Repository: kumahq/kuma
Pull request #11703 (2024-10-08 08:27:54)

fix(dev/tools): fail make dev/tools step if installing go deps returned error
## Motivation

If installing go deps errors, we should fail the whole step. Without this, when installing go deps fails on CI we will use versions from cache which can be wrong and result in unexpected errors in CI especially on release branches

## Implementation information

Now we are waiting for specific pids, and will return error if job fails

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->



Patch:
diff --git a/UPGRADE.md b/UPGRADE.md
index 8a46c4672..0ba4145ce 100644
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -233,6 +233,12 @@ The values `yes` and `no` are deprecated for specifying boolean values in switch
 
 Please use `true` and `false` as replacements; some boolean switches also support `enabled` and `disabled`. [Check the documentation](https://kuma.io/docs/latest/reference/kubernetes-annotations/) for the specific annotation to confirm the correct replacements.
 
+#### Deprecation of `kuma.io/mesh` annotation
+
+It was previously possible to create a resource in a `Mesh` by providing the `Mesh` name as an annotation, but this support has been deprecated and will be removed in the future.
+
+Please use the `kuma.io/mesh` label instead.
+
 ## Upgrade to `2.8.x`
 
 ### MeshFaultInjection responseBandwidth.limit
diff --git a/app/kumactl/data/install/k8s-deprecated/metrics/namespace.yaml b/app/kumactl/data/install/k8s-deprecated/metrics/namespace.yaml
index eab084d78..10b24597a 100644
--- a/app/kumactl/data/install/k8s-deprecated/metrics/namespace.yaml
+++ b/app/kumactl/data/install/k8s-deprecated/metrics/namespace.yaml
@@ -6,5 +6,4 @@ metadata:
   name: {{ .Namespace }}
   labels:
     kuma.io/sidecar-injection: enabled
-  annotations:
     kuma.io/mesh: {{ .Mesh }}
diff --git a/app/kumactl/data/install/k8s/metrics/namespace.yaml b/app/kumactl/data/install/k8s/metrics/namespace.yaml
index c8f22e869..9ea7b01ac 100644
--- a/app/kumactl/data/install/k8s/metrics/namespace.yaml
+++ b/app/kumactl/data/install/k8s/metrics/namespace.yaml
@@ -5,5 +5,4 @@ metadata:
   name: {{ .Namespace }}
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: {{ .Mesh }}
diff --git a/mk/dependencies/deps.lock b/mk/dependencies/deps.lock
index 8bdde8be7..031e9e497 100644
--- a/mk/dependencies/deps.lock
+++ b/mk/dependencies/deps.lock
@@ -1,1 +1,1 @@
-fac2c19fe796298c648b82b21d3e90c0099fe72a
+67e5a6e147d569852851535e91196922ade8162d
diff --git a/mk/dependencies/go-deps.sh b/mk/dependencies/go-deps.sh
index a1917ef53..ac242bc73 100755
--- a/mk/dependencies/go-deps.sh
+++ b/mk/dependencies/go-deps.sh
@@ -12,6 +12,7 @@ GINKGO=github.com/onsi/ginkgo/v2/ginkgo@$(go list -f '{{.Version}}' -m github.co
 CONTROLLER_GEN=sigs.k8s.io/controller-tools/cmd/controller-gen@$(go list -f '{{.Version}}' -m sigs.k8s.io/controller-tools)
 
 echo '' > mk/dependencies/go-deps.versions
+PIDS=()
 for i in \
     google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.1 \
     google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1.0 \
@@ -27,8 +28,12 @@ for i in \
   echo "install go dep: ${i}"
   echo "${i}" >> mk/dependencies/go-deps.versions
   GOBIN=${OUTPUT_BIN_DIR} go install "${i}" &
+  PIDS+=($!)
+done
+
+for PID in "${PIDS[@]}"; do
+    wait "${PID}"
 done
-wait
 
 set +x
 # Get the protos from some go dependencies
diff --git a/pkg/core/resources/apis/meshservice/generate/generator.go b/pkg/core/resources/apis/meshservice/generate/generator.go
index ab7bfbdd0..5bdf18bc5 100644
--- a/pkg/core/resources/apis/meshservice/generate/generator.go
+++ b/pkg/core/resources/apis/meshservice/generate/generator.go
@@ -23,7 +23,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/user"
 	core_metrics "github.com/kumahq/kuma/pkg/metrics"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/k8s/metadata"
-	"github.com/kumahq/kuma/pkg/xds/cache/mesh"
+	mesh_cache "github.com/kumahq/kuma/pkg/xds/cache/mesh"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 )
 
@@ -39,7 +39,7 @@ type Generator struct {
 	deletionGracePeriod time.Duration
 	metric              prometheus.Summary
 	resManager          manager.ResourceManager
-	meshCache           *mesh.Cache
+	meshCache           *mesh_cache.Cache
 }
 
 var _ component.Component = &Generator{}
@@ -50,7 +50,7 @@ func New(
 	deletionGracePeriod time.Duration,
 	metrics core_metrics.Metrics,
 	resManager manager.ResourceManager,
-	meshCache *mesh.Cache,
+	meshCache *mesh_cache.Cache,
 ) (*Generator, error) {
 	metric := prometheus.NewSummary(prometheus.SummaryOpts{
 		Name:       "component_meshservice_generator",
@@ -290,6 +290,18 @@ func (g *Generator) Start(stop <-chan struct{}) error {
 					dataplanes := meshCtx.Resources.Dataplanes()
 					meshServices := meshCtx.Resources.MeshServices()
 					g.generate(ctx, mesh, dataplanes.Items, meshServices.Items)
+				} else {
+					for _, meshService := range meshCtx.Resources.MeshServices().Items {
+						if managedBy, ok := meshService.GetMeta().GetLabels()[mesh_proto.ManagedByLabel]; !ok || managedBy != managedByValue {
+							continue
+						}
+						log := g.logger.WithValues("mesh", mesh, "MeshService", meshService.GetMeta().GetName())
+						if err := g.resManager.Delete(ctx, meshservice_api.NewMeshServiceResource(), store.DeleteBy(model.MetaToResourceKey(meshService.GetMeta()))); err != nil {
+							log.Error(err, "couldn't delete MeshService")
+							continue
+						}
+						log.Info("deleted MeshService")
+					}
 				}
 			}
 			g.metric.Observe(float64(time.Since(start).Milliseconds()))
diff --git a/pkg/plugins/runtime/k8s/controllers/configmap_controller.go b/pkg/plugins/runtime/k8s/controllers/configmap_controller.go
index 4831f092b..652c5c325 100644
--- a/pkg/plugins/runtime/k8s/controllers/configmap_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/configmap_controller.go
@@ -121,7 +121,7 @@ func ServiceToConfigMapsMapper(client kube_client.Reader, l logr.Logger, systemN
 
 		meshSet := map[string]struct{}{}
 		for i := range pods.Items {
-			meshSet[k8s_util.MeshOfByAnnotation(&pods.Items[i], &ns)] = struct{}{}
+			meshSet[k8s_util.MeshOfByLabelOrAnnotation(l, &pods.Items[i], &ns)] = struct{}{}
 		}
 		var req []kube_reconile.Request
 		for mesh := range meshSet {
diff --git a/pkg/plugins/runtime/k8s/controllers/gateway_converter.go b/pkg/plugins/runtime/k8s/controllers/gateway_converter.go
index 7fc0c1443..312d11349 100644
--- a/pkg/plugins/runtime/k8s/controllers/gateway_converter.go
+++ b/pkg/plugins/runtime/k8s/controllers/gateway_converter.go
@@ -25,7 +25,7 @@ func (r *PodReconciler) createorUpdateBuiltinGatewayDataplane(ctx context.Contex
 			Namespace: pod.Namespace,
 			Name:      pod.Name,
 		},
-		Mesh: k8s_util.MeshOfByAnnotation(pod, ns),
+		Mesh: k8s_util.MeshOfByLabelOrAnnotation(r.Log, pod, ns),
 	}
 
 	tagsAnnotation, ok := pod.Annotations[metadata.KumaTagsAnnotation]
diff --git a/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go b/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go
index 7d9e94ef6..d8a790f29 100644
--- a/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/gateway_instance_controller.go
@@ -309,7 +309,6 @@ func (r *GatewayInstanceReconciler) createOrUpdateDeployment(
 			podAnnotations := map[string]string{
 				metadata.KumaGatewayAnnotation: metadata.AnnotationBuiltin,
 				metadata.KumaTagsAnnotation:    string(jsonTags),
-				metadata.KumaMeshAnnotation:    mesh,
 			}
 
 			if obj != nil {
@@ -324,6 +323,7 @@ func (r *GatewayInstanceReconciler) createOrUpdateDeployment(
 
 			podLabels := k8sSelector(gatewayInstance.Name)
 			podLabels[metadata.KumaSidecarInjectionAnnotation] = metadata.AnnotationDisabled
+			podLabels[metadata.KumaMeshLabel] = mesh
 
 			for k, v := range gatewayInstance.Spec.PodTemplate.Metadata.Labels {
 				podLabels[k] = v
diff --git a/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go b/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go
index 49aace756..77502a1d3 100644
--- a/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go
@@ -82,7 +82,7 @@ func (r *GatewayReconciler) Reconcile(ctx context.Context, req kube_ctrl.Request
 		return kube_ctrl.Result{}, errors.Wrap(err, "unable to get Namespace of MeshGateway")
 	}
 
-	mesh := k8s_util.MeshOfByAnnotation(gateway, &ns)
+	mesh := k8s_util.MeshOfByLabelOrAnnotation(r.Log, gateway, &ns)
 	gatewaySpec, listenerConditions, err := r.gapiToKumaGateway(ctx, mesh, gateway, config)
 	if err != nil {
 		return kube_ctrl.Result{}, errors.Wrap(err, "error generating MeshGateway.kuma.io")
@@ -146,7 +146,7 @@ func (r *GatewayReconciler) createOrUpdateInstance(ctx context.Context, mesh str
 		if instance.Labels == nil {
 			instance.Labels = map[string]string{}
 		}
-		instance.Labels[metadata.KumaMeshAnnotation] = mesh
+		instance.Labels[metadata.KumaMeshLabel] = mesh
 
 		instance.Spec = mesh_k8s.MeshGatewayInstanceSpec{
 			Tags:                    config.Tags,
diff --git a/pkg/plugins/runtime/k8s/controllers/inbound_converter.go b/pkg/plugins/runtime/k8s/controllers/inbound_converter.go
index 63883f55b..898274a4d 100644
--- a/pkg/plugins/runtime/k8s/controllers/inbound_converter.go
+++ b/pkg/plugins/runtime/k8s/controllers/inbound_converter.go
@@ -193,7 +193,7 @@ func InboundTagsForService(zone string, pod *kube_core.Pod, svc *kube_core.Servi
 		tags[key] = value
 	}
 	if len(ignoredLabels) > 0 {
-		logger.Info("ignoring internal labels when converting labels to tags", "label", strings.Join(ignoredLabels, ","))
+		logger.V(1).Info("ignoring internal labels when converting labels to tags", "label", strings.Join(ignoredLabels, ","))
 	}
 
 	tags[mesh_proto.KubeNamespaceTag] = pod.Namespace
diff --git a/pkg/plugins/runtime/k8s/controllers/meshservice_controller.go b/pkg/plugins/runtime/k8s/controllers/meshservice_controller.go
index 4bb36ee3f..f3614b691 100644
--- a/pkg/plugins/runtime/k8s/controllers/meshservice_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/meshservice_controller.go
@@ -113,7 +113,10 @@ func (r *MeshServiceReconciler) Reconcile(ctx context.Context, req kube_ctrl.Req
 	}
 
 	if mesh.Spec.MeshServicesMode() == mesh_proto.Mesh_MeshServices_Disabled {
-		log.V(1).Info("MeshServices not enabled on Mesh, ignoring")
+		log.V(1).Info("MeshServices not enabled on Mesh, deleting existing")
+		if err := r.deleteIfExist(ctx, req.NamespacedName); err != nil {
+			return kube_ctrl.Result{}, err
+		}
 		return kube_ctrl.Result{}, nil
 	}
 
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_controller.go b/pkg/plugins/runtime/k8s/controllers/pod_controller.go
index ba22616ae..d033deccf 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_controller.go
@@ -293,7 +293,7 @@ func (r *PodReconciler) findOtherDataplanes(ctx context.Context, pod *kube_core.
 	}
 
 	// only consider Dataplanes in the same Mesh as Pod
-	mesh := util_k8s.MeshOfByAnnotation(pod, ns)
+	mesh := util_k8s.MeshOfByLabelOrAnnotation(converterLog, pod, ns)
 	otherDataplanes := make([]*mesh_k8s.Dataplane, 0)
 	for i := range allDataplanes.Items {
 		dataplane := allDataplanes.Items[i]
diff --git a/pkg/plugins/runtime/k8s/controllers/pod_converter.go b/pkg/plugins/runtime/k8s/controllers/pod_converter.go
index 87e1feb93..c8a9ab967 100644
--- a/pkg/plugins/runtime/k8s/controllers/pod_converter.go
+++ b/pkg/plugins/runtime/k8s/controllers/pod_converter.go
@@ -46,7 +46,7 @@ func (p *PodConverter) PodToDataplane(
 ) error {
 	logger := converterLog.WithValues("Dataplane.name", dataplane.Name, "Pod.name", pod.Name)
 	previousMesh := dataplane.Mesh
-	dataplane.Mesh = util_k8s.MeshOfByAnnotation(pod, ns)
+	dataplane.Mesh = util_k8s.MeshOfByLabelOrAnnotation(logger, pod, ns)
 	dataplaneProto, err := p.dataplaneFor(ctx, pod, services, others)
 	if err != nil {
 		return err
diff --git a/pkg/plugins/runtime/k8s/metadata/annotations.go b/pkg/plugins/runtime/k8s/metadata/annotations.go
index ea15d7583..959b6ef74 100644
--- a/pkg/plugins/runtime/k8s/metadata/annotations.go
+++ b/pkg/plugins/runtime/k8s/metadata/annotations.go
@@ -11,6 +11,8 @@ import (
 
 // Annotations that can be used by the end users.
 const (
+	// Deprecated: use KumaMeshLabel as a label from pkg/plugins/runtime/k8s/metadata/labels.go instead of this annotation.
+	//
 	// KumaMeshAnnotation defines a Pod annotation that
 	// associates a given Pod with a particular Mesh.
 	// Annotation value must be the name of a Mesh resource.
diff --git a/pkg/plugins/runtime/k8s/util/util.go b/pkg/plugins/runtime/k8s/util/util.go
index 2abe57ad1..26636ddb7 100644
--- a/pkg/plugins/runtime/k8s/util/util.go
+++ b/pkg/plugins/runtime/k8s/util/util.go
@@ -7,7 +7,6 @@ import (
 	"github.com/go-logr/logr"
 	"golang.org/x/exp/maps"
 	kube_core "k8s.io/api/core/v1"
-	kube_meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kube_labels "k8s.io/apimachinery/pkg/labels"
 	kube_types "k8s.io/apimachinery/pkg/types"
 	kube_intstr "k8s.io/apimachinery/pkg/util/intstr"
@@ -137,19 +136,6 @@ func CopyStringMap(in map[string]string) map[string]string {
 	return out
 }
 
-// MeshOfByAnnotation returns the mesh of the given object according to its own annotations
-// or those of its namespace.
-func MeshOfByAnnotation(obj kube_meta.Object, namespace *kube_core.Namespace) string {
-	if mesh, exists := metadata.Annotations(obj.GetAnnotations()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" {
-		return mesh
-	}
-	if mesh, exists := metadata.Annotations(namespace.GetAnnotations()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" {
-		return mesh
-	}
-
-	return model.DefaultMesh
-}
-
 // MeshOfByLabelOrAnnotation returns the mesh of the given object according to its own
 // annotations or labels or the annotations of its namespace. It treats the annotation
 // directly on the object as deprecated.
@@ -157,18 +143,18 @@ func MeshOfByLabelOrAnnotation(log logr.Logger, obj kube_client.Object, namespac
 	if mesh, exists := metadata.Annotations(obj.GetLabels()).GetString(metadata.KumaMeshLabel); exists && mesh != "" {
 		return mesh
 	}
-	if mesh, exists := metadata.Annotations(obj.GetAnnotations()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" {
-		log.Info("WARNING: The kuma.io/mesh annotation is deprecated for this object kind. Use label instead", "name", obj.GetName(), "namespace", obj.GetNamespace(), "kind", obj.GetObjectKind().GroupVersionKind().Kind)
+	if mesh, exists := metadata.Annotations(obj.GetAnnotations()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" { // nolint:staticcheck
+		log.Info("WARNING: The kuma.io/mesh annotation is no longer supported. Use label instead", "name", obj.GetName(), "namespace", obj.GetNamespace(), "kind", obj.GetObjectKind().GroupVersionKind().Kind)
 		return mesh
 	}
 
 	// Label wasn't found on the object, let's look on the namespace instead
-	if mesh, exists := metadata.Annotations(namespace.GetLabels()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" {
+	if mesh, exists := metadata.Annotations(namespace.GetLabels()).GetString(metadata.KumaMeshLabel); exists && mesh != "" {
 		return mesh
 	}
 
-	if mesh, exists := metadata.Annotations(namespace.GetAnnotations()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" {
-		log.Info("WARNING: The kuma.io/mesh annotation is deprecated for this object kind. Use label instead", "name", obj.GetName(), "namespace", obj.GetNamespace(), "kind", obj.GetObjectKind().GroupVersionKind().Kind)
+	if mesh, exists := metadata.Annotations(namespace.GetAnnotations()).GetString(metadata.KumaMeshAnnotation); exists && mesh != "" { // nolint:staticcheck
+		log.Info("WARNING: The kuma.io/mesh annotation is no longer supported. Use label instead", "name", obj.GetName(), "namespace", obj.GetNamespace(), "kind", obj.GetObjectKind().GroupVersionKind().Kind)
 		return mesh
 	}
 
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
index 519c7728c..109b8f1bf 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
@@ -159,7 +159,6 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
 			tproxyCfg,
 			i.cfg,
 			pod.Annotations,
-			meshName,
 			i.defaultAdminPort,
 		); err != nil {
 			return errors.Wrap(err, "could not generate annotations for pod")
@@ -169,6 +168,11 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
 			pod.Annotations[key] = value
 		}
 
+		if pod.Labels == nil {
+			pod.Labels = map[string]string{}
+		}
+		pod.Labels[metadata.KumaMeshLabel] = meshName
+
 		switch {
 		case !tproxyCfg.CNIMode:
 			initContainer := i.NewInitContainer([]string{"--config", tproxyCfgYAML})
@@ -189,7 +193,7 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
 			pod.Annotations[metadata.KumaTrafficTransparentProxyConfig] = tproxyCfgYAML
 		}
 	} else { // this is legacy and deprecated - will be removed soon
-		if annotations, err = i.NewAnnotations(pod, meshName, logger); err != nil {
+		if annotations, err = i.NewAnnotations(pod, logger); err != nil {
 			return errors.Wrap(err, "could not generate annotations for pod")
 		}
 
@@ -197,6 +201,11 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
 			pod.Annotations[key] = value
 		}
 
+		if pod.Labels == nil {
+			pod.Labels = map[string]string{}
+		}
+		pod.Labels[metadata.KumaMeshLabel] = meshName
+
 		podRedirect, err := tproxy_k8s.NewPodRedirectFromAnnotations(pod.Annotations)
 		if err != nil {
 			return err
@@ -662,12 +671,11 @@ func (i *KumaInjector) NewValidationContainer(ipFamilyMode, inboundRedirectPort
 }
 
 // Deprecated
-func (i *KumaInjector) NewAnnotations(pod *kube_core.Pod, mesh string, logger logr.Logger) (map[string]string, error) {
+func (i *KumaInjector) NewAnnotations(pod *kube_core.Pod, logger logr.Logger) (map[string]string, error) {
 	portOutbound := i.cfg.SidecarContainer.RedirectPortOutbound
 	portInbound := i.cfg.SidecarContainer.RedirectPortInbound
 
 	result := map[string]string{
-		metadata.KumaMeshAnnotation:                            mesh, // either user-defined value or default
 		metadata.KumaSidecarInjectedAnnotation:                 metadata.AnnotationTrue,
 		metadata.KumaTransparentProxyingAnnotation:             metadata.AnnotationEnabled,
 		metadata.KumaSidecarUID:                                fmt.Sprintf("%d", i.cfg.SidecarContainer.UID),
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/precheck.go b/pkg/plugins/runtime/k8s/webhooks/injector/precheck.go
index cde543abf..051c0b06c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/precheck.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/precheck.go
@@ -35,7 +35,7 @@ func (i *KumaInjector) preCheck(ctx context.Context, pod *kube_core.Pod, logger
 		return "", nil
 	}
 
-	meshName := k8s_util.MeshOfByAnnotation(pod, ns)
+	meshName := k8s_util.MeshOfByLabelOrAnnotation(logger, pod, ns)
 	logger = logger.WithValues("mesh", meshName)
 	// Check mesh exists
 	if err := i.client.Get(ctx, kube_types.NamespacedName{Name: meshName}, &mesh_k8s.Mesh{}); err != nil {
diff --git a/pkg/transparentproxy/kubernetes/kubernetes_config.go b/pkg/transparentproxy/kubernetes/kubernetes_config.go
index 7a9620341..1c4662911 100644
--- a/pkg/transparentproxy/kubernetes/kubernetes_config.go
+++ b/pkg/transparentproxy/kubernetes/kubernetes_config.go
@@ -484,13 +484,11 @@ func ConfigToAnnotations(
 	cfg tproxy_config.Config,
 	runtimeCfg k8s.Injector,
 	annotations map[string]string,
-	mesh string,
 	defaultAdminPort uint32,
 ) (map[string]string, error) {
 	result := map[string]string{
 		k8s_metadata.KumaSidecarInjectedAnnotation:                 k8s_metadata.AnnotationTrue,
 		k8s_metadata.KumaTransparentProxyingAnnotation:             k8s_metadata.AnnotationEnabled,
-		k8s_metadata.KumaMeshAnnotation:                            mesh, // either user-defined value or default
 		k8s_metadata.KumaSidecarUID:                                cfg.KumaDPUser,
 		k8s_metadata.KumaTransparentProxyingOutboundPortAnnotation: cfg.Redirect.Outbound.Port.String(),
 		k8s_metadata.KumaTransparentProxyingInboundPortAnnotation:  cfg.Redirect.Inbound.Port.String(),


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-observability.defaults.golden.yaml b/app/kumactl/cmd/install/testdata/install-observability.defaults.golden.yaml
index 946fd18ac..6a6a8f274 100644
--- a/app/kumactl/cmd/install/testdata/install-observability.defaults.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-observability.defaults.golden.yaml
@@ -6,7 +6,6 @@ metadata:
   name: mesh-observability
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: default
 ---
 apiVersion: v1
diff --git a/app/kumactl/cmd/install/testdata/install-observability.no-grafana.golden.yaml b/app/kumactl/cmd/install/testdata/install-observability.no-grafana.golden.yaml
index 7c0b80563..2e4d88ad6 100644
--- a/app/kumactl/cmd/install/testdata/install-observability.no-grafana.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-observability.no-grafana.golden.yaml
@@ -6,7 +6,6 @@ metadata:
   name: mesh-observability
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: default
 ---
 apiVersion: v1
diff --git a/app/kumactl/cmd/install/testdata/install-observability.no-jaeger.golden.yaml b/app/kumactl/cmd/install/testdata/install-observability.no-jaeger.golden.yaml
index 8c15de111..05b306f6f 100644
--- a/app/kumactl/cmd/install/testdata/install-observability.no-jaeger.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-observability.no-jaeger.golden.yaml
@@ -6,7 +6,6 @@ metadata:
   name: mesh-observability
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: default
 ---
 apiVersion: v1
diff --git a/app/kumactl/cmd/install/testdata/install-observability.no-loki.golden.yaml b/app/kumactl/cmd/install/testdata/install-observability.no-loki.golden.yaml
index 7207f54c1..e712aaac6 100644
--- a/app/kumactl/cmd/install/testdata/install-observability.no-loki.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-observability.no-loki.golden.yaml
@@ -6,7 +6,6 @@ metadata:
   name: mesh-observability
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: default
 ---
 apiVersion: v1
diff --git a/app/kumactl/cmd/install/testdata/install-observability.no-prometheus.golden.yaml b/app/kumactl/cmd/install/testdata/install-observability.no-prometheus.golden.yaml
index 538a9b731..14998194f 100644
--- a/app/kumactl/cmd/install/testdata/install-observability.no-prometheus.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-observability.no-prometheus.golden.yaml
@@ -6,7 +6,6 @@ metadata:
   name: mesh-observability
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: default
 ---
 apiVersion: v1
diff --git a/app/kumactl/cmd/install/testdata/install-observability.overrides.golden.yaml b/app/kumactl/cmd/install/testdata/install-observability.overrides.golden.yaml
index 791807676..9e3916293 100644
--- a/app/kumactl/cmd/install/testdata/install-observability.overrides.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-observability.overrides.golden.yaml
@@ -6,7 +6,6 @@ metadata:
   name: kuma
   labels:
     kuma.io/sidecar-injection: disabled
-  annotations:
     kuma.io/mesh: mesh-1
 ---
 apiVersion: v1
diff --git a/pkg/plugins/runtime/k8s/controllers/configmap_controller_test.go b/pkg/plugins/runtime/k8s/controllers/configmap_controller_test.go
index 4d9821018..318440ad2 100644
--- a/pkg/plugins/runtime/k8s/controllers/configmap_controller_test.go
+++ b/pkg/plugins/runtime/k8s/controllers/configmap_controller_test.go
@@ -115,7 +115,7 @@ var _ = Describe("ServiceToConfigMapMapper", func() {
 			defaultNs,
 			[]kube_core.Pod{
 				podFn("pod1", map[string]string{"app": "app2"}, nil),
-				podFn("pod2", map[string]string{"app": "app2"}, map[string]string{metadata.KumaMeshAnnotation: "mesh2"}),
+				podFn("pod2", map[string]string{"app": "app2", metadata.KumaMeshLabel: "mesh2"}, map[string]string{}),
 			},
 			[]string{},
 		),
@@ -124,7 +124,7 @@ var _ = Describe("ServiceToConfigMapMapper", func() {
 			defaultNs,
 			[]kube_core.Pod{
 				podFn("pod1", map[string]string{"app": "app1"}, nil),
-				podFn("pod2", map[string]string{"app": "app2"}, map[string]string{metadata.KumaMeshAnnotation: "mesh2"}),
+				podFn("pod2", map[string]string{"app": "app2", metadata.KumaMeshLabel: "mesh2"}, map[string]string{}),
 			},
 			[]string{"kuma-default-dns-vips"},
 		),
@@ -132,8 +132,8 @@ var _ = Describe("ServiceToConfigMapMapper", func() {
 			serviceFn(map[string]string{"app": "app1"}),
 			defaultNs,
 			[]kube_core.Pod{
-				podFn("pod1", map[string]string{"app": "app1"}, map[string]string{metadata.KumaMeshAnnotation: "mesh1"}),
-				podFn("pod2", map[string]string{"app": "app2"}, map[string]string{metadata.KumaMeshAnnotation: "mesh2"}),
+				podFn("pod1", map[string]string{"app": "app1", metadata.KumaMeshLabel: "mesh1"}, map[string]string{}),
+				podFn("pod2", map[string]string{"app": "app2", metadata.KumaMeshLabel: "mesh2"}, map[string]string{}),
 			},
 			[]string{"kuma-mesh1-dns-vips"},
 		),
@@ -141,8 +141,8 @@ var _ = Describe("ServiceToConfigMapMapper", func() {
 			serviceFn(map[string]string{"app": "app1"}),
 			defaultNs,
 			[]kube_core.Pod{
-				podFn("pod1", map[string]string{"app": "app1"}, map[string]string{metadata.KumaMeshAnnotation: "mesh1"}),
-				podFn("pod2", map[string]string{"app": "app1"}, map[string]string{metadata.KumaMeshAnnotation: "mesh2"}),
+				podFn("pod1", map[string]string{"app": "app1", metadata.KumaMeshLabel: "mesh1"}, map[string]string{}),
+				podFn("pod2", map[string]string{"app": "app1", metadata.KumaMeshLabel: "mesh2"}, map[string]string{}),
 			},
 			[]string{"kuma-mesh1-dns-vips", "kuma-mesh2-dns-vips"},
 		),
@@ -151,7 +151,7 @@ var _ = Describe("ServiceToConfigMapMapper", func() {
 			kube_core.Namespace{
 				ObjectMeta: metav1.ObjectMeta{
 					Annotations: map[string]string{
-						metadata.KumaMeshAnnotation: "mesh1",
+						metadata.KumaMeshLabel: "mesh1",
 					},
 				},
 			},
@@ -166,15 +166,45 @@ var _ = Describe("ServiceToConfigMapMapper", func() {
 			kube_core.Namespace{
 				ObjectMeta: metav1.ObjectMeta{
 					Annotations: map[string]string{
-						metadata.KumaMeshAnnotation: "mesh1",
+						metadata.KumaMeshLabel: "mesh1",
 					},
 				},
 			},
 			[]kube_core.Pod{
-				podFn("pod1", map[string]string{"app": "app1"}, map[string]string{metadata.KumaMeshAnnotation: "mesh2"}),
+				podFn("pod1", map[string]string{"app": "app1"}, map[string]string{metadata.KumaMeshLabel: "mesh2"}),
 				podFn("pod2", map[string]string{"app": "app1"}, nil),
 			},
 			[]string{"kuma-mesh1-dns-vips", "kuma-mesh2-dns-vips"},
 		),
+		Entry("namespace label pod has label",
+			serviceFn(map[string]string{"app": "app1"}),
+			kube_core.Namespace{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						metadata.KumaMeshLabel: "mesh1",
+					},
+				},
+			},
+			[]kube_core.Pod{
+				podFn("pod1", map[string]string{"app": "app1", metadata.KumaMeshLabel: "mesh1"}, map[string]string{}),
+				podFn("pod2", map[string]string{"app": "app1"}, nil),
+			},
+			[]string{"kuma-mesh1-dns-vips"},
+		),
+		Entry("namespace label pod has annotation",
+			serviceFn(map[string]string{"app": "app1"}),
+			kube_core.Namespace{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						metadata.KumaMeshLabel: "mesh1",
+					},
+				},
+			},
+			[]kube_core.Pod{
+				podFn("pod1", map[string]string{"app": "app1"}, map[string]string{metadata.KumaMeshAnnotation: "mesh1"}), // nolint:staticcheck
+				podFn("pod2", map[string]string{"app": "app1"}, nil),
+			},
+			[]string{"kuma-mesh1-dns-vips"},
+		),
 	)
 })
diff --git a/pkg/plugins/runtime/k8s/util/util_test.go b/pkg/plugins/runtime/k8s/util/util_test.go
index 7d06b7e41..795434fcf 100644
--- a/pkg/plugins/runtime/k8s/util/util_test.go
+++ b/pkg/plugins/runtime/k8s/util/util_test.go
@@ -232,7 +232,7 @@ var _ = Describe("Util", func() {
 				}
 
 				// then
-				Expect(util.MeshOfByAnnotation(pod, ns)).To(Equal(given.expected))
+				Expect(util.MeshOfByLabelOrAnnotation(logr.Discard(), pod, ns)).To(Equal(given.expected))
 			},
 			Entry("Pod without annotations", testCase{
 				podAnnotations: nil,
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index d2a5f3462..b624fced9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index bb12fd07a..621037a3c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index c1d88ebe3..e51fceac6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: coredns
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
   generateName: coredns-fb8b8dccf-
   labels:
     k8s-app: kube-dns
+    kuma.io/mesh: default
     pod-template-hash: fb8b8dccf
   ownerReferences:
   - apiVersion: apps/v1
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index 510b90ee8..9bc0e0057 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -16,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: demo
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index fb5335880..240797efe 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index 2237d5617..c9b792234 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
     kuma.io/gateway: enabled
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index d2a5f3462..b624fced9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index 30e947e32..a822cab0a 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -19,6 +18,7 @@ metadata:
     prometheus.io/scrape: "true"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index 39649042c..aed554472 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     prometheus.metrics.kuma.io/port: "5678"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
index d56d796dd..23223f2d1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     kuma.io/sidecar-injection: enabled
     run: busybox
   name: busybox
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index e1e8f786e..dab7f4b86 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: mesh-name-from-ns
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: mesh-name-from-ns
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index ee4752df9..673cdc973 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -16,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: mesh-name-from-pod
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 399a8666b..498f4f659 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
index f464bda03..f0d40029f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "19000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
index e3d738d0d..567d7652d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
index b3fc1728b..0ed2283bc 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ports: "1236"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
index ac978cc54..c1ed639e1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ports: 4321,7654
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
index fc28477bb..1f7762e45 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ports: ""
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
index b185b6fe8..5d411e45f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
index a59848cdd..bd70de7a3 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
index 22fae5585..32e70cef1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
index 7b4cac091..8133c5316 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -18,6 +17,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
index d5cb86a9b..3369b00ff 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
@@ -9,7 +9,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -21,6 +20,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
index d7bddaa0a..3274ec49a 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
@@ -9,7 +9,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-proxy-concurrency: "99"
@@ -22,6 +21,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
index 8b343d45c..85e10ae7c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
@@ -9,7 +9,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -21,6 +20,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
index 3e8305a43..c40c76737 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/service-account-token-volume: token
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
index fd211a309..30f8e3d36 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-drain-time: 10s
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
index 8267b1dc4..3dace8160 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
@@ -7,7 +7,6 @@ metadata:
     kuma.io/container-patches: container-patch-1
     kuma.io/envoy-admin-port: "9901"
     kuma.io/envoy-log-level: trace
-    kuma.io/mesh: default
     kuma.io/sidecar-drain-time: 10s
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -19,6 +18,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
index dc5223fbb..d0e7447d1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
@@ -8,7 +8,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -19,6 +18,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
index a8fa11eb4..f6816c1c8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -22,6 +21,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
index 5a36c7618..eb02926c7 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
index a1bb48a44..34b8e2779 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
     kuma.io/init-first: "true"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
index 7bf8b8cc8..54fa45145 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.34.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.34.golden.yaml
index 4f2c669e1..8f54852c9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.34.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.34.golden.yaml
@@ -7,7 +7,6 @@ metadata:
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
     kuma.io/init-first: "true"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml
index d773b940f..2eb110945 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: init
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml
index 917f963a5..c623d5cb4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/drop-invalid-packets: "true"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml
index fdb3e9b48..ebce8b54d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/iptables-logs: "true"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml
index c06a85d33..48fe7e44b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ips: 10.0.0.1,172.16.0.0/16,fe80::1,fe80::/10
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml
index 4d2292fe5..98027ea1f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/exclude-inbound-ips: 192.168.0.1,172.32.16.8/16,a81b:a033:6399:73c7:72b6:aa8c:6f22:7098,fe80::/10
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.40.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.40.golden.yaml
index 0a93135ad..a42e2cf1d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.40.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.40.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
index ad3e94e34..67d3308ac 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
index fe010977f..636270448 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
index e675c4e8a..e9fdcb18c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: coredns
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
   generateName: coredns-fb8b8dccf-
   labels:
     k8s-app: kube-dns
+    kuma.io/mesh: default
     pod-template-hash: fb8b8dccf
   ownerReferences:
   - apiVersion: apps/v1
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
index 4390eb144..4241bd77c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
@@ -16,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: demo
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
index 982080d2d..c00f00fc8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
index 9a941ad54..14a672208 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
     kuma.io/gateway: enabled
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
index ad3e94e34..67d3308ac 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
index fb0be23ba..0503bd214 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -19,6 +18,7 @@ metadata:
     prometheus.io/scrape: "true"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
index 0965346df..f883c8dac 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     prometheus.metrics.kuma.io/port: "5678"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
index 2b9bb422f..641e5ad41 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     kuma.io/sidecar-injection: enabled
     run: busybox
   name: busybox
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
index e8e06d65a..4e256fb13 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: mesh-name-from-ns
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: mesh-name-from-ns
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
index c4d46617c..ea28b9106 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
@@ -16,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: mesh-name-from-pod
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
index bf6c34299..d69ca2e0b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
index 70ad85899..94c525042 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "19000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
index ad24eb156..4ad7f762b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
index c026c970e..b8c79f878 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ports: "1236"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
index 6e94a86f3..672f542d3 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ports: 4321,7654
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
index 6a6ab9e8f..012dcd9b5 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ports: ""
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
index 1c9f47351..e3d47dfd8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
index 3526389bc..df1555736 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
index 8059a6569..95a85f529 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
index 47982db4d..876dd53ac 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -18,6 +17,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
index e830f26a4..2435f91fa 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
@@ -9,7 +9,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -21,6 +20,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
index e69478001..14a29e2ca 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
@@ -9,7 +9,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-proxy-concurrency: "99"
@@ -22,6 +21,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
index 375fc5c4d..3da9d91d7 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
@@ -9,7 +9,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-env-vars: KUMA_DATAPLANE_DRAIN_TIME=5s;NEW_ENV_VAR=123
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -21,6 +20,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
index 19e7b74b9..2658316ff 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/service-account-token-volume: token
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
index d7774312c..eb95a4560 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-drain-time: 10s
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
index c4b5b01ee..808290d26 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
@@ -7,7 +7,6 @@ metadata:
     kuma.io/container-patches: container-patch-1
     kuma.io/envoy-admin-port: "9901"
     kuma.io/envoy-log-level: trace
-    kuma.io/mesh: default
     kuma.io/sidecar-drain-time: 10s
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
@@ -19,6 +18,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
index 80ada2bb8..0ac63fbe6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
@@ -8,7 +8,6 @@ metadata:
     kuma.io/builtin-dns-logging: "false"
     kuma.io/builtin-dns-port: "25053"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -19,6 +18,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
index f049258d6..ea27d889d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -22,6 +21,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
index df8c1a870..e8e0a3828 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
index 0f8b99ec8..81aa1029d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
@@ -6,7 +6,6 @@ metadata:
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
     kuma.io/init-first: "true"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
index f11390a19..2a4d06f2d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.34.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.34.golden.yaml
index aea729666..796b6b302 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.34.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.34.golden.yaml
@@ -7,7 +7,6 @@ metadata:
     kuma.io/application-probe-proxy-port: "0"
     kuma.io/envoy-admin-port: "9901"
     kuma.io/init-first: "true"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -18,6 +17,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml
index ca7ce8757..eb5f42205 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: init
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml
index 3dbf01e1f..d63fbb372 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/drop-invalid-packets: "true"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml
index 95d9be116..aecbdd094 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/iptables-logs: "true"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml
index 480c6790e..0f94fbae9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/exclude-outbound-ips: 10.0.0.1,172.16.0.0/16,fe80::1,fe80::/10
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml
index bdb9d9ba1..59ddc1f63 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -17,6 +16,7 @@ metadata:
     traffic.kuma.io/exclude-inbound-ips: 192.168.0.1,172.32.16.8/16,a81b:a033:6399:73c7:72b6:aa8c:6f22:7098,fe80::/10
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.40.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.40.golden.yaml
index a676d7b52..625963e52 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.40.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.40.golden.yaml
@@ -5,7 +5,6 @@ metadata:
     kubectl.kubernetes.io/default-container: busybox
     kuma.io/application-probe-proxy-port: "9000"
     kuma.io/envoy-admin-port: "9901"
-    kuma.io/mesh: default
     kuma.io/sidecar-injected: "true"
     kuma.io/sidecar-uid: "5678"
     kuma.io/transparent-proxying: enabled
@@ -16,6 +15,7 @@ metadata:
     kuma.io/virtual-probes-port: "9000"
   creationTimestamp: null
   labels:
+    kuma.io/mesh: default
     run: busybox
   name: busybox
 spec:
diff --git a/pkg/test/resources/builders/mesh_builder.go b/pkg/test/resources/builders/mesh_builder.go
index 82f41d89f..f2d732d22 100644
--- a/pkg/test/resources/builders/mesh_builder.go
+++ b/pkg/test/resources/builders/mesh_builder.go
@@ -9,6 +9,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
+	"github.com/kumahq/kuma/pkg/core/resources/model/rest"
 	"github.com/kumahq/kuma/pkg/core/resources/store"
 	mesh_k8s "github.com/kumahq/kuma/pkg/plugins/resources/k8s/native/api/v1alpha1"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
@@ -164,3 +165,12 @@ func (m *MeshBuilder) KubeYaml() string {
 	}
 	return string(res)
 }
+
+func (m *MeshBuilder) UniYaml() string {
+	mesh := m.Build()
+	res, err := yaml.Marshal(rest.From.Resource(mesh))
+	if err != nil {
+		panic(err)
+	}
+	return string(res)
+}
diff --git a/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go b/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go
index a88cd60e1..5fb25c610 100644
--- a/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go
+++ b/test/e2e/reachableservices/auto_reachable_mesh_services_k8s.go
@@ -45,12 +45,11 @@ spec:
 			)).
 			Install(NamespaceWithSidecarInjection(namespace)).
 			Install(
-				YamlK8s(
+				Yaml(
 					builders.Mesh().
 						WithName(meshName).
 						WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1").
-						WithMeshServicesEnabled(mesh_proto.Mesh_MeshServices_Exclusive).
-						KubeYaml(),
+						WithMeshServicesEnabled(mesh_proto.Mesh_MeshServices_Exclusive),
 				),
 			).
 			Install(testserver.Install(testserver.WithName("client-server"), testserver.WithMesh(meshName), testserver.WithNamespace(namespace))).
diff --git a/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go b/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go
index e5696d5e1..75fb04da7 100644
--- a/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go
+++ b/test/e2e_env/kubernetes/appprobeproxy/probe_proxy.go
@@ -173,7 +173,7 @@ func ApplicationProbeProxy() {
 		By("patch the application pod and disabling application probe proxy using annotation")
 		kubectlOptsApps := kubernetes.Cluster.GetKubectlOptions(namespace)
 		nextTemplateHash := patchAndWait(kubernetes.Cluster.GetTesting(), Default, kubernetes.Cluster, kubectlOptsApps, httpAppName,
-			`[{"op":"add", "path":"/spec/template/metadata/annotations/kuma.io~1application-probe-proxy-port", "value":"0"}]`)
+			`[{"op": "add", "path": "/spec/template/metadata/annotations", "value": {}},{"op":"add", "path":"/spec/template/metadata/annotations/kuma.io~1application-probe-proxy-port", "value":"0"}]`)
 
 		By("checking virtual probes annotations on the new pod")
 		var nextRevPodName string
diff --git a/test/e2e_env/kubernetes/gateway/cross-mesh.go b/test/e2e_env/kubernetes/gateway/cross-mesh.go
index 21b806243..5bf28e1e2 100644
--- a/test/e2e_env/kubernetes/gateway/cross-mesh.go
+++ b/test/e2e_env/kubernetes/gateway/cross-mesh.go
@@ -204,7 +204,7 @@ kind: Gateway
 metadata:
   name: %s
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   gatewayClassName: kuma-cross-mesh
@@ -220,7 +220,7 @@ kind: HTTPRoute
 metadata:
   name: %s
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   parentRefs:
diff --git a/test/e2e_env/kubernetes/gateway/delegated.go b/test/e2e_env/kubernetes/gateway/delegated.go
index 55278a9fa..747a2824b 100644
--- a/test/e2e_env/kubernetes/gateway/delegated.go
+++ b/test/e2e_env/kubernetes/gateway/delegated.go
@@ -63,7 +63,7 @@ spec:
 					mesh.WithEgressRoutingEnabled()
 				}
 				err := NewClusterSetup().
-					Install(YamlK8s(mesh.KubeYaml())).
+					Install(Yaml(mesh)).
 					Install(MeshTrafficPermissionAllowAllKubernetes(config.Mesh)).
 					Install(NamespaceWithSidecarInjection(config.Namespace)).
 					Install(Namespace(config.NamespaceOutsideMesh)).
diff --git a/test/e2e_env/kubernetes/gateway/gatewayapi.go b/test/e2e_env/kubernetes/gateway/gatewayapi.go
index a2bce81ca..a3810dc44 100644
--- a/test/e2e_env/kubernetes/gateway/gatewayapi.go
+++ b/test/e2e_env/kubernetes/gateway/gatewayapi.go
@@ -119,7 +119,7 @@ kind: Gateway
 metadata:
   name: %s
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   gatewayClassName: ha-kuma
@@ -168,7 +168,7 @@ kind: Gateway
 metadata:
   name: %s
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   gatewayClassName: kuma
@@ -214,7 +214,7 @@ kind: HTTPRoute
 metadata:
   name: test-server-paths
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   parentRefs:
@@ -269,7 +269,7 @@ kind: HTTPRoute
 metadata:
   name: test-server-1
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   parentRefs:
@@ -286,7 +286,7 @@ kind: HTTPRoute
 metadata:
   name: test-server-2
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   parentRefs:
@@ -332,7 +332,7 @@ kind: HTTPRoute
 metadata:
   name: external-service
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   parentRefs:
@@ -388,7 +388,7 @@ kind: Gateway
 metadata:
   name: %s
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   gatewayClassName: kuma
@@ -428,7 +428,7 @@ kind: HTTPRoute
 metadata:
   name: test-server-paths
   namespace: %s
-  annotations:
+  labels:
     kuma.io/mesh: %s
 spec:
   parentRefs:
diff --git a/test/e2e_env/kubernetes/graceful/eviction.go b/test/e2e_env/kubernetes/graceful/eviction.go
index 29575018f..7235042d1 100644
--- a/test/e2e_env/kubernetes/graceful/eviction.go
+++ b/test/e2e_env/kubernetes/graceful/eviction.go
@@ -36,7 +36,7 @@ kind: Pod
 metadata:
   name: to-be-evicted
   namespace: eviction
-  annotations:
+  labels:
     kuma.io/mesh: eviction
 spec:
   volumes:
diff --git a/test/e2e_env/kubernetes/graceful/graceful.go b/test/e2e_env/kubernetes/graceful/graceful.go
index 1bf090952..00b54174f 100644
--- a/test/e2e_env/kubernetes/graceful/graceful.go
+++ b/test/e2e_env/kubernetes/graceful/graceful.go
@@ -41,7 +41,7 @@ kind: MeshGatewayInstance
 metadata:
   name: edge-gateway
   namespace: graceful
-  annotations:
+  labels:
     kuma.io/mesh: graceful
 spec:
   replicas: %d
diff --git a/test/e2e_env/kubernetes/graceful/wait_for_envoy.go b/test/e2e_env/kubernetes/graceful/wait_for_envoy.go
index bcc0f47d2..0f1d42d58 100644
--- a/test/e2e_env/kubernetes/graceful/wait_for_envoy.go
+++ b/test/e2e_env/kubernetes/graceful/wait_for_envoy.go
@@ -49,8 +49,8 @@ metadata:
   namespace: %s
   labels:
     app: wait-for-envoy
-  annotations:
     kuma.io/mesh: %s
+  annotations:
     kuma.io/wait-for-dataplane-ready: "true"
 spec:
   restartPolicy: Never
diff --git a/test/e2e_env/kubernetes/membership/membership.go b/test/e2e_env/kubernetes/membership/membership.go
index 9615f817d..cd5b26b26 100644
--- a/test/e2e_env/kubernetes/membership/membership.go
+++ b/test/e2e_env/kubernetes/membership/membership.go
@@ -70,7 +70,7 @@ spec:
 			testserver.WithMesh(mesh2),
 			testserver.WithoutWaitingToBeReady(),
 		)(kubernetes.Cluster)
-		Expect(err).ToNot(HaveOccurred())
+		Expect(err).To(HaveOccurred())
 
 		// then the client is not allowed to do it
 		// then it's not allowed
diff --git a/test/e2e_env/kubernetes/meshcircuitbreaker/meshcircuitbreaker.go b/test/e2e_env/kubernetes/meshcircuitbreaker/meshcircuitbreaker.go
index 29b26b155..d45ef8df2 100644
--- a/test/e2e_env/kubernetes/meshcircuitbreaker/meshcircuitbreaker.go
+++ b/test/e2e_env/kubernetes/meshcircuitbreaker/meshcircuitbreaker.go
@@ -6,8 +6,10 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	"github.com/kumahq/kuma/pkg/plugins/policies/meshcircuitbreaker/api/v1alpha1"
 	meshretry_api "github.com/kumahq/kuma/pkg/plugins/policies/meshretry/api/v1alpha1"
+	"github.com/kumahq/kuma/pkg/test/resources/builders"
 	. "github.com/kumahq/kuma/test/framework"
 	"github.com/kumahq/kuma/test/framework/client"
 	"github.com/kumahq/kuma/test/framework/deployments/democlient"
@@ -19,36 +21,18 @@ func MeshCircuitBreaker() {
 	namespace := "meshcircuitbreaker-namespace"
 	mesh := "meshcircuitbreaker"
 
-	kubeMeshServiceYAML := fmt.Sprintf(`
-apiVersion: kuma.io/v1alpha1
-kind: MeshService
-metadata:
-  name: test-server
-  namespace: %s
-  labels:
-    kuma.io/origin: zone
-    kuma.io/mesh: %s
-    kuma.io/managed-by: k8s-controller
-    k8s.kuma.io/is-headless-service: "false"
-spec:
-  selector:
-    dataplaneTags:
-      app: test-server
-      k8s.kuma.io/namespace: %s
-  ports:
-  - port: 80
-    name: main
-    targetPort: main
-    appProtocol: http
-`, namespace, mesh, namespace)
-
 	BeforeAll(func() {
 		err := NewClusterSetup().
-			Install(MeshKubernetes(mesh)).
+			Install(
+				Yaml(
+					builders.Mesh().
+						WithName(mesh).
+						WithMeshServicesEnabled(mesh_proto.Mesh_MeshServices_Everywhere),
+				),
+			).
 			Install(NamespaceWithSidecarInjection(namespace)).
 			Install(democlient.Install(democlient.WithNamespace(namespace), democlient.WithMesh(mesh))).
 			Install(testserver.Install(testserver.WithMesh(mesh), testserver.WithNamespace(namespace))).
-			Install(YamlK8s(kubeMeshServiceYAML)).
 			Install(YamlK8s(fmt.Sprintf(`
 apiVersion: kuma.io/v1alpha1
 kind: HostnameGenerator
diff --git a/test/e2e_env/kubernetes/meshtimeout/meshtimeout.go b/test/e2e_env/kubernetes/meshtimeout/meshtimeout.go
index f704e8c85..1e48199c3 100644
--- a/test/e2e_env/kubernetes/meshtimeout/meshtimeout.go
+++ b/test/e2e_env/kubernetes/meshtimeout/meshtimeout.go
@@ -27,11 +27,10 @@ func MeshTimeout() {
 
 		BeforeAll(func() {
 			err := NewClusterSetup().
-				Install(YamlK8s(builders.Mesh().
+				Install(Yaml(builders.Mesh().
 					WithName(mesh).
 					WithoutInitialPolicies().
-					WithMeshServicesEnabled(mode).
-					KubeYaml())).
+					WithMeshServicesEnabled(mode))).
 				Install(NamespaceWithSidecarInjection(namespace)).
 				Install(democlient.Install(democlient.WithNamespace(namespace), democlient.WithMesh(mesh))).
 				Install(testserver.Install(testserver.WithMesh(mesh), testserver.WithNamespace(namespace))).
diff --git a/test/e2e_env/multizone/meshservice/migration.go b/test/e2e_env/multizone/meshservice/migration.go
new file mode 100644
index 000000000..43e2d0914
--- /dev/null
+++ b/test/e2e_env/multizone/meshservice/migration.go
@@ -0,0 +1,144 @@
+package meshservice
+
+import (
+	"fmt"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"sigs.k8s.io/yaml"
+
+	"github.com/kumahq/kuma/pkg/kds/hash"
+	. "github.com/kumahq/kuma/test/framework"
+	"github.com/kumahq/kuma/test/framework/deployments/testserver"
+	"github.com/kumahq/kuma/test/framework/envs/multizone"
+)
+
+func Migration() {
+	namespace := "msmigration"
+	meshName := "msmigration"
+
+	BeforeAll(func() {
+		err := NewClusterSetup().
+			Install(MTLSMeshUniversal(meshName)).
+			Setup(multizone.Global)
+		Expect(err).ToNot(HaveOccurred())
+
+		err = NewClusterSetup().
+			Install(NamespaceWithSidecarInjection(namespace)).
+			Install(testserver.Install(
+				testserver.WithName("demo-client"),
+				testserver.WithMesh(meshName),
+				testserver.WithNamespace(namespace),
+			)).
+			Install(testserver.Install(
+				testserver.WithName("test-server"),
+				testserver.WithNamespace(namespace),
+				testserver.WithMesh(meshName),
+			)).
+			Setup(multizone.KubeZone1)
+		Expect(err).ToNot(HaveOccurred())
+
+		err = NewClusterSetup().
+			Install(TestServerUniversal("test-server", meshName)).
+			Setup(multizone.UniZone1)
+		Expect(err).ToNot(HaveOccurred())
+	})
+
+	AfterEachFailure(func() {
+		DebugUniversal(multizone.Global, meshName)
+		DebugUniversal(multizone.UniZone1, meshName)
+		DebugKube(multizone.KubeZone1, meshName, namespace)
+	})
+
+	E2EAfterAll(func() {
+		Expect(multizone.KubeZone1.TriggerDeleteNamespace(namespace)).To(Succeed())
+		Expect(multizone.UniZone1.DeleteMeshApps(meshName)).To(Succeed())
+		Expect(multizone.Global.DeleteMesh(meshName)).To(Succeed())
+	})
+
+	type meshServiceList struct {
+		Total int `json:"total"`
+		Items []struct {
+			Name string `json:"name"`
+		} `json:"items"`
+	}
+
+	unmarshal := func(out string) *meshServiceList {
+		l := &meshServiceList{}
+		Expect(yaml.Unmarshal([]byte(out), l)).To(Succeed())
+		return l
+	}
+
+	hasMeshServices := func(names ...string) {
+		Eventually(func(g Gomega) {
+			// when
+			out, err := multizone.Global.GetKumactlOptions().RunKumactlAndGetOutput("get", "meshservices", "-m", meshName, "-o", "yaml")
+			// then
+			g.Expect(err).ToNot(HaveOccurred())
+			response := unmarshal(out)
+			g.Expect(response.Total).To(Equal(len(names)))
+			var actualNames []string
+			for _, name := range response.Items {
+				actualNames = append(actualNames, name.Name)
+			}
+			g.Expect(actualNames).To(ConsistOf(names))
+		}).Should(Succeed())
+	}
+
+	noMeshServices := func() {
+		// call hasMeshServices with no names
+		hasMeshServices()
+	}
+
+	It("should automatically create MeshServices when the mode is 'Exclusive'", func() {
+		// given
+		noMeshServices()
+
+		// when enable 'mode: Exclusive'
+		Expect(MTLSMeshWithMeshServicesUniversal(meshName, "Exclusive")(multizone.Global)).To(Succeed())
+
+		// then
+		hasMeshServices(
+			hash.HashedName(meshName, "demo-client", Kuma1, namespace),
+			hash.HashedName(meshName, "test-server", Kuma1, namespace),
+			hash.HashedName(meshName, "test-server", Kuma4),
+		)
+	})
+
+	It("should be possible to manually create MeshService on Universal", func() {
+		// when
+		Expect(YamlUniversal(fmt.Sprintf(`
+type: MeshService
+name: manually-created-ms
+mesh: %s
+labels:
+  kuma.io/origin: zone
+spec:
+  selector:
+    dataplaneTags:
+      kuma.io/service: manually-created-ms
+  ports:
+  - port: 80
+    targetPort: 80
+    appProtocol: http
+`, meshName))(multizone.UniZone1)).To(Succeed())
+
+		// then
+		hasMeshServices(
+			hash.HashedName(meshName, "demo-client", Kuma1, namespace),
+			hash.HashedName(meshName, "test-server", Kuma1, namespace),
+			hash.HashedName(meshName, "test-server", Kuma4),
+			hash.HashedName(meshName, "manually-created-ms", Kuma4),
+		)
+	})
+
+	It("should delete automatically created MeshServices when the mode is 'Disabled'", func() {
+		// when mode is 'Disabled'
+		Expect(MTLSMeshWithMeshServicesUniversal(meshName, "Disabled")(multizone.Global)).To(Succeed())
+
+		// then
+		hasMeshServices(
+			hash.HashedName(meshName, "manually-created-ms", Kuma4),
+		)
+	})
+}
diff --git a/test/e2e_env/multizone/meshtimeout/meshtimeout.go b/test/e2e_env/multizone/meshtimeout/meshtimeout.go
index dd9f6d0b4..5a67248f7 100644
--- a/test/e2e_env/multizone/meshtimeout/meshtimeout.go
+++ b/test/e2e_env/multizone/meshtimeout/meshtimeout.go
@@ -7,9 +7,11 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	meshhttproute_api "github.com/kumahq/kuma/pkg/plugins/policies/meshhttproute/api/v1alpha1"
 	meshretry_api "github.com/kumahq/kuma/pkg/plugins/policies/meshretry/api/v1alpha1"
 	meshtimeout_api "github.com/kumahq/kuma/pkg/plugins/policies/meshtimeout/api/v1alpha1"
+	"github.com/kumahq/kuma/pkg/test/resources/builders"
 	. "github.com/kumahq/kuma/test/framework"
 	framework_client "github.com/kumahq/kuma/test/framework/client"
 	"github.com/kumahq/kuma/test/framework/deployments/testserver"
@@ -23,7 +25,14 @@ func MeshTimeout() {
 	BeforeAll(func() {
 		// Global
 		Expect(NewClusterSetup().
-			Install(MTLSMeshUniversal(mesh)).
+			Install(
+				Yaml(
+					builders.Mesh().
+						WithName(mesh).
+						WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1").
+						WithMeshServicesEnabled(mesh_proto.Mesh_MeshServices_Everywhere),
+				),
+			).
 			Install(MeshTrafficPermissionAllowAllUniversal(mesh)).
 			Install(YamlUniversal(fmt.Sprintf(`
 type: MeshMultiZoneService
@@ -59,29 +68,6 @@ spec:
 			Setup(multizone.KubeZone1),
 		).To(Succeed())
 
-		kubeServiceYAML := fmt.Sprintf(`
-apiVersion: kuma.io/v1alpha1
-kind: MeshService
-metadata:
-  name: test-server
-  namespace: %s
-  labels:
-    kuma.io/origin: zone
-    kuma.io/mesh: %s
-    kuma.io/managed-by: k8s-controller
-    k8s.kuma.io/is-headless-service: "false"
-spec:
-  selector:
-    dataplaneTags:
-      app: test-server
-      k8s.kuma.io/namespace: %s
-  ports:
-  - port: 80
-    name: main
-    targetPort: main
-    appProtocol: http
-`, k8sZoneNamespace, mesh, k8sZoneNamespace)
-
 		Expect(NewClusterSetup().
 			Install(NamespaceWithSidecarInjection(k8sZoneNamespace)).
 			Install(testserver.Install(
@@ -90,7 +76,6 @@ spec:
 				testserver.WithNamespace(k8sZoneNamespace),
 				testserver.WithEchoArgs("echo", "--instance", "kube-test-server-2"),
 			)).
-			Install(YamlK8s(kubeServiceYAML)).
 			Setup(multizone.KubeZone2),
 		).To(Succeed())
 
diff --git a/test/e2e_env/multizone/multizone_suite_test.go b/test/e2e_env/multizone/multizone_suite_test.go
index 5040a277d..e727d4aa1 100644
--- a/test/e2e_env/multizone/multizone_suite_test.go
+++ b/test/e2e_env/multizone/multizone_suite_test.go
@@ -77,6 +77,7 @@ var (
 	_ = Describe("Defaults", defaults.Defaults, Ordered)
 	_ = Describe("MeshService Sync", meshservice.Sync, Ordered)
 	_ = Describe("MeshService Connectivity", meshservice.Connectivity, Ordered)
+	_ = Describe("MeshService Migration", meshservice.Migration, Ordered)
 	_ = Describe("Targeting real MeshService in policies", meshservice.MeshServiceTargeting, Ordered)
 	_ = Describe("MeshMultiZoneService Connectivity", meshmultizoneservice.Connectivity, Ordered)
 	_ = Describe("MeshMultiZoneService MeshLbStrategy", localityawarelb.MeshMzService, Ordered)
diff --git a/test/e2e_env/multizone/reachablebackends/reachablebackends.go b/test/e2e_env/multizone/reachablebackends/reachablebackends.go
index 15a87c106..8f804a250 100644
--- a/test/e2e_env/multizone/reachablebackends/reachablebackends.go
+++ b/test/e2e_env/multizone/reachablebackends/reachablebackends.go
@@ -6,6 +6,8 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	"github.com/kumahq/kuma/pkg/test/resources/builders"
 	. "github.com/kumahq/kuma/test/framework"
 	"github.com/kumahq/kuma/test/framework/client"
 	"github.com/kumahq/kuma/test/framework/deployments/testserver"
@@ -107,27 +109,19 @@ spec:
         k8s.kuma.io/namespace: %s
 `, meshName, namespace)
 
-	meshWithEgress := fmt.Sprintf(`
-type: Mesh
-name: "%s"
-meshServices:
-  mode: Everywhere
-mtls:
-  enabledBackend: ca-1
-  backends:
-  - name: ca-1
-    type: builtin
-networking:
-  outbound:
-    passthrough: false
-routing:
-  zoneEgress: true
-`, meshName)
-
 	BeforeAll(func() {
 		// Global
 		err := NewClusterSetup().
-			Install(YamlUniversal(meshWithEgress)).
+			Install(
+				Yaml(
+					builders.Mesh().
+						WithName(meshName).
+						WithMeshServicesEnabled(mesh_proto.Mesh_MeshServices_Everywhere).
+						WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1").
+						WithEgressRoutingEnabled().
+						WithoutPassthrough(),
+				),
+			).
 			Install(MeshTrafficPermissionAllowAllUniversal(meshName)).
 			Install(YamlUniversal(mmzs)).
 			Install(YamlUniversal(mmzsNotAccessible)).
@@ -185,50 +179,6 @@ routing:
 		Expect(err).ToNot(HaveOccurred())
 
 		// Zone Kube2
-		kubeServiceYAML := fmt.Sprintf(`
-apiVersion: kuma.io/v1alpha1
-kind: MeshService
-metadata:
-  name: other-zone-test-server
-  namespace: %s
-  labels:
-    kuma.io/origin: zone
-    kuma.io/mesh: %s
-    kuma.io/managed-by: k8s-controller
-    k8s.kuma.io/is-headless-service: "false"
-spec:
-  selector:
-    dataplaneTags:
-      app: other-zone-test-server
-      k8s.kuma.io/namespace: %s
-  ports:
-  - port: 80
-    name: main
-    targetPort: main
-    appProtocol: http
-`, namespace, meshName, namespace)
-		kubeServiceNotAccessibleYAML := fmt.Sprintf(`
-apiVersion: kuma.io/v1alpha1
-kind: MeshService
-metadata:
-  name: other-zone-not-accessible
-  namespace: %s
-  labels:
-    kuma.io/origin: zone
-    kuma.io/mesh: %s
-    kuma.io/managed-by: k8s-controller
-    k8s.kuma.io/is-headless-service: "false"
-spec:
-  selector:
-    dataplaneTags:
-      app: other-zone-not-accessible
-      k8s.kuma.io/namespace: %s
-  ports:
-  - port: 80
-    name: main
-    targetPort: main
-    appProtocol: http
-`, namespace, meshName, namespace)
 		err = NewClusterSetup().
 			Install(NamespaceWithSidecarInjection(namespace)).
 			Install(testserver.Install(
@@ -243,8 +193,6 @@ spec:
 				testserver.WithMesh(meshName),
 				testserver.WithEchoArgs("echo", "--instance", "other-zone-not-accessible"),
 			)).
-			Install(YamlK8s(kubeServiceYAML)).
-			Install(YamlK8s(kubeServiceNotAccessibleYAML)).
 			Setup(multizone.KubeZone2)
 		Expect(err).ToNot(HaveOccurred())
 	})
diff --git a/test/framework/deployments/democlient/kubernetes.go b/test/framework/deployments/democlient/kubernetes.go
index 8d4bce381..d148a82fb 100644
--- a/test/framework/deployments/democlient/kubernetes.go
+++ b/test/framework/deployments/democlient/kubernetes.go
@@ -43,7 +43,7 @@ func (k *k8SDeployment) deployment() *appsv1.Deployment {
 func (k *k8SDeployment) podSpec() corev1.PodTemplateSpec {
 	return corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels:      map[string]string{"app": k.Name()},
+			Labels:      map[string]string{"app": k.Name(), "kuma.io/mesh": k.opts.Mesh},
 			Annotations: k.getAnnotations(),
 		},
 		Spec: corev1.PodSpec{
@@ -97,7 +97,6 @@ func (k *k8SDeployment) service() *corev1.Service {
 
 func (k *k8SDeployment) getAnnotations() map[string]string {
 	annotations := make(map[string]string)
-	annotations["kuma.io/mesh"] = k.opts.Mesh
 	for key, value := range k.opts.PodAnnotations {
 		annotations[key] = value
 	}
diff --git a/test/framework/deployments/testserver/kubernetes.go b/test/framework/deployments/testserver/kubernetes.go
index dca30f1bf..ae514b14f 100644
--- a/test/framework/deployments/testserver/kubernetes.go
+++ b/test/framework/deployments/testserver/kubernetes.go
@@ -258,7 +258,6 @@ func (k *k8SDeployment) podSpec() corev1.PodTemplateSpec {
 
 func (k *k8SDeployment) getAnnotations() map[string]string {
 	annotations := make(map[string]string)
-	annotations["kuma.io/mesh"] = k.opts.Mesh
 	for key, value := range k.opts.PodAnnotations {
 		annotations[key] = value
 	}
@@ -268,6 +267,7 @@ func (k *k8SDeployment) getAnnotations() map[string]string {
 func (k *k8SDeployment) getLabels() map[string]string {
 	labels := make(map[string]string)
 	labels["app"] = k.Name()
+	labels["kuma.io/mesh"] = k.opts.Mesh
 	for key, value := range k.opts.PodLabels {
 		labels[key] = value
 	}
diff --git a/test/framework/setup.go b/test/framework/setup.go
index 4ed3b2702..ba76613af 100644
--- a/test/framework/setup.go
+++ b/test/framework/setup.go
@@ -506,6 +506,24 @@ func YamlUniversal(yaml string) InstallFunc {
 	}
 }
 
+type builder interface {
+	KubeYaml() string
+	UniYaml() string
+}
+
+func Yaml(b builder) InstallFunc {
+	return func(cluster Cluster) error {
+		switch c := cluster.(type) {
+		case *K8sCluster:
+			return YamlK8s(b.KubeYaml())(c)
+		case *UniversalCluster:
+			return YamlUniversal(b.UniYaml())(c)
+		default:
+			return errors.New("unknown cluster type")
+		}
+	}
+}
+
 func ResourceUniversal(resource model.Resource) InstallFunc {
 	return func(cluster Cluster) error {
 		_, err := retry.DoWithRetryE(cluster.GetTesting(), "install resource", DefaultRetries, DefaultTimeout,
@@ -712,8 +730,8 @@ func DemoClientJobK8s(namespace, mesh, destination string) InstallFunc {
 		Spec: batchv1.JobSpec{
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
-					Annotations: map[string]string{"kuma.io/mesh": mesh},
-					Labels:      map[string]string{"app": name},
+					Annotations: map[string]string{},
+					Labels:      map[string]string{"app": name, "kuma.io/mesh": mesh},
 				},
 				Spec: corev1.PodSpec{
 					Containers: []corev1.Container{