manager/manager_test.go b/pkg/core/resources/manager/manager_test.go
index edf0e10a8..3e88bb4ea 100644
--- a/pkg/core/resources/manager/manager_test.go
+++ b/pkg/core/resources/manager/manager_test.go
@@ -30,7 +30,7 @@ var _ = Describe("Resource Manager", func() {
 		meshRes := mesh.MeshResource{
 			Spec: mesh_proto.Mesh{},
 		}
-		return resManager.Create(context.Background(), &meshRes, store.CreateByKey(name, name))
+		return resManager.Create(context.Background(), &meshRes, store.CreateByKey(name, model.NoMesh))
 	}
 
 	createSampleResource := func(mesh string) (*sample.TrafficRouteResource, error) {
diff --git a/pkg/core/secrets/manager/validator_test.go b/pkg/core/secrets/manager/validator_test.go
index 9bb7504d6..2d3cfa1a0 100644
--- a/pkg/core/secrets/manager/validator_test.go
+++ b/pkg/core/secrets/manager/validator_test.go
@@ -12,6 +12,7 @@ import (
 	core_managers "github.com/kumahq/kuma/pkg/core/managers/apis/mesh"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/core/secrets/cipher"
 	secrets_manager "github.com/kumahq/kuma/pkg/core/secrets/manager"
@@ -72,9 +73,9 @@ var _ = Describe("Secret Validator", func() {
 				},
 			},
 		}
-		err := resManager.Create(context.Background(), mesh, core_store.CreateByKey("default", "default"))
+		err := resManager.Create(context.Background(), mesh, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
-		err = core_managers.EnsureEnabledCA(context.Background(), caManagers, mesh, "default")
+		err = core_managers.EnsureEnabledCA(context.Background(), caManagers, mesh, model.DefaultMesh)
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/pkg/defaults/components_test.go b/pkg/defaults/components_test.go
index 46b2024da..4333a0d0e 100644
--- a/pkg/defaults/components_test.go
+++ b/pkg/defaults/components_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/kumahq/kuma/pkg/config/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	core_component "github.com/kumahq/kuma/pkg/core/runtime/component"
 	"github.com/kumahq/kuma/pkg/defaults"
@@ -41,7 +42,7 @@ var _ = Describe("Defaults Component", func() {
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
-			err = manager.Get(context.Background(), &mesh_core.MeshResource{}, core_store.GetByKey("default", "default"))
+			err = manager.Get(context.Background(), &mesh_core.MeshResource{}, core_store.GetByKey(model.DefaultMesh, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 		})
 
@@ -60,7 +61,7 @@ var _ = Describe("Defaults Component", func() {
 					},
 				},
 			}
-			err := manager.Create(context.Background(), mesh, core_store.CreateByKey("default", "default"))
+			err := manager.Create(context.Background(), mesh, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			// when
@@ -69,7 +70,7 @@ var _ = Describe("Defaults Component", func() {
 			// then
 			mesh = &mesh_core.MeshResource{}
 			Expect(err).ToNot(HaveOccurred())
-			err = manager.Get(context.Background(), mesh, core_store.GetByKey("default", "default"))
+			err = manager.Get(context.Background(), mesh, core_store.GetByKey(model.DefaultMesh, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(mesh.Spec.Mtls.EnabledBackend).To(Equal("builtin"))
 		})
@@ -111,7 +112,7 @@ var _ = Describe("Defaults Component", func() {
 			store := resources_memory.NewStore()
 			manager := core_manager.NewResourceManager(store)
 			component := defaults.NewDefaultsComponent(&kuma_cp.Defaults{}, given.cpMode, given.environment, manager, store)
-			err := manager.Create(context.Background(), &mesh_core.MeshResource{}, core_store.CreateByKey("default", "default"))
+			err := manager.Create(context.Background(), &mesh_core.MeshResource{}, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			// when
diff --git a/pkg/dns/sync_test.go b/pkg/dns/sync_test.go
index e613b7fcb..13b0f6b5d 100644
--- a/pkg/dns/sync_test.go
+++ b/pkg/dns/sync_test.go
@@ -7,6 +7,7 @@ import (
 	config_manager "github.com/kumahq/kuma/pkg/core/config/manager"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	resources_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/core/runtime/component"
 	"github.com/kumahq/kuma/pkg/dns"
@@ -56,7 +57,7 @@ var _ = Describe("DNS sync", func() {
 		BeforeEach(func() {
 			// given a mesh and one service
 			mesh := core_mesh.MeshResource{}
-			err := resManager.Create(context.Background(), &mesh, core_store.CreateByKey("default", "default"))
+			err := resManager.Create(context.Background(), &mesh, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			webDp := core_mesh.DataplaneResource{
diff --git a/pkg/gc/collector_test.go b/pkg/gc/collector_test.go
index d763f4f39..804e78e7c 100644
--- a/pkg/gc/collector_test.go
+++ b/pkg/gc/collector_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/gc"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
@@ -55,7 +56,7 @@ var _ = Describe("Dataplane Collector", func() {
 
 	BeforeEach(func() {
 		rm = manager.NewResourceManager(memory.NewStore())
-		err := rm.Create(context.Background(), &core_mesh.MeshResource{}, store.CreateByKey("default", "default"))
+		err := rm.Create(context.Background(), &core_mesh.MeshResource{}, store.CreateByKey(core_model.DefaultMesh, core_model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/pkg/kds/client/sink_test.go b/pkg/kds/client/sink_test.go
index b58375d3b..bbdd5053d 100644
--- a/pkg/kds/client/sink_test.go
+++ b/pkg/kds/client/sink_test.go
@@ -45,8 +45,8 @@ var _ = Describe("KDS Sink", func() {
 			})).
 			Exec(kds_verifier.DiscoveryResponse(
 				&mesh.MeshResourceList{Items: []*mesh.MeshResource{
-					{Meta: &test_model.ResourceMeta{Name: "mesh1", Mesh: "mesh1"}, Spec: samples.Mesh1},
-					{Meta: &test_model.ResourceMeta{Name: "mesh2", Mesh: "mesh2"}, Spec: samples.Mesh2},
+					{Meta: &test_model.ResourceMeta{Name: "mesh1"}, Spec: samples.Mesh1},
+					{Meta: &test_model.ResourceMeta{Name: "mesh2"}, Spec: samples.Mesh2},
 				}}, "1", "1")).
 			Exec(kds_verifier.WaitRequest(defaultTimeout, func(rs *envoy_api_v2.DiscoveryRequest) {
 				Expect(rs.VersionInfo).To(Equal("1"))
diff --git a/pkg/kds/remote/components_test.go b/pkg/kds/remote/components_test.go
index 2737f231c..cda1ed3be 100644
--- a/pkg/kds/remote/components_test.go
+++ b/pkg/kds/remote/components_test.go
@@ -84,7 +84,7 @@ var _ = Describe("Remote Sync", func() {
 	})
 
 	It("should sync policies from global store to the local", func() {
-		err := globalStore.Create(context.Background(), &mesh.MeshResource{Spec: samples.Mesh1}, store.CreateByKey("mesh-1", "mesh-1"))
+		err := globalStore.Create(context.Background(), &mesh.MeshResource{Spec: samples.Mesh1}, store.CreateByKey("mesh-1", model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		Eventually(func() int {
diff --git a/pkg/kds/server/server_test.go b/pkg/kds/server/server_test.go
index 491be7ac1..847318acb 100644
--- a/pkg/kds/server/server_test.go
+++ b/pkg/kds/server/server_test.go
@@ -79,7 +79,7 @@ var _ = Describe("KDS Server", func() {
 			To(HaveLen(len(kds.SupportedTypes)))
 
 		vrf := kds_verifier.New().
-			Exec(kds_verifier.Create(ctx, &mesh.MeshResource{Spec: kds_samples.Mesh1}, store.CreateByKey("mesh-1", "mesh-1"))).
+			Exec(kds_verifier.Create(ctx, &mesh.MeshResource{Spec: kds_samples.Mesh1}, store.CreateByKey("mesh-1", model.NoMesh))).
 			Exec(kds_verifier.Create(ctx, &mesh.DataplaneResource{Spec: kds_samples.Ingress}, store.CreateByKey("Ingress-1", "mesh-1"))).
 			Exec(kds_verifier.Create(ctx, &mesh.DataplaneInsightResource{Spec: kds_samples.DataplaneInsight}, store.CreateByKey("insight-1", "mesh-1"))).
 			Exec(kds_verifier.Create(ctx, &mesh.ExternalServiceResource{Spec: kds_samples.ExternalService}, store.CreateByKey("es-1", "mesh-1"))).
diff --git a/pkg/kds/store/sync_test.go b/pkg/kds/store/sync_test.go
index 045b4fe9c..5bd92cfb1 100644
--- a/pkg/kds/store/sync_test.go
+++ b/pkg/kds/store/sync_test.go
@@ -27,7 +27,6 @@ var _ = Describe("SyncResourceStore", func() {
 		meshName := fmt.Sprintf("mesh-%d", idx)
 		return &mesh.MeshResource{
 			Meta: &model2.ResourceMeta{
-				Mesh: meshName,
 				Name: meshName,
 			},
 			Spec: mesh_proto.Mesh{
diff --git a/pkg/mads/generator/assignments_test.go b/pkg/mads/generator/assignments_test.go
index 04cdd37f8..687e58fca 100644
--- a/pkg/mads/generator/assignments_test.go
+++ b/pkg/mads/generator/assignments_test.go
@@ -73,7 +73,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 					},
 				},
@@ -112,7 +111,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
@@ -180,7 +178,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
@@ -266,7 +263,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
@@ -339,7 +335,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
@@ -413,7 +408,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "default",
-							Mesh: "default",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
@@ -555,7 +549,6 @@ var _ = Describe("MonitoringAssignmentsGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
diff --git a/pkg/mads/reconcile/snapshot_generator_test.go b/pkg/mads/reconcile/snapshot_generator_test.go
index 9a6ffa1fb..e8cc3ac96 100644
--- a/pkg/mads/reconcile/snapshot_generator_test.go
+++ b/pkg/mads/reconcile/snapshot_generator_test.go
@@ -79,7 +79,6 @@ var _ = Describe("snapshotGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "default",
-							Mesh: "default",
 						},
 					},
 				},
@@ -110,13 +109,11 @@ var _ = Describe("snapshotGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "default",
-							Mesh: "default",
 						},
 					},
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
@@ -162,13 +159,11 @@ var _ = Describe("snapshotGenerator", func() {
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "default",
-							Mesh: "default",
 						},
 					},
 					{
 						Meta: &test_model.ResourceMeta{
 							Name: "demo",
-							Mesh: "demo",
 						},
 						Spec: mesh_proto.Mesh{
 							Metrics: &mesh_proto.Metrics{
diff --git a/pkg/metrics/store/store_test.go b/pkg/metrics/store/store_test.go
index c3e9b2834..b64d714e5 100644
--- a/pkg/metrics/store/store_test.go
+++ b/pkg/metrics/store/store_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
 	metrics_store "github.com/kumahq/kuma/pkg/metrics/store"
@@ -28,13 +29,13 @@ var _ = Describe("Metered Store", func() {
 		Expect(err).ToNot(HaveOccurred())
 
 		// setup test data
-		err = memoryStore.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey("default", "default"))
+		err = memoryStore.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
 	It("should public metrics of GET", func() {
 		// when
-		err := store.Get(context.Background(), &core_mesh.MeshResource{}, core_store.GetByKey("default", "default"))
+		err := store.Get(context.Background(), &core_mesh.MeshResource{}, core_store.GetByKey(model.DefaultMesh, model.NoMesh))
 
 		// then
 		Expect(err).ToNot(HaveOccurred())
@@ -43,7 +44,7 @@ var _ = Describe("Metered Store", func() {
 
 	It("should public metrics of LIST", func() {
 		// when
-		err := store.List(context.Background(), &core_mesh.MeshResourceList{}, core_store.ListByMesh("default"))
+		err := store.List(context.Background(), &core_mesh.MeshResourceList{}, core_store.ListByMesh(model.DefaultMesh))
 
 		// then
 		Expect(err).ToNot(HaveOccurred())
@@ -52,7 +53,7 @@ var _ = Describe("Metered Store", func() {
 
 	It("should public metrics of DELETE", func() {
 		// when
-		err := store.Delete(context.Background(), &core_mesh.MeshResource{}, core_store.DeleteByKey("default", "default"))
+		err := store.Delete(context.Background(), &core_mesh.MeshResource{}, core_store.DeleteByKey(model.DefaultMesh, model.NoMesh))
 
 		// then
 		Expect(err).ToNot(HaveOccurred())
@@ -62,7 +63,7 @@ var _ = Describe("Metered Store", func() {
 	It("should public metrics of UPDATE", func() {
 		// when
 		mesh := &core_mesh.MeshResource{}
-		err := store.Get(context.Background(), mesh, core_store.GetByKey("default", "default"))
+		err := store.Get(context.Background(), mesh, core_store.GetByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// when
diff --git a/pkg/plugins/resources/k8s/store_test.go b/pkg/plugins/resources/k8s/store_test.go
index e2a6fc7b2..66bb35a8a 100644
--- a/pkg/plugins/resources/k8s/store_test.go
+++ b/pkg/plugins/resources/k8s/store_test.go
@@ -214,7 +214,7 @@ var _ = Describe("KubernetesStore", func() {
 		It("should set owner reference", func() {
 			// setup
 			mesh := core_mesh.MeshResource{}
-			err := s.Create(context.Background(), &mesh, store.CreateByKey("mesh", "mesh"))
+			err := s.Create(context.Background(), &mesh, store.CreateByKey("mesh", core_model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			err = k8sClient.Get(context.Background(), client.ObjectKey{Namespace: ns, Name: "mesh"}, &mesh_k8s.Mesh{})
@@ -322,7 +322,7 @@ var _ = Describe("KubernetesStore", func() {
 			mesh := &core_mesh.MeshResource{}
 
 			// when
-			err := s.Get(context.Background(), mesh, store.GetByKey(name, name))
+			err := s.Get(context.Background(), mesh, store.GetByKey(name, core_model.NoMesh))
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
@@ -489,7 +489,7 @@ var _ = Describe("KubernetesStore", func() {
 			actual := &core_mesh.MeshResource{}
 
 			// when
-			err := s.Get(context.Background(), actual, store.GetByKey(name, name))
+			err := s.Get(context.Background(), actual, store.GetByKey(name, core_model.NoMesh))
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
@@ -561,7 +561,7 @@ var _ = Describe("KubernetesStore", func() {
 			backend.Create(initial)
 
 			// when
-			err := s.Delete(context.Background(), &core_mesh.MeshResource{}, store.DeleteByKey(name, name))
+			err := s.Delete(context.Background(), &core_mesh.MeshResource{}, store.DeleteByKey(name, core_model.NoMesh))
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
@@ -694,7 +694,7 @@ var _ = Describe("KubernetesStore", func() {
 			}))
 
 			// when
-			err = s.Delete(context.Background(), &core_mesh.MeshResource{}, store.DeleteByKey("demo", "demo"))
+			err = s.Delete(context.Background(), &core_mesh.MeshResource{}, store.DeleteByKey("demo", core_model.NoMesh))
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
diff --git a/pkg/plugins/resources/postgres/migrate_test.go b/pkg/plugins/resources/postgres/migrate_test.go
index 9b2723f6c..66bdbc452 100644
--- a/pkg/plugins/resources/postgres/migrate_test.go
+++ b/pkg/plugins/resources/postgres/migrate_test.go
@@ -32,14 +32,14 @@ var _ = Describe("Migrate", func() {
 
 		// then
 		Expect(err).ToNot(HaveOccurred())
-		Expect(ver).To(Equal(plugins.DbVersion(1592232449)))
+		Expect(ver).To(Equal(plugins.DbVersion(1604501001)))
 
 		// and when migrating again
 		ver, err = migrateDb(cfg)
 
 		// then
 		Expect(err).To(Equal(plugins.AlreadyMigrated))
-		Expect(ver).To(Equal(plugins.DbVersion(1592232449)))
+		Expect(ver).To(Equal(plugins.DbVersion(1604501001)))
 	})
 
 	It("should throw an error when trying to run migrations on newer migration version of DB than in Kuma", func() {
@@ -57,7 +57,7 @@ var _ = Describe("Migrate", func() {
 		_, err = migrateDb(cfg)
 
 		// then
-		Expect(err).To(MatchError("DB is migrated to newer version than Kuma. DB migration version 9999999999. Kuma migration version 1592232449. Run newer version of Kuma"))
+		Expect(err).To(MatchError("DB is migrated to newer version than Kuma. DB migration version 9999999999. Kuma migration version 1604501001. Run newer version of Kuma"))
 	})
 
 	It("should indicate if db is migrated", func() {
diff --git a/pkg/plugins/resources/remote/store_test.go b/pkg/plugins/resources/remote/store_test.go
index 6fe249072..1daf29980 100644
--- a/pkg/plugins/resources/remote/store_test.go
+++ b/pkg/plugins/resources/remote/store_test.go
@@ -104,13 +104,13 @@ var _ = Describe("RemoteStore", func() {
 
 			// when
 			resource := mesh.MeshResource{}
-			err := store.Get(context.Background(), &resource, core_store.GetByKey(meshName, meshName))
+			err := store.Get(context.Background(), &resource, core_store.GetByKey(meshName, core_model.NoMesh))
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
 
 			Expect(resource.GetMeta().GetName()).To(Equal(meshName))
-			Expect(resource.GetMeta().GetMesh()).To(Equal(meshName))
+			Expect(resource.GetMeta().GetMesh()).To(Equal(core_model.NoMesh))
 			Expect(resource.GetMeta().GetCreationTime()).Should(Equal(creationTime))
 			Expect(resource.GetMeta().GetModificationTime()).Should(Equal(modificationTime))
 		})
@@ -185,14 +185,14 @@ var _ = Describe("RemoteStore", func() {
 				Expect(req.URL.Path).To(Equal(fmt.Sprintf("/meshes/%s", meshName)))
 				bytes, err := ioutil.ReadAll(req.Body)
 				Expect(err).ToNot(HaveOccurred())
-				Expect(bytes).To(MatchJSON(`{"mesh":"someMesh","name":"someMesh","type":"Mesh","creationTime": "0001-01-01T00:00:00Z","modificationTime": "0001-01-01T00:00:00Z"}`))
+				Expect(bytes).To(MatchJSON(`{"name":"someMesh","type":"Mesh","creationTime": "0001-01-01T00:00:00Z","modificationTime": "0001-01-01T00:00:00Z"}`))
 			})
 
 			// when
 			resource := mesh.MeshResource{
 				Spec: v1alpha1.Mesh{},
 			}
-			err := store.Create(context.Background(), &resource, core_store.CreateByKey(meshName, meshName))
+			err := store.Create(context.Background(), &resource, core_store.CreateByKey(meshName, core_model.NoMesh))
 
 			// then
 			Expect(err).ToNot(HaveOccurred())
@@ -214,7 +214,7 @@ var _ = Describe("RemoteStore", func() {
 			store := setupErrorStore(400, json)
 
 			// when
-			err := store.Create(context.Background(), &mesh.MeshResource{}, core_store.CreateByKey("test", "test"))
+			err := store.Create(context.Background(), &mesh.MeshResource{}, core_store.CreateByKey("test", core_model.NoMesh))
 
 			// then
 			Expect(err).To(HaveOccurred())
@@ -265,7 +265,7 @@ var _ = Describe("RemoteStore", func() {
 				Expect(req.URL.Path).To(Equal(fmt.Sprintf("/meshes/%s", meshName)))
 				bytes, err := ioutil.ReadAll(req.Body)
 				Expect(err).ToNot(HaveOccurred())
-				Expect(bytes).To(MatchJSON(`{"mesh":"someMesh","mtls":{"enabledBackend":"builtin","backends":[{"name":"builtin","type":"builtin"}]},"name":"someMesh","type":"Mesh","creationTime": "0001-01-01T00:00:00Z","modificationTime": "0001-01-01T00:00:00Z"}`))
+				Expect(bytes).To(MatchJSON(`{"name":"someMesh","mtls":{"enabledBackend":"builtin","backends":[{"name":"builtin","type":"builtin"}]},"name":"someMesh","type":"Mesh","creationTime": "0001-01-01T00:00:00Z","modificationTime": "0001-01-01T00:00:00Z"}`))
 			})
 
 			// when
@@ -282,7 +282,6 @@ var _ = Describe("RemoteStore", func() {
 					},
 				},
 				Meta: &model.ResourceMeta{
-					Mesh: meshName,
 					Name: meshName,
 				},
 			}
@@ -300,7 +299,6 @@ var _ = Describe("RemoteStore", func() {
 			resource := mesh.MeshResource{
 				Spec: v1alpha1.Mesh{},
 				Meta: &model.ResourceMeta{
-					Mesh: "default",
 					Name: "default",
 				},
 			}
@@ -332,7 +330,6 @@ var _ = Describe("RemoteStore", func() {
 			// when
 			resource := mesh.MeshResource{
 				Meta: &model.ResourceMeta{
-					Mesh: "test",
 					Name: "test",
 				},
 			}
@@ -427,12 +424,12 @@ var _ = Describe("RemoteStore", func() {
 			Expect(meshes.Items).To(HaveLen(2))
 
 			Expect(meshes.Items[0].Meta.GetName()).To(Equal("mesh-1"))
-			Expect(meshes.Items[0].Meta.GetMesh()).To(Equal("mesh-1"))
+			Expect(meshes.Items[0].Meta.GetMesh()).To(Equal(core_model.NoMesh))
 			Expect(meshes.Items[0].Meta.GetCreationTime()).Should(Equal(creationTime))
 			Expect(meshes.Items[0].Meta.GetModificationTime()).Should(Equal(modificationTime))
 
 			Expect(meshes.Items[1].Meta.GetName()).To(Equal("mesh-2"))
-			Expect(meshes.Items[1].Meta.GetMesh()).To(Equal("mesh-2"))
+			Expect(meshes.Items[1].Meta.GetMesh()).To(Equal(core_model.NoMesh))
 			Expect(meshes.Items[1].Meta.GetCreationTime()).Should(Equal(creationTime))
 			Expect(meshes.Items[1].Meta.GetModificationTime()).Should(Equal(modificationTime))
 		})
diff --git a/pkg/plugins/resources/remote/testdata/get-mesh.json b/pkg/plugins/resources/remote/testdata/get-mesh.json
index 173312c3d..0ea2ca899 100644
--- a/pkg/plugins/resources/remote/testdata/get-mesh.json
+++ b/pkg/plugins/resources/remote/testdata/get-mesh.json
@@ -1,7 +1,6 @@
 {
   "type": "Mesh",
-  "mesh": "someMesh",
   "name": "someMesh",
   "creationTime": "2018-07-17T16:05:36.995Z",
   "modificationTime": "2019-07-17T16:05:36.995Z"
-}
\ No newline at end of file
+}
diff --git a/pkg/plugins/resources/remote/testdata/list-meshes.json b/pkg/plugins/resources/remote/testdata/list-meshes.json
index c0ef7ad8c..d2ed715c4 100644
--- a/pkg/plugins/resources/remote/testdata/list-meshes.json
+++ b/pkg/plugins/resources/remote/testdata/list-meshes.json
@@ -2,17 +2,15 @@
     "items": [
         {
             "type": "Meshes",
-            "mesh": "mesh-1",
             "name": "mesh-1",
             "creationTime": "2018-07-17T16:05:36.995Z",
             "modificationTime": "2019-07-17T16:05:36.995Z"
         },
         {
             "type": "Meshes",
-            "mesh": "mesh-2",
             "name": "mesh-2",
             "creationTime": "2018-07-17T16:05:36.995Z",
             "modificationTime": "2019-07-17T16:05:36.995Z"
         }
     ]
-}
\ No newline at end of file
+}
diff --git a/pkg/plugins/runtime/universal/outbound_test.go b/pkg/plugins/runtime/universal/outbound_test.go
index 4bd60c859..08005a957 100644
--- a/pkg/plugins/runtime/universal/outbound_test.go
+++ b/pkg/plugins/runtime/universal/outbound_test.go
@@ -36,7 +36,7 @@ var _ = Describe("UpdateOutbound", func() {
 	BeforeEach(func() {
 		rm = &countingManager{ResourceManager: core_manager.NewResourceManager(memory.NewStore())}
 
-		err := rm.Create(context.Background(), &mesh.MeshResource{}, store.CreateByKey("default", "default"))
+		err := rm.Create(context.Background(), &mesh.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
@@ -97,7 +97,7 @@ var _ = Describe("UpdateOutbound", func() {
 
 		It("should not update dataplane outbounds when new service is added to another mesh", func() {
 			// when
-			err := rm.Create(context.Background(), &mesh.MeshResource{}, store.CreateByKey("another-mesh", "another-mesh"))
+			err := rm.Create(context.Background(), &mesh.MeshResource{}, store.CreateByKey("another-mesh", model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 			// and
 			err = rm.Create(context.Background(), &mesh.DataplaneResource{
diff --git a/pkg/sds/server/server_test.go b/pkg/sds/server/server_test.go
index 7e6717c36..01edd605d 100644
--- a/pkg/sds/server/server_test.go
+++ b/pkg/sds/server/server_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core"
 	mesh_core "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	dp_server "github.com/kumahq/kuma/pkg/dp-server"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
@@ -95,7 +96,7 @@ var _ = Describe("SDS Server", func() {
 				},
 			},
 		}
-		err = resManager.Create(context.Background(), &meshRes, core_store.CreateByKey("default", "default"))
+		err = resManager.Create(context.Background(), &meshRes, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// setup backend dataplane
@@ -245,7 +246,7 @@ var _ = Describe("SDS Server", func() {
 		It("should return pair when CA is changed", func(done Done) {
 			// when
 			meshRes := mesh_core.MeshResource{}
-			Expect(resManager.Get(context.Background(), &meshRes, core_store.GetByKey("default", "default"))).To(Succeed())
+			Expect(resManager.Get(context.Background(), &meshRes, core_store.GetByKey(model.DefaultMesh, model.NoMesh))).To(Succeed())
 			meshRes.Spec.Mtls.EnabledBackend = "" // we need to first disable mTLS
 			Expect(resManager.Update(context.Background(), &meshRes)).To(Succeed())
 			meshRes.Spec.Mtls.EnabledBackend = "ca-2"
diff --git a/pkg/test/store/owner_test_template.go b/pkg/test/store/owner_test_template.go
index e662147c7..58b22b167 100644
--- a/pkg/test/store/owner_test_template.go
+++ b/pkg/test/store/owner_test_template.go
@@ -33,7 +33,7 @@ func ExecuteOwnerTests(
 	It("should delete resource when its owner is deleted", func() {
 		// setup
 		meshRes := core_mesh.MeshResource{}
-		err := s.Create(context.Background(), &meshRes, store.CreateByKey(mesh, mesh))
+		err := s.Create(context.Background(), &meshRes, store.CreateByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		name := "resource-1"
@@ -49,7 +49,7 @@ func ExecuteOwnerTests(
 		Expect(err).ToNot(HaveOccurred())
 
 		// when
-		err = s.Delete(context.Background(), &meshRes, store.DeleteByKey(mesh, mesh))
+		err = s.Delete(context.Background(), &meshRes, store.DeleteByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// then
@@ -61,7 +61,7 @@ func ExecuteOwnerTests(
 	It("should delete several resources when their owner is deleted", func() {
 		// setup
 		meshRes := core_mesh.MeshResource{}
-		err := s.Create(context.Background(), &meshRes, store.CreateByKey(mesh, mesh))
+		err := s.Create(context.Background(), &meshRes, store.CreateByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		for i := 0; i < 10; i++ {
@@ -82,7 +82,7 @@ func ExecuteOwnerTests(
 		Expect(actual.Items).To(HaveLen(10))
 
 		// when
-		err = s.Delete(context.Background(), &meshRes, store.DeleteByKey(mesh, mesh))
+		err = s.Delete(context.Background(), &meshRes, store.DeleteByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// then
@@ -95,7 +95,7 @@ func ExecuteOwnerTests(
 	It("should delete owners chain", func() {
 		// setup
 		meshRes := core_mesh.MeshResource{}
-		err := s.Create(context.Background(), &meshRes, store.CreateByKey(mesh, mesh))
+		err := s.Create(context.Background(), &meshRes, store.CreateByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		var prev model.Resource = &meshRes
@@ -119,7 +119,7 @@ func ExecuteOwnerTests(
 		Expect(actual.Items).To(HaveLen(10))
 
 		// when
-		err = s.Delete(context.Background(), &meshRes, store.DeleteByKey(mesh, mesh))
+		err = s.Delete(context.Background(), &meshRes, store.DeleteByKey(mesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		// then
diff --git a/pkg/xds/auth/callbacks_test.go b/pkg/xds/auth/callbacks_test.go
index 0e7a349dd..7c781fdb9 100644
--- a/pkg/xds/auth/callbacks_test.go
+++ b/pkg/xds/auth/callbacks_test.go
@@ -13,6 +13,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
@@ -71,7 +72,7 @@ var _ = Describe("Auth Callbacks", func() {
 		testAuth = &testAuthenticator{}
 		callbacks = auth.NewCallbacks(resManager, testAuth)
 
-		err := resManager.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey("default", "default"))
+		err := resManager.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 		err = resManager.Create(context.Background(), dpRes, core_store.CreateByKey("web-01", "default"))
 		Expect(err).ToNot(HaveOccurred())
diff --git a/pkg/xds/bootstrap/generator_test.go b/pkg/xds/bootstrap/generator_test.go
index 4d48dc365..58e3bb1e7 100644
--- a/pkg/xds/bootstrap/generator_test.go
+++ b/pkg/xds/bootstrap/generator_test.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/kumahq/kuma/pkg/core"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
@@ -57,7 +58,7 @@ var _ = Describe("bootstrapGenerator", func() {
 
 		// when
 		meshRes := mesh.MeshResource{}
-		err := resManager.Create(context.Background(), &meshRes, store.CreateByKey("mesh", "mesh"))
+		err := resManager.Create(context.Background(), &meshRes, store.CreateByKey("mesh", model.NoMesh))
 		// then
 		Expect(err).ToNot(HaveOccurred())
 
diff --git a/pkg/xds/bootstrap/server_test.go b/pkg/xds/bootstrap/server_test.go
index 1cab51378..a36ede581 100644
--- a/pkg/xds/bootstrap/server_test.go
+++ b/pkg/xds/bootstrap/server_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core"
 	"github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	dp_server "github.com/kumahq/kuma/pkg/dp-server"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
@@ -86,7 +87,7 @@ var _ = Describe("Bootstrap Server", func() {
 	})
 
 	BeforeEach(func() {
-		err := resManager.Create(context.Background(), &mesh.MeshResource{}, store.CreateByKey("default", "default"))
+		err := resManager.Create(context.Background(), &mesh.MeshResource{}, store.CreateByKey(model.DefaultMesh, model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 		core.Now = func() time.Time {
 			now, _ := time.Parse(time.RFC3339, "2018-07-17T16:05:36.995+00:00")
diff --git a/pkg/xds/cache/cla/cache_test.go b/pkg/xds/cache/cla/cache_test.go
index cee592be4..3836b723b 100644
--- a/pkg/xds/cache/cla/cache_test.go
+++ b/pkg/xds/cache/cla/cache_test.go
@@ -66,7 +66,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 
 	BeforeEach(func() {
 		mesh := "mesh-0"
-		err := s.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey(mesh, mesh))
+		err := s.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey(mesh, core_model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 
 		err = s.Create(context.Background(), &core_mesh.DataplaneResource{
diff --git a/pkg/xds/cache/mesh/cache_test.go b/pkg/xds/cache/mesh/cache_test.go
index be881ca89..fed70f665 100644
--- a/pkg/xds/cache/mesh/cache_test.go
+++ b/pkg/xds/cache/mesh/cache_test.go
@@ -92,7 +92,7 @@ var _ = Describe("MeshSnapshot Cache", func() {
 	BeforeEach(func() {
 		for i := 0; i < 3; i++ {
 			mesh := fmt.Sprintf("mesh-%d", i)
-			err := s.Create(context.Background(), &mesh_core.MeshResource{}, core_store.CreateByKey(mesh, mesh))
+			err := s.Create(context.Background(), &mesh_core.MeshResource{}, core_store.CreateByKey(mesh, core_model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 
 			for _, dp := range testDataplaneResources(baseLen, mesh, "v1", "192.168.0.1") {
@@ -110,7 +110,7 @@ var _ = Describe("MeshSnapshot Cache", func() {
 		By("getting Hash for the first time")
 		hash, err := meshCache.GetHash(context.Background(), "mesh-0")
 		Expect(err).ToNot(HaveOccurred())
-		expectedHash := `Dataplane:mesh-0:dp-0:1:192.168.0.1,Dataplane:mesh-0:dp-10:1:192.168.0.1,Dataplane:mesh-0:dp-11:1:192.168.0.1,Dataplane:mesh-0:dp-12:1:192.168.0.1,Dataplane:mesh-0:dp-13:1:192.168.0.1,Dataplane:mesh-0:dp-14:1:192.168.0.1,Dataplane:mesh-0:dp-15:1:192.168.0.1,Dataplane:mesh-0:dp-16:1:192.168.0.1,Dataplane:mesh-0:dp-17:1:192.168.0.1,Dataplane:mesh-0:dp-18:1:192.168.0.1,Dataplane:mesh-0:dp-19:1:192.168.0.1,Dataplane:mesh-0:dp-1:1:192.168.0.1,Dataplane:mesh-0:dp-20:1:192.168.0.1,Dataplane:mesh-0:dp-21:1:192.168.0.1,Dataplane:mesh-0:dp-22:1:192.168.0.1,Dataplane:mesh-0:dp-23:1:192.168.0.1,Dataplane:mesh-0:dp-24:1:192.168.0.1,Dataplane:mesh-0:dp-25:1:192.168.0.1,Dataplane:mesh-0:dp-26:1:192.168.0.1,Dataplane:mesh-0:dp-27:1:192.168.0.1,Dataplane:mesh-0:dp-28:1:192.168.0.1,Dataplane:mesh-0:dp-29:1:192.168.0.1,Dataplane:mesh-0:dp-2:1:192.168.0.1,Dataplane:mesh-0:dp-30:1:192.168.0.1,Dataplane:mesh-0:dp-31:1:192.168.0.1,Dataplane:mesh-0:dp-32:1:192.168.0.1,Dataplane:mesh-0:dp-33:1:192.168.0.1,Dataplane:mesh-0:dp-34:1:192.168.0.1,Dataplane:mesh-0:dp-35:1:192.168.0.1,Dataplane:mesh-0:dp-36:1:192.168.0.1,Dataplane:mesh-0:dp-37:1:192.168.0.1,Dataplane:mesh-0:dp-38:1:192.168.0.1,Dataplane:mesh-0:dp-39:1:192.168.0.1,Dataplane:mesh-0:dp-3:1:192.168.0.1,Dataplane:mesh-0:dp-40:1:192.168.0.1,Dataplane:mesh-0:dp-41:1:192.168.0.1,Dataplane:mesh-0:dp-42:1:192.168.0.1,Dataplane:mesh-0:dp-43:1:192.168.0.1,Dataplane:mesh-0:dp-44:1:192.168.0.1,Dataplane:mesh-0:dp-45:1:192.168.0.1,Dataplane:mesh-0:dp-46:1:192.168.0.1,Dataplane:mesh-0:dp-47:1:192.168.0.1,Dataplane:mesh-0:dp-48:1:192.168.0.1,Dataplane:mesh-0:dp-49:1:192.168.0.1,Dataplane:mesh-0:dp-4:1:192.168.0.1,Dataplane:mesh-0:dp-50:1:192.168.0.1,Dataplane:mesh-0:dp-51:1:192.168.0.1,Dataplane:mesh-0:dp-52:1:192.168.0.1,Dataplane:mesh-0:dp-53:1:192.168.0.1,Dataplane:mesh-0:dp-54:1:192.168.0.1,Dataplane:mesh-0:dp-55:1:192.168.0.1,Dataplane:mesh-0:dp-56:1:192.168.0.1,Dataplane:mesh-0:dp-57:1:192.168.0.1,Dataplane:mesh-0:dp-58:1:192.168.0.1,Dataplane:mesh-0:dp-59:1:192.168.0.1,Dataplane:mesh-0:dp-5:1:192.168.0.1,Dataplane:mesh-0:dp-60:1:192.168.0.1,Dataplane:mesh-0:dp-61:1:192.168.0.1,Dataplane:mesh-0:dp-62:1:192.168.0.1,Dataplane:mesh-0:dp-63:1:192.168.0.1,Dataplane:mesh-0:dp-64:1:192.168.0.1,Dataplane:mesh-0:dp-65:1:192.168.0.1,Dataplane:mesh-0:dp-66:1:192.168.0.1,Dataplane:mesh-0:dp-67:1:192.168.0.1,Dataplane:mesh-0:dp-68:1:192.168.0.1,Dataplane:mesh-0:dp-69:1:192.168.0.1,Dataplane:mesh-0:dp-6:1:192.168.0.1,Dataplane:mesh-0:dp-70:1:192.168.0.1,Dataplane:mesh-0:dp-71:1:192.168.0.1,Dataplane:mesh-0:dp-72:1:192.168.0.1,Dataplane:mesh-0:dp-73:1:192.168.0.1,Dataplane:mesh-0:dp-74:1:192.168.0.1,Dataplane:mesh-0:dp-75:1:192.168.0.1,Dataplane:mesh-0:dp-76:1:192.168.0.1,Dataplane:mesh-0:dp-77:1:192.168.0.1,Dataplane:mesh-0:dp-78:1:192.168.0.1,Dataplane:mesh-0:dp-79:1:192.168.0.1,Dataplane:mesh-0:dp-7:1:192.168.0.1,Dataplane:mesh-0:dp-80:1:192.168.0.1,Dataplane:mesh-0:dp-81:1:192.168.0.1,Dataplane:mesh-0:dp-82:1:192.168.0.1,Dataplane:mesh-0:dp-83:1:192.168.0.1,Dataplane:mesh-0:dp-84:1:192.168.0.1,Dataplane:mesh-0:dp-85:1:192.168.0.1,Dataplane:mesh-0:dp-86:1:192.168.0.1,Dataplane:mesh-0:dp-87:1:192.168.0.1,Dataplane:mesh-0:dp-88:1:192.168.0.1,Dataplane:mesh-0:dp-89:1:192.168.0.1,Dataplane:mesh-0:dp-8:1:192.168.0.1,Dataplane:mesh-0:dp-90:1:192.168.0.1,Dataplane:mesh-0:dp-91:1:192.168.0.1,Dataplane:mesh-0:dp-92:1:192.168.0.1,Dataplane:mesh-0:dp-93:1:192.168.0.1,Dataplane:mesh-0:dp-94:1:192.168.0.1,Dataplane:mesh-0:dp-95:1:192.168.0.1,Dataplane:mesh-0:dp-96:1:192.168.0.1,Dataplane:mesh-0:dp-97:1:192.168.0.1,Dataplane:mesh-0:dp-98:1:192.168.0.1,Dataplane:mesh-0:dp-99:1:192.168.0.1,Dataplane:mesh-0:dp-9:1:192.168.0.1,Mesh:mesh-0:mesh-0:1,TrafficRoute:mesh-0:tr-0:1,TrafficRoute:mesh-0:tr-10:1,TrafficRoute:mesh-0:tr-11:1,TrafficRoute:mesh-0:tr-12:1,TrafficRoute:mesh-0:tr-13:1,TrafficRoute:mesh-0:tr-14:1,TrafficRoute:mesh-0:tr-15:1,TrafficRoute:mesh-0:tr-16:1,TrafficRoute:mesh-0:tr-17:1,TrafficRoute:mesh-0:tr-18:1,TrafficRoute:mesh-0:tr-19:1,TrafficRoute:mesh-0:tr-1:1,TrafficRoute:mesh-0:tr-20:1,TrafficRoute:mesh-0:tr-21:1,TrafficRoute:mesh-0:tr-22:1,TrafficRoute:mesh-0:tr-23:1,TrafficRoute:mesh-0:tr-24:1,TrafficRoute:mesh-0:tr-25:1,TrafficRoute:mesh-0:tr-26:1,TrafficRoute:mesh-0:tr-27:1,TrafficRoute:mesh-0:tr-28:1,TrafficRoute:mesh-0:tr-29:1,TrafficRoute:mesh-0:tr-2:1,TrafficRoute:mesh-0:tr-30:1,TrafficRoute:mesh-0:tr-31:1,TrafficRoute:mesh-0:tr-32:1,TrafficRoute:mesh-0:tr-33:1,TrafficRoute:mesh-0:tr-34:1,TrafficRoute:mesh-0:tr-35:1,TrafficRoute:mesh-0:tr-36:1,TrafficRoute:mesh-0:tr-37:1,TrafficRoute:mesh-0:tr-38:1,TrafficRoute:mesh-0:tr-39:1,TrafficRoute:mesh-0:tr-3:1,TrafficRoute:mesh-0:tr-40:1,TrafficRoute:mesh-0:tr-41:1,TrafficRoute:mesh-0:tr-42:1,TrafficRoute:mesh-0:tr-43:1,TrafficRoute:mesh-0:tr-44:1,TrafficRoute:mesh-0:tr-45:1,TrafficRoute:mesh-0:tr-46:1,TrafficRoute:mesh-0:tr-47:1,TrafficRoute:mesh-0:tr-48:1,TrafficRoute:mesh-0:tr-49:1,TrafficRoute:mesh-0:tr-4:1,TrafficRoute:mesh-0:tr-50:1,TrafficRoute:mesh-0:tr-51:1,TrafficRoute:mesh-0:tr-52:1,TrafficRoute:mesh-0:tr-53:1,TrafficRoute:mesh-0:tr-54:1,TrafficRoute:mesh-0:tr-55:1,TrafficRoute:mesh-0:tr-56:1,TrafficRoute:mesh-0:tr-57:1,TrafficRoute:mesh-0:tr-58:1,TrafficRoute:mesh-0:tr-59:1,TrafficRoute:mesh-0:tr-5:1,TrafficRoute:mesh-0:tr-60:1,TrafficRoute:mesh-0:tr-61:1,TrafficRoute:mesh-0:tr-62:1,TrafficRoute:mesh-0:tr-63:1,TrafficRoute:mesh-0:tr-64:1,TrafficRoute:mesh-0:tr-65:1,TrafficRoute:mesh-0:tr-66:1,TrafficRoute:mesh-0:tr-67:1,TrafficRoute:mesh-0:tr-68:1,TrafficRoute:mesh-0:tr-69:1,TrafficRoute:mesh-0:tr-6:1,TrafficRoute:mesh-0:tr-70:1,TrafficRoute:mesh-0:tr-71:1,TrafficRoute:mesh-0:tr-72:1,TrafficRoute:mesh-0:tr-73:1,TrafficRoute:mesh-0:tr-74:1,TrafficRoute:mesh-0:tr-75:1,TrafficRoute:mesh-0:tr-76:1,TrafficRoute:mesh-0:tr-77:1,TrafficRoute:mesh-0:tr-78:1,TrafficRoute:mesh-0:tr-79:1,TrafficRoute:mesh-0:tr-7:1,TrafficRoute:mesh-0:tr-80:1,TrafficRoute:mesh-0:tr-81:1,TrafficRoute:mesh-0:tr-82:1,TrafficRoute:mesh-0:tr-83:1,TrafficRoute:mesh-0:tr-84:1,TrafficRoute:mesh-0:tr-85:1,TrafficRoute:mesh-0:tr-86:1,TrafficRoute:mesh-0:tr-87:1,TrafficRoute:mesh-0:tr-88:1,TrafficRoute:mesh-0:tr-89:1,TrafficRoute:mesh-0:tr-8:1,TrafficRoute:mesh-0:tr-90:1,TrafficRoute:mesh-0:tr-91:1,TrafficRoute:mesh-0:tr-92:1,TrafficRoute:mesh-0:tr-93:1,TrafficRoute:mesh-0:tr-94:1,TrafficRoute:mesh-0:tr-95:1,TrafficRoute:mesh-0:tr-96:1,TrafficRoute:mesh-0:tr-97:1,TrafficRoute:mesh-0:tr-98:1,TrafficRoute:mesh-0:tr-99:1,TrafficRoute:mesh-0:tr-9:1`
+		expectedHash := `Dataplane:mesh-0:dp-0:1:192.168.0.1,Dataplane:mesh-0:dp-10:1:192.168.0.1,Dataplane:mesh-0:dp-11:1:192.168.0.1,Dataplane:mesh-0:dp-12:1:192.168.0.1,Dataplane:mesh-0:dp-13:1:192.168.0.1,Dataplane:mesh-0:dp-14:1:192.168.0.1,Dataplane:mesh-0:dp-15:1:192.168.0.1,Dataplane:mesh-0:dp-16:1:192.168.0.1,Dataplane:mesh-0:dp-17:1:192.168.0.1,Dataplane:mesh-0:dp-18:1:192.168.0.1,Dataplane:mesh-0:dp-19:1:192.168.0.1,Dataplane:mesh-0:dp-1:1:192.168.0.1,Dataplane:mesh-0:dp-20:1:192.168.0.1,Dataplane:mesh-0:dp-21:1:192.168.0.1,Dataplane:mesh-0:dp-22:1:192.168.0.1,Dataplane:mesh-0:dp-23:1:192.168.0.1,Dataplane:mesh-0:dp-24:1:192.168.0.1,Dataplane:mesh-0:dp-25:1:192.168.0.1,Dataplane:mesh-0:dp-26:1:192.168.0.1,Dataplane:mesh-0:dp-27:1:192.168.0.1,Dataplane:mesh-0:dp-28:1:192.168.0.1,Dataplane:mesh-0:dp-29:1:192.168.0.1,Dataplane:mesh-0:dp-2:1:192.168.0.1,Dataplane:mesh-0:dp-30:1:192.168.0.1,Dataplane:mesh-0:dp-31:1:192.168.0.1,Dataplane:mesh-0:dp-32:1:192.168.0.1,Dataplane:mesh-0:dp-33:1:192.168.0.1,Dataplane:mesh-0:dp-34:1:192.168.0.1,Dataplane:mesh-0:dp-35:1:192.168.0.1,Dataplane:mesh-0:dp-36:1:192.168.0.1,Dataplane:mesh-0:dp-37:1:192.168.0.1,Dataplane:mesh-0:dp-38:1:192.168.0.1,Dataplane:mesh-0:dp-39:1:192.168.0.1,Dataplane:mesh-0:dp-3:1:192.168.0.1,Dataplane:mesh-0:dp-40:1:192.168.0.1,Dataplane:mesh-0:dp-41:1:192.168.0.1,Dataplane:mesh-0:dp-42:1:192.168.0.1,Dataplane:mesh-0:dp-43:1:192.168.0.1,Dataplane:mesh-0:dp-44:1:192.168.0.1,Dataplane:mesh-0:dp-45:1:192.168.0.1,Dataplane:mesh-0:dp-46:1:192.168.0.1,Dataplane:mesh-0:dp-47:1:192.168.0.1,Dataplane:mesh-0:dp-48:1:192.168.0.1,Dataplane:mesh-0:dp-49:1:192.168.0.1,Dataplane:mesh-0:dp-4:1:192.168.0.1,Dataplane:mesh-0:dp-50:1:192.168.0.1,Dataplane:mesh-0:dp-51:1:192.168.0.1,Dataplane:mesh-0:dp-52:1:192.168.0.1,Dataplane:mesh-0:dp-53:1:192.168.0.1,Dataplane:mesh-0:dp-54:1:192.168.0.1,Dataplane:mesh-0:dp-55:1:192.168.0.1,Dataplane:mesh-0:dp-56:1:192.168.0.1,Dataplane:mesh-0:dp-57:1:192.168.0.1,Dataplane:mesh-0:dp-58:1:192.168.0.1,Dataplane:mesh-0:dp-59:1:192.168.0.1,Dataplane:mesh-0:dp-5:1:192.168.0.1,Dataplane:mesh-0:dp-60:1:192.168.0.1,Dataplane:mesh-0:dp-61:1:192.168.0.1,Dataplane:mesh-0:dp-62:1:192.168.0.1,Dataplane:mesh-0:dp-63:1:192.168.0.1,Dataplane:mesh-0:dp-64:1:192.168.0.1,Dataplane:mesh-0:dp-65:1:192.168.0.1,Dataplane:mesh-0:dp-66:1:192.168.0.1,Dataplane:mesh-0:dp-67:1:192.168.0.1,Dataplane:mesh-0:dp-68:1:192.168.0.1,Dataplane:mesh-0:dp-69:1:192.168.0.1,Dataplane:mesh-0:dp-6:1:192.168.0.1,Dataplane:mesh-0:dp-70:1:192.168.0.1,Dataplane:mesh-0:dp-71:1:192.168.0.1,Dataplane:mesh-0:dp-72:1:192.168.0.1,Dataplane:mesh-0:dp-73:1:192.168.0.1,Dataplane:mesh-0:dp-74:1:192.168.0.1,Dataplane:mesh-0:dp-75:1:192.168.0.1,Dataplane:mesh-0:dp-76:1:192.168.0.1,Dataplane:mesh-0:dp-77:1:192.168.0.1,Dataplane:mesh-0:dp-78:1:192.168.0.1,Dataplane:mesh-0:dp-79:1:192.168.0.1,Dataplane:mesh-0:dp-7:1:192.168.0.1,Dataplane:mesh-0:dp-80:1:192.168.0.1,Dataplane:mesh-0:dp-81:1:192.168.0.1,Dataplane:mesh-0:dp-82:1:192.168.0.1,Dataplane:mesh-0:dp-83:1:192.168.0.1,Dataplane:mesh-0:dp-84:1:192.168.0.1,Dataplane:mesh-0:dp-85:1:192.168.0.1,Dataplane:mesh-0:dp-86:1:192.168.0.1,Dataplane:mesh-0:dp-87:1:192.168.0.1,Dataplane:mesh-0:dp-88:1:192.168.0.1,Dataplane:mesh-0:dp-89:1:192.168.0.1,Dataplane:mesh-0:dp-8:1:192.168.0.1,Dataplane:mesh-0:dp-90:1:192.168.0.1,Dataplane:mesh-0:dp-91:1:192.168.0.1,Dataplane:mesh-0:dp-92:1:192.168.0.1,Dataplane:mesh-0:dp-93:1:192.168.0.1,Dataplane:mesh-0:dp-94:1:192.168.0.1,Dataplane:mesh-0:dp-95:1:192.168.0.1,Dataplane:mesh-0:dp-96:1:192.168.0.1,Dataplane:mesh-0:dp-97:1:192.168.0.1,Dataplane:mesh-0:dp-98:1:192.168.0.1,Dataplane:mesh-0:dp-99:1:192.168.0.1,Dataplane:mesh-0:dp-9:1:192.168.0.1,Mesh::mesh-0:1,TrafficRoute:mesh-0:tr-0:1,TrafficRoute:mesh-0:tr-10:1,TrafficRoute:mesh-0:tr-11:1,TrafficRoute:mesh-0:tr-12:1,TrafficRoute:mesh-0:tr-13:1,TrafficRoute:mesh-0:tr-14:1,TrafficRoute:mesh-0:tr-15:1,TrafficRoute:mesh-0:tr-16:1,TrafficRoute:mesh-0:tr-17:1,TrafficRoute:mesh-0:tr-18:1,TrafficRoute:mesh-0:tr-19:1,TrafficRoute:mesh-0:tr-1:1,TrafficRoute:mesh-0:tr-20:1,TrafficRoute:mesh-0:tr-21:1,TrafficRoute:mesh-0:tr-22:1,TrafficRoute:mesh-0:tr-23:1,TrafficRoute:mesh-0:tr-24:1,TrafficRoute:mesh-0:tr-25:1,TrafficRoute:mesh-0:tr-26:1,TrafficRoute:mesh-0:tr-27:1,TrafficRoute:mesh-0:tr-28:1,TrafficRoute:mesh-0:tr-29:1,TrafficRoute:mesh-0:tr-2:1,TrafficRoute:mesh-0:tr-30:1,TrafficRoute:mesh-0:tr-31:1,TrafficRoute:mesh-0:tr-32:1,TrafficRoute:mesh-0:tr-33:1,TrafficRoute:mesh-0:tr-34:1,TrafficRoute:mesh-0:tr-35:1,TrafficRoute:mesh-0:tr-36:1,TrafficRoute:mesh-0:tr-37:1,TrafficRoute:mesh-0:tr-38:1,TrafficRoute:mesh-0:tr-39:1,TrafficRoute:mesh-0:tr-3:1,TrafficRoute:mesh-0:tr-40:1,TrafficRoute:mesh-0:tr-41:1,TrafficRoute:mesh-0:tr-42:1,TrafficRoute:mesh-0:tr-43:1,TrafficRoute:mesh-0:tr-44:1,TrafficRoute:mesh-0:tr-45:1,TrafficRoute:mesh-0:tr-46:1,TrafficRoute:mesh-0:tr-47:1,TrafficRoute:mesh-0:tr-48:1,TrafficRoute:mesh-0:tr-49:1,TrafficRoute:mesh-0:tr-4:1,TrafficRoute:mesh-0:tr-50:1,TrafficRoute:mesh-0:tr-51:1,TrafficRoute:mesh-0:tr-52:1,TrafficRoute:mesh-0:tr-53:1,TrafficRoute:mesh-0:tr-54:1,TrafficRoute:mesh-0:tr-55:1,TrafficRoute:mesh-0:tr-56:1,TrafficRoute:mesh-0:tr-57:1,TrafficRoute:mesh-0:tr-58:1,TrafficRoute:mesh-0:tr-59:1,TrafficRoute:mesh-0:tr-5:1,TrafficRoute:mesh-0:tr-60:1,TrafficRoute:mesh-0:tr-61:1,TrafficRoute:mesh-0:tr-62:1,TrafficRoute:mesh-0:tr-63:1,TrafficRoute:mesh-0:tr-64:1,TrafficRoute:mesh-0:tr-65:1,TrafficRoute:mesh-0:tr-66:1,TrafficRoute:mesh-0:tr-67:1,TrafficRoute:mesh-0:tr-68:1,TrafficRoute:mesh-0:tr-69:1,TrafficRoute:mesh-0:tr-6:1,TrafficRoute:mesh-0:tr-70:1,TrafficRoute:mesh-0:tr-71:1,TrafficRoute:mesh-0:tr-72:1,TrafficRoute:mesh-0:tr-73:1,TrafficRoute:mesh-0:tr-74:1,TrafficRoute:mesh-0:tr-75:1,TrafficRoute:mesh-0:tr-76:1,TrafficRoute:mesh-0:tr-77:1,TrafficRoute:mesh-0:tr-78:1,TrafficRoute:mesh-0:tr-79:1,TrafficRoute:mesh-0:tr-7:1,TrafficRoute:mesh-0:tr-80:1,TrafficRoute:mesh-0:tr-81:1,TrafficRoute:mesh-0:tr-82:1,TrafficRoute:mesh-0:tr-83:1,TrafficRoute:mesh-0:tr-84:1,TrafficRoute:mesh-0:tr-85:1,TrafficRoute:mesh-0:tr-86:1,TrafficRoute:mesh-0:tr-87:1,TrafficRoute:mesh-0:tr-88:1,TrafficRoute:mesh-0:tr-89:1,TrafficRoute:mesh-0:tr-8:1,TrafficRoute:mesh-0:tr-90:1,TrafficRoute:mesh-0:tr-91:1,TrafficRoute:mesh-0:tr-92:1,TrafficRoute:mesh-0:tr-93:1,TrafficRoute:mesh-0:tr-94:1,TrafficRoute:mesh-0:tr-95:1,TrafficRoute:mesh-0:tr-96:1,TrafficRoute:mesh-0:tr-97:1,TrafficRoute:mesh-0:tr-98:1,TrafficRoute:mesh-0:tr-99:1,TrafficRoute:mesh-0:tr-9:1`
 		Expect(hash).To(Equal(expectedHash))
 		Expect(countingManager.getQueries).To(Equal(1))  // one Get to obtain Mesh
 		Expect(countingManager.listQueries).To(Equal(2)) // 2 List to fetch Dataplanes and TrafficRoutes
@@ -133,7 +133,7 @@ var _ = Describe("MeshSnapshot Cache", func() {
 
 		hash, err = meshCache.GetHash(context.Background(), "mesh-0")
 		Expect(err).ToNot(HaveOccurred())
-		expectedHash = `Dataplane:mesh-0:dp-0:1:192.168.0.1,Dataplane:mesh-0:dp-10:1:192.168.0.1,Dataplane:mesh-0:dp-11:1:192.168.0.1,Dataplane:mesh-0:dp-12:1:192.168.0.1,Dataplane:mesh-0:dp-13:1:192.168.0.1,Dataplane:mesh-0:dp-14:1:192.168.0.1,Dataplane:mesh-0:dp-15:1:192.168.0.1,Dataplane:mesh-0:dp-16:1:192.168.0.1,Dataplane:mesh-0:dp-17:1:192.168.0.1,Dataplane:mesh-0:dp-18:1:192.168.0.1,Dataplane:mesh-0:dp-19:1:192.168.0.1,Dataplane:mesh-0:dp-1:2:1.1.1.1,Dataplane:mesh-0:dp-20:1:192.168.0.1,Dataplane:mesh-0:dp-21:1:192.168.0.1,Dataplane:mesh-0:dp-22:1:192.168.0.1,Dataplane:mesh-0:dp-23:1:192.168.0.1,Dataplane:mesh-0:dp-24:1:192.168.0.1,Dataplane:mesh-0:dp-25:1:192.168.0.1,Dataplane:mesh-0:dp-26:1:192.168.0.1,Dataplane:mesh-0:dp-27:1:192.168.0.1,Dataplane:mesh-0:dp-28:1:192.168.0.1,Dataplane:mesh-0:dp-29:1:192.168.0.1,Dataplane:mesh-0:dp-2:1:192.168.0.1,Dataplane:mesh-0:dp-30:1:192.168.0.1,Dataplane:mesh-0:dp-31:1:192.168.0.1,Dataplane:mesh-0:dp-32:1:192.168.0.1,Dataplane:mesh-0:dp-33:1:192.168.0.1,Dataplane:mesh-0:dp-34:1:192.168.0.1,Dataplane:mesh-0:dp-35:1:192.168.0.1,Dataplane:mesh-0:dp-36:1:192.168.0.1,Dataplane:mesh-0:dp-37:1:192.168.0.1,Dataplane:mesh-0:dp-38:1:192.168.0.1,Dataplane:mesh-0:dp-39:1:192.168.0.1,Dataplane:mesh-0:dp-3:1:192.168.0.1,Dataplane:mesh-0:dp-40:1:192.168.0.1,Dataplane:mesh-0:dp-41:1:192.168.0.1,Dataplane:mesh-0:dp-42:1:192.168.0.1,Dataplane:mesh-0:dp-43:1:192.168.0.1,Dataplane:mesh-0:dp-44:1:192.168.0.1,Dataplane:mesh-0:dp-45:1:192.168.0.1,Dataplane:mesh-0:dp-46:1:192.168.0.1,Dataplane:mesh-0:dp-47:1:192.168.0.1,Dataplane:mesh-0:dp-48:1:192.168.0.1,Dataplane:mesh-0:dp-49:1:192.168.0.1,Dataplane:mesh-0:dp-4:1:192.168.0.1,Dataplane:mesh-0:dp-50:1:192.168.0.1,Dataplane:mesh-0:dp-51:1:192.168.0.1,Dataplane:mesh-0:dp-52:1:192.168.0.1,Dataplane:mesh-0:dp-53:1:192.168.0.1,Dataplane:mesh-0:dp-54:1:192.168.0.1,Dataplane:mesh-0:dp-55:1:192.168.0.1,Dataplane:mesh-0:dp-56:1:192.168.0.1,Dataplane:mesh-0:dp-57:1:192.168.0.1,Dataplane:mesh-0:dp-58:1:192.168.0.1,Dataplane:mesh-0:dp-59:1:192.168.0.1,Dataplane:mesh-0:dp-5:1:192.168.0.1,Dataplane:mesh-0:dp-60:1:192.168.0.1,Dataplane:mesh-0:dp-61:1:192.168.0.1,Dataplane:mesh-0:dp-62:1:192.168.0.1,Dataplane:mesh-0:dp-63:1:192.168.0.1,Dataplane:mesh-0:dp-64:1:192.168.0.1,Dataplane:mesh-0:dp-65:1:192.168.0.1,Dataplane:mesh-0:dp-66:1:192.168.0.1,Dataplane:mesh-0:dp-67:1:192.168.0.1,Dataplane:mesh-0:dp-68:1:192.168.0.1,Dataplane:mesh-0:dp-69:1:192.168.0.1,Dataplane:mesh-0:dp-6:1:192.168.0.1,Dataplane:mesh-0:dp-70:1:192.168.0.1,Dataplane:mesh-0:dp-71:1:192.168.0.1,Dataplane:mesh-0:dp-72:1:192.168.0.1,Dataplane:mesh-0:dp-73:1:192.168.0.1,Dataplane:mesh-0:dp-74:1:192.168.0.1,Dataplane:mesh-0:dp-75:1:192.168.0.1,Dataplane:mesh-0:dp-76:1:192.168.0.1,Dataplane:mesh-0:dp-77:1:192.168.0.1,Dataplane:mesh-0:dp-78:1:192.168.0.1,Dataplane:mesh-0:dp-79:1:192.168.0.1,Dataplane:mesh-0:dp-7:1:192.168.0.1,Dataplane:mesh-0:dp-80:1:192.168.0.1,Dataplane:mesh-0:dp-81:1:192.168.0.1,Dataplane:mesh-0:dp-82:1:192.168.0.1,Dataplane:mesh-0:dp-83:1:192.168.0.1,Dataplane:mesh-0:dp-84:1:192.168.0.1,Dataplane:mesh-0:dp-85:1:192.168.0.1,Dataplane:mesh-0:dp-86:1:192.168.0.1,Dataplane:mesh-0:dp-87:1:192.168.0.1,Dataplane:mesh-0:dp-88:1:192.168.0.1,Dataplane:mesh-0:dp-89:1:192.168.0.1,Dataplane:mesh-0:dp-8:1:192.168.0.1,Dataplane:mesh-0:dp-90:1:192.168.0.1,Dataplane:mesh-0:dp-91:1:192.168.0.1,Dataplane:mesh-0:dp-92:1:192.168.0.1,Dataplane:mesh-0:dp-93:1:192.168.0.1,Dataplane:mesh-0:dp-94:1:192.168.0.1,Dataplane:mesh-0:dp-95:1:192.168.0.1,Dataplane:mesh-0:dp-96:1:192.168.0.1,Dataplane:mesh-0:dp-97:1:192.168.0.1,Dataplane:mesh-0:dp-98:1:192.168.0.1,Dataplane:mesh-0:dp-99:1:192.168.0.1,Dataplane:mesh-0:dp-9:1:192.168.0.1,Mesh:mesh-0:mesh-0:1,TrafficRoute:mesh-0:tr-0:1,TrafficRoute:mesh-0:tr-10:1,TrafficRoute:mesh-0:tr-11:1,TrafficRoute:mesh-0:tr-12:1,TrafficRoute:mesh-0:tr-13:1,TrafficRoute:mesh-0:tr-14:1,TrafficRoute:mesh-0:tr-15:1,TrafficRoute:mesh-0:tr-16:1,TrafficRoute:mesh-0:tr-17:1,TrafficRoute:mesh-0:tr-18:1,TrafficRoute:mesh-0:tr-19:1,TrafficRoute:mesh-0:tr-1:1,TrafficRoute:mesh-0:tr-20:1,TrafficRoute:mesh-0:tr-21:1,TrafficRoute:mesh-0:tr-22:1,TrafficRoute:mesh-0:tr-23:1,TrafficRoute:mesh-0:tr-24:1,TrafficRoute:mesh-0:tr-25:1,TrafficRoute:mesh-0:tr-26:1,TrafficRoute:mesh-0:tr-27:1,TrafficRoute:mesh-0:tr-28:1,TrafficRoute:mesh-0:tr-29:1,TrafficRoute:mesh-0:tr-2:1,TrafficRoute:mesh-0:tr-30:1,TrafficRoute:mesh-0:tr-31:1,TrafficRoute:mesh-0:tr-32:1,TrafficRoute:mesh-0:tr-33:1,TrafficRoute:mesh-0:tr-34:1,TrafficRoute:mesh-0:tr-35:1,TrafficRoute:mesh-0:tr-36:1,TrafficRoute:mesh-0:tr-37:1,TrafficRoute:mesh-0:tr-38:1,TrafficRoute:mesh-0:tr-39:1,TrafficRoute:mesh-0:tr-3:1,TrafficRoute:mesh-0:tr-40:1,TrafficRoute:mesh-0:tr-41:1,TrafficRoute:mesh-0:tr-42:1,TrafficRoute:mesh-0:tr-43:1,TrafficRoute:mesh-0:tr-44:1,TrafficRoute:mesh-0:tr-45:1,TrafficRoute:mesh-0:tr-46:1,TrafficRoute:mesh-0:tr-47:1,TrafficRoute:mesh-0:tr-48:1,TrafficRoute:mesh-0:tr-49:1,TrafficRoute:mesh-0:tr-4:1,TrafficRoute:mesh-0:tr-50:1,TrafficRoute:mesh-0:tr-51:1,TrafficRoute:mesh-0:tr-52:1,TrafficRoute:mesh-0:tr-53:1,TrafficRoute:mesh-0:tr-54:1,TrafficRoute:mesh-0:tr-55:1,TrafficRoute:mesh-0:tr-56:1,TrafficRoute:mesh-0:tr-57:1,TrafficRoute:mesh-0:tr-58:1,TrafficRoute:mesh-0:tr-59:1,TrafficRoute:mesh-0:tr-5:1,TrafficRoute:mesh-0:tr-60:1,TrafficRoute:mesh-0:tr-61:1,TrafficRoute:mesh-0:tr-62:1,TrafficRoute:mesh-0:tr-63:1,TrafficRoute:mesh-0:tr-64:1,TrafficRoute:mesh-0:tr-65:1,TrafficRoute:mesh-0:tr-66:1,TrafficRoute:mesh-0:tr-67:1,TrafficRoute:mesh-0:tr-68:1,TrafficRoute:mesh-0:tr-69:1,TrafficRoute:mesh-0:tr-6:1,TrafficRoute:mesh-0:tr-70:1,TrafficRoute:mesh-0:tr-71:1,TrafficRoute:mesh-0:tr-72:1,TrafficRoute:mesh-0:tr-73:1,TrafficRoute:mesh-0:tr-74:1,TrafficRoute:mesh-0:tr-75:1,TrafficRoute:mesh-0:tr-76:1,TrafficRoute:mesh-0:tr-77:1,TrafficRoute:mesh-0:tr-78:1,TrafficRoute:mesh-0:tr-79:1,TrafficRoute:mesh-0:tr-7:1,TrafficRoute:mesh-0:tr-80:1,TrafficRoute:mesh-0:tr-81:1,TrafficRoute:mesh-0:tr-82:1,TrafficRoute:mesh-0:tr-83:1,TrafficRoute:mesh-0:tr-84:1,TrafficRoute:mesh-0:tr-85:1,TrafficRoute:mesh-0:tr-86:1,TrafficRoute:mesh-0:tr-87:1,TrafficRoute:mesh-0:tr-88:1,TrafficRoute:mesh-0:tr-89:1,TrafficRoute:mesh-0:tr-8:1,TrafficRoute:mesh-0:tr-90:1,TrafficRoute:mesh-0:tr-91:1,TrafficRoute:mesh-0:tr-92:1,TrafficRoute:mesh-0:tr-93:1,TrafficRoute:mesh-0:tr-94:1,TrafficRoute:mesh-0:tr-95:1,TrafficRoute:mesh-0:tr-96:1,TrafficRoute:mesh-0:tr-97:1,TrafficRoute:mesh-0:tr-98:1,TrafficRoute:mesh-0:tr-99:1,TrafficRoute:mesh-0:tr-9:1`
+		expectedHash = `Dataplane:mesh-0:dp-0:1:192.168.0.1,Dataplane:mesh-0:dp-10:1:192.168.0.1,Dataplane:mesh-0:dp-11:1:192.168.0.1,Dataplane:mesh-0:dp-12:1:192.168.0.1,Dataplane:mesh-0:dp-13:1:192.168.0.1,Dataplane:mesh-0:dp-14:1:192.168.0.1,Dataplane:mesh-0:dp-15:1:192.168.0.1,Dataplane:mesh-0:dp-16:1:192.168.0.1,Dataplane:mesh-0:dp-17:1:192.168.0.1,Dataplane:mesh-0:dp-18:1:192.168.0.1,Dataplane:mesh-0:dp-19:1:192.168.0.1,Dataplane:mesh-0:dp-1:2:1.1.1.1,Dataplane:mesh-0:dp-20:1:192.168.0.1,Dataplane:mesh-0:dp-21:1:192.168.0.1,Dataplane:mesh-0:dp-22:1:192.168.0.1,Dataplane:mesh-0:dp-23:1:192.168.0.1,Dataplane:mesh-0:dp-24:1:192.168.0.1,Dataplane:mesh-0:dp-25:1:192.168.0.1,Dataplane:mesh-0:dp-26:1:192.168.0.1,Dataplane:mesh-0:dp-27:1:192.168.0.1,Dataplane:mesh-0:dp-28:1:192.168.0.1,Dataplane:mesh-0:dp-29:1:192.168.0.1,Dataplane:mesh-0:dp-2:1:192.168.0.1,Dataplane:mesh-0:dp-30:1:192.168.0.1,Dataplane:mesh-0:dp-31:1:192.168.0.1,Dataplane:mesh-0:dp-32:1:192.168.0.1,Dataplane:mesh-0:dp-33:1:192.168.0.1,Dataplane:mesh-0:dp-34:1:192.168.0.1,Dataplane:mesh-0:dp-35:1:192.168.0.1,Dataplane:mesh-0:dp-36:1:192.168.0.1,Dataplane:mesh-0:dp-37:1:192.168.0.1,Dataplane:mesh-0:dp-38:1:192.168.0.1,Dataplane:mesh-0:dp-39:1:192.168.0.1,Dataplane:mesh-0:dp-3:1:192.168.0.1,Dataplane:mesh-0:dp-40:1:192.168.0.1,Dataplane:mesh-0:dp-41:1:192.168.0.1,Dataplane:mesh-0:dp-42:1:192.168.0.1,Dataplane:mesh-0:dp-43:1:192.168.0.1,Dataplane:mesh-0:dp-44:1:192.168.0.1,Dataplane:mesh-0:dp-45:1:192.168.0.1,Dataplane:mesh-0:dp-46:1:192.168.0.1,Dataplane:mesh-0:dp-47:1:192.168.0.1,Dataplane:mesh-0:dp-48:1:192.168.0.1,Dataplane:mesh-0:dp-49:1:192.168.0.1,Dataplane:mesh-0:dp-4:1:192.168.0.1,Dataplane:mesh-0:dp-50:1:192.168.0.1,Dataplane:mesh-0:dp-51:1:192.168.0.1,Dataplane:mesh-0:dp-52:1:192.168.0.1,Dataplane:mesh-0:dp-53:1:192.168.0.1,Dataplane:mesh-0:dp-54:1:192.168.0.1,Dataplane:mesh-0:dp-55:1:192.168.0.1,Dataplane:mesh-0:dp-56:1:192.168.0.1,Dataplane:mesh-0:dp-57:1:192.168.0.1,Dataplane:mesh-0:dp-58:1:192.168.0.1,Dataplane:mesh-0:dp-59:1:192.168.0.1,Dataplane:mesh-0:dp-5:1:192.168.0.1,Dataplane:mesh-0:dp-60:1:192.168.0.1,Dataplane:mesh-0:dp-61:1:192.168.0.1,Dataplane:mesh-0:dp-62:1:192.168.0.1,Dataplane:mesh-0:dp-63:1:192.168.0.1,Dataplane:mesh-0:dp-64:1:192.168.0.1,Dataplane:mesh-0:dp-65:1:192.168.0.1,Dataplane:mesh-0:dp-66:1:192.168.0.1,Dataplane:mesh-0:dp-67:1:192.168.0.1,Dataplane:mesh-0:dp-68:1:192.168.0.1,Dataplane:mesh-0:dp-69:1:192.168.0.1,Dataplane:mesh-0:dp-6:1:192.168.0.1,Dataplane:mesh-0:dp-70:1:192.168.0.1,Dataplane:mesh-0:dp-71:1:192.168.0.1,Dataplane:mesh-0:dp-72:1:192.168.0.1,Dataplane:mesh-0:dp-73:1:192.168.0.1,Dataplane:mesh-0:dp-74:1:192.168.0.1,Dataplane:mesh-0:dp-75:1:192.168.0.1,Dataplane:mesh-0:dp-76:1:192.168.0.1,Dataplane:mesh-0:dp-77:1:192.168.0.1,Dataplane:mesh-0:dp-78:1:192.168.0.1,Dataplane:mesh-0:dp-79:1:192.168.0.1,Dataplane:mesh-0:dp-7:1:192.168.0.1,Dataplane:mesh-0:dp-80:1:192.168.0.1,Dataplane:mesh-0:dp-81:1:192.168.0.1,Dataplane:mesh-0:dp-82:1:192.168.0.1,Dataplane:mesh-0:dp-83:1:192.168.0.1,Dataplane:mesh-0:dp-84:1:192.168.0.1,Dataplane:mesh-0:dp-85:1:192.168.0.1,Dataplane:mesh-0:dp-86:1:192.168.0.1,Dataplane:mesh-0:dp-87:1:192.168.0.1,Dataplane:mesh-0:dp-88:1:192.168.0.1,Dataplane:mesh-0:dp-89:1:192.168.0.1,Dataplane:mesh-0:dp-8:1:192.168.0.1,Dataplane:mesh-0:dp-90:1:192.168.0.1,Dataplane:mesh-0:dp-91:1:192.168.0.1,Dataplane:mesh-0:dp-92:1:192.168.0.1,Dataplane:mesh-0:dp-93:1:192.168.0.1,Dataplane:mesh-0:dp-94:1:192.168.0.1,Dataplane:mesh-0:dp-95:1:192.168.0.1,Dataplane:mesh-0:dp-96:1:192.168.0.1,Dataplane:mesh-0:dp-97:1:192.168.0.1,Dataplane:mesh-0:dp-98:1:192.168.0.1,Dataplane:mesh-0:dp-99:1:192.168.0.1,Dataplane:mesh-0:dp-9:1:192.168.0.1,Mesh::mesh-0:1,TrafficRoute:mesh-0:tr-0:1,TrafficRoute:mesh-0:tr-10:1,TrafficRoute:mesh-0:tr-11:1,TrafficRoute:mesh-0:tr-12:1,TrafficRoute:mesh-0:tr-13:1,TrafficRoute:mesh-0:tr-14:1,TrafficRoute:mesh-0:tr-15:1,TrafficRoute:mesh-0:tr-16:1,TrafficRoute:mesh-0:tr-17:1,TrafficRoute:mesh-0:tr-18:1,TrafficRoute:mesh-0:tr-19:1,TrafficRoute:mesh-0:tr-1:1,TrafficRoute:mesh-0:tr-20:1,TrafficRoute:mesh-0:tr-21:1,TrafficRoute:mesh-0:tr-22:1,TrafficRoute:mesh-0:tr-23:1,TrafficRoute:mesh-0:tr-24:1,TrafficRoute:mesh-0:tr-25:1,TrafficRoute:mesh-0:tr-26:1,TrafficRoute:mesh-0:tr-27:1,TrafficRoute:mesh-0:tr-28:1,TrafficRoute:mesh-0:tr-29:1,TrafficRoute:mesh-0:tr-2:1,TrafficRoute:mesh-0:tr-30:1,TrafficRoute:mesh-0:tr-31:1,TrafficRoute:mesh-0:tr-32:1,TrafficRoute:mesh-0:tr-33:1,TrafficRoute:mesh-0:tr-34:1,TrafficRoute:mesh-0:tr-35:1,TrafficRoute:mesh-0:tr-36:1,TrafficRoute:mesh-0:tr-37:1,TrafficRoute:mesh-0:tr-38:1,TrafficRoute:mesh-0:tr-39:1,TrafficRoute:mesh-0:tr-3:1,TrafficRoute:mesh-0:tr-40:1,TrafficRoute:mesh-0:tr-41:1,TrafficRoute:mesh-0:tr-42:1,TrafficRoute:mesh-0:tr-43:1,TrafficRoute:mesh-0:tr-44:1,TrafficRoute:mesh-0:tr-45:1,TrafficRoute:mesh-0:tr-46:1,TrafficRoute:mesh-0:tr-47:1,TrafficRoute:mesh-0:tr-48:1,TrafficRoute:mesh-0:tr-49:1,TrafficRoute:mesh-0:tr-4:1,TrafficRoute:mesh-0:tr-50:1,TrafficRoute:mesh-0:tr-51:1,TrafficRoute:mesh-0:tr-52:1,TrafficRoute:mesh-0:tr-53:1,TrafficRoute:mesh-0:tr-54:1,TrafficRoute:mesh-0:tr-55:1,TrafficRoute:mesh-0:tr-56:1,TrafficRoute:mesh-0:tr-57:1,TrafficRoute:mesh-0:tr-58:1,TrafficRoute:mesh-0:tr-59:1,TrafficRoute:mesh-0:tr-5:1,TrafficRoute:mesh-0:tr-60:1,TrafficRoute:mesh-0:tr-61:1,TrafficRoute:mesh-0:tr-62:1,TrafficRoute:mesh-0:tr-63:1,TrafficRoute:mesh-0:tr-64:1,TrafficRoute:mesh-0:tr-65:1,TrafficRoute:mesh-0:tr-66:1,TrafficRoute:mesh-0:tr-67:1,TrafficRoute:mesh-0:tr-68:1,TrafficRoute:mesh-0:tr-69:1,TrafficRoute:mesh-0:tr-6:1,TrafficRoute:mesh-0:tr-70:1,TrafficRoute:mesh-0:tr-71:1,TrafficRoute:mesh-0:tr-72:1,TrafficRoute:mesh-0:tr-73:1,TrafficRoute:mesh-0:tr-74:1,TrafficRoute:mesh-0:tr-75:1,TrafficRoute:mesh-0:tr-76:1,TrafficRoute:mesh-0:tr-77:1,TrafficRoute:mesh-0:tr-78:1,TrafficRoute:mesh-0:tr-79:1,TrafficRoute:mesh-0:tr-7:1,TrafficRoute:mesh-0:tr-80:1,TrafficRoute:mesh-0:tr-81:1,TrafficRoute:mesh-0:tr-82:1,TrafficRoute:mesh-0:tr-83:1,TrafficRoute:mesh-0:tr-84:1,TrafficRoute:mesh-0:tr-85:1,TrafficRoute:mesh-0:tr-86:1,TrafficRoute:mesh-0:tr-87:1,TrafficRoute:mesh-0:tr-88:1,TrafficRoute:mesh-0:tr-89:1,TrafficRoute:mesh-0:tr-8:1,TrafficRoute:mesh-0:tr-90:1,TrafficRoute:mesh-0:tr-91:1,TrafficRoute:mesh-0:tr-92:1,TrafficRoute:mesh-0:tr-93:1,TrafficRoute:mesh-0:tr-94:1,TrafficRoute:mesh-0:tr-95:1,TrafficRoute:mesh-0:tr-96:1,TrafficRoute:mesh-0:tr-97:1,TrafficRoute:mesh-0:tr-98:1,TrafficRoute:mesh-0:tr-99:1,TrafficRoute:mesh-0:tr-9:1`
 		Expect(hash).To(Equal(expectedHash))
 		Expect(countingManager.getQueries).To(Equal(2))
 		Expect(countingManager.listQueries).To(Equal(4))
diff --git a/pkg/xds/envoy/clusters/client_side_mtls_configurer_test.go b/pkg/xds/envoy/clusters/client_side_mtls_configurer_test.go
index 1d965f37e..9aa005a44 100644
--- a/pkg/xds/envoy/clusters/client_side_mtls_configurer_test.go
+++ b/pkg/xds/envoy/clusters/client_side_mtls_configurer_test.go
@@ -52,7 +52,6 @@ var _ = Describe("EdsClusterConfigurer", func() {
 				Mesh: xds_context.MeshContext{
 					Resource: &mesh_core.MeshResource{
 						Meta: &test_model.ResourceMeta{
-							Mesh: "default",
 							Name: "default",
 						},
 						Spec: mesh_proto.Mesh{
@@ -124,7 +123,6 @@ var _ = Describe("EdsClusterConfigurer", func() {
 				Mesh: xds_context.MeshContext{
 					Resource: &mesh_core.MeshResource{
 						Meta: &test_model.ResourceMeta{
-							Mesh: "default",
 							Name: "default",
 						},
 						Spec: mesh_proto.Mesh{
@@ -249,7 +247,6 @@ var _ = Describe("EdsClusterConfigurer", func() {
 				Mesh: xds_context.MeshContext{
 					Resource: &mesh_core.MeshResource{
 						Meta: &test_model.ResourceMeta{
-							Mesh: "default",
 							Name: "default",
 						},
 						Spec: mesh_proto.Mesh{
diff --git a/pkg/xds/envoy/listeners/server_mtls_configurer_test.go b/pkg/xds/envoy/listeners/server_mtls_configurer_test.go
index 7e2a504f7..94466bb47 100644
--- a/pkg/xds/envoy/listeners/server_mtls_configurer_test.go
+++ b/pkg/xds/envoy/listeners/server_mtls_configurer_test.go
@@ -62,7 +62,6 @@ var _ = Describe("ServerMtlsConfigurer", func() {
 				Mesh: xds_context.MeshContext{
 					Resource: &mesh_core.MeshResource{
 						Meta: &test_model.ResourceMeta{
-							Mesh: "default",
 							Name: "default",
 						},
 						Spec: mesh_proto.Mesh{
@@ -145,7 +144,6 @@ var _ = Describe("ServerMtlsConfigurer", func() {
 				Mesh: xds_context.MeshContext{
 					Resource: &mesh_core.MeshResource{
 						Meta: &test_model.ResourceMeta{
-							Mesh: "default",
 							Name: "default",
 						},
 						Spec: mesh_proto.Mesh{
diff --git a/pkg/xds/envoy/tls_test.go b/pkg/xds/envoy/tls_test.go
index b43d3b8e5..6c19ba0d0 100644
--- a/pkg/xds/envoy/tls_test.go
+++ b/pkg/xds/envoy/tls_test.go
@@ -56,7 +56,6 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
 					Mesh: xds_context.MeshContext{
 						Resource: &mesh_core.MeshResource{
 							Meta: &test_model.ResourceMeta{
-								Mesh: "default",
 								Name: "default",
 							},
 							Spec: mesh_proto.Mesh{
@@ -260,7 +259,6 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
 					Mesh: xds_context.MeshContext{
 						Resource: &mesh_core.MeshResource{
 							Meta: &test_model.ResourceMeta{
-								Mesh: "default",
 								Name: "default",
 							},
 							Spec: mesh_proto.Mesh{
diff --git a/pkg/xds/generator/inbound_proxy_generator_test.go b/pkg/xds/generator/inbound_proxy_generator_test.go
index 1f35c9cef..c56ed4b39 100644
--- a/pkg/xds/generator/inbound_proxy_generator_test.go
+++ b/pkg/xds/generator/inbound_proxy_generator_test.go
@@ -40,7 +40,6 @@ var _ = Describe("InboundProxyGenerator", func() {
 				Mesh: xds_context.MeshContext{
 					Resource: &mesh_core.MeshResource{
 						Meta: &test_model.ResourceMeta{
-							Mesh: "default",
 							Name: "default",
 						},
 						Spec: mesh_proto.Mesh{
diff --git a/pkg/xds/generator/outbound_proxy_generator_test.go b/pkg/xds/generator/outbound_proxy_generator_test.go
index 982af6b1e..d754e3a7f 100644
--- a/pkg/xds/generator/outbound_proxy_generator_test.go
+++ b/pkg/xds/generator/outbound_proxy_generator_test.go
@@ -21,7 +21,6 @@ import (
 var _ = Describe("OutboundProxyGenerator", func() {
 
 	meta := &test_model.ResourceMeta{
-		Mesh: "mesh1",
 		Name: "mesh1",
 	}
 	plainCtx := xds_context.Context{
diff --git a/pkg/xds/server/components_test.go b/pkg/xds/server/components_test.go
index 79a71603e..17fcf67e5 100644
--- a/pkg/xds/server/components_test.go
+++ b/pkg/xds/server/components_test.go
@@ -54,7 +54,7 @@ var _ = Describe("Components", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			// and example mesh
-			opts := core_store.CreateByKey("demo", "demo")
+			opts := core_store.CreateByKey("demo", core_model.NoMesh)
 			err = runtime.ResourceManager().Create(context.Background(), &mesh_core.MeshResource{}, opts)
 			Expect(err).ToNot(HaveOccurred())
 
diff --git a/pkg/xds/server/dataplane_lifecycle_test.go b/pkg/xds/server/dataplane_lifecycle_test.go
index df962ceee..36963208c 100644
--- a/pkg/xds/server/dataplane_lifecycle_test.go
+++ b/pkg/xds/server/dataplane_lifecycle_test.go
@@ -12,6 +12,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
+	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/test/resources/model"
@@ -28,7 +29,7 @@ var _ = Describe("Dataplane Lifecycle", func() {
 		resManager = core_manager.NewResourceManager(store)
 		dpLifecycle = server.NewDataplaneLifecycle(resManager)
 
-		err := resManager.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey("default", "default"))
+		err := resManager.Create(context.Background(), &core_mesh.MeshResource{}, core_store.CreateByKey(core_model.DefaultMesh, core_model.NoMesh))
 		Expect(err).ToNot(HaveOccurred())
 	})
 
diff --git a/pkg/xds/server/dataplane_status_sink_test.go b/pkg/xds/server/dataplane_status_sink_test.go
index 648a3f5cc..ca330b533 100644
--- a/pkg/xds/server/dataplane_status_sink_test.go
+++ b/pkg/xds/server/dataplane_status_sink_test.go
@@ -135,7 +135,7 @@ var _ = Describe("DataplaneInsightSink", func() {
 
 		BeforeEach(func() {
 			store = memory_resources.NewStore()
-			err := store.Create(context.Background(), &mesh_core.MeshResource{}, core_store.CreateByKey("default", "default"))
+			err := store.Create(context.Background(), &mesh_core.MeshResource{}, core_store.CreateByKey(core_model.DefaultMesh, core_model.NoMesh))
 			Expect(err).ToNot(HaveOccurred())
 		})
 
diff --git a/pkg/xds/topology/healthchecks_test.go b/pkg/xds/topology/healthchecks_test.go
index ffc321f12..6f96cb894 100644
--- a/pkg/xds/topology/healthchecks_test.go
+++ b/pkg/xds/topology/healthchecks_test.go
@@ -38,13 +38,11 @@ var _ = Describe("HealthCheck", func() {
 			// given
 			mesh := &mesh_core.MeshResource{ // mesh that is relevant to this test case
 				Meta: &test_model.ResourceMeta{
-					Mesh: "demo",
 					Name: "demo",
 				},
 			}
 			otherMesh := &mesh_core.MeshResource{ // mesh that is irrelevant to this test case
 				Meta: &test_model.ResourceMeta{
-					Mesh: "default",
 					Name: "default",
 				},
 			}
diff --git a/pkg/xds/topology/outbound_test.go b/pkg/xds/topology/outbound_test.go
index 7177a13cd..f7459efdb 100644
--- a/pkg/xds/topology/outbound_test.go
+++ b/pkg/xds/topology/outbound_test.go
@@ -17,7 +17,6 @@ var _ = Describe("TrafficRoute", func() {
 	const defaultMeshName = "default"
 	defaultMeshWithMTLS := &mesh_core.MeshResource{
 		Meta: &test_model.ResourceMeta{
-			Mesh: defaultMeshName,
 			Name: defaultMeshName,
 		},
 		Spec: mesh_proto.Mesh{
@@ -28,7 +27,6 @@ var _ = Describe("TrafficRoute", func() {
 	}
 	defaultMeshWithoutMTLS := &mesh_core.MeshResource{
 		Meta: &test_model.ResourceMeta{
-			Mesh: defaultMeshName,
 			Name: defaultMeshName,
 		},
 		Spec: mesh_proto.Mesh{
@@ -39,7 +37,6 @@ var _ = Describe("TrafficRoute", func() {
 	}
 	defaultMeshWithLocality := &mesh_core.MeshResource{
 		Meta: &test_model.ResourceMeta{
-			Mesh: defaultMeshName,
 			Name: defaultMeshName,
 		},
 		Spec: mesh_proto.Mesh{
diff --git a/pkg/xds/topology/router_test.go b/pkg/xds/topology/router_test.go
index 701c41e71..fde694cc0 100644
--- a/pkg/xds/topology/router_test.go
+++ b/pkg/xds/topology/router_test.go
@@ -36,13 +36,11 @@ var _ = Describe("TrafficRoute", func() {
 			// given
 			mesh := &mesh_core.MeshResource{ // mesh that is relevant to this test case
 				Meta: &test_model.ResourceMeta{
-					Mesh: "demo",
 					Name: "demo",
 				},
 			}
 			otherMesh := &mesh_core.MeshResource{ // mesh that is irrelevant to this test case
 				Meta: &test_model.ResourceMeta{
-					Mesh: "default",
 					Name: "default",
 				},
 			}
diff --git a/test/dockerfiles/Dockerfile.universal b/test/dockerfiles/Dockerfile.universal
index b4199a34c..fd9b9c686 100644
--- a/test/dockerfiles/Dockerfile.universal
+++ b/test/dockerfiles/Dockerfile.universal
@@ -1,5 +1,9 @@
-# using Envoy's base to inherit the Envoy binary
-FROM envoyproxy/envoy-alpine:v1.16.0
+# using Envoy's base to copy the Envoy binary
+FROM envoyproxy/envoy-alpine:v1.16.0 as envoy
+
+FROM ubuntu:20.04
+
+COPY --from=envoy /usr/local/bin/envoy /usr/local/bin/envoy
 
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/kuma-cp/kuma-cp /usr/bin
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/kuma-dp/kuma-dp /usr/bin
@@ -9,10 +13,16 @@ RUN mkdir /kuma
 RUN echo "# use this file to override default configuration of \`kuma-cp\`" > /kuma/kuma-cp.conf \
     && chmod a+rw /kuma/kuma-cp.conf
 
-RUN apk add --no-cache openssh curl nmap-ncat vim \
-  && ssh-keygen -A \
+RUN apt update \
+  && apt dist-upgrade -y \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -y tzdata \
+  && apt install -y openssh-server curl ncat vim \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN ssh-keygen -A \
   && sed -i s/#PermitRootLogin.*/PermitRootLogin\ yes/ /etc/ssh/sshd_config \
   && sed -i s/#PermitEmptyPasswords.*/PermitEmptyPasswords\ yes/ /etc/ssh/sshd_config \
+  && mkdir /var/run/sshd \
   && passwd -d root
 
 # do not detach (-D), log to stderr (-e)
diff --git a/test/e2e/testdata/demo-client.yaml b/test/e2e/testdata/demo-client.yaml
index 6a7b102ed..a3e602f19 100644
--- a/test/e2e/testdata/demo-client.yaml
+++ b/test/e2e/testdata/demo-client.yaml
@@ -33,13 +33,13 @@ spec:
     spec:
       containers:
         - name: demo-client
-          image: kong-docker-kuma-ci-docker.bintray.io/curl
+          image: kuma-universal
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 3000
-          command:
-            - nc
-            - -lvk
+          command: [ "ncat" ]
+          args:
+            - -lk
             - -p
             - "3000"
           resources:
diff --git a/test/e2e/testdata/echo-server.yaml b/test/e2e/testdata/echo-server.yaml
index 33e1a7752..ac9498aaf 100644
--- a/test/e2e/testdata/echo-server.yaml
+++ b/test/e2e/testdata/echo-server.yaml
@@ -35,7 +35,7 @@ spec:
     spec:
       containers:
         - name: echo-server
-          image: alpine
+          image: kuma-universal
           imagePullPolicy: IfNotPresent
           readinessProbe:
             httpGet:
@@ -45,15 +45,13 @@ spec:
             periodSeconds: 3
           ports:
             - containerPort: 80
-          command:
-            - nc
+          command: [ "ncat" ]
+          args:
             - -lk
             - -p
             - "80"
-            - -e
-            - echo
-            - -e
-            - "HTTP/1.1 200 OK\n\n"
+            - --sh-exec
+            - '/usr/bin/printf "HTTP/1.1 200 OK\n\n Echo\n"'
           resources:
             limits:
               cpu: 50m
diff --git a/test/framework/universal_app.go b/test/framework/universal_app.go
index a86118885..0b3d1e098 100644
--- a/test/framework/universal_app.go
+++ b/test/framework/universal_app.go
@@ -233,7 +233,7 @@ func (s *UniversalApp) CreateDP(token, cpAddress, appname, ip, dpyaml string) {
 }
 
 func (s *UniversalApp) getIP() (string, error) {
-	cmd := SshCmd(s.ports[sshPort], []string{}, []string{"getent", "hosts", s.container[:12]})
+	cmd := SshCmd(s.ports[sshPort], []string{}, []string{"getent", "ahosts", s.container[:12]})
 	bytes, err := cmd.CombinedOutput()
 	if err != nil {
 		return "invalid", errors.Wrapf(err, "getent failed with %s", string(bytes))