Repository: kumahq/kuma
Pull request #1046 (2020-10-01 14:16:43)

feat(kuma-cp) exclude traffic interceptions on port using annotations
### Summary

This PR introduces annotations to exclude specified ports from being intercepted by Envoy
```
traffic.kuma.io/exclude-inbound-ports annotation
traffic.kuma.io/exclude-outbound-ports annotation
```
Additionally, there is an option to apply this globally with
```
KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
```
Because overriding individual config settings was not possible on K8S I introduced
```
controlPlane:
  envVar:
    KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS: 1234
```
in HELM

and
```
--env-var KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS=1234
```
in `kumactl install`

When you apply global configuration, we automatically add annotation to Pod but only if the annotation is not defined, so the user can override global behavior.

### Documentation

- [ ] https://github.com/kumahq/kuma-website/pull/285



Patch:
diff --git a/app/kumactl/cmd/install/install_control_plane.go b/app/kumactl/cmd/install/install_control_plane.go
index 863879f5a..4ef748a14 100644
--- a/app/kumactl/cmd/install/install_control_plane.go
+++ b/app/kumactl/cmd/install/install_control_plane.go
@@ -26,34 +26,35 @@ var (
 )
 
 type InstallControlPlaneArgs struct {
-	Namespace                                 string           `helm:"namespace"`
-	ControlPlane_image_pullPolicy             string           `helm:"controlPlane.image.pullPolicy"`
-	ControlPlane_image_registry               string           `helm:"controlPlane.image.registry"`
-	ControlPlane_image_repository             string           `helm:"controlPlane.image.repository"`
-	ControlPlane_image_tag                    string           `helm:"controlPlane.image.tag"`
-	ControlPlane_service_name                 string           `helm:"controlPlane.service.name"`
-	ControlPlane_tls_cert                     string           `helm:"controlPlane.tls.cert"`
-	ControlPlane_tls_key                      string           `helm:"controlPlane.tls.key"`
-	ControlPlane_injectorFailurePolicy        string           `helm:"controlPlane.injectorFailurePolicy"`
-	ControlPlane_secrets                      []ImageEnvSecret `helm:"controlPlane.secrets"`
-	DataPlane_image_registry                  string           `helm:"dataPlane.image.registry"`
-	DataPlane_image_repository                string           `helm:"dataPlane.image.repository"`
-	DataPlane_image_tag                       string           `helm:"dataPlane.image.tag"`
-	DataPlane_initImage_registry              string           `helm:"dataPlane.initImage.registry"`
-	DataPlane_initImage_repository            string           `helm:"dataPlane.initImage.repository"`
-	DataPlane_initImage_tag                   string           `helm:"dataPlane.initImage.tag"`
-	ControlPlane_kdsGlobalAddress             string           `helm:"controlPlane.kdsGlobalAddress"`
-	Cni_enabled                               bool             `helm:"cni.enabled"`
-	Cni_image_registry                        string           `helm:"cni.image.registry"`
-	Cni_image_repository                      string           `helm:"cni.image.repository"`
-	Cni_image_tag                             string           `helm:"cni.image.tag"`
-	ControlPlane_mode                         string           `helm:"controlPlane.mode"`
-	ControlPlane_zone                         string           `helm:"controlPlane.zone"`
-	ControlPlane_globalRemoteSyncService_type string           `helm:"controlPlane.globalRemoteSyncService.type"`
-	Ingress_enabled                           bool             `helm:"ingress.enabled"`
-	Ingress_mesh                              string           `helm:"ingress.mesh"`
-	Ingress_drainTime                         string           `helm:"ingress.drainTime"`
-	Ingress_service_type                      string           `helm:"ingress.service.type"`
+	Namespace                                 string            `helm:"namespace"`
+	ControlPlane_image_pullPolicy             string            `helm:"controlPlane.image.pullPolicy"`
+	ControlPlane_image_registry               string            `helm:"controlPlane.image.registry"`
+	ControlPlane_image_repository             string            `helm:"controlPlane.image.repository"`
+	ControlPlane_image_tag                    string            `helm:"controlPlane.image.tag"`
+	ControlPlane_service_name                 string            `helm:"controlPlane.service.name"`
+	ControlPlane_tls_cert                     string            `helm:"controlPlane.tls.cert"`
+	ControlPlane_tls_key                      string            `helm:"controlPlane.tls.key"`
+	ControlPlane_injectorFailurePolicy        string            `helm:"controlPlane.injectorFailurePolicy"`
+	ControlPlane_secrets                      []ImageEnvSecret  `helm:"controlPlane.secrets"`
+	ControlPlane_envVars                      map[string]string `helm:"controlPlane.envVars"`
+	DataPlane_image_registry                  string            `helm:"dataPlane.image.registry"`
+	DataPlane_image_repository                string            `helm:"dataPlane.image.repository"`
+	DataPlane_image_tag                       string            `helm:"dataPlane.image.tag"`
+	DataPlane_initImage_registry              string            `helm:"dataPlane.initImage.registry"`
+	DataPlane_initImage_repository            string            `helm:"dataPlane.initImage.repository"`
+	DataPlane_initImage_tag                   string            `helm:"dataPlane.initImage.tag"`
+	ControlPlane_kdsGlobalAddress             string            `helm:"controlPlane.kdsGlobalAddress"`
+	Cni_enabled                               bool              `helm:"cni.enabled"`
+	Cni_image_registry                        string            `helm:"cni.image.registry"`
+	Cni_image_repository                      string            `helm:"cni.image.repository"`
+	Cni_image_tag                             string            `helm:"cni.image.tag"`
+	ControlPlane_mode                         string            `helm:"controlPlane.mode"`
+	ControlPlane_zone                         string            `helm:"controlPlane.zone"`
+	ControlPlane_globalRemoteSyncService_type string            `helm:"controlPlane.globalRemoteSyncService.type"`
+	Ingress_enabled                           bool              `helm:"ingress.enabled"`
+	Ingress_mesh                              string            `helm:"ingress.mesh"`
+	Ingress_drainTime                         string            `helm:"ingress.drainTime"`
+	Ingress_service_type                      string            `helm:"ingress.service.type"`
 }
 
 type ImageEnvSecret struct {
@@ -71,6 +72,7 @@ var DefaultInstallControlPlaneArgs = InstallControlPlaneArgs{
 	ControlPlane_service_name:                 "kuma-control-plane",
 	ControlPlane_tls_cert:                     "",
 	ControlPlane_tls_key:                      "",
+	ControlPlane_envVars:                      map[string]string{},
 	ControlPlane_injectorFailurePolicy:        "Ignore",
 	DataPlane_image_registry:                  "kong-docker-kuma-docker.bintray.io",
 	DataPlane_image_repository:                "kuma-dp",
@@ -151,6 +153,7 @@ func newInstallControlPlaneCmd(pctx *kumactl_cmd.RootContext) *cobra.Command {
 	cmd.Flags().StringVar(&args.ControlPlane_tls_cert, "tls-cert", args.ControlPlane_tls_cert, "TLS certificate for Kuma Control Plane servers")
 	cmd.Flags().StringVar(&args.ControlPlane_tls_key, "tls-key", args.ControlPlane_tls_key, "TLS key for Kuma Control Plane servers")
 	cmd.Flags().StringVar(&args.ControlPlane_injectorFailurePolicy, "injector-failure-policy", args.ControlPlane_injectorFailurePolicy, "failue policy of the mutating web hook implemented by the Kuma Injector component")
+	cmd.Flags().StringToStringVar(&args.ControlPlane_envVars, "env-var", args.ControlPlane_envVars, "environment variables that will be passed to the control plane")
 	cmd.Flags().StringVar(&args.DataPlane_image_registry, "dataplane-registry", args.DataPlane_image_registry, "registry for the image of the Kuma DataPlane component")
 	cmd.Flags().StringVar(&args.DataPlane_image_repository, "dataplane-repository", args.DataPlane_image_repository, "repository for the image of the Kuma DataPlane component")
 	cmd.Flags().StringVar(&args.DataPlane_image_tag, "dataplane-version", args.DataPlane_image_tag, "version of the image of the Kuma DataPlane component")
diff --git a/app/kumactl/cmd/install/render_helm_files.go b/app/kumactl/cmd/install/render_helm_files.go
index 915fa17a5..b756c67bf 100644
--- a/app/kumactl/cmd/install/render_helm_files.go
+++ b/app/kumactl/cmd/install/render_helm_files.go
@@ -119,12 +119,24 @@ func generateOverrideValues(args interface{}) map[string]interface{} {
 			}
 			root = root[n].(map[string]interface{})
 		}
-		root[splitTag[tagCount-1]] = value
+		root[splitTag[tagCount-1]] = adjustType(value)
 	}
 
 	return overrideValues
 }
 
+// If the parameter value is map it has to be of a type map[string]interface{} therefore we need to convert it
+func adjustType(value interface{}) interface{} {
+	if m, ok := value.(map[string]string); ok {
+		result := map[string]interface{}{}
+		for k, v := range m {
+			result[k] = v
+		}
+		return result
+	}
+	return value
+}
+
 func generateReleaseOptions(name, namespace string) chartutil.ReleaseOptions {
 	return chartutil.ReleaseOptions{
 		Name:      name,
diff --git a/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go b/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go
index 32b1ace8a..d28963064 100644
--- a/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go
+++ b/app/kumactl/pkg/install/k8s/control-plane/helmtemplates_vfsdata.go
@@ -21,7 +21,7 @@ var HelmTemplates = func() http.FileSystem {
 	fs := vfsgen۰FS{
 		"/": &vfsgen۰DirInfo{
 			name:    "/",
-			modTime: time.Date(2020, 9, 28, 12, 56, 47, 951836718, time.UTC),
+			modTime: time.Date(2020, 10, 1, 15, 48, 11, 684699442, time.UTC),
 		},
 		"/.helmignore": &vfsgen۰CompressedFileInfo{
 			name:             ".helmignore",
@@ -32,17 +32,17 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/Chart.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "Chart.yaml",
-			modTime:          time.Date(2020, 9, 24, 9, 57, 34, 6302958, time.UTC),
+			modTime:          time.Date(2020, 10, 1, 15, 43, 36, 843014072, time.UTC),
 			uncompressedSize: 265,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x44\x8e\xb1\x4e\x03\x31\x0c\x86\xf7\x3c\x85\x5f\xe0\x92\x02\x03\x52\x36\xc4\x82\xc4\xc2\xd4\xdd\xcd\x99\x8b\xd5\x24\x36\x49\xee\xaa\xbe\x3d\x4a\x44\xc5\x64\xe9\xb3\x7f\xff\x1f\x2a\x9f\xa9\x36\x96\xe2\xe1\x78\x36\x05\x33\x79\xb8\xee\x19\xcd\x4a\x2d\x54\xd6\x3e\x57\x6f\xf0\x41\x29\x43\x88\x58\x3b\x7c\x4b\x85\x1e\x09\x3e\xf7\x8c\xf0\x2e\xa5\x57\x49\xf0\x95\xb0\x90\xe9\x77\x25\x0f\xa8\x9a\x38\xe0\x88\x9a\xe3\xf1\xfd\x64\x5f\xec\xc9\xa0\xea\xf9\x9f\xbc\xda\x27\x13\x65\x54\xc6\xde\xb5\x79\xe7\x36\xee\x71\xbf\xd8\x20\xd9\x0d\x8b\xf8\x33\x87\xe1\x30\x02\x8f\xa3\x81\x2c\x8b\xe3\x8c\x1b\x35\x77\xa9\x58\xd6\x09\x97\x24\x9b\x2c\x85\x6e\xb6\x1d\x9b\xb9\xd2\xfd\x26\x75\x6d\xde\x00\x2c\xd0\xa8\x1e\x1c\x08\x32\xb5\x38\x41\xf8\x33\xd7\x69\xfe\x1b\x00\x00\xff\xff\xd9\x76\x18\x85\x09\x01\x00\x00"),
 		},
 		"/README.md": &vfsgen۰CompressedFileInfo{
 			name:             "README.md",
-			modTime:          time.Date(2020, 9, 28, 12, 56, 47, 949870700, time.UTC),
-			uncompressedSize: 9833,
+			modTime:          time.Date(2020, 10, 1, 15, 48, 11, 683952739, time.UTC),
+			uncompressedSize: 10031,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xc4\x9a\xdf\x73\xdb\xb8\x11\xc7\xdf\xf9\x57\x6c\xc7\x2f\xfd\x61\x51\x4e\xd3\xbb\xc9\xf8\x2d\xb5\xe7\x5a\xcd\xa5\x1e\x4f\x7c\xbd\x3e\x38\x9e\x10\x02\x56\x14\x2a\x10\xcb\xc1\x82\x76\x74\xa7\xfc\xef\x1d\x80\xa2\x64\xcb\xfa\x41\x89\x4c\xa3\x87\x44\x16\x81\x05\x3e\xd8\xc5\x8f\xfd\x12\xf7\x7f\xb8\x7f\xb8\x9f\x55\x85\x18\x18\xca\xe9\x61\xf9\xbd\x72\xe6\x21\x49\xce\x20\xfc\x91\x24\xbf\x4c\x31\x7e\x03\x39\x15\xce\x03\x57\x65\x49\xce\x33\x08\x63\xc0\x4f\x11\x26\x28\x7c\xe5\x90\x41\x58\x05\x54\x7a\x4d\x96\xa1\x74\xf4\xa8\x15\x2a\x18\xcf\x21\x0b\xb5\xa5\x37\xa0\x2d\xfb\x50\x4b\x92\xf5\x8e\xcc\xa0\x34\xc2\x62\x96\xc6\x16\x36\x8c\xff\x13\x4d\x01\x8f\x6f\xff\x92\x26\xc9\xd9\x19\xfc\x2a\x4c\x85\x9c\x24\x0b\xb8\x15\x4e\x14\xe8\xd1\x41\xeb\xcf\x02\xae\x91\xa5\xd3\xb1\x67\xd0\xcf\x27\xd8\x9c\x88\xca\xf8\x13\xaa\x26\x8b\xc1\x31\x9f\xa6\xda\xa0\xff\x4f\x07\x9b\x8b\x64\x01\x59\x6e\x68\x2c\x4c\xaa\x0b\x91\x63\xea\x30\xd7\xec\xdd\x3c\x6b\x37\x6e\x4d\x71\x98\x90\x8b\xa1\xf4\x73\x08\xb1\x68\x8a\x8f\xf5\x45\x36\x23\x9b\x0f\x14\xc9\x19\xba\x41\x8c\xe0\xfa\x7b\x3a\xd6\xd6\x3b\x31\x4f\x35\x65\xbb\x7c\xb1\x41\xe1\x45\x9e\x1d\xe1\x7d\x2f\xf2\xee\x00\x4b\x9b\x56\x9b\x73\x50\xb5\x61\x06\x4f\x70\x15\xa6\x44\xfa\xbe\x2c\x7f\x45\xc7\x7b\x62\x37\x52\x94\xc2\xcb\xe9\xdd\x9c\x3d\x16\x37\xa2\x40\x2e\x85\xc4\xec\x40\x8b\xb7\xa1\x4e\x9c\xc3\x0e\x0d\x0a\x46\xb0\x4d\x55\x78\xd2\xbe\x7e\x14\xb1\x38\x1a\x06\x23\xc6\x68\x0e\xf8\xc2\xbb\x0a\x33\x38\x69\x5e\x40\xb6\x5c\x19\x6e\xc3\xc2\x90\x1a\xca\x3f\xe0\x23\x9a\x03\x11\x15\x3b\x78\x75\x0b\x86\x72\x30\xa1\xfc\x25\x90\x45\xa0\x09\xd0\x64\xf2\x69\xa1\xed\x84\x3e\x2d\x14\x8e\xab\xfc\x88\x88\x0a\xb5\xfa\xa1\x28\x48\x1d\x1e\x8f\x35\x45\x28\xce\x2b\x02\xf6\xc2\x2a\x61\xc8\xe2\xa7\x85\xc3\x82\x3c\x7e\x5a\xd4\xf1\xda\x8a\x62\x5d\x3d\xeb\x48\xf1\x5b\x1b\x1b\x4b\x8a\x50\x36\x46\x52\x3f\x2b\xad\xd5\xe6\xc4\xaa\xaf\x28\x66\x8a\xff\x11\x47\xef\xbd\x52\x0e\x99\xb3\xed\x2d\xfe\xfb\xe3\x87\x30\xf8\x75\xd1\x95\x67\xba\x51\x9c\x5e\xf5\x15\x85\x25\x85\x77\x68\x50\x7a\x72\xd9\xee\x16\x6f\x48\x21\x34\xe5\xe2\x2a\xb5\x9a\xce\x57\xb5\x39\x88\xf6\xa0\x24\xc5\x6d\xe7\xc5\xef\x30\xab\xc6\xe8\x2c\x7a\xe4\x54\xd3\x90\xf8\x12\x8c\xb6\xd5\x97\xf3\x8d\x07\xc2\xc9\xe9\x25\x88\x42\xfd\xf8\x37\xf8\x9a\x6d\xa1\xd0\xf6\xbf\xb1\x67\x3f\x09\x6d\x2a\x87\xb7\x64\xb4\x7c\xb5\x79\x2c\x60\xf9\x18\xca\xf8\x3c\xb8\x25\x50\x14\x95\x17\x5e\xdb\x1c\x9e\x70\x3c\x25\x9a\x81\x2e\x4a\x83\x05\x5a\x5f\x1f\x39\x56\xa4\xa3\x65\x2b\x20\xa9\x28\xc9\xa2\xf5\x81\x62\x94\x5b\x72\x27\xac\x52\xaf\x29\x18\xdd\xa3\x96\x98\x86\x70\xdf\xe3\x8b\xbb\xba\x58\x3d\x2b\x96\x0c\x5b\x3c\xf1\xbd\xe6\x45\x43\xe1\xe7\x65\x1b\x8a\x50\xac\x2f\x8a\x2b\x53\xb1\x47\x37\xba\xed\x8f\x42\x58\x4b\x21\x3c\xc8\x6e\x99\xe0\x0b\x78\xaf\x94\x0e\x0f\x85\x81\x67\x25\xc3\x86\x5b\x56\x1e\xc8\xee\xc2\x5a\x9a\xdf\x4a\xf1\xfb\xd7\xde\x66\x77\xbd\xbc\x7f\x8c\x8b\xfd\xdd\xdc\xca\xbb\x6d\x11\xb6\x3d\xa2\xea\x05\x6b\x50\xd7\x85\x50\xf9\xbb\x45\xd4\x2e\x8a\x17\x11\xb6\x3d\xa2\xba\x52\x7c\x20\xa1\xfe\x2e\x8c\xb0\xf2\x98\x2c\xe1\x28\x8a\x90\xa3\x3c\xa3\xb8\x25\x17\x03\xe7\x69\xaa\xe5\x74\x5b\xff\x35\x03\x7e\x29\x89\x51\xb5\xa6\xf8\xe1\xc7\x77\x3f\x7c\x63\x5f\xbc\x98\x27\x2d\xe7\xc5\x16\xb8\xff\xd3\xbc\x68\x4e\xc6\x29\xcf\x74\xf9\x2f\xe4\xe9\x95\xc3\xd8\xc5\xec\x45\x8b\xff\x99\xa2\x9f\xa2\x03\x72\x60\xc9\x87\xde\x87\xf2\x20\x63\x61\x9b\x47\x88\xa5\x29\x08\x56\x5a\xed\x7a\xfd\x9d\x69\x1d\x32\x55\x4e\x22\x67\x7b\x5b\x0c\x19\xf1\xcf\xef\x18\x56\xc5\x81\x4b\x94\x71\x13\x3f\xf1\x38\xd2\xe4\x17\x7a\x32\x41\xc7\x30\x16\x21\x18\xc9\xc6\xf3\xe6\xd1\x14\xde\x70\x2a\xf1\xd9\x1c\xd8\x41\xf1\xe1\x0e\x42\x31\x3d\xd1\x52\x78\x5c\x9d\x41\x56\xd9\x52\x08\x9d\xd0\x9b\x63\x29\x72\xb4\xe8\x44\xd8\xeb\x85\x55\xc0\x68\x26\x03\xd6\xb9\xdd\x3b\xbd\xb6\x53\xcc\x70\x7e\x28\x4b\x0a\x14\x33\x9c\xf7\xd0\xfb\x6f\x42\x51\xe7\xad\x65\x65\xcc\xf6\x23\xd4\x46\x7e\x31\x0a\xc5\x6f\x57\xa5\x3b\x9d\x69\xb3\xd1\xe4\x86\xfc\xad\x43\x46\xeb\xb3\x4e\xf3\xa2\x95\x86\xb0\xa6\x88\xc5\xd7\x1a\x42\xd7\xfc\xe2\x1c\x2a\x46\x86\xb6\x99\xd5\x41\x8a\x92\x58\x7b\x72\x87\x7c\xd1\x50\x34\xc5\x3b\xf9\x22\xea\x1e\xb2\xcc\xba\xaf\x51\xad\x94\x90\x4d\x0a\x2f\xf2\x7e\x72\xbd\x2e\xbe\xb0\x3a\x45\x2b\xc6\x06\x55\xd6\xb6\xc5\xd1\x52\x93\x8c\x34\x51\xf4\xb8\xba\x19\x45\xa5\x12\x85\x0a\x47\x92\xd2\xd1\x97\x39\x68\xab\x7d\xd4\x2d\x85\xb6\x07\x8e\x15\x0b\xc8\x26\xc2\xf0\x29\x1b\xc6\x8a\xa2\x95\xf4\xf1\xfc\x14\x7d\x33\xea\x51\xff\xe8\x45\x03\xb1\xba\x5d\xa2\x7a\x30\x63\x0d\x6c\xad\x53\xd4\xbe\x33\x56\xab\x8f\x91\x37\x57\xbe\xe8\x6f\x7d\x5a\x52\x2c\x05\x4d\x7d\xac\x43\x5e\x51\xec\x5d\x9a\x76\x50\x74\x5f\x9f\x96\x14\x86\xc6\x33\x7a\xd4\x66\x2e\x86\xcb\x77\x01\x03\x69\x75\x76\x2c\x45\x2b\x91\x76\x75\x8e\x5a\x93\xf4\xb3\x46\x65\x17\xe9\x45\xfa\xe6\xd4\xd9\xad\x84\x17\x47\x6c\x79\xeb\xd3\x60\x58\x9f\xae\xfb\xda\xf9\xba\xae\xb4\xaf\x29\x0e\xc5\xd5\x76\x8a\x6e\x91\xd5\x75\xd7\xdb\xa4\x38\x1c\x57\xdb\x28\xba\x46\x55\x8f\xbe\xb0\xda\x8f\x5a\x44\xd5\x06\x45\xd8\xda\x3a\x87\xd5\xb7\xa1\xd8\x17\x55\x7b\x28\x4e\x0e\xab\x26\xa2\x82\xb5\xac\x5b\x44\xad\x28\xf6\x47\xd5\x4e\x8a\x0e\x61\xd5\xd5\x17\xda\xe6\x0e\x99\x8f\x38\x4b\x2d\x60\x34\x81\x90\x25\x9f\x83\xf6\xa0\xb0\x34\x34\x67\x18\xd5\x76\xe2\x4e\x2e\x1d\x31\x83\xac\xd5\x3e\x90\x54\x14\x95\x0d\x59\xe1\xee\xf7\x5a\x0b\x88\xc7\xa8\x93\xd5\x83\x86\x42\x39\xa1\xed\x2f\xba\x68\xf3\xfe\x22\x14\x8b\xdd\xad\xa5\x1c\x32\x0a\x8c\x66\x1f\x12\x35\x78\xd2\xc6\x00\xfb\xf0\xef\x18\x41\x48\xaf\x1f\x11\x04\x43\xb4\xaf\x6d\xbe\xcb\xe6\xdb\x0b\xee\xa0\x81\x34\x14\xad\x84\xe6\x3d\xda\x60\xe3\x8b\xef\xf3\x16\x66\x93\x62\xaf\xd0\xbc\x47\x1b\xec\x4a\xd1\x4d\x1b\xdc\xa4\x78\x21\x03\xee\x7a\xc7\xfa\x42\x1b\x6c\xfa\x7f\xb4\x20\xf8\xc2\xe6\x9b\x8b\x8b\x8b\x37\xbd\xf9\x62\xaf\x5c\x7e\x8c\x66\xde\xc0\xed\x16\x04\x7b\xd4\x06\x1b\x8a\x02\x79\xda\x36\x4b\x8a\x7a\x9f\xa7\xa5\x2f\xae\x85\x17\xf1\x06\xca\xaa\xe3\x63\x34\x64\xf3\x88\xd5\xda\x17\xea\xf4\x7b\x20\xc9\xd9\x19\x5c\x55\xec\xa9\x80\x8f\x4b\x9d\x0f\xae\x71\x12\xf6\x80\x30\xba\x49\xf2\xbe\xc9\x4b\xaf\x3e\x5e\x33\x08\x87\x60\x48\x28\x54\xf0\xa8\x45\x1c\xf1\xfb\x4c\x3a\xc5\xd9\xc3\x1f\xc3\x7f\x7f\x02\xa5\x5d\x4c\x9d\xe6\x29\xfc\x44\x0e\x0a\x72\x08\x0a\xbd\xd0\x06\x15\x84\x6c\xce\x15\xf5\x82\x4b\x76\x69\xd2\xaa\x78\xd3\xe6\x3c\x29\xeb\xf7\xff\x0e\x27\xe8\x02\xff\x7d\x30\x1f\x2f\xe1\x28\x92\x55\x81\xb6\x76\xf9\xc3\xfd\x14\x4d\x31\x90\x4e\x3d\xd4\x37\x73\x6e\xc8\xe3\xea\xae\x02\xa8\x90\x7e\x52\x89\x8e\x93\xf5\xa5\x9e\xba\xe7\x15\xc7\x3e\x78\x74\x56\x18\x13\x12\xea\x57\xf7\x82\xb2\xf3\x00\xe5\x70\x12\xfa\x1d\x6f\x16\x91\x31\xf4\x14\x96\x56\x57\x19\x64\x10\x65\x69\xe6\xf0\x34\x45\xdb\xb4\x14\x9e\x59\x7c\x0a\x0d\xf9\xd5\x45\xa4\xcb\x04\xfe\x1c\xda\x83\xac\x10\x33\x5c\xc9\x6c\xc3\x65\x73\x4d\xea\x31\x9c\xbd\xe3\xe1\xcb\xab\x48\x51\x2e\x9e\x5b\x09\x2b\xfa\x9a\x2b\x8c\xd3\xab\xde\x82\xc7\xa2\x34\xc2\x23\x87\xf6\xe2\x6d\xa8\xe6\x07\xf0\xa1\x3f\xec\x43\xdd\xa8\x29\x64\xa5\xc3\x41\x56\xdb\x29\x89\x7d\xf8\xee\x10\xa8\xd0\xde\xa3\xaa\x91\x4a\x47\x12\x99\x03\xd2\xb6\xc1\x01\x48\x92\xf5\xf5\xac\x4b\x98\x7a\x5f\xf2\xe5\x30\x52\x85\xf4\x35\x79\x76\x8f\xeb\xe5\xd3\x41\x59\x8d\x8d\x96\x03\xc1\x8c\x9e\x53\x7e\x9b\x8a\x42\xfc\x46\x56\x3c\x71\x2a\xa9\x18\xae\xea\x0d\x1e\xff\x9a\x96\x36\x4f\xd6\x4e\x5e\x1b\x0a\x3f\xa5\x3c\x1d\x2a\x92\x3c\x8c\x7e\xfd\x3c\x46\xf6\x9f\x4b\x17\x76\x42\x89\x3c\x94\x31\x94\x3f\x37\x92\xf5\x67\xb5\x0e\xe5\x61\xf2\xbf\x00\x00\x00\xff\xff\xc6\xab\x84\x50\x69\x26\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xc4\x9a\x5f\x73\xdb\xb8\x11\xc0\xdf\xf9\x29\xb6\xe3\x97\xfe\xb1\x28\xa7\xe9\xdd\x64\xfc\x96\xda\x73\xad\xe6\x52\x8f\x27\xbe\xa6\x0f\x8e\x27\x84\x88\x15\x85\x0a\xc4\x72\xb0\xa0\x1c\xdd\xe9\xbe\x7b\x07\x20\x29\x59\xb2\xfe\x50\x22\xd3\xe8\x25\x8a\xb9\x58\xe0\xc7\x5d\x2c\x76\x57\x78\xfc\xc3\xe3\xd3\xe3\xac\xcc\xc5\x40\x53\x46\x4f\xf5\xf7\xd2\xea\xa7\x28\xba\x00\xff\x9f\x28\xfa\x65\x8a\xe1\x1b\xa4\x53\x61\x1d\x70\x59\x14\x64\x1d\x83\xd0\x1a\xdc\x14\x61\x82\xc2\x95\x16\x19\x84\x91\x40\x85\x53\x64\x18\x0a\x4b\x73\x25\x51\xc2\x78\x01\x89\x1f\x9d\x3a\x0d\xca\xb0\xf3\xa3\x52\x32\xce\x92\x1e\x14\x5a\x18\x4c\xe2\x30\xc3\x96\xf2\x7f\xa2\xce\x61\xfe\xf6\x2f\x71\x14\x5d\x5c\xc0\x27\xa1\x4b\xe4\x28\x5a\xc2\xbd\xb0\x22\x47\x87\x16\x5a\x7f\x96\x70\x8b\x9c\x5a\x15\x56\x06\xfd\x7c\xbc\xce\x89\x28\xb5\x3b\x63\x68\xb4\x1c\x9c\xf2\x69\x86\x0d\xfa\xff\x74\xd0\xb9\x8c\x96\x90\x64\x9a\xc6\x42\xc7\x2a\x17\x19\xc6\x16\x33\xc5\xce\x2e\x92\x76\xef\xad\x11\x87\x09\xd9\xe0\x4a\x3f\x7b\x17\x0b\xaa\xf8\x54\x5b\x24\x33\x32\xd9\x40\x52\x3a\x43\x3b\x08\x1e\x5c\x7d\x8f\xc7\xca\x38\x2b\x16\xb1\xa2\x64\x9f\x2d\xb6\x28\x9c\xc8\x92\x13\xac\xef\x44\xd6\x1d\xa0\xd6\x69\x94\xbe\x04\x59\x29\x66\x70\x04\x37\x7e\x4b\xc4\xef\x8b\xe2\x13\x5a\x3e\xe0\xbb\x81\xa2\x10\x2e\x9d\x3e\x2c\xd8\x61\x7e\x27\x72\xe4\x42\xa4\x98\x1c\x99\xf1\xde\x8f\x09\x7b\xd8\xa2\x46\xc1\x08\xa6\x19\x0a\xcf\xca\x55\x8f\x02\x16\x07\xc5\xa0\xc5\x18\xf5\x11\x5b\x38\x5b\x62\x02\x67\xed\x0b\x48\xea\xc8\x70\xef\x03\x43\xac\x29\xfb\x80\x73\xd4\x47\x3c\x2a\x2c\xf0\xe6\x1e\x34\x65\xa0\xbd\xfc\x35\x90\x41\xa0\x09\xd0\x64\xf2\x79\xa9\xcc\x84\x3e\x2f\x25\x8e\xcb\xec\x04\x8f\xf2\xa3\xfa\xa1\xc8\x49\x1e\x7f\x1f\x6b\x0a\x2f\xce\x2b\x02\x76\xc2\x48\xa1\xc9\xe0\xe7\xa5\xc5\x9c\x1c\x7e\x5e\x56\xfe\xda\x8a\x62\x3d\x3c\xe9\x48\xf1\x6b\x1b\x1d\x35\x85\x97\x0d\x9e\xd4\x4f\xa4\x35\x4a\x9f\x39\xf4\x15\xc5\x4c\xf2\x3f\xc2\xdb\x7b\x2f\xa5\x45\xe6\x64\xf7\x8c\xff\xfe\xf8\xc1\xbf\xfc\x4a\x74\x65\x99\x6e\x14\xe7\x0f\x7d\x45\x61\x48\xe2\x03\x6a\x4c\x1d\xd9\x64\xff\x8c\x77\x24\x11\x1a\xb9\x10\xa5\x56\xdb\xf9\xa6\x52\x07\x41\x1f\x14\x24\xb9\xed\xbe\xf8\x0d\x66\xe5\x18\xad\x41\x87\x1c\x2b\x1a\x12\x5f\x83\x56\xa6\xfc\x7a\xb9\xf5\x40\xd8\x74\x7a\x0d\x22\x97\x3f\xfe\x0d\x7e\x4f\x76\x50\x28\xf3\xdf\xb0\xb2\x9f\x84\xd2\xa5\xc5\x7b\xd2\x2a\x7d\x75\x78\x2c\xa1\x7e\x0c\x45\x78\xee\xcd\xe2\x29\xf2\xd2\x09\xa7\x4c\x06\xcf\x38\x9e\x12\xcd\x40\xe5\x85\xc6\x1c\x8d\xab\x52\x8e\x15\xe9\xa8\x9e\x05\x52\xca\x0b\x32\x68\x9c\xa7\x18\x65\x86\xec\x19\x51\xea\x35\x05\xa3\x9d\xab\x14\x63\xef\xee\x07\x6c\xf1\x50\x89\x55\xbb\xa2\x66\xd8\x61\x89\xef\xb5\x2f\x1a\x0a\xb7\x28\xda\x50\x78\xb1\xbe\x28\x6e\x74\xc9\x0e\xed\xe8\xbe\x3f\x0a\x61\x0c\x79\xf7\x20\xb3\x63\x83\x2f\xe1\xbd\x94\xca\x3f\x14\x1a\x5e\x48\xfa\x03\xb7\x28\x1d\x90\xd9\x87\x55\xab\xdf\x49\xf1\xdb\xef\xbd\xed\xee\x2a\xbc\x7f\x0c\xc1\xfe\x61\x61\xd2\x87\x5d\x1e\xb6\xdb\xa3\xaa\x80\x35\xa8\xc6\x82\x1f\xfc\xdd\x3c\x6a\x1f\xc5\x86\x87\xed\xf6\xa8\xae\x14\x1f\x48\xc8\xbf\x0b\x2d\x4c\x7a\x4a\x95\x70\x12\x85\xaf\x51\x5e\x50\xdc\x93\x0d\x8e\xf3\x3c\x55\xe9\x74\xd7\xfa\x15\x03\x7e\x2d\x88\x51\xb6\xa6\xf8\xe1\xc7\x77\x3f\x7c\x63\x5b\x6c\xec\x93\x96\xfb\x62\x07\xdc\xff\x69\x5f\x34\x99\x71\xcc\x33\x55\xfc\x0b\x79\x7a\x63\x31\x2c\x31\xd9\x98\xf1\x3f\x53\x74\x53\xb4\x40\x16\x0c\x39\xbf\x7a\x2f\x0f\x69\x10\x36\x59\x80\xa8\x55\x81\xd7\xd2\xea\xd4\xeb\x2f\xa7\xb5\xc8\x54\xda\x14\x39\x39\x38\xa3\xaf\x88\x7f\x7e\xc7\xb0\x12\x07\x2e\x30\x0d\x87\xf8\x99\xe9\x48\x53\x5f\xa8\xc9\x04\x2d\xc3\x58\x78\x67\x24\x13\xf2\xcd\x93\x29\x9c\xe6\x38\xc5\x17\x7b\x60\x0f\xc5\x87\x07\xf0\x62\x6a\xa2\x52\xe1\x70\x95\x83\xac\xaa\x25\xef\x3a\x7e\x35\xa7\x52\x64\x68\xd0\x0a\x7f\xd6\x0b\x23\x81\x51\x4f\x06\xac\x32\x73\x70\x7b\xed\xa6\x98\xe1\xe2\x58\x95\xe4\x29\x66\xb8\xe8\x61\xf5\xdf\x84\xa2\xaa\x5b\x8b\x52\xeb\xdd\x29\xd4\x56\x7d\x31\xf2\xe2\xf7\x2b\xe9\x4e\x39\x6d\x32\x9a\xdc\x91\xbb\xb7\xc8\x68\x5c\xd2\x69\x5f\xb4\xea\x21\xac\x29\x82\xf8\xba\x87\xd0\xb5\xbe\xb8\x84\x92\x91\xa1\x6d\x65\x75\x94\xa2\x20\x56\x8e\xec\x31\x5b\x34\x14\x8d\x78\x27\x5b\x84\xbe\x47\x5a\x24\xdd\x63\x54\xab\x4e\xc8\x36\x85\x13\x59\x3f\xb5\x5e\x5f\xb6\x40\x33\xff\x24\x2c\x1f\xdb\xdd\x2f\x4e\x3d\x34\x73\x65\xc9\xf8\x2a\x02\xe6\xc2\x2a\x31\xd6\xc8\xe0\xa6\xc2\xc1\xb3\xd2\x1a\xc6\x08\x85\x60\x1f\x37\x1d\x85\x48\x50\xcf\x07\xc5\x46\xda\xdb\xf9\xd4\x33\x2a\x46\xe3\x27\x97\x49\xdb\xf7\x36\xaa\x3b\xab\xc1\x26\xa1\x75\x73\x73\x37\x0a\xfd\x56\x14\xd2\x27\x56\x85\xa5\xaf\x0b\x50\x46\xb9\xb0\x6a\xa1\xcc\x91\xe4\x68\x09\xc9\x44\x68\x3e\xe7\xd8\x5b\x51\xb4\x6a\xe0\xbc\xac\x05\xee\x46\x3d\x76\x71\x7a\xe9\xe4\x18\xd5\xae\xdc\x3e\x5a\x77\x7b\xb6\xd6\x85\x76\xdf\x75\xb7\x51\xa7\x34\x69\x57\xb6\xe8\x2f\xca\xd6\x14\x75\x5b\x56\x9d\x6a\x90\x57\x14\x07\x03\xec\x1e\x8a\xee\x51\xb6\xa6\xd0\x34\x9e\xd1\x5c\xe9\x85\x18\xd6\xbf\x68\x0c\x52\xa3\x92\x53\x29\x5a\xb5\x9a\x57\xd9\xe0\x9a\xa4\x9f\x48\x9b\x5c\xc5\x57\xf1\x9b\x73\x77\xb7\x14\x4e\x9c\x70\x70\xaf\x73\x5a\x1f\x9f\x6e\xfb\x3a\xbf\xbb\x9e\x17\xaf\x29\x8e\xf9\xd5\x6e\x8a\x6e\x9e\xd5\xf5\xec\xde\xa6\x38\xee\x57\xbb\x28\xba\x7a\x55\x8f\xb6\x30\xca\x8d\x5a\x78\xd5\x16\x85\x3f\xda\x3a\xbb\xd5\xb7\xa1\x38\xe4\x55\x07\x28\xce\x76\xab\xc6\xa3\xbc\xb6\xa4\x9b\x47\xad\x28\x0e\x7b\xd5\x5e\x8a\x0e\x6e\xd5\xd5\x16\xca\x64\x16\x99\x4f\xc8\xa5\x96\x30\x9a\x80\xaf\xf5\x2f\x41\x39\x90\x58\x68\x5a\x30\x8c\x2a\x3d\xe1\x24\x4f\x2d\x31\x43\x5a\xf5\x2c\x21\xa5\x3c\x2f\x8d\xaf\x6d\xf7\xff\x3a\xb7\x84\x90\x46\x9d\x9d\x0d\x36\x14\xd2\x0a\x65\x7e\x51\x79\x9b\x5f\x61\xbc\x58\x58\x6e\xd5\x90\x22\x2d\x41\x2b\x76\xbe\xdc\xac\x32\x59\x76\x75\x3e\x2b\x52\xa7\xe6\x08\x82\x21\xe8\x57\x26\xdb\xa7\xf3\xed\x15\x77\xc8\x69\x1b\x8a\x56\xed\xf2\x03\x1d\xce\xc6\x16\xdf\xe7\xb7\xa4\x6d\x8a\x83\xed\xf2\x03\x1d\xce\xae\x14\xdd\x3a\x9c\xdb\x14\x1b\xcd\xcc\x7d\xbf\x14\x6f\x74\x38\x9b\xf5\x9f\xdc\xd6\xdc\xd0\xf9\xe6\xea\xea\xea\x4d\x6f\xb6\x38\xd8\xf4\x3f\xa5\xf3\xdf\xc0\xed\x6f\x6b\xf6\xd8\xe1\x6c\x28\x72\xe4\x69\xdb\x2a\x29\x74\x2d\x1d\xd5\xb6\xb8\x15\x4e\x54\xf5\x67\xb3\xf0\x31\x6a\x32\x59\xc0\x6a\x6d\x0b\x79\xfe\x6d\x96\xe8\xe2\x02\x6e\x4a\x76\x94\xc3\xc7\xba\x5b\x09\xb7\x38\xf1\x67\x80\x7f\xbb\x51\xf4\xbe\xa9\x4b\x6f\x3e\xde\x32\x08\x8b\xa0\x49\x48\x94\x30\x57\x22\xbc\xf1\xc7\x24\xb5\x92\x93\xa7\x3f\xfa\x7f\xfe\x04\x52\xd9\x50\x3a\x2d\x62\xf8\x89\x2c\xe4\x64\x11\x24\x3a\xa1\x34\x4a\xf0\xd5\x9c\xcd\xab\x80\x4b\xa6\x56\x69\x64\xb8\x2f\x74\x19\x15\xd5\x2d\x06\x8b\x13\xb4\x9e\xff\xd1\xab\x0f\x57\x89\x24\xa5\xa5\x2f\xec\xc3\xc8\xa7\xc7\x29\xea\x7c\x90\x5a\xf9\x54\xdd\x2f\xba\x23\x87\xab\x1b\x17\x20\x7d\xf9\x49\x05\x5a\x8e\xd6\x57\x93\xaa\x95\x97\x1c\xd6\xe0\xd0\x1a\xa1\xb5\x2f\xa8\x5f\xdd\x6e\x4a\x2e\x3d\x94\xc5\x89\x5f\x77\xb8\x1f\x45\x5a\xd3\xb3\x0f\xad\xb6\xd4\xc8\x20\x8a\x42\x2f\xe0\x79\x8a\xa6\x99\xc9\x3f\x33\xf8\xec\x27\x72\xab\xeb\x54\xd7\x11\xfc\xd9\xcf\x07\x49\x2e\x66\xb8\x6a\x16\x0e\xeb\xe9\x9a\xd2\x63\x38\x7b\xc7\xc3\xcd\x0b\x55\xa1\xe9\xbd\x30\x29\xac\xe8\x2b\x2e\xff\x9e\x5e\xad\x16\x1c\xe6\x85\x16\x0e\xd9\xcf\x17\xee\x74\x35\x7f\xa8\x5a\x1f\xec\xfc\xd8\xd0\x53\x48\x0a\x8b\x83\xa4\xd2\x53\x10\x3b\xff\xdd\x22\x50\xae\x9c\x43\x59\x21\x15\x96\x52\x64\xf6\x48\xbb\x5e\x0e\x40\x14\xad\x2f\x99\x5d\xc3\xd4\xb9\x82\xaf\x87\x81\xca\x97\xaf\xd1\x8b\xdb\x68\x9b\x4f\x07\x45\x39\xd6\x2a\x1d\x08\x66\x74\x1c\xf3\xdb\x58\xe4\xe2\x57\x32\xe2\x99\xe3\x94\xf2\xe1\x6a\xdc\x60\xfe\xd7\xb8\x30\x59\xb4\x36\xf2\x5a\x91\xff\x53\xcc\xd3\xa1\xa4\x94\x87\xc1\xae\x5f\xc6\xc8\xee\x4b\x61\xfd\x49\x98\x22\x0f\xd3\xe0\xca\x5f\x9a\xc6\xfb\x17\xb9\x76\xe5\x61\xf4\xbf\x00\x00\x00\xff\xff\x2f\xd3\xd4\x44\x2f\x27\x00\x00"),
 		},
 		"/crds": &vfsgen۰DirInfo{
 			name:    "crds",
@@ -141,7 +141,7 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates": &vfsgen۰DirInfo{
 			name:    "templates",
-			modTime: time.Date(2020, 9, 29, 9, 24, 11, 829275335, time.UTC),
+			modTime: time.Date(2020, 10, 1, 15, 48, 11, 684535383, time.UTC),
 		},
 		"/templates/NOTES.txt": &vfsgen۰CompressedFileInfo{
 			name:             "NOTES.txt",
@@ -166,7 +166,7 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates/cni-daemonset.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cni-daemonset.yaml",
-			modTime:          time.Date(2020, 9, 24, 9, 57, 34, 7303355, time.UTC),
+			modTime:          time.Date(2020, 10, 1, 15, 43, 36, 844006282, time.UTC),
 			uncompressedSize: 2929,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x94\x56\x5d\x6f\xdb\xb8\x12\x7d\xf7\xaf\x18\xb8\x05\xda\x02\x91\x84\x5e\xdc\x16\x17\xba\x4f\xd9\x34\xed\x1a\x6d\xdc\x20\x1f\x5d\x2c\x16\x8b\x60\x4c\x8e\x2c\xc2\x14\x47\x4b\x8e\x9c\x7a\xd3\xfc\xf7\x05\xf5\x61\xcb\x89\xd3\x76\xf5\x10\x44\xd4\xcc\xe1\xe1\x99\x33\x43\xdf\xdd\x25\x60\x0a\x48\xbf\xa0\x6d\x28\xa4\xca\x99\x94\x1c\x2e\x2c\x69\xb8\xbf\x9f\xac\x8c\xd3\x39\xbc\x43\xaa\xd8\x5d\x92\x4c\xb0\x36\x5f\xc8\x07\xc3\x2e\x07\xac\xeb\x90\xad\x5f\x4f\x2a\x12\xd4\x28\x98\x4f\x00\x1c\x56\x94\xc3\xdd\x1d\x18\xa7\x6c\xa3\x09\xa6\xab\xa6\xc2\x34\x2e\x4f\x21\x85\xfb\xfb\x44\x39\x93\x38\xd6\xd4\x07\x87\x1a\x15\xe5\xb0\x6a\x16\x94\x84\x4d\x10\xaa\x26\x00\x16\x17\x64\x43\xc4\x6b\xd9\xed\x41\x29\x67\x3e\xb5\x9f\x23\xde\x37\x70\xc6\x69\x72\x02\xff\x8d\x6c\x43\x4d\x2a\x66\x05\xb2\xa4\x84\x7d\xfc\x1f\xa0\x42\x51\xe5\xa7\xef\x43\x5e\xf6\x19\x87\xa0\xdf\x46\x68\x80\xa6\xd6\x28\x74\x29\x1e\x85\x96\x9b\x0e\x5a\x36\x35\xe5\x70\xc1\xd6\x1a\xb7\xbc\x6e\x03\xda\x75\x3f\x5e\xe9\x42\x23\x8f\xaf\xd7\x0e\xd7\x68\x6c\x94\x37\x87\xd7\x13\x00\xa1\xaa\xb6\xdb\x98\xb1\x92\xf1\xd9\xe9\x10\x9f\x7f\x4d\xfc\x7f\x1d\xf1\xf8\xa0\x73\x2c\x28\x86\xdd\x16\x0e\xe0\x19\x5c\x95\x26\x1c\x01\x5a\x76\x4b\xb8\x35\x52\x82\x94\x04\x27\xde\x88\x51\x68\x8f\xb5\x66\x17\x3e\x3b\xbb\x01\x61\x4b\xbe\x4d\x87\x05\x59\xbe\x3d\x1a\x61\x54\xe8\x57\xa1\x4d\xac\x59\x03\x06\x40\x50\x3d\x02\xa0\xd6\x09\xbb\x23\x20\x17\x1a\x6f\xdc\x12\x8c\xc0\x92\x24\x8c\xd2\x6b\x6f\xd8\x1b\xd9\x40\x50\x25\xe9\x26\xca\x06\xe8\x34\x48\x89\x02\x46\x02\x78\x0a\xdc\x78\x45\x01\xd0\x53\x7c\x23\xbf\x26\x3d\x42\x30\x45\x84\xa5\x35\xf9\x16\x1b\x68\x6d\x94\x90\x4e\xb7\x21\x3d\x32\xf9\x14\x6d\x5d\x62\x1a\xcd\xe6\x1d\x09\x85\xd4\x70\x36\x90\x4d\x6a\xd6\x39\xbc\x78\xb1\x4d\x53\x25\xa9\x55\x68\xaa\x4c\xb1\x2b\xcc\x72\xcf\xd6\x2f\x6b\x6f\x9c\xc0\xf3\xf4\xaa\x2f\x60\xfa\x0b\x06\x3a\x47\x29\x61\x9a\x45\x8b\x77\x39\x15\xd6\xe9\x06\x2b\x3b\x7d\xd5\x16\x26\x94\xf8\x9f\x37\x6f\x43\x53\x0d\x85\x19\x0c\x3b\x94\xb7\xad\xc1\xb8\x15\x63\xa7\x0c\x25\xde\x55\x73\xbc\xba\x4b\x07\xe1\xdf\xb1\xb2\x4f\x59\x20\xe2\x93\xd3\xbb\x85\x92\x83\xcc\x49\x6e\xd9\xaf\x72\x10\xdf\x50\xbf\xbe\x2b\xf6\x9e\x57\xce\x70\x45\x10\x1a\x4f\x10\xbd\xb7\xed\xe3\x4e\xf3\x41\x62\x0d\xec\x00\xad\x6d\x29\x86\x5d\x09\x12\xa0\xa2\x20\x25\x39\xcc\xf9\xb2\x8f\xdd\x7e\x04\xe0\x3a\xee\xc8\x3e\x87\xd3\xaf\x26\xec\xf9\xe3\x0c\xfd\xea\xbb\xee\x82\x82\x7d\xb4\xc5\xd6\x3e\xe3\x5d\x57\xb4\xc9\x0f\x18\xfa\x67\xb6\x1e\x53\x3e\xfd\x4a\xaa\x91\x9f\x60\x3c\xb8\xf9\xc4\x62\x08\xf3\x76\x18\x76\x53\x2d\x51\xb6\x09\x42\x3e\x19\xd8\xf7\x09\xd1\xcd\x46\xd1\xb1\x52\xdc\x38\xe9\x32\x06\x7d\x27\x5b\x0d\x8c\x33\x95\xf9\x9b\x40\xf3\xad\x13\x53\x11\xe8\xae\x9d\x70\x98\x34\xd0\xd4\x4b\x8f\x9a\x80\x3d\x68\xb2\x14\xab\xf7\x7f\x10\xb2\x16\x3e\x6e\xdd\x0e\xc2\xa0\x19\x10\xa6\x05\x7b\x45\x5b\xf8\x21\x61\x9a\x43\x29\x52\x87\x3c\xcb\xf6\x5b\x44\xb3\x0a\xb1\x0b\x14\xd5\x12\xb2\x68\x18\xcb\xa8\x43\x56\x73\xf7\x27\x7b\x26\xe4\x2b\xe3\x5a\xd3\x24\x5c\xc4\x56\xda\x16\x7f\xf4\xe9\x83\x47\x45\xe7\xe4\x0d\xeb\x4b\x52\xec\x74\xc8\xe1\x4d\x1f\xa6\xd8\x09\x1a\x47\x7e\x64\xba\xa4\xbf\x4f\x8c\x0b\x82\xd6\x8e\x34\x89\x8f\xa9\x70\x79\xe8\xb2\x29\xd8\x57\x28\xb3\xf8\x75\x0a\x2f\xb5\x51\x02\x53\xd3\xbd\x8d\x5b\xab\x5d\x82\xa9\x67\x96\x29\x3c\x7f\x05\xdf\xe0\xaf\x86\x85\x76\xfd\xb1\xdd\xe3\xbc\xb1\xf6\x9c\xad\x51\x9b\x1c\x8e\xed\x2d\x6e\xc2\x28\x42\x71\x55\x61\xbc\x24\xff\x98\x66\x23\x9e\x69\x28\xa7\x7f\x8e\xc2\xc8\xad\xf3\xd1\x6b\x94\x3d\x16\x1b\xb8\xe8\x66\xee\x7c\x06\xdd\xc8\x80\xc2\x58\x8a\x95\x52\x9e\xe2\x5c\xd9\x4b\x1a\x04\x39\x99\xcf\x6e\x4e\x3e\xcf\xdf\xdf\xcc\x8f\xcf\x4e\xf7\x22\x00\xd6\xf1\x88\x79\xa7\x45\xcb\x24\xe2\x4e\x1f\xec\x7d\xd5\xef\xe9\xba\xfe\x1f\xf6\x16\x1e\xb4\x8e\x7d\x4c\xa8\xca\xb6\x91\x9f\x26\x31\x3f\xbd\xfa\xed\xf3\xc5\xc7\x96\xcc\xec\xc3\x21\x26\xef\x3d\x57\xf9\x83\x0f\xd0\xef\x77\x86\xf5\x47\xda\x5c\x50\xf1\x38\xe0\x67\x7f\x4a\x74\x40\x07\xd2\xdb\xce\x57\xce\xdc\xf4\x47\xbc\x39\x10\xf9\xe0\x24\x37\xef\x66\x17\x87\xc5\xcc\x48\x54\x1c\xeb\x59\xd5\x58\x69\x42\xe6\x48\x52\xfd\x40\xd2\x59\xd1\x0e\xd1\x23\xd0\x54\x5b\xde\xf4\xb3\xaa\x8c\x9e\xd6\xad\xd6\xb5\x6d\x96\xc6\x1d\x01\x4b\x49\xfe\xd6\x04\xda\x8b\x0c\x82\x4e\xc7\x9b\xb8\x2d\xcc\x61\x9a\xbf\x1e\xcf\xe6\xa7\xef\x6e\x22\xdd\xf3\x4f\xd7\x1f\x66\xf3\x27\x4a\x5f\xa0\x0d\x34\x2e\xf9\x9a\x6d\x53\xd1\x59\x1c\x31\x21\x7f\x80\x5d\xc5\xd5\x78\x73\xe5\x90\xc5\x2b\x21\xe3\x5a\xda\xb3\x2e\x8c\x9b\x1c\x2a\x49\x94\x7d\x61\x5c\xa2\x8d\xff\x11\xd4\x20\xdb\x63\xbd\xc6\x60\x8e\x64\x04\xd6\x71\xdd\xbb\x7a\xae\x03\xe9\xb1\x37\x4f\xe6\xb3\xf4\xd1\x90\x38\x4c\x2b\xd2\x68\x19\xed\xed\x5e\x77\x1c\xd7\xe8\x33\x6b\x16\x8f\x4e\x9b\x3c\x49\xee\x87\x90\x4f\x18\x65\x74\xf9\xfe\x13\x00\x00\xff\xff\xb6\xbe\x03\xf8\x71\x0b\x00\x00"),
@@ -187,10 +187,10 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates/cp-deployment.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-deployment.yaml",
-			modTime:          time.Date(2020, 9, 28, 12, 56, 47, 951268512, time.UTC),
-			uncompressedSize: 5252,
+			modTime:          time.Date(2020, 10, 1, 15, 48, 11, 684423448, time.UTC),
+			uncompressedSize: 5422,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xbc\x57\x51\x73\xda\x38\x10\x7e\xcf\xaf\xd0\x30\x7d\x68\x1f\x30\x49\x9a\xa4\x3d\xcf\xf4\xc1\x01\x35\xf5\x05\x1b\xc6\x36\x99\xc9\xbd\x78\x14\x7b\x03\x1e\x64\xc9\x95\x64\x7a\x5c\x9a\xff\x7e\x23\x1b\x08\x18\x1b\x70\x7b\x73\x3c\x81\xb4\xbb\xdf\xb7\xab\xd5\xc7\x8a\x64\xc9\x03\x08\x99\x70\x66\x22\x92\x65\xb2\xb7\xb8\x38\x9b\x27\x2c\x36\xd1\x00\x32\xca\x97\x29\x30\x75\x96\x82\x22\x31\x51\xc4\x3c\x43\x88\x91\x14\x4c\xf4\xf2\x82\x12\x16\xd1\x3c\x06\xd4\x99\xe7\x29\x31\xf4\x72\x07\x19\xe8\xf5\xb5\x1b\x71\xa6\x04\xa7\xdd\x8c\x12\x06\x2b\x0f\x99\x91\xa8\x74\x33\x3c\xa0\x40\x24\x18\xee\x7a\x19\xbd\xbe\x9e\x21\x44\xc9\x13\x50\xa9\x11\x10\x7a\x79\xe9\x56\xc2\x97\xbb\x1a\xe0\x27\x62\x09\x8b\x81\x29\x74\x55\x3a\x22\xcd\xdb\x44\xda\xac\x02\x2d\x33\x88\x74\x40\xa9\x04\x51\x30\x5d\x96\xc1\x05\xa7\x34\x61\xd3\x49\x16\x13\x05\xe5\x12\x42\x29\xf9\xdb\xcf\xc5\x14\x4c\x74\xf1\xb6\x32\x61\x64\x41\x12\x4a\x9e\x28\x98\xe8\x5c\x07\x02\x0a\x91\xe2\xa2\xf4\x4a\x89\x8a\x66\xc3\x2d\xda\x75\xc4\xd7\x2e\xc3\x9a\x04\x6e\xd6\x09\x34\xa7\x80\x90\x82\x34\xa3\x1b\xa6\xdb\x27\x51\xf8\x31\xc6\x15\x51\x09\x67\x1b\x0e\x08\x45\x33\x88\xe6\x32\x4f\x7b\x11\x67\xcf\xc9\x74\xe7\xb4\xde\x67\x22\x61\x0a\xbd\x33\x82\x55\x5c\xe3\x96\x48\x18\x13\x35\x43\x9d\x5e\x94\x75\x4b\x97\x94\x64\xc6\x92\xa4\xb4\xf3\xa1\x20\x2c\x67\xe4\xf2\xfa\x46\xe6\xe9\x1b\xe1\x2d\x14\x45\x65\x57\x42\x24\x40\xc9\x56\x50\x3f\xe0\x69\xc6\xf9\x5c\x76\x09\x8b\xd7\x01\x8e\xa0\xd2\x9d\x6a\xb7\xad\xf7\xe7\x6d\xfa\xcd\x15\x47\x68\xdd\x38\xc5\x77\x10\x8b\x24\x02\x2b\x8a\x78\xce\x94\xdb\xba\xfb\xd7\x34\x7f\x24\x6a\x86\x8c\x07\x42\x73\x90\xc6\xca\x68\xac\x6d\x0c\xc6\x63\xf0\x57\xb4\xdf\x18\x6e\xaf\x6e\x27\x8c\x14\x7f\x24\x29\x6d\x4a\x4c\x43\x01\x8b\xdf\x16\x34\x14\x49\x18\x88\xad\xb2\x75\x57\xb7\xb8\x8e\xab\xfe\x24\x29\x99\xd6\xa5\xf9\xcc\x45\x4a\x94\xad\x77\x3b\xe8\x7d\x9c\x44\x0a\x75\x92\xf2\x57\x6d\x66\xc5\x1e\xea\x08\xce\x55\x07\xbd\xfb\x80\x7e\xa2\xef\x39\x57\xb0\x7d\x0c\x2b\xb0\x71\x4e\xe9\x98\xd3\x24\x5a\x96\x22\xd1\x18\xcd\xc8\x36\x96\xbb\x61\x80\x2d\xcc\xad\x9f\x6f\x49\xde\x4f\x1c\x2b\xc4\xee\x83\xed\x8d\x5c\x07\xbb\xc1\x8e\x11\x42\x0b\x8d\x64\xea\x04\x9f\x40\x30\x50\x20\x3b\xcd\x61\xfc\x60\xe4\xe1\x30\x78\x1c\xe3\xdf\x8f\x72\x3f\xb9\xc5\x9e\x8b\x03\xec\x87\xfe\xa3\x1f\x60\x27\x74\x2d\x07\xfb\x63\xab\xdf\x10\xbc\x5e\x3c\x6b\x6b\x5a\x01\xbc\xc3\x2e\xf6\xac\x61\x68\x0d\x1e\xb0\x17\xd8\x3e\x1e\x84\xdf\x46\x7e\xa0\xf1\x1a\xa1\x4e\x6b\x70\xe3\x80\xa2\x1f\x21\x13\x0c\xfd\xb0\x8f\xbd\x20\xfc\x6a\x0f\x1b\x68\xf4\x16\x44\xf4\x44\xce\x7a\x2b\x75\xe8\x15\x5c\x12\x5e\x48\x4e\x04\x42\xe9\x2f\x46\x24\xd4\x69\x68\xf7\xf8\xf1\xb7\xc1\xe6\xb0\xdc\x71\x2f\x14\xe8\x19\xc1\xf7\xfa\x9e\x4d\xb9\x2e\xa1\x80\x94\x2b\xe8\x1c\x2c\x8b\x33\x19\x06\x76\x7f\x38\xf1\x03\xec\x85\x1e\x76\x46\x01\x0e\xef\x86\xa3\xdb\xe2\xd8\x06\x1e\xf6\xfd\xe6\xae\xa8\x43\x9e\xc7\xf2\x8e\xf2\x27\x42\xad\x38\x16\x20\x65\x15\x7c\x4f\x28\x6a\x38\x59\x63\x3b\xf4\xb1\xf7\x50\x30\xb2\x06\xe1\xc8\x1d\x3e\x36\x34\xbe\x12\x39\x1c\x68\x79\x6f\xe2\x06\xb6\xb3\xd3\xf4\xd6\xc0\xb1\x7d\xdf\x1e\xb9\x6b\x88\xf1\xc8\x6b\xba\x9c\xd7\x57\x57\x1f\x7f\x33\x7a\xd1\x6a\x03\xdb\xfb\xc5\xc3\x6f\x05\x6e\xbb\x7f\xe2\x7e\x30\xf2\xc2\xbe\x6b\x87\xd8\xb5\x6e\x87\x78\x70\xfc\xf4\x58\x62\x00\xd3\xc3\x46\x7c\xd2\xa5\x3e\x84\xeb\xdb\x03\xdc\xb7\xbc\xb0\x3f\x72\x03\xcb\x76\xb1\x17\xda\x8e\x75\x77\xea\x65\x3f\x41\xe6\xf5\x0c\xd2\x42\xe3\x2b\xd4\x37\x3c\x6d\xd7\x0e\xfe\x17\x92\x2c\x29\x4d\x5b\x12\x1d\xe0\xaf\xd6\x64\x18\xf8\xa1\x7f\x6f\x8f\x43\x07\xfb\xdf\xc2\xbe\x87\xad\xc0\x1e\xb9\xed\x6e\x63\x0c\xcf\x24\xa7\x4a\x1a\x72\x9e\x64\x0e\xc8\x59\x5f\x40\x31\xb6\x9d\x44\xc3\x19\x0d\x70\x3b\xbc\x42\x77\x1a\x42\xaf\x24\xab\xd6\xef\x1f\xce\xa0\xb5\x4c\xfd\x35\x72\x5b\xd2\x2b\x60\x6a\xe9\xd5\xca\x92\x5e\x14\x84\x4d\x01\xbd\x03\x0a\xfa\x49\x82\xcc\x2f\xf5\x91\x57\xf7\xb7\x29\x87\x97\x97\x4d\x08\x03\xb3\x45\xd5\x6c\x45\xfc\xab\xe0\xa9\x59\xd9\xd0\x93\xa0\x0e\x7d\x0f\x4b\x0f\x9e\xf7\x77\x51\x0d\x82\x5f\x78\xec\x83\xe8\xcf\x1c\x96\xbb\xc6\xf7\xb0\x3c\xa1\x14\x44\x4c\x65\x75\xce\x11\x39\xab\xac\x74\xbb\x94\x4f\xbb\x14\x16\x40\xbf\x34\x9d\x01\xe5\xd3\xa1\x36\xd8\x2f\x55\x77\xf5\x0a\xe8\x3e\x27\x14\xbe\xf4\x40\x45\x1b\x39\xdc\x1f\x98\x57\x8f\x8c\x62\x70\xdf\x8a\x93\x71\xa1\xf6\x88\x6e\x66\xd1\x31\x17\xca\x44\xd7\x37\x9f\x2f\x8e\x58\x5c\x5d\x7d\xac\xeb\x5d\x06\x87\xfe\x6e\xa7\xc5\xff\x5e\xcd\xdf\xed\x1e\xfe\xa7\x4f\x47\x2d\x3e\x1f\xb5\xf8\xe3\x68\x96\x97\xc7\x2c\xae\x3f\x56\x3a\x24\x13\x5c\xf1\x88\x53\x13\x4d\x06\xe3\x63\x3d\x41\x93\x05\x30\x90\x72\x2c\xf8\x13\xec\xd6\x7c\xa6\x54\x76\x07\xaa\xda\xae\x19\x51\x33\x13\xf5\x66\x40\xa8\x9a\x2d\xab\x9b\x6b\xda\xe7\x5b\x1b\x02\x48\x9c\xfc\x12\x88\xf6\x3c\x11\x42\xf2\x5c\x44\x50\x69\x9b\x43\x72\xb5\x71\xd9\xd7\xb8\x63\x0e\x3f\xd7\x0f\xa9\xb7\x67\xd4\xc5\x65\xed\x90\x44\x25\x1c\x1f\xf1\x1a\x7a\x4e\xc0\xf7\x1c\x64\xf5\x26\x20\x14\x65\xb9\x89\xae\xcf\xcf\xd3\xca\x7a\x0a\x29\x17\x4b\x13\x5d\x5e\xdf\x38\x49\x3d\x95\x36\x08\x17\xa7\x23\xd4\x76\xd6\x82\xd3\x3c\x05\x47\xbf\x7c\xa5\xd9\x24\xa8\x8d\x2f\x85\xda\xd9\x09\xa1\x54\x87\x1b\x97\xcd\xd1\x6a\xec\x2a\xbb\x70\xc4\xe8\xd2\x44\x7a\xde\x6c\x4d\x68\x47\xb8\x56\x22\x77\x80\xdc\x61\xe1\x3b\x85\x5a\x59\xbf\x9a\x97\x77\xcb\xb2\x95\xe5\xd9\x3d\x81\x72\xcd\x6d\x1f\xee\x3f\xa8\x54\xb9\xe0\x90\x6c\x97\xd2\x2f\xc6\xfd\x37\x00\x00\xff\xff\x3d\xf1\x32\x7b\x84\x14\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xbc\x58\x51\x6f\xe2\xba\x12\x7e\xef\xaf\xb0\x50\x1f\x76\xa5\x4b\x68\xbb\x6d\x77\x6f\xa4\x7d\x48\xc1\xdb\xcd\x2d\x09\x28\x09\x95\x7a\x5f\x22\x37\x99\x42\x84\x63\x67\x6d\x87\xbd\xdc\xb6\xff\xfd\xc8\x09\xb4\x10\x12\x20\xdd\xa3\xc3\x13\xd8\x33\xdf\xf7\xcd\x78\x3c\x1d\x97\x64\xc9\x3d\x08\x99\x70\x66\x22\x92\x65\xb2\xb7\x38\x3f\x99\x27\x2c\x36\xd1\x00\x32\xca\x97\x29\x30\x75\x92\x82\x22\x31\x51\xc4\x3c\x41\x88\x91\x14\x4c\xf4\xfc\x8c\x12\x16\xd1\x3c\x06\xd4\x99\xe7\x29\x31\xf4\x72\x07\x19\xe8\xf5\xb5\x1b\x71\xa6\x04\xa7\xdd\x8c\x12\x06\x2b\x0f\x99\x91\xa8\x74\x33\x3c\xa0\x40\x24\x18\xee\x7a\x19\xbd\xbe\x9e\x20\x44\xc9\x23\x50\xa9\x19\x10\x7a\x7e\xee\x56\xe0\xcb\x5d\x4d\xf0\x82\x58\xc2\x62\x60\x0a\x5d\x96\x8e\x48\xeb\x36\x91\x36\xab\x50\xcb\x0c\x22\x0d\x28\x95\x20\x0a\xa6\xcb\x12\x5c\x70\x4a\x13\x36\x9d\x64\x31\x51\x50\x2e\x21\x94\x92\xff\xf9\xb9\x98\x82\x89\xce\xdf\x57\x26\x8c\x2c\x48\x42\xc9\x23\x05\x13\x9d\x69\x20\xa0\x10\x29\x2e\x4a\xaf\x94\xa8\x68\x36\xdc\x90\x5d\x27\x7c\xed\x32\xac\x09\xe0\x7a\x1d\x40\x73\x08\x08\x29\x48\x33\xfa\xa6\x74\xf3\x24\x0a\x3f\xc6\xb8\x22\x2a\xe1\xec\x4d\x03\x42\xd1\x0c\xa2\xb9\xcc\xd3\x5e\xc4\xd9\x53\x32\xdd\x3a\xad\x4f\x99\x48\x98\x42\xa7\x46\xb0\xc2\x35\x6e\x88\x84\x31\x51\x33\xd4\xe9\x45\x59\xb7\x74\x49\x49\x66\x2c\x49\x4a\x3b\x9f\x0b\xc1\x72\x46\x2e\xae\xae\x65\x9e\xbe\x0b\xde\x60\x51\x54\x76\x25\x44\x02\x94\x6c\x45\xf5\x1b\x1e\x67\x9c\xcf\x65\x97\xb0\x78\x0d\x70\x80\x95\x6e\x65\xbb\x6d\xbe\xbf\x6d\xca\x6f\xce\x38\x42\xeb\xc2\x29\xbe\x83\x58\x24\x11\x58\x51\xc4\x73\xa6\xdc\xd6\xd5\xbf\x96\xf9\x3b\x51\x33\x64\xdc\x13\x9a\x83\x34\x56\x46\x63\x6d\x63\x30\x1e\x83\xbf\x92\xfd\xae\x70\x73\x75\x33\x60\xa4\xf8\x03\x49\x69\x53\x60\x9a\x0a\x58\xfc\xbe\xa0\xa9\x48\xc2\x40\x6c\xa4\xad\xbb\xba\xc5\x75\x5a\xf5\x27\x49\xc9\xb4\x2e\xcc\x27\x2e\x52\xa2\x6c\xbd\xdb\x41\x9f\xe2\x24\x52\xa8\x93\x94\xbf\x6a\x23\x2b\xf6\x50\x47\x70\xae\x3a\xe8\xf4\x33\x7a\x41\xbf\x72\xae\x60\xf3\x18\x56\x64\xe3\x9c\xd2\x31\xa7\x49\xb4\x2c\x9b\x44\x23\x9a\x91\xbd\x59\x6e\xc3\x00\x5b\x98\x1b\x3f\xdf\x83\xbc\x9b\x38\x56\x88\xdd\x7b\xdb\x1b\xb9\x0e\x76\x83\x2d\x23\x84\x16\x9a\xc9\xd4\x01\x3e\x82\x60\xa0\x40\x76\x9a\x61\xfc\x60\xe4\xe1\x30\x78\x18\xe3\x3f\x47\xb9\x9b\xdc\x60\xcf\xc5\x01\xf6\x43\xff\xc1\x0f\xb0\x13\xba\x96\x83\xfd\xb1\xd5\x6f\x00\xaf\x6f\x9e\xb5\x39\xad\x10\xde\x62\x17\x7b\xd6\x30\xb4\x06\xf7\xd8\x0b\x6c\x1f\x0f\xc2\x9f\x23\x3f\xd0\x7c\x8d\x54\xc7\x15\xb8\xb1\xa7\xa3\x1f\x10\x13\x0c\xfd\xb0\x8f\xbd\x20\xfc\x61\x0f\x1b\x64\xf4\x16\x44\xf4\x44\xce\x7a\xab\xee\xd0\x2b\xb4\x24\xbc\x68\x39\x11\x08\xa5\xbf\x18\x91\x50\xc7\xb1\xdd\xe1\x87\x3f\x26\x9b\xc3\x72\xcb\xbd\xe8\x40\x4f\x08\x7e\xd5\xd7\x6c\xca\x75\x0a\x05\xa4\x5c\x41\x67\x6f\x5a\x9c\xc9\x30\xb0\xfb\xc3\x89\x1f\x60\x2f\xf4\xb0\x33\x0a\x70\x78\x3b\x1c\xdd\x14\xc7\x36\xf0\xb0\xef\x37\x57\x45\x1d\xf3\x3c\x96\xb7\x94\x3f\x12\x6a\xc5\xb1\x00\x29\xab\xe4\x3b\x8d\xa2\x46\x93\x35\xb6\x43\x1f\x7b\xf7\x85\x22\x6b\x10\x8e\xdc\xe1\x43\x43\xe1\x2b\x91\xc3\x9e\x92\xf7\x26\x6e\x60\x3b\x5b\x45\x6f\x0d\x1c\xdb\xf7\xed\x91\xbb\xa6\x18\x8f\xbc\xa6\xcb\x79\x75\x79\xf9\xe5\x0f\xd1\x8b\x52\x1b\xd8\xde\x07\x0f\xbf\x15\xb9\xed\xfe\x07\xf7\x83\x91\x17\xf6\x5d\x3b\xc4\xae\x75\x33\xc4\x83\xc3\xa7\xc7\x12\x03\x98\x1e\x36\xe2\xa3\x2e\xf5\x3e\x5e\xdf\x1e\xe0\xbe\xe5\x85\xfd\x91\x1b\x58\xb6\x8b\xbd\xd0\x76\xac\xdb\x63\x2f\xfb\x11\x6d\x5e\xcf\x20\x2d\x7a\x7c\x45\xfa\x9b\x4e\xdb\xb5\x83\x7f\x44\x24\x4b\x4a\xd3\x96\x42\x07\xf8\x87\x35\x19\x06\x7e\xe8\xdf\xd9\xe3\xd0\xc1\xfe\xcf\xb0\xef\x61\x2b\xb0\x47\x6e\xbb\xdb\x18\xc3\x13\xc9\xa9\x92\x86\x9c\x27\x99\x03\x72\xd6\x17\x50\x8c\x6d\x47\xc9\x70\x46\x03\xdc\x8e\xaf\xe8\x3b\x0d\xd0\xab\x96\x55\xeb\xf7\x7f\xce\xa0\x75\x9b\xfa\xef\xc8\x6d\x29\xaf\xa0\xa9\x95\x57\xdb\x96\xf4\xa2\x20\x6c\x0a\xe8\x74\x0e\xcb\x7f\xa1\xd3\x02\x1e\x99\xdf\xeb\xd1\x81\x2d\xee\x89\x90\x4d\x71\x3c\x3f\x17\x30\xe8\x05\xe5\x59\x06\xa2\x6a\xb6\x29\x7e\x45\xf4\x21\xa5\x40\x41\x3f\x9e\x1a\x55\xae\x3a\xcd\x3e\x95\x2b\x08\x03\xb3\x45\x83\xca\x1f\x82\xa7\x66\x65\x43\xcf\xac\x1a\xfa\x0e\x96\x1e\x3c\xed\xee\xa2\x1a\x06\xbf\xf0\xd8\x25\xd1\x9f\x39\x2c\xb7\x8d\xef\x60\x79\x44\x2a\x88\x98\xca\xea\x44\x26\x72\x56\x59\xe9\x76\x29\x9f\x76\x29\x2c\x80\x7e\x6f\xaa\x16\xca\xa7\x43\x6d\xb0\x9b\xaa\xee\xea\xbd\xd2\x7d\x4a\x28\x7c\xef\x81\x8a\xde\x1a\xf7\xee\x68\xbf\x7a\x0e\x15\x4f\x8c\x0d\x9c\x8c\x0b\xb5\x23\xf4\x6d\x6a\x1e\x73\xa1\x4c\x74\x75\xfd\xed\xfc\x80\xc5\xe5\xe5\x97\xba\x5b\xc6\x60\xdf\x60\x30\x2d\xfe\x42\xd7\x0c\x06\x3b\xfc\x5f\xbf\x1e\xb4\xf8\x76\xd0\xe2\xdf\x07\xa3\xbc\x38\x64\x71\xf5\xa5\x52\x21\x99\xe0\x8a\x47\x9c\x9a\x68\x32\x18\x1f\xaa\x09\x9a\x2c\x80\x81\x94\x63\xc1\x1f\x61\x3b\xe7\x33\xa5\xb2\x5b\x50\xd5\x72\xcd\x88\x9a\x99\xa8\x37\x03\x42\xd5\x6c\x59\xdd\x5c\xcb\x3e\xdb\xd8\x10\x40\xe2\xe4\x43\x24\xda\xf3\x48\x0a\xc9\x73\x11\x41\xa5\x6c\xf6\x35\xd6\x37\x97\xdd\x6e\x7c\xc8\xe1\x65\xfd\xe4\x7b\x7f\xf0\x9d\x5f\xd4\x8e\x73\x54\xc2\xe1\x61\xb4\xa1\xe6\x04\xfc\xca\x41\x56\x6f\x02\x42\x51\x96\x9b\xe8\xea\xec\x2c\xad\xac\xa7\x90\x72\xb1\x34\xd1\xc5\xd5\xb5\x93\xd4\x4b\x69\xc3\x70\x7e\x3c\x43\x6d\x65\x2d\x38\xcd\x53\x70\xf4\x1b\x5d\x9a\x4d\x0d\xb5\xf1\x4d\x53\x3b\xe5\x21\x94\x6a\xb8\x71\x59\x1c\xad\x06\xc4\xb2\x0a\x47\x8c\x2e\x4d\xa4\x27\xe3\xd6\x82\xb6\x1a\xd7\xaa\xc9\xed\x11\xb7\xbf\xf1\x1d\x23\xad\xcc\x5f\xcd\xff\x08\x5a\xa6\xad\x4c\xcf\xf6\x09\x94\x6b\x6e\x7b\xb8\xbf\x21\x53\xe5\x82\x43\xb2\x6d\x49\x1f\xc4\xfd\x2b\x00\x00\xff\xff\x2c\x7e\x15\xf1\x2e\x15\x00\x00"),
 		},
 		"/templates/cp-global-sync-service.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-global-sync-service.yaml",
@@ -201,21 +201,21 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/templates/cp-rbac.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-rbac.yaml",
-			modTime:          time.Date(2020, 9, 29, 9, 24, 11, 829006519, time.UTC),
+			modTime:          time.Date(2020, 10, 1, 15, 48, 11, 684589621, time.UTC),
 			uncompressedSize: 3578,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xd4\x56\x4d\x6f\xdb\x38\x10\xbd\xfb\x57\x10\xde\xdb\x02\x52\xb0\xc0\x1e\x02\xdf\xda\x1e\x7a\x29\x8a\x22\x29\x72\xa7\xa9\x27\x6b\x6a\x6a\xa8\x92\x43\xa7\x8d\xeb\xff\x5e\x50\x72\x2c\xc7\x5f\x8d\x95\xa4\x6d\x7c\x32\x87\x9a\x99\x37\x1f\x7c\x33\xba\xa1\x1b\xf8\x40\x8e\x27\x6a\xf1\xdf\x68\x4e\x5c\x4c\xd4\x35\xfc\x82\x0c\xde\x18\xe3\x22\xcb\xa8\x86\xe8\x42\x8b\x9e\x8c\x94\x62\x5d\x63\xa2\x96\x4b\x45\x6c\x6c\x2c\xa0\xc6\xf3\x58\xeb\x3c\x89\xc7\x2a\x57\xab\x55\x66\x1c\x8b\x77\x36\x6b\xac\x66\xac\x35\x42\xa3\x4d\xa7\x96\x5f\xc1\x42\x07\xe4\x1f\xef\xc5\x6a\xb5\x1a\x29\x65\xf5\x14\x36\x24\x0f\xcb\x65\xb6\x63\xbc\xbb\x4b\xe6\x7f\x28\x26\x2e\xc0\xa2\xfe\x4f\x6a\x59\x96\x8d\xb6\x03\xf0\x53\x6d\x72\x1d\xa5\x72\x9e\xee\xb4\x90\xe3\x7c\x7e\x19\x72\x72\x17\x9b\xd0\xde\xd9\x18\x04\xfe\xca\x59\x9c\x17\xd7\x64\x37\xae\x41\x88\x7d\xb4\x68\x75\x32\xa5\x1b\x7a\xef\x5d\x6c\xda\x63\xfa\x65\x6a\x3c\x6e\xff\x7a\x04\x17\xbd\xc1\xd6\xcd\x26\x89\x61\x23\x6a\x5c\xd1\x1f\x42\x57\xb1\x4e\xb0\x80\x9f\x6e\xe9\xce\x20\x9b\xff\x96\x42\x7f\xb8\xd5\x62\xaa\xf3\xb1\x60\x01\x96\x83\x9e\x8c\x87\x16\xf4\x08\x4f\xd9\x6f\xf3\x44\xee\x98\x93\x54\x97\x36\xd3\x61\x5f\x44\x1c\x68\x56\x49\x7f\x53\x23\x54\x5b\x1f\xde\x39\xde\x39\x3d\xd0\x38\x37\x3d\x07\x63\x8b\x4d\x71\x28\xd4\x35\x52\x58\xb4\x97\x43\x22\x6f\xbc\xfb\xf6\x5d\x50\x37\x56\x0b\x5e\x21\xe2\x8b\x20\x5a\xe2\x2f\x81\x1f\x81\x33\xc4\xbf\x78\x5d\x96\x64\x1a\xf8\x9a\x42\x62\x82\xb0\x7b\x65\xdd\x6c\x4f\xe6\x5d\x14\xec\x49\xc5\x3f\x78\x64\xa5\x8e\x56\x88\xbf\xc0\xc8\x03\xbb\x86\xbc\x89\x24\x53\x0f\x3d\x87\xef\xe5\x15\xb4\x95\xca\x54\x30\xf3\xe1\xa5\x6b\xf9\xa4\x54\xf8\xaa\xf2\x1b\x6d\x23\x42\xbe\xe6\x9e\x4f\xa9\xfb\xf3\xda\x25\x9e\xf1\xa8\x9d\x60\xdc\xb1\xe7\x13\x0a\x9e\x9c\x81\x8b\x64\x67\xed\x77\xe3\x94\x29\x07\xeb\xa9\x45\xd1\x79\x39\x5c\x9b\xcb\xee\x4b\xc3\xa6\x3c\x51\x23\x86\xdc\x3a\x3f\xcf\xb4\x88\x36\x55\x0d\x96\xac\x40\x49\x4c\x7d\x5e\x9f\xa5\xcb\xd7\x71\x6d\x45\x75\x36\xbf\x25\x62\xbd\x28\x89\xb5\xa5\xbb\xfb\xda\xee\x60\x1b\xff\x3b\x1e\xd8\xab\x1d\x55\xbd\x98\xf9\x9e\x36\x1f\xe5\xe2\x1f\xb5\xd0\x96\x52\x9b\xa4\x3a\x2a\x71\x73\xb0\x9a\xa2\x74\x1e\x8a\x42\x88\x20\x9e\xa9\xfa\xf3\x87\x6b\x65\xe0\xe5\x18\xa6\x34\x71\xc1\x42\x66\x7b\xe4\x1e\x7d\xac\xc9\x87\xc7\x82\x70\x7b\x6a\x86\x3c\x6d\xb4\xbf\x25\x2e\x88\x67\x7f\x64\xc2\x3b\x8b\x2b\x94\x49\xeb\x3e\x55\x27\xd0\x8f\x94\xda\xdf\x4b\xce\xc7\x1a\xe2\x34\x51\xd4\x7a\xb3\x38\xb8\xc4\xa5\xec\x9e\xbf\xbc\x3d\x6e\x7d\x1b\x50\xac\x67\x58\xc0\x5e\x70\xb1\x1c\xba\xa6\x05\x18\x8f\xbf\x64\xcd\x38\x8e\xd2\x38\x2e\x69\x56\xeb\xe6\x37\x03\x1d\xd8\x26\xcf\xf3\x98\x1f\xd3\x2d\x03\xdf\xee\xeb\x7c\xb4\x3f\x03\x00\x00\xff\xff\x05\xfb\xce\x73\xfa\x0d\x00\x00"),
 		},
 		"/templates/cp-service.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-service.yaml",
-			modTime:          time.Date(2020, 9, 24, 9, 57, 34, 8953825, time.UTC),
+			modTime:          time.Date(2020, 10, 1, 15, 43, 36, 845707988, time.UTC),
 			uncompressedSize: 1001,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\x7c\x53\x4d\x8f\xd3\x30\x10\xbd\xf7\x57\x8c\xa2\x3d\x92\xc0\x42\xbf\xb0\xc4\x8d\x23\x5a\x55\x20\xf6\x3e\xb5\x87\xae\x55\xc7\x36\x9e\x49\xc5\xaa\xdb\xff\x8e\x5c\x27\x62\xd3\x84\xbd\xb5\xf1\x7b\xf3\x3e\xc6\xc6\x68\x1f\x29\xb1\x0d\x5e\xc1\xe9\x7e\x71\xb4\xde\x28\xf8\x41\xe9\x64\x35\x2d\x5a\x12\x34\x28\xa8\x16\x00\x1e\x5b\x52\x70\x3e\x83\xf5\xda\x75\x86\xa0\x3a\x76\x2d\x36\x3a\x78\x49\xc1\xed\x1c\x7a\x6a\xb8\xf0\x1e\xb0\xa5\x0a\x1a\xb8\x5c\x7a\x1e\x47\xd4\x85\xdc\x7c\x27\x47\xc8\xd4\x3c\x0c\x9f\x0b\xca\xe1\x9e\x1c\x67\x9d\xf3\xb9\xbe\x91\x28\x67\x79\xe0\x0b\x78\xeb\x0d\x79\x81\x65\xa1\xa1\xf7\x41\x50\x6c\xf0\x57\x2e\x40\x4c\xa1\x25\x79\xa2\x8e\x1b\x1b\xde\xb3\x4e\x18\x49\x41\x25\xa9\xa3\x6a\x06\x10\x43\x12\x05\xd5\x6a\xbd\xfd\x50\x8e\xb3\x7a\x42\x7f\x20\xb8\x3b\xd2\xf3\x3b\xb8\x3b\xa1\xeb\x08\xd4\x17\x68\x1e\xf3\x2f\x9e\x0d\xdc\xbc\xf2\x51\x8c\x95\x59\xd7\x21\x70\xb9\x5c\xa3\xf7\xa3\x5e\xe0\x77\x17\x84\x06\x58\x16\x24\x6f\xf2\x5f\x8e\xa4\x73\x0a\x79\x8e\x7d\x59\x6f\x49\x66\x54\x19\x92\x43\xf4\xf1\x6b\x28\x89\x56\xeb\xed\x7d\xef\xa2\xec\xed\x49\x24\xd6\x18\x6d\x9d\xe9\x94\x46\xe0\xe5\xf2\xd3\x04\xcb\x35\x9a\xd6\x72\xbe\x17\xaf\x29\x00\x82\xe9\x40\xb2\x2b\x2a\x03\xf3\xba\xb3\x5f\xe0\x69\xde\x72\x1b\xf2\x2e\x0f\x2e\xec\xd1\x55\x43\xf0\x7f\x56\x37\xeb\x91\x7c\x8b\x86\xe7\x6c\xae\xd6\x9b\xcd\x08\x78\x48\x51\xd7\x6c\xf8\x16\xb5\x9d\xa2\xfe\x4c\x51\x9f\xa7\xfd\x4c\x51\xdb\x8f\x53\xd4\x3e\x04\x61\x49\x18\xe7\x4d\xae\xc6\x65\x1a\xcf\xe3\x02\x63\x0a\x12\x74\x70\x0a\x7e\x7e\xdd\x2d\x46\x17\x00\x80\xc9\x91\x96\x90\xca\x36\x31\x46\x05\xf9\x09\xd4\x7d\x9d\x75\xcc\x7d\xce\x3e\x92\x81\xf9\xed\x7f\x8f\xe5\x6f\x00\x00\x00\xff\xff\x4c\xb9\x00\x16\xe9\x03\x00\x00"),
 		},
 		"/templates/cp-webhooks-and-secrets.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "cp-webhooks-and-secrets.yaml",
-			modTime:          time.Date(2020, 9, 28, 12, 56, 47, 951621116, time.UTC),
+			modTime:          time.Date(2020, 10, 1, 15, 43, 36, 846026197, time.UTC),
 			uncompressedSize: 5397,
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xe4\x58\x5f\x6f\xdb\x36\x10\x7f\xd7\xa7\x20\x84\x16\x68\x0b\x50\x8a\x93\x38\xc8\x04\xf4\xa1\x6b\xd3\x62\x58\x5b\x04\x4d\x96\x3d\x53\xd4\xc9\xe2\x4c\x91\x1a\x79\x72\xe6\xb9\xfe\xee\x03\x29\xc9\x96\x14\x27\x71\xba\x02\xcb\x52\xbd\xe9\xfe\xdf\xfd\x7e\x3c\xca\x5e\xad\x28\x79\x86\xd2\x5e\x31\x69\x49\xf2\x9a\x44\x57\x4c\xd6\x60\x23\xae\x15\x1a\x2d\xcf\x25\x53\x10\xa1\xb4\x64\xbd\x0e\x56\xab\xf8\x55\xf0\x01\x14\x18\x86\x40\x38\x18\x14\xb9\xe0\x0c\xc1\x06\x16\x20\x21\x05\x62\x65\x93\x38\x2e\x99\x45\x30\xa5\x50\x99\x8d\x66\x02\x8b\x3a\x8d\x84\x8e\x6d\x65\xc4\x2c\xe6\x66\x59\xa1\x8e\x0a\x2c\xe5\xc8\x09\x32\x51\x97\x11\xd7\x65\xac\xea\x85\xa6\x33\xa3\xeb\x8a\x22\xf0\x22\x2e\xf5\x02\xe8\x52\xd7\x86\xba\x9c\x96\xa2\xa6\x05\xc8\x92\x1e\xe7\xd3\xfc\x64\x72\x74\x74\xca\x38\x1b\x06\x6b\xb3\xfa\x60\x80\xd7\xda\xcc\x2d\x98\x85\xe0\x50\x82\x2d\x76\x89\x52\xa9\xd3\xf8\xf4\xe0\x98\x65\xd3\x83\xc3\x93\x34\x9d\x66\x69\x76\x78\x3a\xe5\x87\x87\x07\xf9\x64\x7a\xf4\xd3\x34\x87\xc3\x29\x1c\x9f\xe4\x53\xc8\xd2\x38\x83\x4a\xea\x65\x09\x0a\x6d\xec\x2a\x89\x95\x2d\x63\x5e\x30\x83\x36\x66\x59\x29\xac\x15\x5a\xd1\x6b\x48\x0b\xad\xe7\x31\x42\x59\x49\x37\xa5\x9b\x3a\x6a\x81\x1b\xc0\x08\x2b\x19\xbc\x8a\xd7\xeb\x80\x10\x0f\x08\xd7\x65\xa9\xd5\x67\x56\x82\xc3\xe4\x85\x50\x5c\xd6\x19\x90\x70\x5e\x97\x6c\x08\x4d\xdb\x84\x33\x0d\x49\xf4\x92\x6c\x63\x30\x89\x4e\xea\x51\x95\xc2\x22\x79\x51\x19\xa1\x30\x27\xe1\x73\x1b\x3d\xb7\xe1\x20\x4b\xf4\x05\x24\x30\x0b\x91\x77\xa9\x18\x87\x97\x23\xfb\xc8\x2e\xf8\xfd\x3e\xb4\xd7\x03\x18\xbc\xbc\xfc\xe8\xd2\x1f\x9d\x4c\x0f\x06\x2a\xe6\xa4\x33\x50\x6f\xdf\x34\x3d\x51\xce\xc2\xad\x87\xb3\xec\x4c\x9d\x11\x18\x6c\xed\x2f\xc4\x4c\x41\xe6\x05\xfd\x4a\x94\x90\xbd\x7e\x37\x71\x5c\x9e\x51\x41\x2e\x4e\x17\x33\xf2\x71\xb6\xfa\x39\x2c\x07\xea\x5f\x61\x49\xfa\x35\xff\x5c\xab\x4c\x36\x80\x3c\xe3\xac\xf1\xfe\x4a\xd2\x93\x63\x50\xbc\xdf\xb9\xc8\xb7\x27\x6a\x94\xfd\xf5\x46\x13\xf1\xc6\xdd\xc0\x9f\xb5\x30\x90\x91\xf0\x53\x6d\x91\x54\x46\x2f\x44\x06\xb7\x1e\x43\xef\x16\x8e\x8a\xee\x45\x75\xaf\x0f\x0f\x3a\x87\x65\xb8\xab\xd5\xd7\x6d\xd9\x5d\x97\x5b\x1b\x50\x99\x7b\x09\x28\xa5\x01\xab\xc4\x15\x18\x47\xeb\x84\x2c\x26\xc1\x5c\xa8\x2c\x21\x17\x9e\xd8\x01\x2e\x2b\x48\xc8\xbc\x4e\xc1\x28\x40\xb0\x6e\x11\xa0\xb4\x41\x09\xc8\x32\x86\x2c\x09\x08\x51\xac\x84\x84\xac\x56\x64\x48\x73\xd5\x50\x9a\xac\xd7\x14\xa5\xf5\x47\xbf\x35\xf6\x5c\xf3\x1e\x37\x29\xd8\x94\x28\x59\x0a\xd2\x26\x1d\x20\x83\xb8\x8d\xce\x45\xfe\x4a\x94\x50\x19\x28\x24\xc7\xce\xad\xab\xc7\x8f\xd9\xa0\x4f\xb0\xab\xff\x76\x62\x8d\xde\x0d\x7c\xa0\x1f\x4f\x64\x73\xe6\x0d\xcc\x84\x45\xc3\x50\x68\x15\xcd\x4f\xfd\x28\x16\x93\x14\x90\x75\x33\xfb\x54\x23\x43\xa1\x66\xbf\x37\xcb\xe1\xad\x56\xb9\x98\xd5\x8d\xc7\x03\x27\xb6\xdd\x34\x65\x1b\x74\xb3\x72\xf8\x20\xec\xb7\x4c\x74\xdf\x81\xb6\x19\xbd\x17\x6d\x8b\x76\xdb\x36\xca\x20\x67\xb5\x44\x30\x91\x3f\xfc\x9b\x62\xfd\x6b\x24\x74\x40\x08\x21\x39\x13\xb2\x36\x70\xae\xa5\xe0\xcb\x84\xbc\x67\x42\x7a\x39\x97\x02\x14\x36\xc3\x49\xbc\x84\x90\x8e\xb1\x2d\x66\x1d\x7f\x7d\xe5\xee\x69\xb7\x64\x67\xbe\x6f\xd3\x5b\xdb\x1d\xd3\xbe\x63\x0d\xf7\xbd\x2b\x86\x45\x42\xe2\xb6\x65\xea\x1b\x16\x9a\x2e\x26\x4c\x56\x05\x9b\x50\x37\x10\x6f\x6c\x6a\x09\xb6\xab\x90\x12\x56\x89\x0f\xee\x0a\xb4\xdb\xa2\x9d\xb8\x3f\x21\xf7\x6c\xa9\x36\x32\xec\x12\x6c\x84\xba\x82\x06\xf3\x91\xe1\xdb\x2f\x67\x6f\x2e\xcf\x06\xa2\xdf\xce\xdf\xf5\x45\x06\xac\xae\x0d\x87\x91\xa3\xab\x1c\xac\x17\x59\x91\xc1\x59\x9e\x03\x47\x9b\x90\xcf\x5a\x41\x0f\x71\x7d\xad\xc0\x50\x03\x39\x18\x50\x1c\x7e\x1c\xc8\x47\x8d\xdf\x80\xfe\x31\xa1\x7e\x0b\xc4\x5c\x18\x5e\x0b\x4c\x0d\xb0\x39\x18\x3b\xd0\x79\x3e\x0b\xf5\x07\x70\x1f\x7e\xa0\x43\xc3\xf2\x5c\x70\xa9\x67\x3b\xe5\x95\xfb\x3a\xf4\xf0\xef\x54\x1b\x5d\x23\xec\xd4\xa0\x61\x7c\xa4\x29\x80\x49\x2c\x78\x01\x7c\x3e\x54\x54\x46\xff\xb5\xdc\x7c\x7b\xdd\x4b\xd3\x06\x1d\xdf\x8e\x36\x77\xb1\xd2\x91\x67\xd7\x45\xda\xf9\xbe\xef\x9b\x77\xb4\xf8\x7f\x32\xb8\x69\x89\xba\xb1\x71\x66\x1e\xc0\xd7\x30\xdc\x87\xaa\xdf\x89\xa4\x95\xce\x6e\x83\xf7\x5f\x5c\xc6\x57\x4c\x8a\xec\x7b\x5d\xc7\x8b\x4d\xb0\x47\x72\x0d\xb7\x05\xe9\x1f\xe8\x06\x6e\x5b\x7e\xdc\x7b\x78\xc7\xed\xeb\x44\xef\xce\x3e\x9e\x3d\x89\x6d\xed\x8e\x4c\xe5\xf0\xda\x73\x89\xf7\xbe\x31\xee\xd8\xeb\x9d\xea\x6f\xad\xf6\xd8\xf4\x2d\x53\xa2\x6f\x39\x03\xbf\xcc\x94\x36\xf0\x14\x4e\xc1\x62\x42\x5b\xe3\xff\x7c\xaf\xef\xff\xc9\xd9\x56\xbc\x0f\xc6\xfe\x7f\x95\xbd\x20\xde\x60\x70\x01\xd2\xdf\xe0\x5d\xce\x92\x21\x2f\x3e\x6e\x36\x6e\xf3\xb4\x9e\xb1\x5d\x5a\x84\x92\xf6\x00\x0c\xd1\xd4\x10\x3e\x01\xd6\xdc\x4b\x1b\xff\xd3\xfe\x11\xb2\x66\xff\x55\xd9\xf4\x70\x1b\x8f\xfe\x09\x00\x00\xff\xff\xe8\x5d\x2e\xa5\x15\x15\x00\x00"),
@@ -257,10 +257,10 @@ var HelmTemplates = func() http.FileSystem {
 		},
 		"/values.yaml": &vfsgen۰CompressedFileInfo{
 			name:             "values.yaml",
-			modTime:          time.Date(2020, 9, 28, 12, 56, 47, 952353117, time.UTC),
-			uncompressedSize: 1514,
+			modTime:          time.Date(2020, 10, 1, 15, 48, 11, 685158175, time.UTC),
+			uncompressedSize: 1529,
 
-			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xac\x54\xd1\x6e\xeb\x44\x10\x7d\xf7\x57\x8c\x9c\xe7\xe6\xba\x40\x2b\xe4\xb7\x4b\x11\xa8\xa2\xf7\x2a\x22\x15\x3c\x4f\xd6\x13\x7b\xc9\x7a\xc6\xec\x8c\x03\x06\xf1\xef\x68\x77\x93\x36\x17\x45\x05\xa4\xfb\x16\xcf\xce\x9c\x3d\x7b\xe6\x9c\xac\xe0\x79\x20\xe8\x68\x8f\x73\x30\x88\xd4\x7b\xb5\xb8\x00\x72\x07\x86\x3d\x98\xc0\xac\x04\x7b\x89\x80\x21\xc0\x0f\xf3\x88\xe0\x47\xec\x49\xab\x3e\xc8\x0e\x43\x5b\x01\x30\x8e\xa4\x13\x3a\x6a\xa1\x3e\xcc\x23\xde\xe8\xa2\x46\x63\x5d\x41\xe9\x4d\x3d\xf0\x82\x9d\x9a\x84\xfb\x9b\x4e\xdc\x81\xe2\x4d\x1e\x28\xbf\xd7\x3b\xcf\x16\x71\x59\x7b\xa9\xf3\xc8\x0a\xbe\x2d\xc4\x34\x11\x59\x3f\x0c\x18\x6d\xfd\x7e\x9a\x7e\xa2\xa8\x5e\xf8\xd4\x63\xd8\xb7\x50\xd7\x55\xb5\x82\x9f\x07\xb2\x81\x22\x48\x04\x16\x4b\x43\x13\x9a\x1b\xc0\x06\x02\xc3\xd8\x93\xbd\x92\x85\xdf\xbc\x95\x93\x42\x17\x02\xee\x28\x54\x79\x60\x9b\x2b\x1f\x5f\xdf\x65\x71\xa6\xaa\x72\xc2\x16\x25\x6c\x02\x72\x7e\x54\x90\xfe\x89\x8e\x14\x5a\xa8\x3d\xef\x33\xe9\x51\xba\x24\x83\x1a\x72\x87\x41\x98\x52\x71\x05\x7f\x08\x53\x21\x09\x70\xe8\xf4\xfb\xac\xdd\xfb\xae\x8b\xa4\x7a\xae\xb3\x74\xb4\xa5\x40\xce\x24\x16\xc9\x0e\xf3\x8e\x22\x93\x91\xae\xbd\xbc\x13\x6d\x21\x78\x9e\x7f\xbf\x72\x86\xd1\x0d\x2d\xe0\xd8\xdd\x7f\x95\xa0\x3c\xff\x92\x61\xbe\x43\x1f\xe6\x48\x1b\x09\xde\x2d\x2d\x3c\xf6\x2c\x91\x52\x83\x52\x3c\x7a\x77\xda\xcc\x2a\x8b\x92\x69\xa4\x4f\x5b\x26\x6a\xe1\x21\xcc\x6a\x14\x1f\x37\xb9\x86\xcc\x62\x68\x5e\x58\x5b\xf8\xf3\xaf\x04\x51\xf6\xff\x23\x8d\x62\xb4\x5d\xd8\x6d\xff\x15\xf2\x49\xb0\xfb\x06\x03\xb2\xa3\x78\x15\x35\xd5\x26\x89\xd6\xc2\xdd\xfd\xd7\x77\xe9\x92\x93\x31\xb5\xa0\xea\xc1\x4f\x1f\x48\x87\x87\x48\x79\xaa\x85\x3d\x06\xcd\x0f\x5a\x25\x83\xa9\xcc\xd1\x51\x6e\x5e\x41\xf1\xdc\xaf\x33\xa9\x5d\x54\x00\xdc\x34\xb7\x70\xdb\x34\xe3\x45\x6d\xa4\x51\x92\x33\xbf\xb8\xbb\xff\xe0\x0b\xdc\xf3\xd3\x36\xdb\xfe\x88\xd1\xcb\xac\x59\x31\x8a\x5a\x86\x2c\xbc\x42\x3a\x4a\x84\xeb\xfa\xfc\x7d\xa0\xe5\xbc\xd1\x0b\xf7\x4f\x73\x08\x2f\x6b\xd8\x7f\x14\xdb\x44\x52\x62\x3b\x45\x63\x12\xf5\x26\x25\x1c\x29\x10\x6e\x2a\x78\x4a\x2e\x92\x15\x75\x1c\xfb\x84\x45\x8c\xbb\x40\xdd\xf9\xed\x97\x2e\x4c\x26\xfc\xdc\x4e\xba\x1a\xe0\x53\x5e\xcf\x39\xfd\x84\x7f\x90\xdd\x41\x8e\x3e\x2c\xf8\xce\xb3\x1a\x86\x70\xe3\xd8\x9f\x7c\x90\xa3\xda\xac\x9b\xf5\x6d\xce\xeb\x83\xf0\xde\xf7\x73\xcc\xdb\xcc\x72\xa7\x3c\x26\x05\xa0\x43\xc3\x29\x05\x0d\xd4\x77\xe4\x30\x56\xa9\xf2\x12\xbd\x4f\x78\xfd\x53\xbd\x6e\xaa\xdf\x16\x3d\x6b\xfb\xc6\xe5\x9e\xbd\xc1\x34\xa0\x12\x78\x2e\xff\x11\x27\x12\x90\xcf\x1e\xdf\xba\x3d\x35\xd4\x55\xe5\xb9\xcf\xe9\xbe\xb6\xb2\x91\x74\x68\xcf\xe6\x4e\x36\x8f\xe8\xf9\xd9\xa7\xc4\x7c\xd9\xe8\x7f\xca\xe7\xff\x08\xd3\x6d\xd3\x34\xb7\xd5\xdf\x01\x00\x00\xff\xff\x47\xb7\x1c\x52\xea\x05\x00\x00"),
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x02\xff\xac\x54\xd1\x6e\xeb\x44\x10\x7d\xf7\x57\x8c\x9c\xe7\xe6\xa6\x40\x2b\xe4\xb7\x4b\x11\xa8\xa2\xf7\xaa\x22\xd5\xe5\x79\xb2\x9e\xd8\x4b\xd6\x33\x66\x66\x1c\x30\x88\x7f\x47\xbb\x4e\xda\x5e\x14\x15\x90\x78\x8b\x67\x67\xce\x9e\x3d\x73\x4e\x56\xf0\xd4\x13\xb4\xb4\xc7\x29\x39\x28\x75\xd1\x5c\x67\x40\x6e\xc1\xb1\x03\x17\x98\x8c\x60\x2f\x0a\x98\x12\xfc\x30\x0d\x08\x71\xc0\x8e\xac\xea\x92\xec\x30\x35\x15\x00\xe3\x40\x36\x62\xa0\x06\xea\xc3\x34\xe0\x95\xcd\xe6\x34\xd4\x15\x2c\xbd\xb9\x07\x9e\xb1\x73\x93\x70\x77\xd5\x4a\x38\x90\x5e\x95\x81\xe5\xf7\x7a\x17\xd9\x15\xe7\x75\x94\xba\x8c\xac\xe0\xdb\x85\x98\x65\x22\xeb\xbb\x1e\xd5\xd7\xef\xc7\xf1\x13\xa9\x45\xe1\x53\x8f\x63\xd7\x40\x5d\x57\xd5\x0a\x7e\xea\xc9\x7b\x52\x10\x05\x16\xcf\x43\x23\x7a\xe8\xc1\x7b\x02\x47\xed\xc8\x5f\xc8\xc2\xaf\xd1\x97\x93\x85\x2e\x24\xdc\x51\xaa\xca\xc0\xb6\x54\x3e\xbe\xbc\xcb\x75\xa2\xaa\x0a\xc2\xae\x92\x1e\x13\x72\x79\x54\x92\xee\x81\x8e\x94\x1a\xa8\x23\xef\x0b\xe9\x41\xda\x2c\x83\x39\x72\x8b\x49\x98\x72\x71\x05\xbf\x0b\xd3\x42\x12\xe0\xd0\xda\xf7\x45\xbb\xf7\x6d\xab\x64\x76\xae\xb3\xb4\xb4\xa5\x44\xc1\x45\x17\xc9\x0e\xd3\x8e\x94\xc9\xc9\xd6\x51\xde\x89\x35\x90\x22\x4f\xbf\x5d\x38\x43\x0d\x7d\x03\x38\xb4\xb7\x5f\x65\xa8\xc8\x3f\x17\x98\xef\x30\xa6\x49\xe9\x51\x52\x0c\x73\x03\xf7\x1d\x8b\x52\x6e\x30\xd2\x63\x0c\xa7\xcd\xac\x8a\x28\x85\x46\xfe\xf4\x79\xa4\x06\xee\xd2\x64\x4e\x7a\xff\x58\x6a\xc8\x2c\x8e\x1e\x85\xad\x81\x3f\xfe\xcc\x10\xcb\xfe\x7f\xa4\x41\x9c\xb6\x33\x87\xed\x3f\x42\x3e\x08\xb6\xdf\x60\x42\x0e\xa4\x17\x51\x73\x6d\x14\xf5\x06\x6e\x6e\xbf\xbe\xc9\x97\x9c\x8c\x69\x0b\xaa\x1d\xe2\xf8\x81\xac\xbf\x53\x2a\x53\x0d\xec\x31\x59\x79\xd0\x2a\x1b\xcc\x64\xd2\x40\xa5\x79\x05\x8b\xe7\x7e\x99\xc8\xfc\x55\x05\x20\x8c\x53\x03\xd7\x9b\xcd\xf0\xaa\x36\xd0\x20\xd9\x99\x5f\xdc\xdc\x7e\x88\x0b\xdc\xd3\xc3\xb6\xd8\xfe\x88\x1a\x65\xb2\xa2\x18\xa9\x2d\x43\x9e\x5e\x20\x03\x65\xc2\x75\x7d\xfe\x3e\xd0\x7c\xde\xe8\x2b\xf7\x8f\x53\x4a\xcf\x6b\xd8\x7f\x14\x7f\x54\x32\x62\x3f\x45\x63\x14\x8b\x2e\x4b\x38\x72\x20\xc2\xb8\xe0\x19\x05\x25\x7f\xd6\x9c\xf8\xf8\x09\x75\xf9\x0c\x1c\x9b\x52\xc2\x5d\xa2\xf6\x2c\xc5\x6b\x53\x66\x4f\xfe\xdf\xc6\xba\x98\xe7\x53\x7c\xcf\xb1\xfd\xec\x39\x49\x76\x07\x39\xc6\x34\xe3\xbb\xc8\xe6\x98\xd2\x55\xe0\x78\xb2\x45\x49\xee\x66\xbd\x59\x5f\x97\xf8\xde\x09\xef\x63\x37\x69\x59\x6e\x51\x3f\xc7\x33\x0b\x02\x2d\x3a\x8e\x39\x77\x60\xb1\xa5\x80\x5a\xe5\xca\x73\x12\x3f\xe3\xf5\x77\x31\xdb\xb1\x7e\x7b\x07\x45\xea\x37\x2e\x8f\x1c\x1d\xc6\x1e\x8d\x20\xf2\xf2\x97\x71\x22\x01\xe5\xec\xfe\xad\xdb\x73\x43\x5d\x55\x91\xbb\x12\xf6\x4b\x2b\x1b\xc8\xfa\xe6\xec\xf5\xec\x7a\xc5\xc8\x4f\x31\x07\xe8\xcb\x8d\xfd\xab\xb8\xfe\x87\x6c\x5d\x6f\x36\x9b\xeb\xea\xaf\x00\x00\x00\xff\xff\x65\x4d\xef\x7d\xf9\x05\x00\x00"),
 		},
 	}
 	fs["/"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
diff --git a/deployments/charts/kuma/README.md b/deployments/charts/kuma/README.md
index 300a83980..9e1df110d 100644
--- a/deployments/charts/kuma/README.md
+++ b/deployments/charts/kuma/README.md
@@ -33,6 +33,7 @@ The chart supports Helm v3+.
 | `controlPlane.image.registry`                      | Kuma CP image registry                                                            | nil, uses global                                         |
 | `controlPlane.image.repository`                    | Kuma CP image repository                                                          | `kuma-cp`                                                |
 | `controlPlane.image.tag`                           | Kuma CP image tag                                                                 | nil, uses global                                         |
+| `controlPlane.envVars`                             | Additional environment variables that will be passed to the control plane         | {}                                                       |
 | `cni.enabled`                                      | Install Kuma with CNI instead of proxy init container                             | `false`                                                  |
 | `cni.logLevel`                                     | CNI log level: one of off\|info\|debug                                            | `info`                                                   |
 | `cni.nodeSelector`                                 | Node Selector for the CNI pods                                                    | `{ kubernetes.io/os: linux, kubernetes.io/arch: amd64 }` |
diff --git a/deployments/charts/kuma/templates/cp-deployment.yaml b/deployments/charts/kuma/templates/cp-deployment.yaml
index 839568ea1..87092f6ee 100644
--- a/deployments/charts/kuma/templates/cp-deployment.yaml
+++ b/deployments/charts/kuma/templates/cp-deployment.yaml
@@ -70,6 +70,10 @@ spec:
             - name: KUMA_MULTICLUSTER_REMOTE_ZONE
               value: {{ .Values.controlPlane.zone | quote }}
           {{- end }}
+          {{- range $key, $value := .Values.controlPlane.envVars }}
+            - name: {{ $key | upper }}
+              value: {{ $value | quote }}
+          {{- end }}
           {{- range $element := .Values.controlPlane.secrets }}
             - name: {{ $element.Env }}
               valueFrom:
diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
index f52ed83ac..2a014451f 100644
--- a/deployments/charts/kuma/values.yaml
+++ b/deployments/charts/kuma/values.yaml
@@ -50,6 +50,8 @@ controlPlane:
     pullPolicy: IfNotPresent
     repository: "kuma-cp"
   # secrets: {}
+
+  envVars: {}
 cni:
   enabled: false
   logLevel: info
diff --git a/docs/cmd/kumactl/HELP.md b/docs/cmd/kumactl/HELP.md
index 2dd32d14c..5c49e1e10 100644
--- a/docs/cmd/kumactl/HELP.md
+++ b/docs/cmd/kumactl/HELP.md
@@ -236,6 +236,7 @@ Flags:
       --dataplane-registry string           registry for the image of the Kuma DataPlane component (default "kong-docker-kuma-docker.bintray.io")
       --dataplane-repository string         repository for the image of the Kuma DataPlane component (default "kuma-dp")
       --dataplane-version string            version of the image of the Kuma DataPlane component (default "latest")
+      --env-var stringToString              environment variables that will be passed to the control plane (default [])
   -h, --help                                help for control-plane
       --image-pull-policy string            image pull policy that applies to all components of the Kuma Control Plane (default "IfNotPresent")
       --ingress-drain-time string           drain time for Envoy proxy (default "30s")
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index 357f46821..6bce18d94 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -153,48 +153,91 @@ runtime:
     # Admission WebHook Server configuration
     admissionServer:
       # Address the Admission WebHook Server should be listening on
-      address:
+      address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
       # Port the Admission WebHook Server should be listening on
-      port: 5443
+      port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
       # Directory with a TLS cert and private key for the Admission WebHook Server.
       # TLS certificate file must be named `tls.crt`.
       # TLS key file must be named `tls.key`.
-      certDir:
+      certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
+    # Injector defines configuration of a Kuma Sidecar Injector.
     injector:
-      cniEnabled: false
-      virtualProbesEnabled: true
-      virtualProbesPort: 9000
+      # if true runs kuma-cp in CNI compatible mode
+      cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
+      # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
+      #	serves on sub-path of insecure port 'virtualProbesPort',
+      #	i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
+      virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
+      # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
+      virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
+      # SidecarContainer defines configuration of the Kuma sidecar container.
       sidecarContainer:
-        image: kuma/kuma-dp:latest
-        redirectPortInbound: 15006
-        redirectPortOutbound: 15001
-        uid: 5678
-        gid: 5678
-        adminPort: 9901
-        drainTime: 30s
-
+        # Image name.
+        image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
+        # Redirect port for inbound traffic.
+        redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
+        # Redirect port for outbound traffic.
+        redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
+        # User ID.
+        uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
+        # Group ID.
+        gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
+        # Admin port.
+        adminPort: 9901 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ADMIN_PORT
+        # Drain time for listeners.
+        drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
+        # Readiness probe.
         readinessProbe:
-          initialDelaySeconds: 1
-          timeoutSeconds:      3
-          periodSeconds:       5
-          successThreshold:    1
-          failureThreshold:    12
+          # Number of seconds after the container has started before readiness probes are initiated.
+          initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
+          # Number of seconds after which the probe times out.
+          timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
+          # Number of seconds after which the probe times out.
+          periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
+          # Minimum consecutive successes for the probe to be considered successful after having failed.
+          successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
+          # Minimum consecutive failures for the probe to be considered failed after having succeeded.
+          failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
+        # Liveness probe.
         livenessProbe:
-          initialDelaySeconds: 60
-          timeoutSeconds:      3
-          periodSeconds:       5
-          failureThreshold:    12
+          # Number of seconds after the container has started before liveness probes are initiated.
+          initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
+          # Number of seconds after which the probe times out.
+          timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
+          # How often (in seconds) to perform the probe.
+          periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
+          # Minimum consecutive failures for the probe to be considered failed after having succeeded.
+          failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
+        # Compute resource requirements.
         resources:
+          # Minimum amount of compute resources required.
           requests:
-            cpu: 50m
-            memory: 64Mi
+            # CPU, in cores. (500m = .5 cores)
+            cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
+            # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
+            memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
+          # Maximum amount of compute resources allowed.
           limits:
-            cpu: 1000m
-            memory: 512Mi
+            # CPU, in cores. (500m = .5 cores)
+            cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
+            # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
+            memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
+      # InitContainer defines configuration of the Kuma init container
       initContainer:
-        image: kuma/kuma-init:latest
+        # Image name.
+        image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
+      # Configuration for a traffic that is intercepted by sidecar
+      sidecarTraffic:
+        # List of inbound ports that will be excluded from interception.
+        # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
+        excludeInboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
+        # List of outbound ports that will be excluded from interception.
+        # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
+        excludeOutboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
+  # Universal-specific configuration
   universal:
-    dataplaneCleanupAge: 72h0m0s
+    # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
+    dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
 
 # Default Kuma entities configuration
 defaults:
diff --git a/pkg/config/plugins/runtime/k8s/config.go b/pkg/config/plugins/runtime/k8s/config.go
index 8e694be2e..8c4214dfd 100644
--- a/pkg/config/plugins/runtime/k8s/config.go
+++ b/pkg/config/plugins/runtime/k8s/config.go
@@ -55,6 +55,10 @@ func DefaultKubernetesRuntimeConfig() *KubernetesRuntimeConfig {
 			InitContainer: InitContainer{
 				Image: "kuma/kuma-init:latest",
 			},
+			SidecarTraffic: SidecarTraffic{
+				ExcludeInboundPorts:  []uint32{},
+				ExcludeOutboundPorts: []uint32{},
+			},
 		},
 	}
 }
@@ -91,8 +95,19 @@ type Injector struct {
 	// serves on sub-path of insecure port 'virtualProbesPort',
 	// i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
 	VirtualProbesEnabled bool `yaml:"virtualProbesEnabled" envconfig:"kuma_runtime_kubernetes_virtual_probes_enabled"`
-	// VirtualProbesPort is an insecure port for listening virtual probes
+	// VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
 	VirtualProbesPort uint32 `yaml:"virtualProbesPort" envconfig:"kuma_runtime_kubernetes_virtual_probes_enabled"`
+	// Cnfiguration for a traffic that is intercepted by sidecar
+	SidecarTraffic SidecarTraffic `yaml:"sidecarTraffic"`
+}
+
+type SidecarTraffic struct {
+	// List of inbound ports that will be excluded from interception.
+	// This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
+	ExcludeInboundPorts []uint32 `yaml:"excludeInboundPorts" envconfig:"kuma_runtime_kubernetes_sidecar_traffic_exclude_inbound_ports"`
+	// List of outbound ports that will be excluded from interception.
+	// This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
+	ExcludeOutboundPorts []uint32 `yaml:"excludeOutboundPorts" envconfig:"kuma_runtime_kubernetes_sidecar_traffic_exclude_outbound_ports"`
 }
 
 // SidecarContainer defines configuration of the Kuma sidecar container.
@@ -121,9 +136,9 @@ type SidecarContainer struct {
 
 // SidecarReadinessProbe defines periodic probe of container service readiness.
 type SidecarReadinessProbe struct {
-	// Number of seconds after the container has started before liveness probes are initiated.
+	// Number of seconds after the container has started before readiness probes are initiated.
 	InitialDelaySeconds int32 `yaml:"initialDelaySeconds,omitempty" envconfig:"kuma_runtime_kubernetes_injector_sidecar_container_readiness_probe_initial_delay_seconds"`
-	// How often (in seconds) to perform the probe.
+	// Number of seconds after which the probe times out.
 	TimeoutSeconds int32 `yaml:"timeoutSeconds,omitempty" envconfig:"kuma_runtime_kubernetes_injector_sidecar_container_readiness_probe_timeout_seconds"`
 	// Number of seconds after which the probe times out.
 	PeriodSeconds int32 `yaml:"periodSeconds,omitempty" envconfig:"kuma_runtime_kubernetes_injector_sidecar_container_readiness_probe_period_seconds"`
diff --git a/pkg/plugins/runtime/k8s/controllers/namespace_controller.go b/pkg/plugins/runtime/k8s/controllers/namespace_controller.go
index f86ffc4eb..058ec1a7d 100644
--- a/pkg/plugins/runtime/k8s/controllers/namespace_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/namespace_controller.go
@@ -13,7 +13,6 @@ import (
 	kube_client "sigs.k8s.io/controller-runtime/pkg/client"
 	kube_controllerutil "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
-	core_manager "github.com/kumahq/kuma/pkg/core/resources/manager"
 	k8scnicncfio "github.com/kumahq/kuma/pkg/plugins/runtime/k8s/apis/k8s.cni.cncf.io"
 	network_v1 "github.com/kumahq/kuma/pkg/plugins/runtime/k8s/apis/k8s.cni.cncf.io/v1"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/metadata"
@@ -24,8 +23,7 @@ type NamespaceReconciler struct {
 	kube_client.Client
 	Log logr.Logger
 
-	CNIEnabled      bool
-	ResourceManager core_manager.ResourceManager
+	CNIEnabled bool
 }
 
 // Reconcile is in charge of creating NetworkAttachmentDefinition if CNI enabled and namespace has label 'kuma.io/sidecar-injection: enabled'
diff --git a/pkg/plugins/runtime/k8s/metadata/annotations.go b/pkg/plugins/runtime/k8s/metadata/annotations.go
index 419bff622..e13b7cfa6 100644
--- a/pkg/plugins/runtime/k8s/metadata/annotations.go
+++ b/pkg/plugins/runtime/k8s/metadata/annotations.go
@@ -41,6 +41,9 @@ const (
 
 	// KumaMetricsPrometheusPath to override `Mesh`-wide default path
 	KumaMetricsPrometheusPath = "prometheus.metrics.kuma.io/path"
+
+	KumaTrafficExcludeInboundPorts  = "traffic.kuma.io/exclude-inbound-ports"
+	KumaTrafficExcludeOutboundPorts = "traffic.kuma.io/exclude-outbound-ports"
 )
 
 // Annotations that are being automatically set by the Kuma Sidecar Injector.
diff --git a/pkg/plugins/runtime/k8s/plugin.go b/pkg/plugins/runtime/k8s/plugin.go
index e281236a2..25b0f35d0 100644
--- a/pkg/plugins/runtime/k8s/plugin.go
+++ b/pkg/plugins/runtime/k8s/plugin.go
@@ -77,10 +77,9 @@ func addControllers(mgr kube_ctrl.Manager, rt core_runtime.Runtime) error {
 
 func addNamespaceReconciler(mgr kube_ctrl.Manager, rt core_runtime.Runtime) error {
 	reconciler := &k8s_controllers.NamespaceReconciler{
-		Client:          mgr.GetClient(),
-		Log:             core.Log.WithName("controllers").WithName("Namespace"),
-		CNIEnabled:      rt.Config().Runtime.Kubernetes.Injector.CNIEnabled,
-		ResourceManager: rt.ResourceManager(),
+		Client:     mgr.GetClient(),
+		Log:        core.Log.WithName("controllers").WithName("Namespace"),
+		CNIEnabled: rt.Config().Runtime.Kubernetes.Injector.CNIEnabled,
 	}
 	return reconciler.SetupWithManager(mgr)
 }
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
index 556336c98..f176edf94 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
@@ -3,6 +3,7 @@ package injector
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/pkg/errors"
 
@@ -297,6 +298,8 @@ func (i *KumaInjector) NewInitContainer(pod *kube_core.Pod) (kube_core.Container
 	if exist && enabled {
 		inboundPortsToIntercept = ""
 	}
+	excludeInboundPorts, _ := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTrafficExcludeInboundPorts)
+	excludeOutboundPorts, _ := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTrafficExcludeOutboundPorts)
 	return kube_core.Container{
 		Name:            KumaInitContainerName,
 		Image:           i.cfg.InitContainer.Image,
@@ -310,6 +313,10 @@ func (i *KumaInjector) NewInitContainer(pod *kube_core.Pod) (kube_core.Container
 			fmt.Sprintf("%d", i.cfg.SidecarContainer.UID),
 			"-g",
 			fmt.Sprintf("%d", i.cfg.SidecarContainer.GID),
+			"-d",
+			excludeInboundPorts,
+			"-o",
+			excludeOutboundPorts,
 			"-m",
 			"REDIRECT",
 			"-i",
@@ -356,5 +363,23 @@ func (i *KumaInjector) NewAnnotations(pod *kube_core.Pod, mesh *mesh_core.MeshRe
 	if _, exist, _ := metadata.Annotations(pod.Annotations).GetUint32(metadata.KumaVirtualProbesPortAnnotation); !exist {
 		annotations[metadata.KumaVirtualProbesPortAnnotation] = fmt.Sprintf("%d", i.cfg.VirtualProbesPort)
 	}
+	if val, exist := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTrafficExcludeInboundPorts); exist {
+		annotations[metadata.KumaTrafficExcludeInboundPorts] = val
+	} else if len(i.cfg.SidecarTraffic.ExcludeInboundPorts) > 0 {
+		annotations[metadata.KumaTrafficExcludeInboundPorts] = portsToAnnotationValue(i.cfg.SidecarTraffic.ExcludeInboundPorts)
+	}
+	if val, exist := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTrafficExcludeOutboundPorts); exist {
+		annotations[metadata.KumaTrafficExcludeOutboundPorts] = val
+	} else if len(i.cfg.SidecarTraffic.ExcludeOutboundPorts) > 0 {
+		annotations[metadata.KumaTrafficExcludeOutboundPorts] = portsToAnnotationValue(i.cfg.SidecarTraffic.ExcludeOutboundPorts)
+	}
 	return annotations
 }
+
+func portsToAnnotationValue(ports []uint32) string {
+	stringPorts := make([]string, len(ports))
+	for i, port := range ports {
+		stringPorts[i] = fmt.Sprintf("%d", port)
+	}
+	return strings.Join(stringPorts, ",")
+}


Test patch:
diff --git a/app/kumactl/cmd/completion/testdata/bash.golden b/app/kumactl/cmd/completion/testdata/bash.golden
index 85c622116..39c8082ec 100644
--- a/app/kumactl/cmd/completion/testdata/bash.golden
+++ b/app/kumactl/cmd/completion/testdata/bash.golden
@@ -1786,6 +1786,9 @@ _kumactl_install_control-plane()
     flags+=("--dataplane-version=")
     two_word_flags+=("--dataplane-version")
     local_nonpersistent_flags+=("--dataplane-version=")
+    flags+=("--env-var=")
+    two_word_flags+=("--env-var")
+    local_nonpersistent_flags+=("--env-var=")
     flags+=("--image-pull-policy=")
     two_word_flags+=("--image-pull-policy")
     local_nonpersistent_flags+=("--image-pull-policy=")
diff --git a/app/kumactl/cmd/completion/testdata/zsh.golden b/app/kumactl/cmd/completion/testdata/zsh.golden
index 3613ce0c8..5798d73e9 100644
--- a/app/kumactl/cmd/completion/testdata/zsh.golden
+++ b/app/kumactl/cmd/completion/testdata/zsh.golden
@@ -750,6 +750,7 @@ function _kumactl_install_control-plane {
     '--dataplane-registry[registry for the image of the Kuma DataPlane component]:' \
     '--dataplane-repository[repository for the image of the Kuma DataPlane component]:' \
     '--dataplane-version[version of the image of the Kuma DataPlane component]:' \
+    '--env-var[environment variables that will be passed to the control plane]:' \
     '--image-pull-policy[image pull policy that applies to all components of the Kuma Control Plane]:' \
     '--ingress-drain-time[drain time for Envoy proxy]:' \
     '--ingress-enabled[install Kuma with an Ingress deployment, using the Data Plane image]' \
diff --git a/pkg/api-server/config_ws_test.go b/pkg/api-server/config_ws_test.go
index 8b1180e5d..a56b676a3 100644
--- a/pkg/api-server/config_ws_test.go
+++ b/pkg/api-server/config_ws_test.go
@@ -197,6 +197,10 @@ var _ = Describe("Config WS", func() {
                   },
                   "uid": 5678
                 },
+                "sidecarTraffic": {
+                  "excludeInboundPorts": [],
+                  "excludeOutboundPorts": []
+                },
                 "virtualProbesEnabled": true,
                 "virtualProbesPort": 9000
               }
diff --git a/pkg/config/loader_test.go b/pkg/config/loader_test.go
index 9c22797fb..3b83cc225 100644
--- a/pkg/config/loader_test.go
+++ b/pkg/config/loader_test.go
@@ -110,6 +110,9 @@ var _ = Describe("Config loader", func() {
 			Expect(cfg.Runtime.Kubernetes.AdmissionServer.Port).To(Equal(uint32(9443)))
 			Expect(cfg.Runtime.Kubernetes.AdmissionServer.CertDir).To(Equal("/var/run/secrets/kuma.io/kuma-admission-server/tls-cert"))
 
+			Expect(cfg.Runtime.Kubernetes.Injector.SidecarTraffic.ExcludeInboundPorts).To(Equal([]uint32{1234, 5678}))
+			Expect(cfg.Runtime.Kubernetes.Injector.SidecarTraffic.ExcludeOutboundPorts).To(Equal([]uint32{4321, 8765}))
+
 			Expect(cfg.Reports.Enabled).To(BeFalse())
 
 			Expect(cfg.General.AdvertisedHostname).To(Equal("kuma.internal"))
@@ -192,6 +195,14 @@ runtime:
       address: 127.0.0.2
       port: 9443
       certDir: /var/run/secrets/kuma.io/kuma-admission-server/tls-cert
+    injector:
+      sidecarTraffic:
+        excludeInboundPorts:
+        - 1234
+        - 5678
+        excludeOutboundPorts:
+        - 4321
+        - 8765
 reports:
   enabled: false
 general:
@@ -225,62 +236,64 @@ diagnostics:
 		}),
 		Entry("from env variables", testCase{
 			envVars: map[string]string{
-				"KUMA_XDS_SERVER_GRPC_PORT":                                     "5000",
-				"KUMA_XDS_SERVER_DIAGNOSTICS_PORT":                              "5003",
-				"KUMA_BOOTSTRAP_SERVER_PORT":                                    "5004",
-				"KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT":                       "1234",
-				"KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST":                         "kuma-control-plane",
-				"KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT":                         "4321",
-				"KUMA_ENVIRONMENT":                                              "kubernetes",
-				"KUMA_STORE_TYPE":                                               "postgres",
-				"KUMA_STORE_POSTGRES_HOST":                                      "postgres.host",
-				"KUMA_STORE_POSTGRES_PORT":                                      "5432",
-				"KUMA_STORE_POSTGRES_USER":                                      "kuma",
-				"KUMA_STORE_POSTGRES_PASSWORD":                                  "kuma",
-				"KUMA_STORE_POSTGRES_DB_NAME":                                   "kuma",
-				"KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT":                        "10",
-				"KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS":                      "300",
-				"KUMA_STORE_POSTGRES_TLS_MODE":                                  "verifyFull",
-				"KUMA_STORE_POSTGRES_TLS_CERT_PATH":                             "/path/to/cert",
-				"KUMA_STORE_POSTGRES_TLS_KEY_PATH":                              "/path/to/key",
-				"KUMA_STORE_POSTGRES_TLS_CA_PATH":                               "/path/to/rootCert",
-				"KUMA_STORE_CACHE_ENABLED":                                      "false",
-				"KUMA_STORE_CACHE_EXPIRATION_TIME":                              "3s",
-				"KUMA_API_SERVER_READ_ONLY":                                     "true",
-				"KUMA_API_SERVER_PORT":                                          "9090",
-				"KUMA_MONITORING_ASSIGNMENT_SERVER_GRPC_PORT":                   "3333",
-				"KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL": "12s",
-				"KUMA_ADMIN_SERVER_APIS_DATAPLANE_TOKEN_ENABLED":                "true",
-				"KUMA_ADMIN_SERVER_LOCAL_PORT":                                  "1111",
-				"KUMA_ADMIN_SERVER_PUBLIC_ENABLED":                              "true",
-				"KUMA_ADMIN_SERVER_PUBLIC_INTERFACE":                            "192.168.0.1",
-				"KUMA_ADMIN_SERVER_PUBLIC_PORT":                                 "2222",
-				"KUMA_ADMIN_SERVER_PUBLIC_TLS_KEY_FILE":                         "/tmp/key",
-				"KUMA_ADMIN_SERVER_PUBLIC_TLS_CERT_FILE":                        "/tmp/cert",
-				"KUMA_ADMIN_SERVER_PUBLIC_CLIENT_CERTS_DIR":                     "/tmp/certs",
-				"KUMA_REPORTS_ENABLED":                                          "false",
-				"KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS":              "127.0.0.2",
-				"KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT":                 "9443",
-				"KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR":             "/var/run/secrets/kuma.io/kuma-admission-server/tls-cert",
-				"KUMA_GENERAL_ADVERTISED_HOSTNAME":                              "kuma.internal",
-				"KUMA_GENERAL_TLS_CERT_FILE":                                    "/tmp/cert",
-				"KUMA_GENERAL_TLS_KEY_FILE":                                     "/tmp/key",
-				"KUMA_API_SERVER_CORS_ALLOWED_DOMAINS":                          "https://kuma,https://someapi",
-				"KUMA_GUI_SERVER_PORT":                                          "8888",
-				"KUMA_GUI_SERVER_API_SERVER_URL":                                "http://localhost:1234",
-				"KUMA_DNS_SERVER_PORT":                                          "15653",
-				"KUMA_DNS_CIDR":                                                 "127.1.0.0/16",
-				"KUMA_MODE":                                                     "remote",
-				"KUMA_MULTICLUSTER_GLOBAL_POLL_TIMEOUT":                         "750ms",
-				"KUMA_MULTICLUSTER_GLOBAL_KDS_GRPC_PORT":                        "1234",
-				"KUMA_MULTICLUSTER_GLOBAL_KDS_REFRESH_INTERVAL":                 "2s",
-				"KUMA_MULTICLUSTER_GLOBAL_KDS_TLS_CERT_FILE":                    "/cert",
-				"KUMA_MULTICLUSTER_GLOBAL_KDS_TLS_KEY_FILE":                     "/key",
-				"KUMA_MULTICLUSTER_REMOTE_GLOBAL_ADDRESS":                       "grpc://1.1.1.1:5685",
-				"KUMA_MULTICLUSTER_REMOTE_ZONE":                                 "zone-1",
-				"KUMA_MULTICLUSTER_REMOTE_KDS_ROOT_CA_FILE":                     "/rootCa",
-				"KUMA_DEFAULTS_SKIP_MESH_CREATION":                              "true",
-				"KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS":                              "true",
+				"KUMA_XDS_SERVER_GRPC_PORT":                                      "5000",
+				"KUMA_XDS_SERVER_DIAGNOSTICS_PORT":                               "5003",
+				"KUMA_BOOTSTRAP_SERVER_PORT":                                     "5004",
+				"KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT":                        "1234",
+				"KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST":                          "kuma-control-plane",
+				"KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT":                          "4321",
+				"KUMA_ENVIRONMENT":                                               "kubernetes",
+				"KUMA_STORE_TYPE":                                                "postgres",
+				"KUMA_STORE_POSTGRES_HOST":                                       "postgres.host",
+				"KUMA_STORE_POSTGRES_PORT":                                       "5432",
+				"KUMA_STORE_POSTGRES_USER":                                       "kuma",
+				"KUMA_STORE_POSTGRES_PASSWORD":                                   "kuma",
+				"KUMA_STORE_POSTGRES_DB_NAME":                                    "kuma",
+				"KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT":                         "10",
+				"KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS":                       "300",
+				"KUMA_STORE_POSTGRES_TLS_MODE":                                   "verifyFull",
+				"KUMA_STORE_POSTGRES_TLS_CERT_PATH":                              "/path/to/cert",
+				"KUMA_STORE_POSTGRES_TLS_KEY_PATH":                               "/path/to/key",
+				"KUMA_STORE_POSTGRES_TLS_CA_PATH":                                "/path/to/rootCert",
+				"KUMA_STORE_CACHE_ENABLED":                                       "false",
+				"KUMA_STORE_CACHE_EXPIRATION_TIME":                               "3s",
+				"KUMA_API_SERVER_READ_ONLY":                                      "true",
+				"KUMA_API_SERVER_PORT":                                           "9090",
+				"KUMA_MONITORING_ASSIGNMENT_SERVER_GRPC_PORT":                    "3333",
+				"KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL":  "12s",
+				"KUMA_ADMIN_SERVER_APIS_DATAPLANE_TOKEN_ENABLED":                 "true",
+				"KUMA_ADMIN_SERVER_LOCAL_PORT":                                   "1111",
+				"KUMA_ADMIN_SERVER_PUBLIC_ENABLED":                               "true",
+				"KUMA_ADMIN_SERVER_PUBLIC_INTERFACE":                             "192.168.0.1",
+				"KUMA_ADMIN_SERVER_PUBLIC_PORT":                                  "2222",
+				"KUMA_ADMIN_SERVER_PUBLIC_TLS_KEY_FILE":                          "/tmp/key",
+				"KUMA_ADMIN_SERVER_PUBLIC_TLS_CERT_FILE":                         "/tmp/cert",
+				"KUMA_ADMIN_SERVER_PUBLIC_CLIENT_CERTS_DIR":                      "/tmp/certs",
+				"KUMA_REPORTS_ENABLED":                                           "false",
+				"KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS":               "127.0.0.2",
+				"KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT":                  "9443",
+				"KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR":              "/var/run/secrets/kuma.io/kuma-admission-server/tls-cert",
+				"KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS":  "1234,5678",
+				"KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS": "4321,8765",
+				"KUMA_GENERAL_ADVERTISED_HOSTNAME":                               "kuma.internal",
+				"KUMA_GENERAL_TLS_CERT_FILE":                                     "/tmp/cert",
+				"KUMA_GENERAL_TLS_KEY_FILE":                                      "/tmp/key",
+				"KUMA_API_SERVER_CORS_ALLOWED_DOMAINS":                           "https://kuma,https://someapi",
+				"KUMA_GUI_SERVER_PORT":                                           "8888",
+				"KUMA_GUI_SERVER_API_SERVER_URL":                                 "http://localhost:1234",
+				"KUMA_DNS_SERVER_PORT":                                           "15653",
+				"KUMA_DNS_CIDR":                                                  "127.1.0.0/16",
+				"KUMA_MODE":                                                      "remote",
+				"KUMA_MULTICLUSTER_GLOBAL_POLL_TIMEOUT":                          "750ms",
+				"KUMA_MULTICLUSTER_GLOBAL_KDS_GRPC_PORT":                         "1234",
+				"KUMA_MULTICLUSTER_GLOBAL_KDS_REFRESH_INTERVAL":                  "2s",
+				"KUMA_MULTICLUSTER_GLOBAL_KDS_TLS_CERT_FILE":                     "/cert",
+				"KUMA_MULTICLUSTER_GLOBAL_KDS_TLS_KEY_FILE":                      "/key",
+				"KUMA_MULTICLUSTER_REMOTE_GLOBAL_ADDRESS":                        "grpc://1.1.1.1:5685",
+				"KUMA_MULTICLUSTER_REMOTE_ZONE":                                  "zone-1",
+				"KUMA_MULTICLUSTER_REMOTE_KDS_ROOT_CA_FILE":                      "/rootCa",
+				"KUMA_DEFAULTS_SKIP_MESH_CREATION":                               "true",
+				"KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS":                               "true",
 			},
 			yamlFileConfig: "",
 		}),
diff --git a/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml b/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
index a3c89cfbd..16222c559 100644
--- a/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
+++ b/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
@@ -35,3 +35,6 @@ injector:
         memory: 512Mi
   initContainer:
     image: kuma/kuma-init:latest
+  sidecarTraffic:
+    excludeInboundPorts: []
+    excludeOutboundPorts: []
diff --git a/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go b/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go
index 6b0fe4dae..5230f23c3 100644
--- a/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/namespace_controller_test.go
@@ -14,8 +14,6 @@ import (
 	kube_reconcile "sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/kumahq/kuma/pkg/core"
-	"github.com/kumahq/kuma/pkg/core/resources/manager"
-	"github.com/kumahq/kuma/pkg/plugins/resources/memory"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/controllers"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/metadata"
 
@@ -26,12 +24,8 @@ var _ = Describe("NamespaceReconciler", func() {
 
 	var kubeClient kube_client.Client
 	var reconciler kube_reconcile.Reconciler
-	var resManager manager.ResourceManager
 
 	BeforeEach(func() {
-		resStore := memory.NewStore()
-		resManager = manager.NewResourceManager(resStore)
-
 		kubeClient = kube_client_fake.NewFakeClientWithScheme(
 			k8sClientScheme,
 			&kube_core.Namespace{
@@ -52,10 +46,9 @@ var _ = Describe("NamespaceReconciler", func() {
 		)
 
 		reconciler = &controllers.NamespaceReconciler{
-			Client:          kubeClient,
-			CNIEnabled:      true,
-			Log:             core.Log.WithName("test"),
-			ResourceManager: resManager,
+			Client:     kubeClient,
+			CNIEnabled: true,
+			Log:        core.Log.WithName("test"),
 		}
 	})
 
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
index d74ad858c..ec8592723 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
@@ -23,17 +23,10 @@ import (
 
 var _ = Describe("Injector", func() {
 
-	var injector *inject.KumaInjector
-
-	BeforeEach(func() {
-		var cfg conf.Injector
-		Expect(config.Load(filepath.Join("testdata", "inject.config.yaml"), &cfg)).To(Succeed())
-		injector = inject.New(cfg, "http://kuma-control-plane.kuma-system:5681", k8sClient)
-	})
-
 	type testCase struct {
 		num       string
 		mesh      string
+		cfgFile   string
 		namespace string
 	}
 
@@ -48,6 +41,10 @@ var _ = Describe("Injector", func() {
 			inputFile := filepath.Join("testdata", fmt.Sprintf("inject.%s.input.yaml", given.num))
 			goldenFile := filepath.Join("testdata", fmt.Sprintf("inject.%s.golden.yaml", given.num))
 
+			var cfg conf.Injector
+			Expect(config.Load(filepath.Join("testdata", given.cfgFile), &cfg)).To(Succeed())
+			injector := inject.New(cfg, "http://kuma-control-plane.kuma-system:5681", k8sClient)
+
 			// and create mesh
 			decoder := serializer.NewCodecFactory(k8sClientScheme).UniversalDeserializer()
 			obj, _, errMesh := decoder.Decode([]byte(given.mesh), nil, nil)
@@ -106,6 +103,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("02. Pod with init containers and annotations", testCase{
 			num: "02",
@@ -121,6 +119,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("03. Pod without Namespace and Name", testCase{
 			num: "03",
@@ -136,6 +135,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("04. Pod with explicitly selected Mesh", testCase{
 			num: "04",
@@ -151,6 +151,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("05. Pod without ServiceAccount token", testCase{
 			num: "05",
@@ -166,6 +167,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("06. Pod with kuma.io/gateway annotation", testCase{
 			num: "06",
@@ -181,6 +183,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("07. Pod with mesh with metrics enabled", testCase{
 			num: "07",
@@ -200,7 +203,9 @@ var _ = Describe("Injector", func() {
               metadata:
                 name: default
                 annotations:
-                  kuma.io/sidecar-injection: enabled`}),
+                  kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
+		}),
 		Entry("08. Pod with prometheus annotation already defined so injector won't override those", testCase{
 			num: "08",
 			mesh: `
@@ -220,6 +225,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("09. Pod with Kuma metrics annotation overrides", testCase{
 			num: "09",
@@ -240,6 +246,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("10. Pod with `kuma.io/sidecar-injection: disabled` annotation", testCase{
 			num: "10",
@@ -256,6 +263,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("11. Namespace - `kuma.io/sidecar-injection: disabled`, Pod - `kuma.io/sidecar-injection: enabled`", testCase{
 			num: "11",
@@ -272,6 +280,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: disabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("12. Mesh name from Namespace", testCase{
 			num: "12",
@@ -289,6 +298,7 @@ var _ = Describe("Injector", func() {
                 annotations:
                   kuma.io/sidecar-injection: enabled
                   kuma.io/mesh: mesh-name-from-ns`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("13. Override mesh name in Pod", testCase{
 			num: "13",
@@ -306,6 +316,7 @@ var _ = Describe("Injector", func() {
                 annotations:
                   kuma.io/sidecar-injection: enabled
                   kuma.io/mesh: mesh-name-from-ns`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("14. Adjust Pod's probes", testCase{
 			num: "14",
@@ -322,6 +333,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("15. Override virtual probes port", testCase{
 			num: "15",
@@ -338,6 +350,7 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
 		}),
 		Entry("16. Override virtual probes enabled state", testCase{
 			num: "16",
@@ -354,6 +367,58 @@ var _ = Describe("Injector", func() {
                 name: default
                 annotations:
                   kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
+		}),
+		Entry("17. traffic.kuma.io/exclude-inbound-ports and traffic.kuma.io/exclude-outbound-ports", testCase{
+			num: "17",
+			mesh: `
+              apiVersion: kuma.io/v1alpha1
+              kind: Mesh
+              metadata:
+                name: default
+              spec: {}`,
+			namespace: `
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: default
+                annotations:
+                  kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
+		}),
+		Entry("18. traffic.kuma.io/exclude-inbound-ports and traffic.kuma.io/exclude-outbound-ports from config", testCase{
+			num: "18",
+			mesh: `
+              apiVersion: kuma.io/v1alpha1
+              kind: Mesh
+              metadata:
+                name: default
+              spec: {}`,
+			namespace: `
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: default
+                annotations:
+                  kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config-ports.yaml",
+		}),
+		Entry("19. traffic.kuma.io/exclude-inbound-ports and traffic.kuma.io/exclude-outbound-ports overrides config", testCase{
+			num: "19",
+			mesh: `
+              apiVersion: kuma.io/v1alpha1
+              kind: Mesh
+              metadata:
+                name: default
+              spec: {}`,
+			namespace: `
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: default
+                annotations:
+                  kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config-ports.yaml",
 		}),
 	)
 })
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index d5a54ee47..cd1573859 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -102,6 +102,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index 6dfd64697..37f9adf59 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -110,6 +110,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index 6f86e08a1..a8906df6d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -164,6 +164,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index c7ad64359..d4ce54419 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -102,6 +102,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index f54ac905b..b36607210 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -95,6 +95,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index cbb4d5e98..b325a0d3f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -103,6 +103,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index d5a54ee47..cd1573859 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -102,6 +102,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index 31042886d..c82758e70 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -105,6 +105,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index a064f1870..bf432acc7 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -104,6 +104,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index e74240cf0..2420126e4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -103,6 +103,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index 020891b26..24e14de9f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -102,6 +102,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 1a92798f6..98c14a431 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -102,6 +102,10 @@ spec:
     - "5678"
     - -g
     - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
     - -m
     - REDIRECT
     - -i
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
index 84bcecc86..b072a5f34 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
@@ -114,6 +114,10 @@ spec:
         - "5678"
         - -g
         - "5678"
+        - -d
+        - ""
+        - -o
+        - ""
         - -m
         - REDIRECT
         - -i
@@ -140,4 +144,4 @@ spec:
     - name: default-token-w7dxf
       secret:
         secretName: default-token-w7dxf
-status: {}
\ No newline at end of file
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
index aead41ee1..6927e5a12 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
@@ -114,6 +114,10 @@ spec:
         - "5678"
         - -g
         - "5678"
+        - -d
+        - ""
+        - -o
+        - ""
         - -m
         - REDIRECT
         - -i
@@ -140,4 +144,4 @@ spec:
     - name: default-token-w7dxf
       secret:
         secretName: default-token-w7dxf
-status: {}
\ No newline at end of file
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
index c09128f62..592ba06eb 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
@@ -114,6 +114,10 @@ spec:
         - "5678"
         - -g
         - "5678"
+        - -d
+        - ""
+        - -o
+        - ""
         - -m
         - REDIRECT
         - -i
@@ -140,4 +144,4 @@ spec:
     - name: default-token-w7dxf
       secret:
         secretName: default-token-w7dxf
-status: {}
\ No newline at end of file
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
new file mode 100644
index 000000000..a2e6bff08
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -0,0 +1,144 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    kuma.io/mesh: default
+    kuma.io/sidecar-injected: "true"
+    kuma.io/transparent-proxying: enabled
+    kuma.io/transparent-proxying-outbound-port: "15001"
+    kuma.io/transparent-proxying-inbound-port: "15006"
+    kuma.io/virtual-probes: enabled
+    kuma.io/virtual-probes-port: "9000"
+    traffic.kuma.io/exclude-inbound-ports: "1234,1235"
+    traffic.kuma.io/exclude-outbound-ports: "1236"
+  creationTimestamp: null
+  labels:
+    run: busybox
+  name: busybox
+spec:
+  containers:
+  - image: busybox
+    name: busybox
+    resources: {}
+    volumeMounts:
+    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      name: default-token-w7dxf
+      readOnly: true
+  - args:
+    - run
+    - --log-level=info
+    env:
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          apiVersion: v1
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          apiVersion: v1
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          apiVersion: v1
+          fieldPath: status.podIP
+    - name: KUMA_CONTROL_PLANE_API_SERVER_URL
+      value: http://kuma-control-plane.kuma-system:5681
+    - name: KUMA_DATAPLANE_MESH
+      value: default
+    - name: KUMA_DATAPLANE_NAME
+      value: $(POD_NAME).$(POD_NAMESPACE)
+    - name: KUMA_DATAPLANE_ADMIN_PORT
+      value: "9901"
+    - name: KUMA_DATAPLANE_DRAIN_TIME
+      value: 31s
+    - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
+      value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    image: kuma/kuma-sidecar:latest
+    imagePullPolicy: IfNotPresent
+    livenessProbe:
+      exec:
+        command:
+        - wget
+        - -qO-
+        - http://127.0.0.1:9901
+      failureThreshold: 212
+      initialDelaySeconds: 260
+      periodSeconds: 25
+      successThreshold: 1
+      timeoutSeconds: 23
+    name: kuma-sidecar
+    readinessProbe:
+      exec:
+        command:
+        - wget
+        - -qO-
+        - http://127.0.0.1:9901
+      failureThreshold: 112
+      initialDelaySeconds: 11
+      periodSeconds: 15
+      successThreshold: 11
+      timeoutSeconds: 13
+    resources:
+      limits:
+        cpu: 1100m
+        memory: 1512Mi
+      requests:
+        cpu: 150m
+        memory: 164Mi
+    securityContext:
+      runAsGroup: 5678
+      runAsUser: 5678
+    volumeMounts:
+    - name: default-token-w7dxf
+      readOnly: true
+      mountPath: "/var/run/secrets/kubernetes.io/serviceaccount"
+  initContainers:
+  - command:
+    - sh
+    - -c
+    - sleep 5
+    image: busybox
+    name: init
+    resources: {}
+  - args:
+    - -p
+    - "15001"
+    - -z
+    - "15006"
+    - -u
+    - "5678"
+    - -g
+    - "5678"
+    - -d
+    - "1234,1235"
+    - -o
+    - "1236"
+    - -m
+    - REDIRECT
+    - -i
+    - '*'
+    - -b
+    - '*'
+    image: kuma/kuma-init:latest
+    imagePullPolicy: IfNotPresent
+    name: kuma-init
+    resources:
+      limits:
+        cpu: 100m
+        memory: 50M
+      requests:
+        cpu: 10m
+        memory: 10M
+    securityContext:
+      capabilities:
+        add:
+        - NET_ADMIN
+      runAsGroup: 0
+      runAsUser: 0
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.input.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.input.yaml
new file mode 100644
index 000000000..1c3482f14
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.input.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox
+  labels:
+    run: busybox
+  annotations:
+    traffic.kuma.io/exclude-inbound-ports: "1234,1235"
+    traffic.kuma.io/exclude-outbound-ports: "1236"
+spec:
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+  containers:
+  - name: busybox
+    image: busybox
+    resources: {}
+    volumeMounts:
+    - name: default-token-w7dxf
+      readOnly: true
+      mountPath: "/var/run/secrets/kubernetes.io/serviceaccount"
+  initContainers:
+    - name: init
+      image: busybox
+      command: ['sh', '-c', 'sleep 5']
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
new file mode 100644
index 000000000..eb3bdf839
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -0,0 +1,144 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    kuma.io/mesh: default
+    kuma.io/sidecar-injected: "true"
+    kuma.io/transparent-proxying: enabled
+    kuma.io/transparent-proxying-inbound-port: "15006"
+    kuma.io/transparent-proxying-outbound-port: "15001"
+    kuma.io/virtual-probes: enabled
+    kuma.io/virtual-probes-port: "9000"
+    traffic.kuma.io/exclude-inbound-ports: 1234,5678
+    traffic.kuma.io/exclude-outbound-ports: 4321,7654
+  creationTimestamp: null
+  labels:
+    run: busybox
+  name: busybox
+spec:
+  containers:
+    - image: busybox
+      name: busybox
+      resources: {}
+      volumeMounts:
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          name: default-token-w7dxf
+          readOnly: true
+    - args:
+        - run
+        - --log-level=info
+      env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: KUMA_CONTROL_PLANE_API_SERVER_URL
+          value: http://kuma-control-plane.kuma-system:5681
+        - name: KUMA_DATAPLANE_MESH
+          value: default
+        - name: KUMA_DATAPLANE_NAME
+          value: $(POD_NAME).$(POD_NAMESPACE)
+        - name: KUMA_DATAPLANE_ADMIN_PORT
+          value: "9901"
+        - name: KUMA_DATAPLANE_DRAIN_TIME
+          value: 31s
+        - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
+          value: /var/run/secrets/kubernetes.io/serviceaccount/token
+      image: kuma/kuma-sidecar:latest
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        exec:
+          command:
+            - wget
+            - -qO-
+            - http://127.0.0.1:9901
+        failureThreshold: 212
+        initialDelaySeconds: 260
+        periodSeconds: 25
+        successThreshold: 1
+        timeoutSeconds: 23
+      name: kuma-sidecar
+      readinessProbe:
+        exec:
+          command:
+            - wget
+            - -qO-
+            - http://127.0.0.1:9901
+        failureThreshold: 112
+        initialDelaySeconds: 11
+        periodSeconds: 15
+        successThreshold: 11
+        timeoutSeconds: 13
+      resources:
+        limits:
+          cpu: 1100m
+          memory: 1512Mi
+        requests:
+          cpu: 150m
+          memory: 164Mi
+      securityContext:
+        runAsGroup: 5678
+        runAsUser: 5678
+      volumeMounts:
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          name: default-token-w7dxf
+          readOnly: true
+  initContainers:
+    - command:
+        - sh
+        - -c
+        - sleep 5
+      image: busybox
+      name: init
+      resources: {}
+    - args:
+        - -p
+        - "15001"
+        - -z
+        - "15006"
+        - -u
+        - "5678"
+        - -g
+        - "5678"
+        - -d
+        - "1234,5678"
+        - -o
+        - "4321,7654"
+        - -m
+        - REDIRECT
+        - -i
+        - '*'
+        - -b
+        - '*'
+      image: kuma/kuma-init:latest
+      imagePullPolicy: IfNotPresent
+      name: kuma-init
+      resources:
+        limits:
+          cpu: 100m
+          memory: 50M
+        requests:
+          cpu: 10m
+          memory: 10M
+      securityContext:
+        capabilities:
+          add:
+            - NET_ADMIN
+        runAsGroup: 0
+        runAsUser: 0
+  volumes:
+    - name: default-token-w7dxf
+      secret:
+        secretName: default-token-w7dxf
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.input.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.input.yaml
new file mode 100644
index 000000000..2a74b1a04
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.input.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox
+  labels:
+    run: busybox
+spec:
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+  containers:
+  - name: busybox
+    image: busybox
+    resources: {}
+    volumeMounts:
+    - name: default-token-w7dxf
+      readOnly: true
+      mountPath: "/var/run/secrets/kubernetes.io/serviceaccount"
+  initContainers:
+    - name: init
+      image: busybox
+      command: ['sh', '-c', 'sleep 5']
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
new file mode 100644
index 000000000..f615db0ab
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -0,0 +1,144 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    kuma.io/mesh: default
+    kuma.io/sidecar-injected: "true"
+    kuma.io/transparent-proxying: enabled
+    kuma.io/transparent-proxying-outbound-port: "15001"
+    kuma.io/transparent-proxying-inbound-port: "15006"
+    kuma.io/virtual-probes: enabled
+    kuma.io/virtual-probes-port: "9000"
+    traffic.kuma.io/exclude-inbound-ports: ""
+    traffic.kuma.io/exclude-outbound-ports: ""
+  creationTimestamp: null
+  labels:
+    run: busybox
+  name: busybox
+spec:
+  containers:
+  - image: busybox
+    name: busybox
+    resources: {}
+    volumeMounts:
+    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      name: default-token-w7dxf
+      readOnly: true
+  - args:
+    - run
+    - --log-level=info
+    env:
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          apiVersion: v1
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          apiVersion: v1
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          apiVersion: v1
+          fieldPath: status.podIP
+    - name: KUMA_CONTROL_PLANE_API_SERVER_URL
+      value: http://kuma-control-plane.kuma-system:5681
+    - name: KUMA_DATAPLANE_MESH
+      value: default
+    - name: KUMA_DATAPLANE_NAME
+      value: $(POD_NAME).$(POD_NAMESPACE)
+    - name: KUMA_DATAPLANE_ADMIN_PORT
+      value: "9901"
+    - name: KUMA_DATAPLANE_DRAIN_TIME
+      value: 31s
+    - name: KUMA_DATAPLANE_RUNTIME_TOKEN_PATH
+      value: /var/run/secrets/kubernetes.io/serviceaccount/token
+    image: kuma/kuma-sidecar:latest
+    imagePullPolicy: IfNotPresent
+    livenessProbe:
+      exec:
+        command:
+        - wget
+        - -qO-
+        - http://127.0.0.1:9901
+      failureThreshold: 212
+      initialDelaySeconds: 260
+      periodSeconds: 25
+      successThreshold: 1
+      timeoutSeconds: 23
+    name: kuma-sidecar
+    readinessProbe:
+      exec:
+        command:
+        - wget
+        - -qO-
+        - http://127.0.0.1:9901
+      failureThreshold: 112
+      initialDelaySeconds: 11
+      periodSeconds: 15
+      successThreshold: 11
+      timeoutSeconds: 13
+    resources:
+      limits:
+        cpu: 1100m
+        memory: 1512Mi
+      requests:
+        cpu: 150m
+        memory: 164Mi
+    securityContext:
+      runAsGroup: 5678
+      runAsUser: 5678
+    volumeMounts:
+    - name: default-token-w7dxf
+      readOnly: true
+      mountPath: "/var/run/secrets/kubernetes.io/serviceaccount"
+  initContainers:
+  - command:
+    - sh
+    - -c
+    - sleep 5
+    image: busybox
+    name: init
+    resources: {}
+  - args:
+    - -p
+    - "15001"
+    - -z
+    - "15006"
+    - -u
+    - "5678"
+    - -g
+    - "5678"
+    - -d
+    - ""
+    - -o
+    - ""
+    - -m
+    - REDIRECT
+    - -i
+    - '*'
+    - -b
+    - '*'
+    image: kuma/kuma-init:latest
+    imagePullPolicy: IfNotPresent
+    name: kuma-init
+    resources:
+      limits:
+        cpu: 100m
+        memory: 50M
+      requests:
+        cpu: 10m
+        memory: 10M
+    securityContext:
+      capabilities:
+        add:
+        - NET_ADMIN
+      runAsGroup: 0
+      runAsUser: 0
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.input.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.input.yaml
new file mode 100644
index 000000000..09c0d881e
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.input.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox
+  labels:
+    run: busybox
+  annotations:
+    traffic.kuma.io/exclude-inbound-ports: ""
+    traffic.kuma.io/exclude-outbound-ports: ""
+spec:
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+  containers:
+  - name: busybox
+    image: busybox
+    resources: {}
+    volumeMounts:
+    - name: default-token-w7dxf
+      readOnly: true
+      mountPath: "/var/run/secrets/kubernetes.io/serviceaccount"
+  initContainers:
+    - name: init
+      image: busybox
+      command: ['sh', '-c', 'sleep 5']
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config-ports.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config-ports.yaml
new file mode 100644
index 000000000..5747daa1d
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config-ports.yaml
@@ -0,0 +1,42 @@
+controlPlane:
+  apiServer:
+    url: http://kuma-control-plane.kuma-system:5681
+sidecarContainer:
+  image: kuma/kuma-sidecar:latest
+  redirectPortOutbound: 15001
+  redirectPortInbound: 15006
+  uid: 5678
+  gid: 5678
+  adminPort: 9901
+  drainTime: 31s
+
+  readinessProbe:
+    initialDelaySeconds: 11
+    timeoutSeconds:      13
+    periodSeconds:       15
+    successThreshold:    11
+    failureThreshold:    112
+  livenessProbe:
+    initialDelaySeconds: 260
+    timeoutSeconds:      23
+    periodSeconds:       25
+    failureThreshold:    212
+  resources:
+    requests:
+      cpu: 150m
+      memory: 164Mi
+    limits:
+      cpu: 1100m
+      memory: 1512Mi
+initContainer:
+  enabled: true
+  image: kuma/kuma-init:latest
+virtualProbesEnabled: true
+virtualProbesPort: 9000
+sidecarTraffic:
+  excludeInboundPorts:
+    - 1234
+    - 5678
+  excludeOutboundPorts:
+    - 4321
+    - 7654