diff --git a/Makefile.e2e.mk b/Makefile.e2e.mk
index e970b089176a..46332ce4a0ad 100644
--- a/Makefile.e2e.mk
+++ b/Makefile.e2e.mk
@@ -280,8 +280,7 @@ wait/traffic-routing/docker-compose/web-to-backend-route: ## Docker Compose: Wai
 	@echo
 	@echo "Waiting until custom 'web-to-backend' TrafficRoute is applied ..."
 	@echo
-	$(call docker_compose) exec kuma-example-web sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_listeners_count,outbound,5000,kuma-example-backend{version=v2}) ) -eq 1 ]]; then echo "listener is now configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: listener has not been configured for subset routing" ; exit 1'
-	$(call docker_compose) exec kuma-example-web sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_clusters_count,kuma-example-backend{version=v2}) ) -eq 1 ]]; then echo "cluster is now configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: cluster has not been configured for subset routing" ; exit 1'
+	sleep 10 # todo(jakubdyszkiewicz) I don't want to build a logic of detecting lb split in cluster since this test will be soon rewritten to E2E Go Framework
 
 verify/traffic-routing/docker-compose/web-to-backend-route: ## Docker Compose: Make sample requests to example setup for TrafficRoute
 	@echo
@@ -300,8 +299,7 @@ wait/traffic-routing/docker-compose/no-web-to-backend-route: ## Docker Compose:
 	@echo
 	@echo "Waiting until custom 'web-to-backend' TrafficRoute is removed ..."
 	@echo
-	$(call docker_compose) exec kuma-example-web sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_listeners_count,outbound,5000,kuma-example-backend{version=v2}) ) -eq 0 ]]; then echo "listener is no longer configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: listener is still configured for subset routing" ; exit 1'
-	$(call docker_compose) exec kuma-example-web sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_clusters_count,kuma-example-backend{version=v2}) ) -eq 0 ]]; then echo "cluster is no longer configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: cluster is still configured for subset routing" ; exit 1'
+	sleep 10 # todo(jakubdyszkiewicz) I don't want to build a logic of detecting lb split in cluster since this test will be soon rewritten to E2E Go Framework
 
 #
 # Minikube setup
@@ -449,8 +447,7 @@ wait/traffic-routing/minikube/web-to-backend-route: ## Minikube: Wait until cust
 	@echo
 	@echo "Waiting until custom 'web-to-backend' TrafficRoute is applied ..."
 	@echo
-	$(call kubectl_exec,kuma-example,kuma-example-web,kuma-example-web) sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_listeners_count,outbound,7070,kuma-example-backend.kuma-example.svc:7070{version=v2}) ) -eq 1 ]]; then echo "listener is now configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: listener has not been configured for subset routing" ; exit 1'
-	$(call kubectl_exec,kuma-example,kuma-example-web,kuma-example-web) sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_clusters_count,kuma-example-backend.kuma-example.svc:7070{version=v2}) ) -eq 1 ]]; then echo "cluster is now configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: cluster has not been configured for subset routing" ; exit 1'
+	sleep 10 # todo(jakubdyszkiewicz) I don't want to build a logic of detecting lb split in cluster since this test will be soon rewritten to E2E Go Framework
 
 verify/traffic-routing/minikube/web-to-backend-route: ## Minikube: Make sample requests to example setup for TrafficRoute
 	@echo
@@ -469,8 +466,7 @@ wait/traffic-routing/minikube/no-web-to-backend-route: ## Minikube: Wait until c
 	@echo
 	@echo "Waiting until custom 'web-to-backend' TrafficRoute is removed ..."
 	@echo
-	$(call kubectl_exec,kuma-example,kuma-example-web,kuma-example-web) sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_listeners_count,outbound,7070,kuma-example-backend.kuma-example.svc:7070{version=v2}) ) -eq 0 ]]; then echo "listener is no longer configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: listener is still configured for subset routing" ; exit 1'
-	$(call kubectl_exec,kuma-example,kuma-example-web,kuma-example-web) sh -c 'for i in `seq 1 10`; do echo -n "try #$$i: " ; if [[ $$( $(call envoy_active_routing_clusters_count,kuma-example-backend.kuma-example.svc:7070{version=v2}) ) -eq 0 ]]; then echo "cluster is no longer configured for subset routing "; exit 0; fi; sleep 1; done; echo -e "\nError: cluster is still configured for subset routing" ; exit 1'
+	sleep 10 # todo(jakubdyszkiewicz) I don't want to build a logic of detecting lb split in cluster since this test will be soon rewritten to E2E Go Framework
 
 undeploy/traffic-routing/minikube: ## Minikube: Undeploy example setup for TrafficRoute
 	@echo
diff --git a/api/go.sum b/api/go.sum
index b5d2abbca342..42159b37bf44 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -1,23 +1,36 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533 h1:8wZizuKuZVu5COB7EsBYxBQz8nRcXXn5d4Gt91eJLvU=
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.5 h1:lRJIqDD8yjV1YyPRqecMdytjDLs2fTXq363aCib5xPU=
 github.com/envoyproxy/go-control-plane v0.9.5/go.mod h1:OXl5to++W0ctG+EHWTFUjiypVxC/Y4VLc/KFU+al13s=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.3.0-java.0.20200311152155-ab56c3dd1cf9 h1:mU3oOAYTK9ZRKMj//H1EWk1vWbkYeWKBPYKMnIwcs/A=
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java.0.20200311152155-ab56c3dd1cf9/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94=
 github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -30,6 +43,7 @@ golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859 h1:R/3boaszxrf1GEUWTVDzSKVwLmSJpwZ1yqXm8j0v2QI=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -38,7 +52,9 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0 h1:HyfiK1WMnHj5FXFXatD+Qs1A/xC2Run6RzeW1SyHxpc=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -47,14 +63,20 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1 h1:wdKvqQk7IttEw92GoRyKG2IDrUIpgpj6H6m81yfeMW0=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/api/mesh/v1alpha1/dataplane.pb.go b/api/mesh/v1alpha1/dataplane.pb.go
index a677fd03e310..bb9275cc07ee 100644
--- a/api/mesh/v1alpha1/dataplane.pb.go
+++ b/api/mesh/v1alpha1/dataplane.pb.go
@@ -359,11 +359,14 @@ type Dataplane_Networking_Outbound struct {
 	Address string `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
 	// Port on which the service will be available to this dataplane.
 	Port uint32 `protobuf:"varint,4,opt,name=port,proto3" json:"port,omitempty"`
+	// DEPRECATED: use networking.outbound[].tags
 	// Service name.
-	Service              string   `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
+	// Tags
+	Tags                 map[string]string `protobuf:"bytes,5,rep,name=tags,proto3" json:"tags,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+	XXX_unrecognized     []byte            `json:"-"`
+	XXX_sizecache        int32             `json:"-"`
 }
 
 func (m *Dataplane_Networking_Outbound) Reset()         { *m = Dataplane_Networking_Outbound{} }
@@ -419,6 +422,13 @@ func (m *Dataplane_Networking_Outbound) GetService() string {
 	return ""
 }
 
+func (m *Dataplane_Networking_Outbound) GetTags() map[string]string {
+	if m != nil {
+		return m.Tags
+	}
+	return nil
+}
+
 // Gateway describes a service that ingress should not be proxied.
 type Dataplane_Networking_Gateway struct {
 	// Tags associated with a gateway (e.g., Kong, Contour, etc) this
@@ -523,6 +533,7 @@ func init() {
 	proto.RegisterType((*Dataplane_Networking_Inbound)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.Inbound")
 	proto.RegisterMapType((map[string]string)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.Inbound.TagsEntry")
 	proto.RegisterType((*Dataplane_Networking_Outbound)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.Outbound")
+	proto.RegisterMapType((map[string]string)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.Outbound.TagsEntry")
 	proto.RegisterType((*Dataplane_Networking_Gateway)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.Gateway")
 	proto.RegisterMapType((map[string]string)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.Gateway.TagsEntry")
 	proto.RegisterType((*Dataplane_Networking_TransparentProxying)(nil), "kuma.mesh.v1alpha1.Dataplane.Networking.TransparentProxying")
@@ -531,43 +542,44 @@ func init() {
 func init() { proto.RegisterFile("mesh/v1alpha1/dataplane.proto", fileDescriptor_7608682fd5ea84a4) }
 
 var fileDescriptor_7608682fd5ea84a4 = []byte{
-	// 606 bytes of a gzipped FileDescriptorProto
+	// 623 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x95, 0xcd, 0x6e, 0xd3, 0x40,
-	0x10, 0xc7, 0x65, 0xc7, 0xad, 0xe3, 0x69, 0x23, 0x95, 0x6d, 0x04, 0x96, 0x01, 0x29, 0xf4, 0x14,
-	0x71, 0x70, 0x08, 0x20, 0x81, 0xaa, 0x5e, 0x62, 0x81, 0xf8, 0x52, 0xa1, 0x5a, 0x7a, 0x40, 0x5c,
-	0xa2, 0x8d, 0xbd, 0x24, 0x56, 0x1c, 0xdb, 0x5a, 0x6f, 0x52, 0x22, 0xde, 0x80, 0x47, 0xa8, 0x78,
-	0x01, 0x24, 0x0e, 0x3c, 0x5f, 0x2e, 0x45, 0xde, 0x8f, 0x24, 0x6d, 0x2a, 0x48, 0x54, 0x71, 0x5b,
-	0xef, 0xcc, 0xff, 0x37, 0xbb, 0xff, 0x9d, 0x91, 0xe1, 0xfe, 0x88, 0x16, 0x83, 0xd6, 0xa4, 0x4d,
-	0x92, 0x7c, 0x40, 0xda, 0xad, 0x88, 0x70, 0x92, 0x27, 0x24, 0xa5, 0x7e, 0xce, 0x32, 0x9e, 0x21,
-	0x34, 0x1c, 0x8f, 0x88, 0x5f, 0xe6, 0xf8, 0x3a, 0xc7, 0xbb, 0x7b, 0x59, 0x32, 0xa2, 0x9c, 0xc5,
-	0x61, 0x21, 0x05, 0xde, 0x9d, 0x09, 0x49, 0xe2, 0x88, 0x70, 0xda, 0xd2, 0x0b, 0x19, 0x38, 0xf8,
-	0xbd, 0x0b, 0xce, 0x0b, 0x4d, 0x47, 0xaf, 0x01, 0x52, 0xca, 0xcf, 0x32, 0x36, 0x8c, 0xd3, 0xbe,
-	0x6b, 0x34, 0x8c, 0xe6, 0xce, 0xe3, 0xa6, 0xbf, 0x5a, 0xcc, 0x9f, 0x4b, 0xfc, 0xf7, 0xf3, 0x7c,
-	0xbc, 0xa4, 0x45, 0x47, 0x60, 0xab, 0x13, 0xb8, 0xa6, 0xc0, 0x1c, 0x5c, 0x87, 0x39, 0x96, 0x29,
-	0x01, 0x09, 0x87, 0x34, 0x8d, 0xb0, 0x96, 0x78, 0xe7, 0x3b, 0x00, 0x0b, 0x30, 0x7a, 0x0b, 0x76,
-	0x9c, 0xf6, 0x19, 0x2d, 0x0a, 0x77, 0x5b, 0xc0, 0x1e, 0xad, 0x7b, 0x26, 0xff, 0x8d, 0xd4, 0x61,
-	0x0d, 0x40, 0x2e, 0xd8, 0x24, 0x8a, 0x04, 0x6b, 0xab, 0x61, 0x34, 0x1d, 0xac, 0x3f, 0xcb, 0x2a,
-	0x7d, 0xc2, 0xe9, 0x19, 0x99, 0xba, 0x95, 0x0d, 0xab, 0xbc, 0x92, 0x3a, 0xac, 0x01, 0xf2, 0xc4,
-	0xbd, 0x6c, 0x9c, 0x46, 0xae, 0xd1, 0xa8, 0x6c, 0x78, 0x62, 0xa1, 0xc3, 0x1a, 0x80, 0x8e, 0xa1,
-	0x9a, 0x8d, 0xb9, 0x84, 0x99, 0x02, 0xd6, 0x5e, 0x1b, 0xf6, 0x41, 0x09, 0xf1, 0x1c, 0x81, 0x32,
-	0xa8, 0x73, 0x46, 0xd2, 0x22, 0x27, 0x8c, 0xa6, 0xbc, 0x9b, 0xb3, 0xec, 0xeb, 0xb4, 0x7c, 0x6d,
-	0x4b, 0xdc, 0xf9, 0x68, 0x6d, 0xf4, 0xe9, 0x02, 0x72, 0xa2, 0x18, 0x78, 0x9f, 0xaf, 0x6e, 0x7a,
-	0x3f, 0x4d, 0xb0, 0xd5, 0x33, 0xa0, 0x0c, 0x6e, 0x91, 0x09, 0x89, 0x13, 0xd2, 0x4b, 0xe8, 0x47,
-	0xca, 0x26, 0x71, 0x48, 0x0b, 0xe5, 0x50, 0x67, 0xd3, 0x37, 0xf5, 0x3b, 0x57, 0x48, 0x78, 0x95,
-	0xed, 0xfd, 0x32, 0x60, 0xef, 0x6a, 0x1e, 0xea, 0x82, 0xc5, 0x49, 0x5f, 0x17, 0x7e, 0x77, 0xe3,
-	0xc2, 0xfe, 0x29, 0xe9, 0x17, 0x2f, 0x53, 0xce, 0xa6, 0x58, 0x80, 0xbd, 0x67, 0xe0, 0xcc, 0xb7,
-	0xd0, 0x1e, 0x54, 0x86, 0x74, 0x2a, 0xa6, 0xc9, 0xc1, 0xe5, 0x12, 0xd5, 0x61, 0x6b, 0x42, 0x92,
-	0x31, 0x15, 0xa3, 0xe1, 0x60, 0xf9, 0x71, 0x68, 0x3e, 0x37, 0xbc, 0xef, 0xc2, 0x2b, 0xf9, 0x50,
-	0xf7, 0xc0, 0x89, 0x53, 0x4e, 0xd9, 0x17, 0x12, 0x52, 0xa5, 0x5e, 0x6c, 0x20, 0x04, 0x56, 0x9e,
-	0x31, 0x2e, 0x5a, 0xb5, 0x86, 0xc5, 0x1a, 0x35, 0x60, 0xa7, 0x90, 0x27, 0x3a, 0x29, 0x43, 0x96,
-	0x08, 0x2d, 0x6f, 0xfd, 0xa5, 0xfb, 0x3f, 0x29, 0x4f, 0x64, 0x87, 0x1d, 0x6e, 0xda, 0xae, 0x0b,
-	0x0b, 0x82, 0xea, 0x2c, 0xd8, 0x3a, 0x37, 0xcc, 0xaa, 0x71, 0x53, 0x33, 0xa6, 0x50, 0xd5, 0xfd,
-	0xfb, 0x0f, 0x33, 0x96, 0xae, 0x55, 0xb9, 0x7c, 0x2d, 0x6d, 0x93, 0xb5, 0x64, 0xd3, 0x03, 0xb0,
-	0x95, 0x27, 0xb2, 0x66, 0x60, 0xcf, 0x02, 0x8b, 0x99, 0x03, 0x03, 0xeb, 0x7d, 0xef, 0x87, 0x01,
-	0xb6, 0x1a, 0xea, 0xb9, 0x33, 0xc6, 0x86, 0xce, 0x28, 0xfd, 0xff, 0x70, 0xe6, 0x1b, 0xec, 0x5f,
-	0x33, 0x7e, 0xc8, 0x87, 0x1a, 0xa3, 0x51, 0xcc, 0x68, 0xc8, 0xbb, 0xe2, 0xd6, 0x25, 0xac, 0x16,
-	0x38, 0xb3, 0x60, 0xfb, 0xa1, 0xe5, 0x5e, 0x5c, 0x54, 0xf0, 0xae, 0x8e, 0x8b, 0x6e, 0x78, 0x0a,
-	0xb7, 0x55, 0x36, 0x09, 0x43, 0x5a, 0x14, 0xdd, 0x42, 0x8f, 0x64, 0xd9, 0x05, 0x0e, 0xae, 0xcb,
-	0x68, 0x47, 0x04, 0xf5, 0x48, 0x05, 0xf0, 0xb9, 0xaa, 0x2f, 0xde, 0xdb, 0x16, 0x7f, 0x91, 0x27,
-	0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x8d, 0x74, 0x75, 0x9c, 0xb0, 0x06, 0x00, 0x00,
+	0x10, 0xc7, 0x65, 0xc7, 0xa9, 0xe3, 0x69, 0x23, 0x95, 0x6d, 0x05, 0x96, 0x01, 0x29, 0xf4, 0x54,
+	0x71, 0x70, 0x29, 0x20, 0x81, 0x4a, 0x2f, 0xb5, 0x40, 0x7c, 0xa9, 0xb4, 0x5a, 0x7a, 0x40, 0x5c,
+	0xa2, 0x8d, 0xbd, 0x24, 0x56, 0x1c, 0xdb, 0x5a, 0x6f, 0x52, 0x22, 0x8e, 0xdc, 0x78, 0x04, 0xc4,
+	0x95, 0x03, 0x12, 0x6f, 0xc0, 0x9b, 0xe5, 0x52, 0xe4, 0xfd, 0x48, 0xd2, 0xa6, 0x82, 0x58, 0x85,
+	0x9b, 0xb3, 0x33, 0xff, 0xdf, 0xec, 0xfe, 0x67, 0x76, 0x03, 0xb7, 0x07, 0xb4, 0xe8, 0xed, 0x8c,
+	0x76, 0x49, 0x92, 0xf7, 0xc8, 0xee, 0x4e, 0x44, 0x38, 0xc9, 0x13, 0x92, 0x52, 0x3f, 0x67, 0x19,
+	0xcf, 0x10, 0xea, 0x0f, 0x07, 0xc4, 0x2f, 0x73, 0x7c, 0x9d, 0xe3, 0xdd, 0x3c, 0x2f, 0x19, 0x50,
+	0xce, 0xe2, 0xb0, 0x90, 0x02, 0xef, 0xc6, 0x88, 0x24, 0x71, 0x44, 0x38, 0xdd, 0xd1, 0x1f, 0x32,
+	0xb0, 0xf5, 0xab, 0x09, 0xce, 0x53, 0x4d, 0x47, 0x2f, 0x00, 0x52, 0xca, 0x4f, 0x33, 0xd6, 0x8f,
+	0xd3, 0xae, 0x6b, 0xb4, 0x8c, 0xed, 0xd5, 0xfb, 0xdb, 0xfe, 0x62, 0x31, 0x7f, 0x2a, 0xf1, 0xdf,
+	0x4c, 0xf3, 0xf1, 0x9c, 0x16, 0xed, 0x83, 0xad, 0x76, 0xe0, 0x9a, 0x02, 0xb3, 0x75, 0x19, 0xe6,
+	0x50, 0xa6, 0x04, 0x24, 0xec, 0xd3, 0x34, 0xc2, 0x5a, 0xe2, 0x7d, 0x5f, 0x03, 0x98, 0x81, 0xd1,
+	0x2b, 0xb0, 0xe3, 0xb4, 0xcb, 0x68, 0x51, 0xb8, 0x2b, 0x02, 0x76, 0x6f, 0xd9, 0x3d, 0xf9, 0x2f,
+	0xa5, 0x0e, 0x6b, 0x00, 0x72, 0xc1, 0x26, 0x51, 0x24, 0x58, 0xf5, 0x96, 0xb1, 0xed, 0x60, 0xfd,
+	0xb3, 0xac, 0xd2, 0x25, 0x9c, 0x9e, 0x92, 0xb1, 0x5b, 0xab, 0x58, 0xe5, 0xb9, 0xd4, 0x61, 0x0d,
+	0x90, 0x3b, 0xee, 0x64, 0xc3, 0x34, 0x72, 0x8d, 0x56, 0xad, 0xe2, 0x8e, 0x85, 0x0e, 0x6b, 0x00,
+	0x3a, 0x84, 0x46, 0x36, 0xe4, 0x12, 0x66, 0x0a, 0xd8, 0xee, 0xd2, 0xb0, 0x23, 0x25, 0xc4, 0x53,
+	0x04, 0xca, 0x60, 0x93, 0x33, 0x92, 0x16, 0x39, 0x61, 0x34, 0xe5, 0xed, 0x9c, 0x65, 0x1f, 0xc7,
+	0x65, 0xb7, 0x2d, 0x71, 0xe6, 0xfd, 0xa5, 0xd1, 0x27, 0x33, 0xc8, 0xb1, 0x62, 0xe0, 0x0d, 0xbe,
+	0xb8, 0xe8, 0xfd, 0x30, 0xc1, 0x56, 0x6d, 0x40, 0x19, 0x5c, 0x23, 0x23, 0x12, 0x27, 0xa4, 0x93,
+	0xd0, 0xb7, 0x94, 0x8d, 0xe2, 0x90, 0x16, 0xca, 0xa1, 0x83, 0xaa, 0x3d, 0xf5, 0x0f, 0x2e, 0x90,
+	0xf0, 0x22, 0xdb, 0xfb, 0x69, 0xc0, 0xfa, 0xc5, 0x3c, 0xd4, 0x06, 0x8b, 0x93, 0xae, 0x2e, 0xfc,
+	0xfa, 0xca, 0x85, 0xfd, 0x13, 0xd2, 0x2d, 0x9e, 0xa5, 0x9c, 0x8d, 0xb1, 0x00, 0x7b, 0x8f, 0xc0,
+	0x99, 0x2e, 0xa1, 0x75, 0xa8, 0xf5, 0xe9, 0x58, 0xdc, 0x26, 0x07, 0x97, 0x9f, 0x68, 0x13, 0xea,
+	0x23, 0x92, 0x0c, 0xa9, 0xb8, 0x1a, 0x0e, 0x96, 0x3f, 0xf6, 0xcc, 0xc7, 0x86, 0xf7, 0x45, 0x78,
+	0x25, 0x1b, 0x75, 0x0b, 0x9c, 0x38, 0xe5, 0x94, 0x7d, 0x20, 0x21, 0x55, 0xea, 0xd9, 0x02, 0x42,
+	0x60, 0xe5, 0x19, 0xe3, 0x62, 0x54, 0x9b, 0x58, 0x7c, 0xa3, 0x16, 0xac, 0x16, 0x72, 0x47, 0xc7,
+	0x65, 0xc8, 0x12, 0xa1, 0xf9, 0xa5, 0x3f, 0x4c, 0xff, 0x3b, 0xe5, 0x89, 0x9c, 0xb0, 0xbd, 0xaa,
+	0xe3, 0x3a, 0xb3, 0x20, 0x68, 0x4c, 0x82, 0xfa, 0x57, 0xc3, 0x6c, 0x18, 0x57, 0x35, 0xe3, 0xb3,
+	0x09, 0x0d, 0x3d, 0xc0, 0x7f, 0x71, 0x63, 0xee, 0x5c, 0xb5, 0xf3, 0xe7, 0xd2, 0x3e, 0x59, 0x73,
+	0x3e, 0xdd, 0x01, 0x5b, 0x99, 0x22, 0x8b, 0x06, 0xf6, 0x24, 0xb0, 0x98, 0xd9, 0x33, 0xb0, 0x5e,
+	0x47, 0x47, 0xca, 0x8e, 0xba, 0xb0, 0xe3, 0x49, 0xe5, 0x0b, 0xf7, 0xef, 0x46, 0xe2, 0x9b, 0x01,
+	0xb6, 0x7a, 0x5f, 0xa6, 0x4d, 0x32, 0x2a, 0x36, 0x49, 0xe9, 0xff, 0x47, 0x93, 0x3e, 0xc1, 0xc6,
+	0x25, 0x2f, 0x01, 0xf2, 0xa1, 0xc9, 0x68, 0x14, 0x33, 0x1a, 0xf2, 0xb6, 0xf0, 0xbf, 0x84, 0x35,
+	0x03, 0x67, 0x12, 0xac, 0xdc, 0xb5, 0xdc, 0xb3, 0xb3, 0x1a, 0x5e, 0xd3, 0x71, 0x31, 0x98, 0x0f,
+	0xe1, 0xba, 0xca, 0x26, 0x61, 0x48, 0x8b, 0xa2, 0x5d, 0xe8, 0xd7, 0xa1, 0x1c, 0x48, 0x07, 0x6f,
+	0xca, 0xe8, 0x81, 0x08, 0xea, 0xdb, 0x1d, 0xc0, 0xfb, 0x86, 0x3e, 0x78, 0x67, 0x45, 0xfc, 0xa1,
+	0x3d, 0xf8, 0x1d, 0x00, 0x00, 0xff, 0xff, 0x4c, 0xcf, 0x2b, 0x37, 0x3b, 0x07, 0x00, 0x00,
 }
diff --git a/api/mesh/v1alpha1/dataplane.pb.validate.go b/api/mesh/v1alpha1/dataplane.pb.validate.go
index b45cf5e08453..ffcbb642a2de 100644
--- a/api/mesh/v1alpha1/dataplane.pb.validate.go
+++ b/api/mesh/v1alpha1/dataplane.pb.validate.go
@@ -437,6 +437,8 @@ func (m *Dataplane_Networking_Outbound) Validate() error {
 		}
 	}
 
+	// no validation rules for Tags
+
 	return nil
 }
 
diff --git a/api/mesh/v1alpha1/dataplane.proto b/api/mesh/v1alpha1/dataplane.proto
index 3b5c3f4f75e2..501293d16e35 100644
--- a/api/mesh/v1alpha1/dataplane.proto
+++ b/api/mesh/v1alpha1/dataplane.proto
@@ -87,8 +87,12 @@ message Dataplane {
       // Port on which the service will be available to this dataplane.
       uint32 port = 4;
 
+      // DEPRECATED: use networking.outbound[].tags
       // Service name.
       string service = 2 [ (validate.rules).string.hostname = true ];
+
+      // Tags
+      map<string, string> tags = 5;
     }
 
     // Gateway describes a service that ingress should not be proxied.
diff --git a/api/mesh/v1alpha1/dataplane_helpers.go b/api/mesh/v1alpha1/dataplane_helpers.go
index d505640ca869..1a40dd036dd6 100644
--- a/api/mesh/v1alpha1/dataplane_helpers.go
+++ b/api/mesh/v1alpha1/dataplane_helpers.go
@@ -134,27 +134,31 @@ func (n *Dataplane_Networking) GetOutboundInterfaces() ([]OutboundInterface, err
 	}
 	ofaces := make([]OutboundInterface, len(n.Outbound))
 	for i, outbound := range n.Outbound {
-		if outbound.Interface != "" { // legacy format
-			oface, err := ParseOutboundInterface(outbound.Interface)
-			if err != nil {
-				return nil, err
-			}
-			ofaces[i] = oface
-		} else {
-			oface := OutboundInterface{
-				DataplanePort: outbound.Port,
-			}
-			if outbound.Address != "" {
-				oface.DataplaneIP = outbound.Address
-			} else {
-				oface.DataplaneIP = "127.0.0.1"
-			}
-			ofaces[i] = oface
+		oface, err := n.ToOutboundInterface(outbound)
+		if err != nil {
+			return nil, err
 		}
+		ofaces[i] = oface
 	}
 	return ofaces, nil
 }
 
+func (n *Dataplane_Networking) ToOutboundInterface(outbound *Dataplane_Networking_Outbound) (OutboundInterface, error) {
+	if outbound.Interface != "" { // legacy format
+		return ParseOutboundInterface(outbound.Interface)
+	} else {
+		oface := OutboundInterface{
+			DataplanePort: outbound.Port,
+		}
+		if outbound.Address != "" {
+			oface.DataplaneIP = outbound.Address
+		} else {
+			oface.DataplaneIP = "127.0.0.1"
+		}
+		return oface, nil
+	}
+}
+
 func ParsePort(text string) (uint32, error) {
 	port, err := strconv.ParseUint(text, 10, 32)
 	if err != nil {
@@ -273,8 +277,18 @@ func (d *Dataplane_Networking_Inbound) MatchTags(selector TagSelector) bool {
 }
 
 func (d *Dataplane_Networking_Outbound) MatchTags(selector TagSelector) bool {
-	service := selector[ServiceTag]
-	return service == MatchAllTag || service == d.Service
+	return selector.Matches(d.GetTagsIncludingLegacy())
+}
+
+// GetTagsIncludingLegacy returns tags but taking on account old legacy format of "service" field in outbound
+// Remove it and migrate to GetTags() once "service" field is removed.
+func (d *Dataplane_Networking_Outbound) GetTagsIncludingLegacy() map[string]string {
+	if d.Tags == nil {
+		return map[string]string{
+			ServiceTag: d.Service,
+		}
+	}
+	return d.Tags
 }
 
 const MatchAllTag = "*"
diff --git a/go.sum b/go.sum
index ab958b9ddc66..a9e8350c3cda 100644
--- a/go.sum
+++ b/go.sum
@@ -18,6 +18,7 @@ github.com/Azure/azure-sdk-for-go v30.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9mo
 github.com/Azure/azure-sdk-for-go v35.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v38.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v38.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
 github.com/Azure/go-autorest/autorest v0.1.0/go.mod h1:AKyIcETwSUFxIcs/Wnq/C+kwCtlEYGUVd7FPNb2slmg=
 github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
@@ -45,15 +46,20 @@ github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbt
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/ClickHouse/clickhouse-go v1.3.12/go.mod h1:EaI/sW7Azgz9UATzd5ZdZHRUhHgv5+JMS9NSr2smCJI=
+github.com/DataDog/datadog-go v3.2.0+incompatible h1:qSG2N4FghB1He/r2mFrWKCaL7dXCilEuNEeAn20fdD4=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20190405210948-c70a36b8193f/go.mod h1:aJ4qN3TfrelA6NZ6AXsXRfmEVaYin3EDbSPJrKS8OXo=
 github.com/GoogleCloudPlatform/k8s-cloud-provider v0.0.0-20190822182118-27a4ced34534/go.mod h1:iroGtC8B3tQiqtds1l+mgk/BBOrxbqjH+eUfFQYRc14=
 github.com/InVisionApp/go-health v2.1.0+incompatible/go.mod h1:/+Gv1o8JUsrjC6pi6MN6/CgKJo4OqZ6x77XAnImrzhg=
 github.com/InVisionApp/go-logger v1.0.1/go.mod h1:+cGTDSn+P8105aZkeOfIhdd7vFO5X1afUHcjvanY0L8=
+github.com/Masterminds/goutils v1.1.0 h1:zukEsf/1JZwCMgHiK3GZftabmxiCw4apj3a28RPBiVg=
 github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/sprig v2.20.0+incompatible h1:dJTKKuUkYW3RMFdQFXPU/s6hg10RgctmTjRcbZ98Ap8=
 github.com/Masterminds/sprig v2.20.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
+github.com/Microsoft/go-winio v0.4.14 h1:+hMXMk01us9KgxGb7ftKQt2Xpf5hH/yky+TDA+qxleU=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
 github.com/Nordix/simple-ipam v1.0.0 h1:oMyASgx2EEH0ccjAEBgCgCviu7z4uB+Od7UUCBxqcFE=
@@ -73,10 +79,12 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 h1:MzBOUgng9orim59UnfUTLRjMpd09C5uEVQ6RPGeCaVI=
 github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129/go.mod h1:rFgpPQZYZ8vdbc+48xibu8ALc3yeyd64IhHS+PU6Yyg=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/armon/go-metrics v0.3.2 h1:EyUnxyP2yaGpLgMiuyyz8sHnByqeTJUfGs72pdH0i4A=
 github.com/armon/go-metrics v0.3.2/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
@@ -89,6 +97,7 @@ github.com/aws/aws-sdk-go v1.28.9 h1:grIuBQc+p3dTRXerh5+2OxSuWFi0iXuxbFdTSg0jaW0
 github.com/aws/aws-sdk-go v1.28.9/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
@@ -100,8 +109,11 @@ github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
 github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
@@ -110,12 +122,14 @@ github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6D
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58/go.mod h1:EOBUe0h4xcZ5GoxqC5SDxFQ8gwyZPKQoEzownBlhI80=
+github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533 h1:8wZizuKuZVu5COB7EsBYxBQz8nRcXXn5d4Gt91eJLvU=
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c/go.mod h1:XGLbWH/ujMcbPbhZq52Nv6UrCghb1yGn//133kEsvDk=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/containerd/containerd v1.2.7/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.3.0/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.3.2 h1:ForxmXkA6tPIvffbrDAcPUIB32QgXkt2XFj+F0UxetA=
 github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
@@ -137,25 +151,32 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do
 github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denisenkom/go-mssqldb v0.0.0-20190515213511-eb9f6a1743f3/go.mod h1:zAg7JM8CkOJ43xKXIj7eRO9kmWm/TW578qo+oDO6tuM=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+github.com/dhui/dktest v0.3.1 h1:NVUdB50k8tml431Ho1hcQBNeC52Qe8oSDPAjseA67Y8=
 github.com/dhui/dktest v0.3.1/go.mod h1:cyzIUfGsBEbZ6BT7tnXqAShHSXCZhSNmFl70sZ7c1yc=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v0.0.0-20200109221225-a4f60165b7a3/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.7.0+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v0.7.3-0.20190103212154-2b7e084dc98b/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v0.7.3-0.20190817195342-4760db040282/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v1.4.2-0.20191008235115-448db5a783a0 h1:dpjboyvZZQmUDgrzdYb0U+OdU/hLnTH3kMTHdjWNkPs=
 github.com/docker/docker v1.4.2-0.20191008235115-448db5a783a0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c h1:ZfSZ3P3BedhKGUhzj7BQlPSU4OvT6tfOKe3DVHzOA7s=
@@ -175,20 +196,26 @@ github.com/elazarl/goproxy/ext v0.0.0-20190711103511-473e67f1d7d2 h1:dWB6v3RcOy0
 github.com/elazarl/goproxy/ext v0.0.0-20190711103511-473e67f1d7d2/go.mod h1:gNh8nYJoAm43RfaxurUnxr+N1PwuFV3ZMl/efxlIlY8=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.9.6+incompatible h1:tfrHha8zJ01ywiOEC1miGY8st1/igzWB8OmvPgoYX7w=
 github.com/emicklei/go-restful v2.9.6+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.5 h1:lRJIqDD8yjV1YyPRqecMdytjDLs2fTXq363aCib5xPU=
 github.com/envoyproxy/go-control-plane v0.9.5/go.mod h1:OXl5to++W0ctG+EHWTFUjiypVxC/Y4VLc/KFU+al13s=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.3.0-java.0.20200311152155-ab56c3dd1cf9 h1:mU3oOAYTK9ZRKMj//H1EWk1vWbkYeWKBPYKMnIwcs/A=
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java.0.20200311152155-ab56c3dd1cf9/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.5.0+incompatible h1:ouOWdg56aJriqS0huScTkVXPC5IcNrDCXZ6OoTAWu7M=
 github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsouza/fake-gcs-server v1.7.0/go.mod h1:5XIRs4YvwNbNoz+1JF8j6KLAyDh7RHGAyAK3EP2EsNk=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
@@ -196,10 +223,14 @@ github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 h1:skJKxRtNmevL
 github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0 h1:wDJmvq38kDhkVxi50ni9ykkdUr1PKgqKOoi01fa0Mdk=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0 h1:MP4Eh7ZCb31lleYCFuwm0oe4/YGak+5l1vA2NOE80nA=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logr/logr v0.1.0 h1:M1Tv3VzNlEHg6uyACnRdtrploV2P7wZqH8BoQMtz0cg=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-logr/zapr v0.1.0 h1:h+WVe9j6HAA01niTJPA/kKH0i7e0rLZBCwauQFcRE54=
 github.com/go-logr/zapr v0.1.0/go.mod h1:tabnROwaDl0UNxkVeFRbY8bwB37GwRv0P8lg6aAiEnk=
 github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
 github.com/go-openapi/analysis v0.0.0-20180825180245-b006789cd277/go.mod h1:k70tL6pCuVxPJOHXQ+wIac1FUrvNkHolPie/cLEU6hI=
@@ -248,6 +279,7 @@ github.com/go-openapi/validate v0.19.5/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85n
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
+github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/gocql/gocql v0.0.0-20190301043612-f6df8288f9b4/go.mod h1:4Fw1eo5iaEhDUs8XyuhSVCVy52Jq3L+/3GJgYkwc+/0=
 github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
@@ -255,12 +287,16 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang-migrate/migrate/v4 v4.8.0 h1:zcamXqBH0W8hHwpaikOGnaFTRrQWU+X8ukBeY1dYucU=
 github.com/golang-migrate/migrate/v4 v4.8.0/go.mod h1:F6bGIGAA7xSb2k17sF1+eHl2gRHa+DWNZpoIKbThPLE=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7 h1:5ZkaAPbicIKTF2I64qf5Fh8Aa83Q/dnOafMYV0OMwjA=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -268,6 +304,7 @@ github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFU
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -277,12 +314,14 @@ github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-containerregistry v0.0.0-20200110202235-f4fb41bf00a3/go.mod h1:2wIuQute9+hhWqvL3vEI7YB0EKluF4WcPzI1eAliazk=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
@@ -290,12 +329,14 @@ github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OI
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.2.2/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/googleapis/gnostic v0.3.1 h1:WeAefnSUHlBb0iJKwxFDZdbfGwkd7xRNuV+IpXMJhYk=
 github.com/googleapis/gnostic v0.3.1/go.mod h1:on+2t9HRStVgn95RSsFWFz+6Q0Snyqv1awfrALZdbtU=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
@@ -308,6 +349,7 @@ github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoA
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4 h1:z53tR0945TRRQO/fLEVPI6SMv7ZflF0TEaTAoU7tOzg=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.8.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
@@ -318,29 +360,43 @@ github.com/gruntwork-io/gruntwork-cli v0.5.1/go.mod h1:IBX21bESC1/LGoV7jhXKUnTQT
 github.com/gruntwork-io/terratest v0.27.5 h1:o+D1Ea65RnQV9e/k57cTpnQprYN+MOXJm9U44TYYWX0=
 github.com/gruntwork-io/terratest v0.27.5/go.mod h1:HJRmpi3vO3QGbYFPnNe5eYjDF3j9INnvXceYq3pKOo4=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-immutable-radix v1.0.0 h1:AKDB1HM5PWEA7i4nhcpwOrO2byshxBjXVn/J/3+z5/0=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-plugin v1.0.1 h1:4OtAfUGbnKC6yS48p0CtMX2oFYtzFZVv6rok3cRWgnE=
 github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
+github.com/hashicorp/go-uuid v1.0.0 h1:RS8zrF7PhGwyNPOtxSClXXj9HA8feRnJzgnI1RJCSnM=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.3 h1:YPkqC67at8FYaadspW/6uE0COsBxS2656RLEr8Bppgk=
 github.com/hashicorp/golang-lru v0.5.3/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl v1.0.1-0.20190430135223-99e2f22d1c94 h1:LaH4JWe6Q7ICdxL5raxQjSRw7Pj8uTtAENrjejIYZIg=
 github.com/hashicorp/hcl v1.0.1-0.20190430135223-99e2f22d1c94/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69 h1:umaj0TCQ9lWUUKy2DxAhEzPbwd0jnxiw1EI2z3FiILM=
 github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69/go.mod h1:zdLK9ilQRSMjSeLKoZ4BqUfBT7jswTGF8zRlKEsiRXA=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/huandu/xstrings v1.2.0 h1:yPeWdRnmynF7p+lLYz0H2tthW9lqhMJrQV/U7yy4wX0=
 github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.7 h1:Y+UAYTZ7gDEuOfhxKWy+dvb5dRQ6rJjFSdX2HZY1/gI=
 github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imkira/go-observer v1.0.3/go.mod h1:zLzElv2cGTHufQG17IEILJMPDg32TD85fFgKyFv00wU=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jackc/fake v0.0.0-20150926172116-812a484cc733/go.mod h1:WrMFNQdiFJ80sQsxDoMokWK1W5TQtxBFNpzWTD84ibQ=
 github.com/jackc/pgx v3.2.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
@@ -356,23 +412,29 @@ github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBv
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.9 h1:9yzud/Ht36ygwatGx56VwCZtlI/2AD15T1X2sjSuGns=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515 h1:T+h1c/A9Gawja4Y9mFVWj2vyii2bbUNDw3kt9VxK2EY=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.1 h1:sJZmqHoEaY7f+NPP8pgLB/WxulyR3fewgCM2qaSlBb4=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -389,6 +451,7 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
 github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-sqlite3 v1.10.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
 github.com/miekg/dns v1.1.29 h1:xHBEhR+t5RzcFJjBLJlax2daXOrTYtr9z4WdKEfWFzg=
@@ -396,21 +459,28 @@ github.com/miekg/dns v1.1.29/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 h1:7GoSOOW2jpsfkntVKaS2rAr1TJqfcxotyaUcuxoZSzg=
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/nakagami/firebirdsql v0.0.0-20190310045651-3c02a58cfed8/go.mod h1:86wM1zFnC6/uDBfZGNwB65O+pR2OFi5q/YQaEUid1qA=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
@@ -421,6 +491,7 @@ github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.0 h1:Iw5WCbBcaAAd0fpRb1c9r5YCylv4XDoCSigm1zLevwU=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
@@ -428,12 +499,17 @@ github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1Cpa
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
+github.com/onsi/gomega v1.9.0 h1:R1uwffexN6Pr340GtYRIdZmAiN4J+iw6WG4wog1DUXg=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
+github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
 github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
 github.com/oracle/oci-go-sdk v7.1.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
+github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -441,8 +517,10 @@ github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.0 h1:J8lpUdobwIeCI7OiSxHqEwJUKvJwicL5+3v1oe2Yb4k=
 github.com/pkg/errors v0.9.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
@@ -452,21 +530,25 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP
 github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.4.0 h1:YVIb/fVcOTMSqtqZWSKnHpSLBxu8DKgxq8z6RuBZwqI=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.9.1 h1:KOMtN28tlbam3/7ZKEYKHhKoJZYYj3gMH4uc62x7X7U=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.8 h1:+fpWZdT24pJBiqJdAwYBjPSk+5YmQzYNPYzQsdzLkt8=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
@@ -486,11 +568,13 @@ github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAm
 github.com/shirou/gopsutil v2.18.12+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
 github.com/shirou/w32 v0.0.0-20160930032740-bb4de0191aa4/go.mod h1:qsXQc7+bwAM3Q1u/4XEfrquwF8Lw7D7y5cD8CuHnfIc=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 h1:bUGsEnyNbVPw06Bs80sCeARAlK8lhwqGyi6UT8ymuGk=
 github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
@@ -499,30 +583,38 @@ github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTd
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
+github.com/spf13/cobra v1.0.0 h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/spiffe/go-spiffe v0.0.0-20190717182101-d8657cb50cae/go.mod h1:HyNeJnVYkDyQgB2qcSPxVYkAA2F3lQu51bDxNpFcKxY=
+github.com/spiffe/go-spiffe v0.0.0-20190820222348-6adcf1eecbcc h1:YeGvOZLHZxE8nrxPGDNH1LGv8zzkAIDfIRgy256rotk=
 github.com/spiffe/go-spiffe v0.0.0-20190820222348-6adcf1eecbcc/go.mod h1:HyNeJnVYkDyQgB2qcSPxVYkAA2F3lQu51bDxNpFcKxY=
+github.com/spiffe/spire v0.10.0 h1:UuBHgHI/4Uqcn0SpVMXWPgWtgKLJkBXOWP9Vs/82sZ4=
 github.com/spiffe/spire v0.10.0/go.mod h1:6dqxKqiDPREetq8Z62bcb+zFybVr/cj2ncTt0iLwREw=
+github.com/spiffe/spire/proto/spire v0.10.0 h1:NJ6HK9/XlnvqTox3fJUTAt6180105ZknpDS6sJC+QUM=
 github.com/spiffe/spire/proto/spire v0.10.0/go.mod h1:QmfLOnjxfc4o9KAe1f8bwYX3WcMLWSiKljTEHdGNFYU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
+github.com/uber-go/tally v3.3.12+incompatible h1:Qa0XrHsKXclmhEpHmBHTTEZotwvQHAbm3lvtJ6RNn+0=
 github.com/uber-go/tally v3.3.12+incompatible/go.mod h1:YDTIBxdXyOU/sCWilKB4bgyufu1cEi0jdVnRdxvjnmU=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
@@ -538,6 +630,7 @@ github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/zeebo/errs v1.2.0 h1:Tk8UszIOLEjtx6DWnvfmMJe6N8q7vu03Bj95HMWDUkc=
 github.com/zeebo/errs v1.2.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
 gitlab.com/nyarla/go-crypt v0.0.0-20160106005555-d9a5dc2b789b/go.mod h1:T3BPAOm2cqquPa0MKWeNkmOM5RQsRhkrwMWonFMN7fE=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
@@ -553,9 +646,12 @@ go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/goleak v0.10.0/go.mod h1:VCZuO8V8mFPlL0F5J5GK1rtHV3DrFcQ1R8ryq7FK0aI=
+go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0 h1:ORx85nbTijNz8ljznvCMR1ZBIPKFn3jQrag10X2AsuM=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -573,6 +669,7 @@ golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200406173513-056763e48d71 h1:DOmugCavvUtnUD114C1Wh+UgTgQZ4pMLzXxi1pSt+/Y=
 golang.org/x/crypto v0.0.0-20200406173513-056763e48d71/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -624,6 +721,7 @@ golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e h1:3G+cUijn7XD+S4eJFddp53Pv7+slrESplyjG25HgL+k=
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -631,6 +729,7 @@ golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4Iltr
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -676,13 +775,16 @@ golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200107162124-548cf772de50/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200413165638-669c56c373c4 h1:opSr2sbRXk5X5/givKrrKj9HXxFpW2sdCiP8MJSKLQY=
 golang.org/x/sys v0.0.0-20200413165638-669c56c373c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -717,10 +819,13 @@ golang.org/x/tools v0.0.0-20191205215504-7b8c8591a921/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200113040837-eac381796e91/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200520220537-cf2d1e09c845 h1:F4gQH8TKyCccYDuNHX5TfZwiM8QWnPbSPUFE96qvGbs=
 golang.org/x/tools v0.0.0-20200520220537-cf2d1e09c845/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gomodules.xyz/jsonpatch/v2 v2.0.1 h1:xyiBuvkD2g5n7cYzx6u2sxQvsAy4QJsZFCzGVdzOXZ0=
 gomodules.xyz/jsonpatch/v2 v2.0.1/go.mod h1:IhYNNY4jnS53ZnfE4PAmpKtDpTCj1JFXc+3mwe7XcUU=
 gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485/go.mod h1:2ltnJ7xHfj0zHS40VVPYEAAMTa3ZGguvHGBSJeRWqE0=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
@@ -751,6 +856,7 @@ google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
 google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200108215221-bd8f9a0ef82f h1:2wh8dWY8959cBGQvk1RD+/eQBgRYYDaZ+hT0/zsARoA=
 google.golang.org/genproto v0.0.0-20200108215221-bd8f9a0ef82f/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
@@ -764,22 +870,27 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac
 google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0 h1:2dTRdpdFEEhJYQD8EMLB61nnrzSCTbG38PhqdhvOltg=
 google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 gopkg.in/DATA-DOG/go-sqlmock.v1 v1.3.0/go.mod h1:OdE7CF6DbADk7lN8LIKRzRJTTZXIjtWgA5THM5lhBAw=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/gcfg.v1 v1.2.0/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637/go.mod h1:BHsqpu/nsuzkT5BpiH1EMZPLyqSMM8JbIavyFACoFNk=
 gopkg.in/warnings.v0 v0.1.1/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
@@ -788,7 +899,9 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -799,14 +912,18 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 k8s.io/api v0.0.0-20190222213804-5cb15d344471/go.mod h1:iuAfoD4hCxJ8Onx9kaTIt30j7jUFS00AXQi6QMi99vA=
 k8s.io/api v0.17.0/go.mod h1:npsyOePkeP0CPwyGfXDHxvypiYMJxBWAMpQxCaJ4ZxI=
 k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
+k8s.io/api v0.18.3 h1:2AJaUQdgUZLoDZHrun21PW2Nx9+ll6cUzvn3IKhSIn0=
 k8s.io/api v0.18.3/go.mod h1:UOaMwERbqJMfeeeHc8XJKawj4P9TgDRnViIqqBeH2QA=
+k8s.io/apiextensions-apiserver v0.18.2 h1:I4v3/jAuQC+89L3Z7dDgAiN4EOjN6sbm6iBqQwHTah8=
 k8s.io/apiextensions-apiserver v0.18.2/go.mod h1:q3faSnRGmYimiocj6cHQ1I3WpLqmDgJFlKL37fC4ZvY=
 k8s.io/apimachinery v0.0.0-20190221213512-86fb29eff628/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
 k8s.io/apimachinery v0.17.0/go.mod h1:b9qmWdKlLuU9EBh+06BtLcSf/Mu89rWL33naRxs1uZg=
 k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
+k8s.io/apimachinery v0.18.3 h1:pOGcbVAhxADgUYnjS08EFXs9QMl8qaH5U4fr5LGUrSk=
 k8s.io/apimachinery v0.18.3/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
 k8s.io/apiserver v0.17.0/go.mod h1:ABM+9x/prjINN6iiffRVNCBR2Wk7uY4z+EtEGZD48cg=
 k8s.io/apiserver v0.18.2/go.mod h1:Xbh066NqrZO8cbsoenCwyDJ1OSi8Ag8I2lezeHxzwzw=
+k8s.io/client-go v0.18.2 h1:aLB0iaD4nmwh7arT2wIn+lMnAq7OswjaejkQ8p9bBYE=
 k8s.io/client-go v0.18.2/go.mod h1:Xcm5wVGXX9HAA2JJ2sSBUn3tCJ+4SVlCbl2MNNv+CIU=
 k8s.io/cloud-provider v0.17.0/go.mod h1:Ze4c3w2C0bRsjkBUoHpFi+qWe3ob1wI2/7cUn+YQIDE=
 k8s.io/code-generator v0.0.0-20191121015212-c4c8f8345c7e/go.mod h1:DVmfPQgxQENqDIzVR2ddLXMH34qeszkKSdH/N+s+38s=
@@ -817,15 +934,19 @@ k8s.io/csi-translation-lib v0.17.0/go.mod h1:HEF7MEz7pOLJCnxabi45IPkhSsE/KmxPQks
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20190822140433-26a664648505/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20200114144118-36b2048a9120/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/helm v2.14.3+incompatible h1:uzotTcZXa/b2SWVoUzM1xiCXVjI38TuxMujS/1s+3Gw=
 k8s.io/helm v2.14.3+incompatible/go.mod h1:LZzlS4LQBHfciFOurYBFkCMTaZ0D1l+p0teMg7TSULI=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
 k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
+k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6 h1:Oh3Mzx5pJ+yIumsAD0MOECPVeXsVot0UkiaCGVyfGQY=
 k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
 k8s.io/legacy-cloud-providers v0.17.0/go.mod h1:DdzaepJ3RtRy+e5YhNtrCYwlgyK87j/5+Yfp0L9Syp8=
 k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
+k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89 h1:d4vVOjXm687F1iLSP2q3lyPPuyvTUt3aVoBpi2DqRsU=
 k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 modernc.org/b v1.0.0/go.mod h1:uZWcZfRj1BpYzfN9JTerzlNUnnPsV9O2ZA8JsRcubNg=
 modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
@@ -844,11 +965,16 @@ modernc.org/xc v1.0.0/go.mod h1:mRNCo0bvLjGhHO9WsyuKVU4q0ceiDDDoEeWDJHrNx8I=
 modernc.org/zappy v1.0.0/go.mod h1:hHe+oGahLVII/aTTyWK/b53VDHMAGCBYYeZ9sn83HC4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
+sigs.k8s.io/controller-runtime v0.6.0 h1:Fzna3DY7c4BIP6KwfSlrfnj20DJ+SeMBK8HSFvOk9NM=
 sigs.k8s.io/controller-runtime v0.6.0/go.mod h1:CpYf5pdNY/B352A1TFLAS2JVSlnGQ5O2cftPHndTroo=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
+sigs.k8s.io/structured-merge-diff v1.0.1-0.20191108220359-b1b620dd3f06 h1:zD2IemQ4LmOcAumeiyDWXKUI2SO0NYDe3H6QGvPOVgU=
 sigs.k8s.io/structured-merge-diff v1.0.1-0.20191108220359-b1b620dd3f06/go.mod h1:/ULNhyfzRopfcjskuui0cTITekDduZ7ycKN3oUT9R18=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0 h1:dOmIZBMfhcHS09XZkMyUgkq5trg3/jRyJYFZUiaOp8E=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/testing_frameworks v0.1.1 h1:cP2l8fkA3O9vekpy5Ks8mmA0NW/F7yBdXf8brkWhVrs=
 sigs.k8s.io/testing_frameworks v0.1.1/go.mod h1:VVBKrHmJ6Ekkfz284YKhQePcdycOzNH9qL6ht1zEr/U=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
diff --git a/pkg/core/policy/connection_matcher.go b/pkg/core/policy/connection_matcher.go
index 3f465ae7e89c..fd912e41b21d 100644
--- a/pkg/core/policy/connection_matcher.go
+++ b/pkg/core/policy/connection_matcher.go
@@ -30,7 +30,7 @@ func ToOutboundServicesOf(dataplane *mesh_core.DataplaneResource) ServiceIterato
 		}
 		oface := dataplane.Spec.Networking.GetOutbound()[idx]
 		idx++
-		return oface.Service, true
+		return oface.GetTagsIncludingLegacy()[mesh_proto.ServiceTag], true
 	})
 }
 
diff --git a/pkg/core/resources/apis/mesh/dataplane_validator.go b/pkg/core/resources/apis/mesh/dataplane_validator.go
index 354eccd29d0a..ed504b8212db 100644
--- a/pkg/core/resources/apis/mesh/dataplane_validator.go
+++ b/pkg/core/resources/apis/mesh/dataplane_validator.go
@@ -158,8 +158,15 @@ func validateOutbound(outbound *mesh_proto.Dataplane_Networking_Outbound) valida
 		}
 	}
 
-	if outbound.Service == "" {
-		result.AddViolation("service", "cannot be empty")
+	if len(outbound.Tags) == 0 {
+		if outbound.Service == "" {
+			result.AddViolation("service", "cannot be empty")
+		}
+	} else {
+		if _, exist := outbound.Tags[mesh_proto.ServiceTag]; !exist {
+			result.AddViolationAt(validators.RootedAt("tags").Key(mesh_proto.ServiceTag), `tag has to exist`)
+		}
+		result.Add(validateTags(outbound.Tags))
 	}
 	return result
 }
diff --git a/pkg/core/resources/apis/mesh/dataplane_validator_test.go b/pkg/core/resources/apis/mesh/dataplane_validator_test.go
index 1eda3ff88cb8..13b838034a91 100644
--- a/pkg/core/resources/apis/mesh/dataplane_validator_test.go
+++ b/pkg/core/resources/apis/mesh/dataplane_validator_test.go
@@ -41,7 +41,8 @@ var _ = Describe("Dataplane", func() {
                     version: "1"
               outbound:
                 - interface: :3333
-                  service: redis`,
+                  tags:
+                    service: redis`,
 		),
 		Entry("dataplane with inbounds", `
             type: Dataplane
@@ -56,7 +57,8 @@ var _ = Describe("Dataplane", func() {
                     version: "1"
               outbound:
                 - port: 3333
-                  service: redis`,
+                  tags:
+                    service: redis`,
 		),
 		Entry("dataplane with full inbounds and outbounds", `
             type: Dataplane
@@ -71,6 +73,24 @@ var _ = Describe("Dataplane", func() {
                   tags:
                     service: backend
                     version: "1"
+              outbound:
+                - port: 3333
+                  address: 127.0.0.1
+                  tags:
+                    service: redis`,
+		),
+		Entry("dataplane with legacy outbounds", `
+            type: Dataplane
+            name: dp-1
+            mesh: default
+            networking:
+              address: 192.168.0.1
+              inbound:
+                - port: 8080
+                  servicePort: 7777
+                  address: 127.0.0.1
+                  tags:
+                    service: backend
               outbound:
                 - port: 3333
                   address: 127.0.0.1
@@ -103,7 +123,8 @@ var _ = Describe("Dataplane", func() {
                   kuma.io/valid: abc.0123-789.under_score:90
               outbound:
                 - port: 3333
-                  service: redis`,
+                  tags:
+                    service: redis`,
 		),
 		Entry("dataplane in ingress mode", `
             type: Dataplane
@@ -411,6 +432,27 @@ var _ = Describe("Dataplane", func() {
                 - field: networking.outbound[0].service
                   message: cannot be empty`,
 		}),
+		Entry("networking.outbound: empty service tag", testCase{
+			dataplane: `
+                type: Dataplane
+                name: dp-1
+                mesh: default
+                networking:
+                  address: 192.168.0.1
+                  inbound:
+                    - port: 1234
+                      tags:
+                        service: backend
+                        version: "v1"
+                  outbound:
+                    - port: 3333
+                      tags:
+                        version: v1`,
+			expected: `
+                violations:
+                - field: networking.outbound[0].tags["service"]
+                  message: tag has to exist`,
+		}),
 		Entry("networking.outbound: port out of the range", testCase{
 			dataplane: `
                 type: Dataplane
diff --git a/pkg/core/xds/resource.go b/pkg/core/xds/resource.go
index cee6af305dd2..22e3a4e55cc4 100644
--- a/pkg/core/xds/resource.go
+++ b/pkg/core/xds/resource.go
@@ -81,6 +81,11 @@ func (s *ResourceSet) Add(resources ...*Resource) *ResourceSet {
 	return s
 }
 
+func (s *ResourceSet) AddSet(set ResourceSet) *ResourceSet {
+	s.Add(set.List()...)
+	return s
+}
+
 func (s *ResourceSet) AddNamed(namedPayloads ...NamedResourcePayload) *ResourceSet {
 	for _, namedPayload := range namedPayloads {
 		s.Add(&Resource{
diff --git a/pkg/core/xds/types.go b/pkg/core/xds/types.go
index a39b4f2c8897..e1f5f3191519 100644
--- a/pkg/core/xds/types.go
+++ b/pkg/core/xds/types.go
@@ -29,12 +29,14 @@ func (id ProxyId) String() string {
 type ServiceName = string
 
 // RouteMap holds the most specific TrafficRoute for each outbound interface of a Dataplane.
-type RouteMap map[ServiceName]*mesh_core.TrafficRouteResource
+type RouteMap map[mesh_proto.OutboundInterface]*mesh_core.TrafficRouteResource
 
 // TagSelectorSet is a set of unique TagSelectors.
 type TagSelectorSet []mesh_proto.TagSelector
 
 // DestinationMap holds a set of selectors for all reachable Dataplanes grouped by service name.
+// DestinationMap is based on ServiceName and not on the OutboundInterface because TrafficRoute can introduce new service destinations that were not included in a outbound section.
+// Policies that match on outbound connections also match by service destination name and not outbound interface for the same reason.
 type DestinationMap map[ServiceName]TagSelectorSet
 
 // Endpoint holds routing-related information about a single endpoint.
diff --git a/pkg/plugins/discovery/k8s/controllers/outbound_converter.go b/pkg/plugins/discovery/k8s/controllers/outbound_converter.go
index 73826acaeb3c..b875458aa5e6 100644
--- a/pkg/plugins/discovery/k8s/controllers/outbound_converter.go
+++ b/pkg/plugins/discovery/k8s/controllers/outbound_converter.go
@@ -30,7 +30,9 @@ func (p *PodConverter) OutboundInterfacesFor(pod *kube_core.Pod, others []*mesh_
 				outbounds = append(outbounds, &mesh_proto.Dataplane_Networking_Outbound{
 					Address: endpoint.Address,
 					Port:    endpoint.Port,
-					Service: serviceTag,
+					Tags: map[string]string{
+						mesh_proto.ServiceTag: serviceTag,
+					},
 				})
 			}
 		} else {
@@ -38,7 +40,9 @@ func (p *PodConverter) OutboundInterfacesFor(pod *kube_core.Pod, others []*mesh_
 			outbounds = append(outbounds, &mesh_proto.Dataplane_Networking_Outbound{
 				Address: service.Spec.ClusterIP,
 				Port:    port,
-				Service: serviceTag,
+				Tags: map[string]string{
+					mesh_proto.ServiceTag: serviceTag,
+				},
 			})
 		}
 	}
diff --git a/pkg/plugins/discovery/k8s/controllers/testdata/02.dataplane.yaml b/pkg/plugins/discovery/k8s/controllers/testdata/02.dataplane.yaml
index 757bf6b9ad99..e21e1e7e43db 100644
--- a/pkg/plugins/discovery/k8s/controllers/testdata/02.dataplane.yaml
+++ b/pkg/plugins/discovery/k8s/controllers/testdata/02.dataplane.yaml
@@ -14,7 +14,9 @@ spec:
     outbound:
       - address: 10.108.144.24
         port: 443
-        service: test-app.playground.svc:443
+        tags:
+          service: test-app.playground.svc:443
       - address: 10.108.144.24
         port: 80
-        service: test-app.playground.svc:80
+        tags:
+          service: test-app.playground.svc:80
diff --git a/pkg/plugins/discovery/k8s/controllers/testdata/04.dataplane.yaml b/pkg/plugins/discovery/k8s/controllers/testdata/04.dataplane.yaml
index 24a676e6b0ec..8c20165033e4 100644
--- a/pkg/plugins/discovery/k8s/controllers/testdata/04.dataplane.yaml
+++ b/pkg/plugins/discovery/k8s/controllers/testdata/04.dataplane.yaml
@@ -14,13 +14,16 @@ spec:
     outbound:
       - address: 10.108.144.25
         port: 80
-        service: second-test-app.playground.svc:80
+        tags:
+          service: second-test-app.playground.svc:80
       - address: 10.108.144.24
         port: 443
-        service: test-app.playground.svc:443
+        tags:
+          service: test-app.playground.svc:443
       - address: 10.108.144.24
         port: 80
-        service: test-app.playground.svc:80
+        tags:
+          service: test-app.playground.svc:80
     transparentProxying:
       directAccessServices:
         - '*'
diff --git a/pkg/plugins/discovery/k8s/controllers/testdata/05.dataplane.yaml b/pkg/plugins/discovery/k8s/controllers/testdata/05.dataplane.yaml
index 1b0e55ea160f..677978cbb58a 100644
--- a/pkg/plugins/discovery/k8s/controllers/testdata/05.dataplane.yaml
+++ b/pkg/plugins/discovery/k8s/controllers/testdata/05.dataplane.yaml
@@ -14,13 +14,16 @@ spec:
     outbound:
       - address: 10.108.144.25
         port: 80
-        service: second-test-app.playground.svc:80
+        tags:
+          service: second-test-app.playground.svc:80
       - address: 10.108.144.24
         port: 443
-        service: test-app.playground.svc:443
+        tags:
+          service: test-app.playground.svc:443
       - address: 10.108.144.24
         port: 80
-        service: test-app.playground.svc:80
+        tags:
+          service: test-app.playground.svc:80
     transparentProxying:
       directAccessServices:
         - test-app.playground.svc:80
diff --git a/pkg/plugins/discovery/k8s/controllers/testdata/06.dataplane.yaml b/pkg/plugins/discovery/k8s/controllers/testdata/06.dataplane.yaml
index 85204f8e8da2..7b035c4d4f28 100644
--- a/pkg/plugins/discovery/k8s/controllers/testdata/06.dataplane.yaml
+++ b/pkg/plugins/discovery/k8s/controllers/testdata/06.dataplane.yaml
@@ -20,4 +20,5 @@ spec:
     outbound:
       - address: 10.244.0.25
         port: 80
-        service: test-app.playground.svc:80
+        tags:
+          service: test-app.playground.svc:80
diff --git a/pkg/plugins/resources/k8s/native/go.sum b/pkg/plugins/resources/k8s/native/go.sum
index aee34333d959..5fd7a15fa52d 100644
--- a/pkg/plugins/resources/k8s/native/go.sum
+++ b/pkg/plugins/resources/k8s/native/go.sum
@@ -1,5 +1,6 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0 h1:ROfEUZz+Gh5pa62DJWXSaonyu3StP6EA6lPEXPI6mCo=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
 github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
@@ -24,11 +25,14 @@ github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533 h1:8wZizuKuZVu5COB7EsBYxBQz8nRcXXn5d4Gt91eJLvU=
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
@@ -43,6 +47,7 @@ github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea/go.mod h1:E3G3o1h8I7cfc
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
@@ -57,20 +62,27 @@ github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.5 h1:lRJIqDD8yjV1YyPRqecMdytjDLs2fTXq363aCib5xPU=
 github.com/envoyproxy/go-control-plane v0.9.5/go.mod h1:OXl5to++W0ctG+EHWTFUjiypVxC/Y4VLc/KFU+al13s=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.3.0-java.0.20200311152155-ab56c3dd1cf9 h1:mU3oOAYTK9ZRKMj//H1EWk1vWbkYeWKBPYKMnIwcs/A=
 github.com/envoyproxy/protoc-gen-validate v0.3.0-java.0.20200311152155-ab56c3dd1cf9/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.5.0+incompatible h1:ouOWdg56aJriqS0huScTkVXPC5IcNrDCXZ6OoTAWu7M=
 github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logr/logr v0.1.0 h1:M1Tv3VzNlEHg6uyACnRdtrploV2P7wZqH8BoQMtz0cg=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-logr/zapr v0.1.0 h1:h+WVe9j6HAA01niTJPA/kKH0i7e0rLZBCwauQFcRE54=
 github.com/go-logr/zapr v0.1.0/go.mod h1:tabnROwaDl0UNxkVeFRbY8bwB37GwRv0P8lg6aAiEnk=
 github.com/go-openapi/analysis v0.0.0-20180825180245-b006789cd277/go.mod h1:k70tL6pCuVxPJOHXQ+wIac1FUrvNkHolPie/cLEU6hI=
 github.com/go-openapi/analysis v0.17.0/go.mod h1:IowGgpVeD0vNm45So8nr+IcQ3pxVtpRoBWb8PVZO0ik=
@@ -118,29 +130,37 @@ github.com/go-openapi/validate v0.19.5/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85n
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef h1:veQD95Isof8w9/WXiA+pa3tz3fJXkt5B7QaRBrM62gk=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/googleapis/gnostic v0.3.1 h1:WeAefnSUHlBb0iJKwxFDZdbfGwkd7xRNuV+IpXMJhYk=
 github.com/googleapis/gnostic v0.3.1/go.mod h1:on+2t9HRStVgn95RSsFWFz+6Q0Snyqv1awfrALZdbtU=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
@@ -150,15 +170,19 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
 github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.8 h1:QiWkFLKq0T7mpzwOTu6BzNDbfTE8OLrYhVKYMLF46Ok=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
@@ -167,9 +191,11 @@ github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQL
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -181,12 +207,15 @@ github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -196,25 +225,33 @@ github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:v
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.11.0 h1:JAKSXpt1YjtLA7YpPiqO9ss6sNXEsPfSGdwN0UHqzrw=
 github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.8.1 h1:C5Dqfs/LeauYDX0jJXIe2SWmwCbGzx9yF8C8xy3Lh34=
 github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0 h1:vrDKnkGzuGvhNAL56c7DBz29ZL+KxnoR0x7enabFceM=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.4.1 h1:K0MGApIoQvMw27RTdJkPbr3JZ7DNbtxQNyi5STVM6Kw=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2 h1:6LJUbpNm42llc4HRCuvApCSWB/WfhuNo9K98Q9sNGfs=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
@@ -231,6 +268,7 @@ github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb6
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -238,6 +276,7 @@ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
@@ -253,8 +292,11 @@ go.mongodb.org/mongo-driver v1.1.1/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qL
 go.mongodb.org/mongo-driver v1.1.2/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0 h1:ORx85nbTijNz8ljznvCMR1ZBIPKFn3jQrag10X2AsuM=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -263,6 +305,7 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190320223903-b7391e95e576/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 h1:/Tl7pH94bvbAAHBdZJT947M/+gp0+CqQXDtMRC0fseo=
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -285,9 +328,11 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -310,13 +355,16 @@ golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7 h1:HmbHVPwrPEKPGLAcHSrMe6+hqSUlvZU0rab6x5EXfGU=
 golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -331,45 +379,59 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190617190820-da514acc4774/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190920225731-5eefd052ad72/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gomodules.xyz/jsonpatch/v2 v2.0.1 h1:xyiBuvkD2g5n7cYzx6u2sxQvsAy4QJsZFCzGVdzOXZ0=
 gomodules.xyz/jsonpatch/v2 v2.0.1/go.mod h1:IhYNNY4jnS53ZnfE4PAmpKtDpTCj1JFXc+3mwe7XcUU=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0 h1:2dTRdpdFEEhJYQD8EMLB61nnrzSCTbG38PhqdhvOltg=
 google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.18.2 h1:wG5g5ZmSVgm5B+eHMIbI9EGATS2L8Z72rda19RIEgY8=
 k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
+k8s.io/apiextensions-apiserver v0.18.2 h1:I4v3/jAuQC+89L3Z7dDgAiN4EOjN6sbm6iBqQwHTah8=
 k8s.io/apiextensions-apiserver v0.18.2/go.mod h1:q3faSnRGmYimiocj6cHQ1I3WpLqmDgJFlKL37fC4ZvY=
+k8s.io/apimachinery v0.18.2 h1:44CmtbmkzVDAhCpRVSiP2R5PPrC2RtlIv/MoB8xpdRA=
 k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
 k8s.io/apiserver v0.18.2/go.mod h1:Xbh066NqrZO8cbsoenCwyDJ1OSi8Ag8I2lezeHxzwzw=
+k8s.io/client-go v0.18.2 h1:aLB0iaD4nmwh7arT2wIn+lMnAq7OswjaejkQ8p9bBYE=
 k8s.io/client-go v0.18.2/go.mod h1:Xcm5wVGXX9HAA2JJ2sSBUn3tCJ+4SVlCbl2MNNv+CIU=
 k8s.io/code-generator v0.18.2/go.mod h1:+UHX5rSbxmR8kzS+FAv7um6dtYrZokQvjHpDSYRVkTc=
 k8s.io/component-base v0.18.2/go.mod h1:kqLlMuhJNHQ9lz8Z7V5bxUUtjFZnrypArGl58gmDfUM=
@@ -377,12 +439,18 @@ k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8
 k8s.io/gengo v0.0.0-20200114144118-36b2048a9120/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c h1:/KUFqjjqAcY4Us6luF5RDNZ16KJtb49HfR3ZHB9qYXM=
 k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
+k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89 h1:d4vVOjXm687F1iLSP2q3lyPPuyvTUt3aVoBpi2DqRsU=
 k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
+sigs.k8s.io/controller-runtime v0.6.0 h1:Fzna3DY7c4BIP6KwfSlrfnj20DJ+SeMBK8HSFvOk9NM=
 sigs.k8s.io/controller-runtime v0.6.0/go.mod h1:CpYf5pdNY/B352A1TFLAS2JVSlnGQ5O2cftPHndTroo=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0 h1:dOmIZBMfhcHS09XZkMyUgkq5trg3/jRyJYFZUiaOp8E=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
diff --git a/pkg/xds/envoy/clusters/lb_subset_configurer.go b/pkg/xds/envoy/clusters/lb_subset_configurer.go
new file mode 100644
index 000000000000..f0b8cb607294
--- /dev/null
+++ b/pkg/xds/envoy/clusters/lb_subset_configurer.go
@@ -0,0 +1,66 @@
+package clusters
+
+import (
+	"strings"
+
+	envoy_api "github.com/envoyproxy/go-control-plane/envoy/api/v2"
+
+	mesh_proto "github.com/Kong/kuma/api/mesh/v1alpha1"
+	"github.com/Kong/kuma/pkg/xds/envoy"
+)
+
+// LbSubset is required for MetadataMatch in Weighted Cluster in TCP Proxy to work.
+// Subset loadbalancing is used in two use cases
+// 1) TrafficRoute for splitting traffic. Example: TrafficRoute that splits 10% of the traffic to version 1 of the service backend and 90% traffic to version 2 of the service backend
+// 2) Multiple outbound sections with the same service
+//    Example:
+//    type: Dataplane
+//    networking:
+//      outbound:
+//      - port: 1234
+//        tags:
+//          service: backend
+//      - port: 1234
+//        tags:
+//          service: backend
+//          version: v1
+//    Only one cluster "backend" is generated for such dataplane, but with lb subset by version.
+func LbSubset(tags []envoy.Tags) ClusterBuilderOptFunc {
+	return func(config *ClusterBuilderConfig) {
+		config.Add(&lbSubsetConfigurer{
+			tags: tags,
+		})
+	}
+}
+
+type lbSubsetConfigurer struct {
+	tags []envoy.Tags
+}
+
+func (e *lbSubsetConfigurer) Configure(c *envoy_api.Cluster) error {
+	var selectors []*envoy_api.Cluster_LbSubsetConfig_LbSubsetSelector
+	subsets := map[string]bool{} // we only need unique subsets
+	for _, tags := range e.tags {
+		keys := tags.WithoutTag(mesh_proto.ServiceTag).Keys() // service tag is not included in metadata
+		if len(keys) == 0 {
+			continue
+		}
+		joinedTags := strings.Join(keys, ",")
+		if !subsets[joinedTags] {
+			selectors = append(selectors, &envoy_api.Cluster_LbSubsetConfig_LbSubsetSelector{
+				Keys: keys,
+				// if there is a split by "version", and there is no endpoint with such version we should not fallback to all endpoints of the service
+				FallbackPolicy: envoy_api.Cluster_LbSubsetConfig_LbSubsetSelector_NO_FALLBACK,
+			})
+			subsets[joinedTags] = true
+		}
+	}
+	if len(selectors) > 0 {
+		// if lb subset is set, but no label (Kuma's tag) is queried, we should return any endpoint
+		c.LbSubsetConfig = &envoy_api.Cluster_LbSubsetConfig{
+			FallbackPolicy:  envoy_api.Cluster_LbSubsetConfig_ANY_ENDPOINT,
+			SubsetSelectors: selectors,
+		}
+	}
+	return nil
+}
diff --git a/pkg/xds/envoy/clusters/lb_subset_configurer_test.go b/pkg/xds/envoy/clusters/lb_subset_configurer_test.go
new file mode 100644
index 000000000000..5b6b56170a84
--- /dev/null
+++ b/pkg/xds/envoy/clusters/lb_subset_configurer_test.go
@@ -0,0 +1,87 @@
+package clusters_test
+
+import (
+	util_proto "github.com/Kong/kuma/pkg/util/proto"
+	"github.com/Kong/kuma/pkg/xds/envoy"
+	"github.com/Kong/kuma/pkg/xds/envoy/clusters"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/extensions/table"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("LbSubset", func() {
+
+	type testCase struct {
+		clusterName string
+		tags        []envoy.Tags
+		expected    string
+	}
+
+	DescribeTable("should generate proper Envoy config",
+		func(given testCase) {
+			// when
+			cluster, err := clusters.NewClusterBuilder().
+				Configure(clusters.EdsCluster(given.clusterName)).
+				Configure(clusters.LbSubset(given.tags)).
+				Build()
+
+			// then
+			Expect(err).ToNot(HaveOccurred())
+
+			actual, err := util_proto.ToYAML(cluster)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(actual).To(MatchYAML(given.expected))
+		},
+		Entry("LbSubset is empty if there is only a service tag", testCase{
+			clusterName: "backend",
+			tags: []envoy.Tags{
+				{
+					"service": "backend",
+				},
+			},
+			expected: `
+            connectTimeout: 5s
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+            name: backend
+            type: EDS`,
+		}),
+		Entry("LbSubset is set when more than service tag is set", testCase{
+			clusterName: "backend",
+			tags: []envoy.Tags{
+				{
+					"service": "backend",
+					"version": "v1",
+				},
+				{
+					"service": "backend",
+					"version": "v2",
+				},
+				{
+					"service": "backend",
+					"version": "v3",
+					"cluster": "k8s-1",
+				},
+			},
+			expected: `
+            connectTimeout: 5s
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+            lbSubsetConfig:
+              fallbackPolicy: ANY_ENDPOINT
+              subsetSelectors:
+              - fallbackPolicy: NO_FALLBACK
+                keys:
+                - version
+              - fallbackPolicy: NO_FALLBACK
+                keys:
+                - cluster
+                - version
+            name: backend
+            type: EDS`,
+		}),
+	)
+})
diff --git a/pkg/xds/envoy/endpoints/endpoints.go b/pkg/xds/envoy/endpoints/endpoints.go
index 7e0eacdc884f..d2588cd16977 100644
--- a/pkg/xds/envoy/endpoints/endpoints.go
+++ b/pkg/xds/envoy/endpoints/endpoints.go
@@ -1,13 +1,12 @@
 package endpoints
 
 import (
-	pstruct "github.com/golang/protobuf/ptypes/struct"
-
 	v2 "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoy_core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoy_endpoint "github.com/envoyproxy/go-control-plane/envoy/api/v2/endpoint"
 
 	core_xds "github.com/Kong/kuma/pkg/core/xds"
+	envoy_common "github.com/Kong/kuma/pkg/xds/envoy"
 )
 
 func CreateStaticEndpoint(clusterName string, address string, port uint32) *v2.ClusterLoadAssignment {
@@ -39,7 +38,7 @@ func CreateClusterLoadAssignment(clusterName string, endpoints []core_xds.Endpoi
 	lbEndpoints := make([]*envoy_endpoint.LbEndpoint, 0, len(endpoints))
 	for _, ep := range endpoints {
 		lbEndpoints = append(lbEndpoints, &envoy_endpoint.LbEndpoint{
-			Metadata: CreateLbMetadata(ep.Tags),
+			Metadata: envoy_common.Metadata(ep.Tags),
 			HostIdentifier: &envoy_endpoint.LbEndpoint_Endpoint{
 				Endpoint: &envoy_endpoint.Endpoint{
 					Address: &envoy_core.Address{
@@ -63,24 +62,3 @@ func CreateClusterLoadAssignment(clusterName string, endpoints []core_xds.Endpoi
 		}},
 	}
 }
-
-func CreateLbMetadata(tags map[string]string) *envoy_core.Metadata {
-	if len(tags) == 0 {
-		return nil
-	}
-	fields := map[string]*pstruct.Value{}
-	for key, value := range tags {
-		fields[key] = &pstruct.Value{
-			Kind: &pstruct.Value_StringValue{
-				StringValue: value,
-			},
-		}
-	}
-	return &envoy_core.Metadata{
-		FilterMetadata: map[string]*pstruct.Struct{
-			"envoy.lb": &pstruct.Struct{
-				Fields: fields,
-			},
-		},
-	}
-}
diff --git a/pkg/xds/envoy/endpoints/endpoints_test.go b/pkg/xds/envoy/endpoints/endpoints_test.go
index 0c6ac92efa78..ff8a4c81c775 100644
--- a/pkg/xds/envoy/endpoints/endpoints_test.go
+++ b/pkg/xds/envoy/endpoints/endpoints_test.go
@@ -96,7 +96,6 @@ var _ = Describe("Endpoints", func() {
                       filterMetadata:
                         envoy.lb:
                           region: us
-                          service: backend
                   - endpoint:
                       address:
                         socketAddress:
@@ -106,64 +105,6 @@ var _ = Describe("Endpoints", func() {
                       filterMetadata:
                         envoy.lb:
                           region: eu
-                          service: backend
-`,
-			}),
-		)
-	})
-
-	Describe("CreateLbMetadata()", func() {
-
-		It("should handle `nil` map of tags", func() {
-			// when
-			metadata := CreateLbMetadata(nil)
-			// then
-			Expect(metadata).To(BeNil())
-		})
-
-		It("should handle empty map of tags", func() {
-			// when
-			metadata := CreateLbMetadata(map[string]string{})
-			// then
-			Expect(metadata).To(BeNil())
-		})
-
-		type testCase struct {
-			tags     map[string]string
-			expected string
-		}
-		DescribeTable("should generate Envoy metadata",
-			func(given testCase) {
-				// when
-				metadata := CreateLbMetadata(given.tags)
-				// and
-				actual, err := util_proto.ToYAML(metadata)
-				// then
-				Expect(err).ToNot(HaveOccurred())
-				Expect(actual).To(MatchYAML(given.expected))
-			},
-			Entry("map with 1 tag", testCase{
-				tags: map[string]string{
-					"service": "redis",
-				},
-				expected: `
-                filterMetadata:
-                  envoy.lb:
-                    service: redis
-`,
-			}),
-			Entry("map with multiple tags", testCase{
-				tags: map[string]string{
-					"service": "redis",
-					"version": "v1",
-					"region":  "eu",
-				},
-				expected: `
-                filterMetadata:
-                  envoy.lb:
-                    service: redis
-                    version: v1
-                    region: eu
 `,
 			}),
 		)
diff --git a/pkg/xds/envoy/listeners/http_inbound_route_configurer.go b/pkg/xds/envoy/listeners/http_inbound_route_configurer.go
index 4f40c9b608c5..8799de573a64 100644
--- a/pkg/xds/envoy/listeners/http_inbound_route_configurer.go
+++ b/pkg/xds/envoy/listeners/http_inbound_route_configurer.go
@@ -9,7 +9,7 @@ import (
 	envoy_routes "github.com/Kong/kuma/pkg/xds/envoy/routes"
 )
 
-func HttpInboundRoute(service string, cluster envoy_common.ClusterInfo) FilterChainBuilderOpt {
+func HttpInboundRoute(service string, cluster envoy_common.ClusterSubset) FilterChainBuilderOpt {
 	return FilterChainBuilderOptFunc(func(config *FilterChainBuilderConfig) {
 		config.Add(&HttpInboundRouteConfigurer{
 			service: service,
@@ -21,7 +21,7 @@ func HttpInboundRoute(service string, cluster envoy_common.ClusterInfo) FilterCh
 type HttpInboundRouteConfigurer struct {
 	service string
 	// Cluster to forward traffic to.
-	cluster envoy_common.ClusterInfo
+	cluster envoy_common.ClusterSubset
 }
 
 func (c *HttpInboundRouteConfigurer) Configure(filterChain *envoy_listener.FilterChain) error {
diff --git a/pkg/xds/envoy/listeners/http_inbound_route_configurer_test.go b/pkg/xds/envoy/listeners/http_inbound_route_configurer_test.go
index f8cd81067340..09882ca2e7a5 100644
--- a/pkg/xds/envoy/listeners/http_inbound_route_configurer_test.go
+++ b/pkg/xds/envoy/listeners/http_inbound_route_configurer_test.go
@@ -19,7 +19,7 @@ var _ = Describe("HttpInboundRouteConfigurer", func() {
 		listenerPort    uint32
 		statsName       string
 		service         string
-		cluster         envoy_common.ClusterInfo
+		cluster         envoy_common.ClusterSubset
 		expected        string
 	}
 
@@ -47,7 +47,7 @@ var _ = Describe("HttpInboundRouteConfigurer", func() {
 			listenerPort:    8080,
 			statsName:       "localhost:8080",
 			service:         "backend",
-			cluster:         envoy_common.ClusterInfo{Name: "localhost:8080", Weight: 200},
+			cluster:         envoy_common.ClusterSubset{ClusterName: "localhost:8080", Weight: 200},
 			expected: `
             name: inbound:192.168.0.1:8080
             trafficDirection: INBOUND
diff --git a/pkg/xds/envoy/listeners/network_access_log_configurer_test.go b/pkg/xds/envoy/listeners/network_access_log_configurer_test.go
index f0b990cefa5e..49f568322754 100644
--- a/pkg/xds/envoy/listeners/network_access_log_configurer_test.go
+++ b/pkg/xds/envoy/listeners/network_access_log_configurer_test.go
@@ -22,7 +22,7 @@ var _ = Describe("NetworkAccessLogConfigurer", func() {
 		listenerAddress string
 		listenerPort    uint32
 		statsName       string
-		clusters        []envoy_common.ClusterInfo
+		clusters        []envoy_common.ClusterSubset
 		backend         *mesh_proto.LoggingBackend
 		expected        string
 	}
@@ -79,7 +79,7 @@ var _ = Describe("NetworkAccessLogConfigurer", func() {
 			listenerAddress: "127.0.0.1",
 			listenerPort:    5432,
 			statsName:       "db",
-			clusters:        []envoy_common.ClusterInfo{{Name: "db", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "db", Weight: 200}},
 			backend:         nil,
 			expected: `
             name: outbound:127.0.0.1:5432
@@ -102,7 +102,7 @@ var _ = Describe("NetworkAccessLogConfigurer", func() {
 			listenerAddress: "127.0.0.1",
 			listenerPort:    5432,
 			statsName:       "db",
-			clusters:        []envoy_common.ClusterInfo{{Name: "db", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "db", Weight: 200}},
 			backend: &mesh_proto.LoggingBackend{
 				Name: "file",
 				Type: mesh_proto.LoggingFileType,
@@ -138,7 +138,7 @@ var _ = Describe("NetworkAccessLogConfigurer", func() {
 			listenerAddress: "127.0.0.1",
 			listenerPort:    5432,
 			statsName:       "db",
-			clusters:        []envoy_common.ClusterInfo{{Name: "db", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "db", Weight: 200}},
 			backend: &mesh_proto.LoggingBackend{
 				Name: "tcp",
 				Format: `[%START_TIME%] "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%REQ(ORIGIN)%" "%REQ(CONTENT-TYPE)%" "%KUMA_SOURCE_SERVICE%" "%KUMA_DESTINATION_SERVICE%" "%KUMA_SOURCE_ADDRESS%" "%KUMA_SOURCE_ADDRESS_WITHOUT_PORT%" "%UPSTREAM_HOST%
diff --git a/pkg/xds/envoy/listeners/network_rbac_configurer_test.go b/pkg/xds/envoy/listeners/network_rbac_configurer_test.go
index e0f4819205ff..6b43edc92b2f 100644
--- a/pkg/xds/envoy/listeners/network_rbac_configurer_test.go
+++ b/pkg/xds/envoy/listeners/network_rbac_configurer_test.go
@@ -22,7 +22,7 @@ var _ = Describe("NetworkRbacConfigurer", func() {
 		listenerAddress string
 		listenerPort    uint32
 		statsName       string
-		clusters        []envoy_common.ClusterInfo
+		clusters        []envoy_common.ClusterSubset
 		rbacEnabled     bool
 		permission      *mesh_core.TrafficPermissionResource
 		expected        string
@@ -51,7 +51,7 @@ var _ = Describe("NetworkRbacConfigurer", func() {
 			listenerAddress: "192.168.0.1",
 			listenerPort:    8080,
 			statsName:       "localhost:8080",
-			clusters:        []envoy_common.ClusterInfo{{Name: "localhost:8080", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "localhost:8080", Weight: 200}},
 			rbacEnabled:     true,
 			permission: &mesh_core.TrafficPermissionResource{
 				Meta: &test_model.ResourceMeta{
@@ -111,7 +111,7 @@ var _ = Describe("NetworkRbacConfigurer", func() {
 			listenerAddress: "192.168.0.1",
 			listenerPort:    8080,
 			statsName:       "localhost:8080",
-			clusters:        []envoy_common.ClusterInfo{{Name: "localhost:8080", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "localhost:8080", Weight: 200}},
 			rbacEnabled:     false,
 			permission: &mesh_core.TrafficPermissionResource{
 				Meta: &test_model.ResourceMeta{
diff --git a/pkg/xds/envoy/listeners/original_dst_forwarder_configurer_test.go b/pkg/xds/envoy/listeners/original_dst_forwarder_configurer_test.go
index 84e5a3a7476d..e04739277e65 100644
--- a/pkg/xds/envoy/listeners/original_dst_forwarder_configurer_test.go
+++ b/pkg/xds/envoy/listeners/original_dst_forwarder_configurer_test.go
@@ -18,7 +18,7 @@ var _ = Describe("OriginalDstForwarderConfigurer", func() {
 		listenerAddress string
 		listenerPort    uint32
 		statsName       string
-		clusters        []envoy_common.ClusterInfo
+		clusters        []envoy_common.ClusterSubset
 		expected        string
 	}
 
@@ -45,7 +45,7 @@ var _ = Describe("OriginalDstForwarderConfigurer", func() {
 			listenerAddress: "0.0.0.0",
 			listenerPort:    12345,
 			statsName:       "pass_through",
-			clusters:        []envoy_common.ClusterInfo{{Name: "pass_through", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "pass_through", Weight: 200}},
 			expected: `
             name: catch_all
             trafficDirection: OUTBOUND
diff --git a/pkg/xds/envoy/listeners/server_mtls_configurer_test.go b/pkg/xds/envoy/listeners/server_mtls_configurer_test.go
index a6678db388ed..852da672674b 100644
--- a/pkg/xds/envoy/listeners/server_mtls_configurer_test.go
+++ b/pkg/xds/envoy/listeners/server_mtls_configurer_test.go
@@ -24,7 +24,7 @@ var _ = Describe("ServerMtlsConfigurer", func() {
 		listenerAddress string
 		listenerPort    uint32
 		statsName       string
-		clusters        []envoy_common.ClusterInfo
+		clusters        []envoy_common.ClusterSubset
 		ctx             xds_context.Context
 		metadata        core_xds.DataplaneMetadata
 		expected        string
@@ -53,7 +53,7 @@ var _ = Describe("ServerMtlsConfigurer", func() {
 			listenerAddress: "192.168.0.1",
 			listenerPort:    8080,
 			statsName:       "localhost:8080",
-			clusters:        []envoy_common.ClusterInfo{{Name: "localhost:8080", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "localhost:8080", Weight: 200}},
 			ctx: xds_context.Context{
 				ControlPlane: &xds_context.ControlPlaneContext{
 					SdsLocation: "kuma-control-plane:5677",
@@ -136,7 +136,7 @@ var _ = Describe("ServerMtlsConfigurer", func() {
 			listenerAddress: "192.168.0.1",
 			listenerPort:    8080,
 			statsName:       "localhost:8080",
-			clusters:        []envoy_common.ClusterInfo{{Name: "localhost:8080", Weight: 200}},
+			clusters:        []envoy_common.ClusterSubset{{ClusterName: "localhost:8080", Weight: 200}},
 			ctx: xds_context.Context{
 				ControlPlane: &xds_context.ControlPlaneContext{
 					SdsLocation: "kuma-control-plane:5677",
diff --git a/pkg/xds/envoy/listeners/tcp_proxy_configurer.go b/pkg/xds/envoy/listeners/tcp_proxy_configurer.go
index 671b5084f9ca..6edf0b7722da 100644
--- a/pkg/xds/envoy/listeners/tcp_proxy_configurer.go
+++ b/pkg/xds/envoy/listeners/tcp_proxy_configurer.go
@@ -1,19 +1,16 @@
 package listeners
 
 import (
-	"github.com/golang/protobuf/ptypes"
-
-	"github.com/Kong/kuma/pkg/xds/envoy/endpoints"
-
 	envoy_listener "github.com/envoyproxy/go-control-plane/envoy/api/v2/listener"
 	envoy_tcp "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/tcp_proxy/v2"
 	envoy_wellknown "github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes"
 
 	util_xds "github.com/Kong/kuma/pkg/util/xds"
 	envoy_common "github.com/Kong/kuma/pkg/xds/envoy"
 )
 
-func TcpProxy(statsName string, clusters ...envoy_common.ClusterInfo) FilterChainBuilderOpt {
+func TcpProxy(statsName string, clusters ...envoy_common.ClusterSubset) FilterChainBuilderOpt {
 	return FilterChainBuilderOptFunc(func(config *FilterChainBuilderConfig) {
 		config.Add(&TcpProxyConfigurer{
 			statsName: statsName,
@@ -22,21 +19,10 @@ func TcpProxy(statsName string, clusters ...envoy_common.ClusterInfo) FilterChai
 	})
 }
 
-func TcpProxyWithMetaMatch(statsName string, cluster envoy_common.ClusterInfo) FilterChainBuilderOpt {
-	return FilterChainBuilderOptFunc(func(config *FilterChainBuilderConfig) {
-		config.Add(&TcpProxyConfigurer{
-			statsName: statsName,
-			clusters:  []envoy_common.ClusterInfo{cluster},
-			metaMatch: true,
-		})
-	})
-}
-
 type TcpProxyConfigurer struct {
 	statsName string
 	// Clusters to forward traffic to.
-	clusters  []envoy_common.ClusterInfo
-	metaMatch bool
+	clusters []envoy_common.ClusterSubset
 }
 
 func (c *TcpProxyConfigurer) Configure(filterChain *envoy_listener.FilterChain) error {
@@ -60,19 +46,17 @@ func (c *TcpProxyConfigurer) tcpProxy() *envoy_tcp.TcpProxy {
 	proxy := envoy_tcp.TcpProxy{
 		StatPrefix: util_xds.SanitizeMetric(c.statsName),
 	}
-	if len(c.clusters) == 1 {
+	if len(c.clusters) == 1 && envoy_common.Metadata(c.clusters[0].Tags) == nil {
 		proxy.ClusterSpecifier = &envoy_tcp.TcpProxy_Cluster{
-			Cluster: c.clusters[0].Name,
-		}
-		if c.metaMatch {
-			proxy.MetadataMatch = endpoints.CreateLbMetadata(c.clusters[0].Tags)
+			Cluster: c.clusters[0].ClusterName,
 		}
 	} else {
 		var weightedClusters []*envoy_tcp.TcpProxy_WeightedCluster_ClusterWeight
 		for _, cluster := range c.clusters {
 			weightedClusters = append(weightedClusters, &envoy_tcp.TcpProxy_WeightedCluster_ClusterWeight{
-				Name:   cluster.Name,
-				Weight: cluster.Weight,
+				Name:          cluster.ClusterName,
+				Weight:        cluster.Weight,
+				MetadataMatch: envoy_common.Metadata(cluster.Tags),
 			})
 		}
 		proxy.ClusterSpecifier = &envoy_tcp.TcpProxy_WeightedClusters{
diff --git a/pkg/xds/envoy/listeners/tcp_proxy_configurer_test.go b/pkg/xds/envoy/listeners/tcp_proxy_configurer_test.go
index 7efbc5a1f4d7..5ecec588a076 100644
--- a/pkg/xds/envoy/listeners/tcp_proxy_configurer_test.go
+++ b/pkg/xds/envoy/listeners/tcp_proxy_configurer_test.go
@@ -18,7 +18,7 @@ var _ = Describe("TcpProxyConfigurer", func() {
 		listenerAddress string
 		listenerPort    uint32
 		statsName       string
-		clusters        []envoy_common.ClusterInfo
+		clusters        []envoy_common.ClusterSubset
 		expected        string
 	}
 
@@ -44,8 +44,8 @@ var _ = Describe("TcpProxyConfigurer", func() {
 			listenerAddress: "192.168.0.1",
 			listenerPort:    8080,
 			statsName:       "localhost:8080",
-			clusters: []envoy_common.ClusterInfo{
-				{Name: "localhost:8080", Weight: 200},
+			clusters: []envoy_common.ClusterSubset{
+				{ClusterName: "localhost:8080", Weight: 200},
 			},
 			expected: `
         name: inbound:192.168.0.1:8080
@@ -68,18 +68,16 @@ var _ = Describe("TcpProxyConfigurer", func() {
 			listenerAddress: "127.0.0.1",
 			listenerPort:    5432,
 			statsName:       "db",
-			clusters: []envoy_common.ClusterInfo{{
-				Name:   "db{version=v1}",
-				Weight: 10,
-				Tags:   map[string]string{"service": "db", "version": "v1"},
+			clusters: []envoy_common.ClusterSubset{{
+				ClusterName: "db",
+				Weight:      10,
+				Tags:        map[string]string{"service": "db", "version": "v1"},
 			}, {
-				Name:   "db{version=v2}",
-				Weight: 90,
-				Tags:   map[string]string{"service": "db", "version": "v2"},
+				ClusterName: "db",
+				Weight:      90,
+				Tags:        map[string]string{"service": "db", "version": "v2"},
 			}},
 			expected: `
-            name: inbound:127.0.0.1:5432
-            trafficDirection: INBOUND
             address:
               socketAddress:
                 address: 127.0.0.1
@@ -92,11 +90,20 @@ var _ = Describe("TcpProxyConfigurer", func() {
                   statPrefix: db
                   weightedClusters:
                     clusters:
-                    - name: db{version=v1}
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            version: v1
+                      name: db
                       weight: 10
-                    - name: db{version=v2}
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            version: v2
+                      name: db
                       weight: 90
-`,
+            name: inbound:127.0.0.1:5432
+            trafficDirection: INBOUND`,
 		}),
 	)
 })
diff --git a/pkg/xds/envoy/metadata.go b/pkg/xds/envoy/metadata.go
new file mode 100644
index 000000000000..1c2fb0e5fbe9
--- /dev/null
+++ b/pkg/xds/envoy/metadata.go
@@ -0,0 +1,34 @@
+package envoy
+
+import (
+	envoy_core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
+	pstruct "github.com/golang/protobuf/ptypes/struct"
+
+	mesh_proto "github.com/Kong/kuma/api/mesh/v1alpha1"
+)
+
+func Metadata(tags Tags) *envoy_core.Metadata {
+	tags = tags.WithoutTag(mesh_proto.ServiceTag) // service name is already in cluster name, we don't need it in metadata
+	if len(tags) == 0 {
+		return nil
+	}
+	fields := map[string]*pstruct.Value{}
+	for key, value := range tags {
+		if key == mesh_proto.ServiceTag {
+			continue
+		}
+		fields[key] = &pstruct.Value{
+			Kind: &pstruct.Value_StringValue{
+				StringValue: value,
+			},
+		}
+	}
+	metadata := &envoy_core.Metadata{
+		FilterMetadata: map[string]*pstruct.Struct{
+			"envoy.lb": {
+				Fields: fields,
+			},
+		},
+	}
+	return metadata
+}
diff --git a/pkg/xds/envoy/metadata_test.go b/pkg/xds/envoy/metadata_test.go
new file mode 100644
index 000000000000..e33e7f4858f7
--- /dev/null
+++ b/pkg/xds/envoy/metadata_test.go
@@ -0,0 +1,64 @@
+package envoy
+
+import (
+	util_proto "github.com/Kong/kuma/pkg/util/proto"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/extensions/table"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Metadata()", func() {
+
+	It("should handle `nil` map of tags", func() {
+		// when
+		metadata := Metadata(nil)
+		// then
+		Expect(metadata).To(BeNil())
+	})
+
+	It("should handle empty map of tags", func() {
+		// when
+		metadata := Metadata(map[string]string{})
+		// then
+		Expect(metadata).To(BeNil())
+	})
+
+	It("should skip service tag", func() {
+		// when
+		metadata := Metadata(map[string]string{
+			"service": "backend",
+		})
+		// then
+		Expect(metadata).To(BeNil())
+	})
+
+	type testCase struct {
+		tags     map[string]string
+		expected string
+	}
+	DescribeTable("should generate Envoy metadata",
+		func(given testCase) {
+			// when
+			metadata := Metadata(given.tags)
+			// and
+			actual, err := util_proto.ToYAML(metadata)
+			// then
+			Expect(err).ToNot(HaveOccurred())
+			Expect(actual).To(MatchYAML(given.expected))
+		},
+		Entry("map with multiple tags", testCase{
+			tags: map[string]string{
+				"service": "redis",
+				"version": "v1",
+				"region":  "eu",
+			},
+			expected: `
+                filterMetadata:
+                  envoy.lb:
+                    version: v1
+                    region: eu
+`,
+		}),
+	)
+})
diff --git a/pkg/xds/envoy/names/resource_names.go b/pkg/xds/envoy/names/resource_names.go
index 22b5d1a7c2bd..dbc9500f29c2 100644
--- a/pkg/xds/envoy/names/resource_names.go
+++ b/pkg/xds/envoy/names/resource_names.go
@@ -2,10 +2,6 @@ package names
 
 import (
 	"fmt"
-	"sort"
-	"strings"
-
-	mesh_proto "github.com/Kong/kuma/api/mesh/v1alpha1"
 )
 
 func GetLocalClusterName(port uint32) string {
@@ -35,18 +31,3 @@ func GetEnvoyAdminClusterName() string {
 func GetPrometheusListenerName() string {
 	return "kuma:metrics:prometheus"
 }
-
-func GetDestinationClusterName(service string, selector map[string]string) string {
-	var pairs []string
-	for key, value := range selector {
-		if key == mesh_proto.ServiceTag {
-			continue
-		}
-		pairs = append(pairs, fmt.Sprintf("%s=%s", key, value))
-	}
-	if len(pairs) == 0 {
-		return service
-	}
-	sort.Strings(pairs)
-	return fmt.Sprintf("%s{%s}", service, strings.Join(pairs, ","))
-}
diff --git a/pkg/xds/envoy/routes/default_route_configurer.go b/pkg/xds/envoy/routes/default_route_configurer.go
index 7674328a3df9..e1ff2132ef1a 100644
--- a/pkg/xds/envoy/routes/default_route_configurer.go
+++ b/pkg/xds/envoy/routes/default_route_configurer.go
@@ -8,11 +8,11 @@ import (
 	envoy_common "github.com/Kong/kuma/pkg/xds/envoy"
 )
 
-func DefaultRoute(clusters ...envoy_common.ClusterInfo) VirtualHostBuilderOpt {
+func DefaultRoute(subsets ...envoy_common.ClusterSubset) VirtualHostBuilderOpt {
 	return VirtualHostBuilderOptFunc(func(config *VirtualHostBuilderConfig) {
 		config.Add(&DefaultRouteConfigurer{
 			RouteConfigurer: RouteConfigurer{
-				clusters: clusters,
+				subsets: subsets,
 			},
 		})
 	})
@@ -38,22 +38,23 @@ func (c DefaultRouteConfigurer) Configure(virtualHost *envoy_route.VirtualHost)
 }
 
 type RouteConfigurer struct {
-	// Clusters to forward traffic to.
-	clusters []envoy_common.ClusterInfo
+	// Subsets to forward traffic to.
+	subsets []envoy_common.ClusterSubset
 }
 
 func (c RouteConfigurer) routeAction() *envoy_route.RouteAction {
 	routeAction := envoy_route.RouteAction{}
-	if len(c.clusters) == 1 {
+	if len(c.subsets) == 1 && envoy_common.Metadata(c.subsets[0].Tags) == nil {
 		routeAction.ClusterSpecifier = &envoy_route.RouteAction_Cluster{
-			Cluster: c.clusters[0].Name,
+			Cluster: c.subsets[0].ClusterName,
 		}
 	} else {
 		var weightedClusters []*envoy_route.WeightedCluster_ClusterWeight
-		for _, cluster := range c.clusters {
+		for _, subset := range c.subsets {
 			weightedClusters = append(weightedClusters, &envoy_route.WeightedCluster_ClusterWeight{
-				Name:   cluster.Name,
-				Weight: &wrappers.UInt32Value{Value: cluster.Weight},
+				Name:          subset.ClusterName,
+				Weight:        &wrappers.UInt32Value{Value: subset.Weight},
+				MetadataMatch: envoy_common.Metadata(subset.Tags),
 			})
 		}
 		routeAction.ClusterSpecifier = &envoy_route.RouteAction_WeightedClusters{
diff --git a/pkg/xds/envoy/routes/default_route_configurer_test.go b/pkg/xds/envoy/routes/default_route_configurer_test.go
index 998dcf18fc10..7d27f80876f5 100644
--- a/pkg/xds/envoy/routes/default_route_configurer_test.go
+++ b/pkg/xds/envoy/routes/default_route_configurer_test.go
@@ -14,7 +14,7 @@ import (
 var _ = Describe("DefaultRouteConfigurer", func() {
 
 	type testCase struct {
-		clusters []envoy_common.ClusterInfo
+		clusters []envoy_common.ClusterSubset
 		expected string
 	}
 
@@ -35,8 +35,8 @@ var _ = Describe("DefaultRouteConfigurer", func() {
 			Expect(actual).To(MatchYAML(given.expected))
 		},
 		Entry("basic VirtualHost with a single destination cluster", testCase{
-			clusters: []envoy_common.ClusterInfo{
-				{Name: "backend", Weight: 200},
+			clusters: []envoy_common.ClusterSubset{
+				{ClusterName: "backend", Weight: 200},
 			},
 			expected: `
             routes:
@@ -47,9 +47,9 @@ var _ = Describe("DefaultRouteConfigurer", func() {
 `,
 		}),
 		Entry("basic VirtualHost with weighted destination clusters", testCase{
-			clusters: []envoy_common.ClusterInfo{
-				{Name: "backend{version=v1}", Weight: 30},
-				{Name: "backend{version=v2}", Weight: 70},
+			clusters: []envoy_common.ClusterSubset{
+				{ClusterName: "backend", Weight: 30, Tags: map[string]string{"version": "v1"}},
+				{ClusterName: "backend", Weight: 70, Tags: map[string]string{"version": "v2"}},
 			},
 			expected: `
             routes:
@@ -58,9 +58,17 @@ var _ = Describe("DefaultRouteConfigurer", func() {
               route:
                 weightedClusters:
                   clusters:
-                  - name: backend{version=v1}
+                  - metadataMatch:
+                      filterMetadata:
+                        envoy.lb:
+                          version: v1
+                    name: backend
                     weight: 30
-                  - name: backend{version=v2}
+                  - metadataMatch:
+                      filterMetadata:
+                        envoy.lb:
+                          version: v2
+                    name: backend
                     weight: 70
 `,
 		}),
diff --git a/pkg/xds/envoy/types.go b/pkg/xds/envoy/types.go
index efff425446cf..b8e96878b2d0 100644
--- a/pkg/xds/envoy/types.go
+++ b/pkg/xds/envoy/types.go
@@ -1,7 +1,55 @@
 package envoy
 
-type ClusterInfo struct {
-	Name   string
-	Weight uint32
-	Tags   map[string]string
+import "sort"
+
+type ClusterSubset struct {
+	ClusterName string
+	Weight      uint32
+	Tags        Tags
+}
+
+type Tags map[string]string
+
+func (t Tags) WithoutTag(tag string) Tags {
+	result := Tags{}
+	for tagName, tagValue := range t {
+		if tag != tagName {
+			result[tagName] = tagValue
+		}
+	}
+	return result
+}
+
+func (t Tags) Keys() []string {
+	var keys []string
+	for key := range t {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+type Clusters map[string][]ClusterSubset
+
+func (c Clusters) ClusterNames() []string {
+	var keys []string
+	for key := range c {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func (c Clusters) Add(infos ...ClusterSubset) {
+	for _, info := range infos {
+		c[info.ClusterName] = append(c[info.ClusterName], info)
+	}
+}
+
+func (c Clusters) Tags(name string) []Tags {
+	var result []Tags
+	for _, info := range c[name] {
+		result = append(result, info.Tags)
+	}
+	return result
 }
diff --git a/pkg/xds/generator/direct_access_proxy_generator.go b/pkg/xds/generator/direct_access_proxy_generator.go
index 98abd2eb5118..b8e9ab5fe859 100644
--- a/pkg/xds/generator/direct_access_proxy_generator.go
+++ b/pkg/xds/generator/direct_access_proxy_generator.go
@@ -46,7 +46,7 @@ func (_ DirectAccessProxyGenerator) Generate(ctx xds_context.Context, proxy *cor
 		listener, err := envoy_listeners.NewListenerBuilder().
 			Configure(envoy_listeners.OutboundListener(name, endpoint.Address, endpoint.Port)).
 			Configure(envoy_listeners.FilterChain(envoy_listeners.NewFilterChainBuilder().
-				Configure(envoy_listeners.TcpProxy(name, envoy_common.ClusterInfo{Name: "direct_access"})).
+				Configure(envoy_listeners.TcpProxy(name, envoy_common.ClusterSubset{ClusterName: "direct_access"})).
 				Configure(envoy_listeners.NetworkAccessLog(meshName, envoy_listeners.TrafficDirectionOutbound, sourceService, name, proxy.Logs[mesh_core.PassThroughService], proxy)))).
 			Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
 			Build()
diff --git a/pkg/xds/generator/inbound_proxy_generator.go b/pkg/xds/generator/inbound_proxy_generator.go
index 257df0114e96..fa42b3447bc7 100644
--- a/pkg/xds/generator/inbound_proxy_generator.go
+++ b/pkg/xds/generator/inbound_proxy_generator.go
@@ -51,12 +51,12 @@ func (g InboundProxyGenerator) Generate(ctx xds_context.Context, proxy *model.Pr
 					Configure(envoy_listeners.HttpConnectionManager(localClusterName)).
 					Configure(envoy_listeners.FaultInjection(proxy.FaultInjections[endpoint])).
 					Configure(envoy_listeners.Tracing(proxy.TracingBackend)).
-					Configure(envoy_listeners.HttpInboundRoute(service, envoy_common.ClusterInfo{Name: localClusterName}))
+					Configure(envoy_listeners.HttpInboundRoute(service, envoy_common.ClusterSubset{ClusterName: localClusterName}))
 			case mesh_core.ProtocolTCP:
 				fallthrough
 			default:
 				// configuration for non-HTTP cases
-				filterChainBuilder.Configure(envoy_listeners.TcpProxy(localClusterName, envoy_common.ClusterInfo{Name: localClusterName}))
+				filterChainBuilder.Configure(envoy_listeners.TcpProxy(localClusterName, envoy_common.ClusterSubset{ClusterName: localClusterName}))
 			}
 			return filterChainBuilder.
 				Configure(envoy_listeners.ServerSideMTLS(ctx, proxy.Metadata)).
diff --git a/pkg/xds/generator/ingress_generator.go b/pkg/xds/generator/ingress_generator.go
index 9e5140eee216..95412c4312e7 100644
--- a/pkg/xds/generator/ingress_generator.go
+++ b/pkg/xds/generator/ingress_generator.go
@@ -44,9 +44,9 @@ func (i IngressGenerator) Generate(ctx xds_context.Context, proxy *model.Proxy)
 			inboundListenerBuilder = inboundListenerBuilder.
 				Configure(envoy_listeners.FilterChain(envoy_listeners.NewFilterChainBuilder().
 					Configure(envoy_listeners.FilterChainMatch(perm)).
-					Configure(envoy_listeners.TcpProxyWithMetaMatch(service, envoy_common.ClusterInfo{
-						Name: service,
-						Tags: TagsBySNI(perm),
+					Configure(envoy_listeners.TcpProxy(service, envoy_common.ClusterSubset{
+						ClusterName: service,
+						Tags:        TagsBySNI(perm),
 					}))))
 		}
 	}
diff --git a/pkg/xds/generator/outbound_proxy_generator.go b/pkg/xds/generator/outbound_proxy_generator.go
index c6b28dd0dc3f..0738fbff838c 100644
--- a/pkg/xds/generator/outbound_proxy_generator.go
+++ b/pkg/xds/generator/outbound_proxy_generator.go
@@ -1,16 +1,19 @@
 package generator
 
 import (
+	envoy_api_v2 "github.com/envoyproxy/go-control-plane/envoy/api/v2"
+
+	"github.com/Kong/kuma/pkg/core/validators"
+	envoy_endpoints "github.com/Kong/kuma/pkg/xds/envoy/endpoints"
+	envoy_names "github.com/Kong/kuma/pkg/xds/envoy/names"
+	envoy_routes "github.com/Kong/kuma/pkg/xds/envoy/routes"
+
 	"github.com/pkg/errors"
 
 	kuma_mesh "github.com/Kong/kuma/api/mesh/v1alpha1"
 	mesh_core "github.com/Kong/kuma/pkg/core/resources/apis/mesh"
-	"github.com/Kong/kuma/pkg/core/validators"
 	model "github.com/Kong/kuma/pkg/core/xds"
 	xds_context "github.com/Kong/kuma/pkg/xds/context"
-	envoy_endpoints "github.com/Kong/kuma/pkg/xds/envoy/endpoints"
-	envoy_names "github.com/Kong/kuma/pkg/xds/envoy/names"
-	envoy_routes "github.com/Kong/kuma/pkg/xds/envoy/routes"
 
 	envoy_common "github.com/Kong/kuma/pkg/xds/envoy"
 	envoy_clusters "github.com/Kong/kuma/pkg/xds/envoy/clusters"
@@ -26,142 +29,172 @@ func (g OutboundProxyGenerator) Generate(ctx xds_context.Context, proxy *model.P
 		return nil, nil
 	}
 	resources := &model.ResourceSet{}
-	sourceService := proxy.Dataplane.Spec.GetIdentifyingService()
-	meshName := ctx.Mesh.Resource.GetMeta().GetName()
-	ofaces, err := proxy.Dataplane.Spec.Networking.GetOutboundInterfaces()
-	if err != nil {
-		return nil, err
-	}
-	for i, outbound := range outbounds {
-		// pick a route
-		route := proxy.TrafficRoutes[outbound.Service]
-		if route == nil {
-			return nil, errors.Errorf("%s{service=%q}: has no TrafficRoute", validators.RootedAt("dataplane").Field("networking").Field("outbound").Index(i), outbound.Service)
-		}
+	clusters := envoy_common.Clusters{}
 
-		// determine the list of destination clusters
-		clusters, err := g.determineClusters(ctx, proxy, route)
+	for _, outbound := range outbounds {
+		// Determine the list of destination subsets
+		// For one outbound listener it may contain many subsets (ex. TrafficRoute to many destinations)
+		subsets, err := g.determineSubsets(proxy, outbound)
 		if err != nil {
 			return nil, err
 		}
+		clusters.Add(subsets...)
 
-		// generate CDS and EDS resources
-		edsResources, endpoints, err := g.generateEds(ctx, proxy, clusters)
+		protocol := g.inferProtocol(proxy, subsets)
+
+		// Generate listener
+		listener, err := g.generateLDS(proxy, subsets, outbound, protocol)
 		if err != nil {
 			return nil, err
 		}
-		resources.Add(edsResources...)
-
-		protocol := InferServiceProtocol(endpoints)
-
-		// generate LDS resource
-		outboundListenerName := envoy_names.GetOutboundListenerName(ofaces[i].DataplaneIP, ofaces[i].DataplanePort)
-		outboundRouteName := envoy_names.GetOutboundRouteName(outbound.Service)
-		destinationService := outbound.Service
-		filterChainBuilder := func() *envoy_listeners.FilterChainBuilder {
-			filterChainBuilder := envoy_listeners.NewFilterChainBuilder()
-			switch protocol {
-			case mesh_core.ProtocolHTTP:
-				// configuration for HTTP case
-				filterChainBuilder.
-					Configure(envoy_listeners.HttpConnectionManager(outbound.Service)).
-					Configure(envoy_listeners.Tracing(proxy.TracingBackend)).
-					Configure(envoy_listeners.HttpAccessLog(meshName, envoy_listeners.TrafficDirectionOutbound, sourceService, destinationService, proxy.Logs[outbound.Service], proxy)).
-					Configure(envoy_listeners.HttpOutboundRoute(outboundRouteName))
-			case mesh_core.ProtocolTCP:
-				fallthrough
-			default:
-				// configuration for non-HTTP cases
-				filterChainBuilder.
-					Configure(envoy_listeners.TcpProxy(outbound.Service, clusters...)).
-					Configure(envoy_listeners.NetworkAccessLog(meshName, envoy_listeners.TrafficDirectionOutbound, sourceService, destinationService, proxy.Logs[outbound.Service], proxy))
-			}
-			return filterChainBuilder
-		}()
-		listener, err := envoy_listeners.NewListenerBuilder().
-			Configure(envoy_listeners.OutboundListener(outboundListenerName, ofaces[i].DataplaneIP, ofaces[i].DataplanePort)).
-			Configure(envoy_listeners.FilterChain(filterChainBuilder)).
-			Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
-			Build()
-		if err != nil {
-			return nil, errors.Wrapf(err, "%s: could not generate listener %s", validators.RootedAt("dataplane").Field("networking").Field("outbound").Index(i), outboundListenerName)
-		}
 		resources.AddNamed(listener)
 
-		// generate RDS resources
-		rdsResources, err := g.generateRds(protocol, outbound.Service, outboundRouteName, clusters, proxy.Dataplane.Spec.Tags())
-		if err != nil {
-			return nil, err
+		// Generate route, routes are only applicable to the HTTP
+		if protocol == mesh_core.ProtocolHTTP {
+			route, err := g.generateRDS(proxy, subsets, outbound)
+			if err != nil {
+				return nil, err
+			}
+			resources.AddNamed(route)
 		}
-		resources.Add(rdsResources...)
 	}
 
+	// Generate clusters. It cannot be generated on the fly with outbound loop because we need to know all subsets of the cluster for every service.
+	cdsResources, err := g.generateCDS(ctx, proxy, clusters)
+	if err != nil {
+		return nil, err
+	}
+	resources.AddSet(cdsResources)
+
+	edsResources := g.generateEDS(proxy, clusters)
+	resources.AddSet(edsResources)
+
 	return resources.List(), nil
 }
 
-func (_ OutboundProxyGenerator) determineClusters(ctx xds_context.Context, proxy *model.Proxy, route *mesh_core.TrafficRouteResource) (clusters []envoy_common.ClusterInfo, err error) {
-	for j, destination := range route.Spec.Conf {
-		service, ok := destination.Destination[kuma_mesh.ServiceTag]
-		if !ok {
-			return nil, errors.Errorf("trafficroute{name=%q}.%s: mandatory tag %q is missing: %v", route.GetMeta().GetName(), validators.RootedAt("conf").Index(j).Field("destination"), kuma_mesh.ServiceTag, destination.Destination)
-		}
-		if destination.Weight == 0 {
-			// Envoy doesn't support 0 weight
-			continue
+func (_ OutboundProxyGenerator) generateLDS(proxy *model.Proxy, subsets []envoy_common.ClusterSubset, outbound *kuma_mesh.Dataplane_Networking_Outbound, protocol mesh_core.Protocol) (*envoy_api_v2.Listener, error) {
+	oface, err := proxy.Dataplane.Spec.Networking.ToOutboundInterface(outbound)
+	if err != nil {
+		return nil, err
+	}
+
+	meshName := proxy.Dataplane.Meta.GetMesh()
+	sourceService := proxy.Dataplane.Spec.GetIdentifyingService()
+	serviceName := outbound.GetTagsIncludingLegacy()[kuma_mesh.ServiceTag]
+	outboundListenerName := envoy_names.GetOutboundListenerName(oface.DataplaneIP, oface.DataplanePort)
+	filterChainBuilder := func() *envoy_listeners.FilterChainBuilder {
+		filterChainBuilder := envoy_listeners.NewFilterChainBuilder()
+		switch protocol {
+		case mesh_core.ProtocolHTTP:
+			// configuration for HTTP case
+			filterChainBuilder.
+				Configure(envoy_listeners.HttpConnectionManager(serviceName)).
+				Configure(envoy_listeners.Tracing(proxy.TracingBackend)).
+				Configure(envoy_listeners.HttpAccessLog(meshName, envoy_listeners.TrafficDirectionOutbound, sourceService, serviceName, proxy.Logs[serviceName], proxy)).
+				Configure(envoy_listeners.HttpOutboundRoute(envoy_names.GetOutboundRouteName(serviceName)))
+		case mesh_core.ProtocolTCP:
+			fallthrough
+		default:
+			// configuration for non-HTTP cases
+			filterChainBuilder.
+				Configure(envoy_listeners.TcpProxy(serviceName, subsets...)).
+				Configure(envoy_listeners.NetworkAccessLog(meshName, envoy_listeners.TrafficDirectionOutbound, sourceService, serviceName, proxy.Logs[serviceName], proxy))
 		}
-		clusters = append(clusters, envoy_common.ClusterInfo{
-			Name:   envoy_names.GetDestinationClusterName(service, destination.Destination),
-			Weight: destination.Weight,
-			Tags:   destination.Destination,
-		})
+		return filterChainBuilder
+	}()
+	listener, err := envoy_listeners.NewListenerBuilder().
+		Configure(envoy_listeners.OutboundListener(outboundListenerName, oface.DataplaneIP, oface.DataplanePort)).
+		Configure(envoy_listeners.FilterChain(filterChainBuilder)).
+		Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
+		Build()
+	if err != nil {
+		return nil, errors.Wrapf(err, "could not generate listener %s for service %s", outboundListenerName, serviceName)
 	}
-	return
+	return listener, nil
 }
 
-func (_ OutboundProxyGenerator) generateEds(ctx xds_context.Context, proxy *model.Proxy, clusters []envoy_common.ClusterInfo) (resources []*model.Resource, allEndpoints []model.Endpoint, _ error) {
-	for _, cluster := range clusters {
-		serviceName := cluster.Tags[kuma_mesh.ServiceTag]
+func (_ OutboundProxyGenerator) generateCDS(ctx xds_context.Context, proxy *model.Proxy, clusters envoy_common.Clusters) (model.ResourceSet, error) {
+	var resources model.ResourceSet
+	for _, clusterName := range clusters.ClusterNames() {
+		serviceName := clusters.Tags(clusterName)[0][kuma_mesh.ServiceTag]
 		healthCheck := proxy.HealthChecks[serviceName]
 		circuitBreaker := proxy.CircuitBreakers[serviceName]
 		edsCluster, err := envoy_clusters.NewClusterBuilder().
-			Configure(envoy_clusters.EdsCluster(cluster.Name)).
-			Configure(envoy_clusters.ClientSideMTLSWithSNI(ctx, proxy.Metadata, serviceName, cluster.Name)).
+			Configure(envoy_clusters.EdsCluster(clusterName)).
+			Configure(envoy_clusters.LbSubset(clusters.Tags(clusterName))).
+			Configure(envoy_clusters.ClientSideMTLSWithSNI(ctx, proxy.Metadata, serviceName, clusterName)).
 			Configure(envoy_clusters.OutlierDetection(circuitBreaker)).
 			Configure(envoy_clusters.HealthCheck(healthCheck)).
 			Build()
 		if err != nil {
-			return nil, nil, err
+			return model.ResourceSet{}, err
 		}
-		resources = append(resources, &model.Resource{
-			Name:     cluster.Name,
-			Resource: edsCluster,
-		})
-		endpoints := model.EndpointList(proxy.OutboundTargets[serviceName]).Filter(cluster.Tags)
-		resources = append(resources, &model.Resource{
-			Name:     cluster.Name,
-			Resource: envoy_endpoints.CreateClusterLoadAssignment(cluster.Name, endpoints),
+		resources.AddNamed(edsCluster)
+	}
+	return resources, nil
+}
+
+func (_ OutboundProxyGenerator) generateEDS(proxy *model.Proxy, clusters envoy_common.Clusters) model.ResourceSet {
+	var resources model.ResourceSet
+	for _, clusterName := range clusters.ClusterNames() {
+		serviceName := clusters.Tags(clusterName)[0][kuma_mesh.ServiceTag]
+		endpoints := model.EndpointList(proxy.OutboundTargets[serviceName])
+		loadAssignment := envoy_endpoints.CreateClusterLoadAssignment(clusterName, endpoints)
+		resources.Add(&model.Resource{
+			Name:     clusterName,
+			Resource: loadAssignment,
 		})
+	}
+	return resources
+}
+
+// inferProtocol infers protocol for the destination listener. It will only return HTTP when all endpoints are tagged with HTTP.
+func (_ OutboundProxyGenerator) inferProtocol(proxy *model.Proxy, clusters []envoy_common.ClusterSubset) mesh_core.Protocol {
+	var allEndpoints []model.Endpoint
+	for _, cluster := range clusters {
+		serviceName := cluster.Tags[kuma_mesh.ServiceTag]
+		endpoints := model.EndpointList(proxy.OutboundTargets[serviceName])
 		allEndpoints = append(allEndpoints, endpoints...)
 	}
-	return
+	return InferServiceProtocol(allEndpoints)
 }
 
-func (_ OutboundProxyGenerator) generateRds(protocol mesh_core.Protocol, service string, outboundRouteName string, clusters []envoy_common.ClusterInfo, tags kuma_mesh.MultiValueTagSet) ([]*model.Resource, error) {
-	resources := &model.ResourceSet{}
-	switch protocol {
-	case mesh_core.ProtocolHTTP:
-		// generate RDS resource
-		routeConfiguration, err := envoy_routes.NewRouteConfigurationBuilder().
-			Configure(envoy_routes.CommonRouteConfiguration(outboundRouteName)).
-			Configure(envoy_routes.TagsHeader(tags)).
-			Configure(envoy_routes.VirtualHost(envoy_routes.NewVirtualHostBuilder().
-				Configure(envoy_routes.CommonVirtualHost(service)).
-				Configure(envoy_routes.DefaultRoute(clusters...)))).
-			Build()
-		if err != nil {
-			return nil, err
+func (_ OutboundProxyGenerator) determineSubsets(proxy *model.Proxy, outbound *kuma_mesh.Dataplane_Networking_Outbound) (subsets []envoy_common.ClusterSubset, err error) {
+	oface, err := proxy.Dataplane.Spec.Networking.ToOutboundInterface(outbound)
+	if err != nil {
+		return nil, err
+	}
+	route := proxy.TrafficRoutes[oface]
+	if route == nil { // should not happen since we always generate default route if TrafficRoute is not found
+		return nil, errors.Errorf("no TrafficRoute for outbound %s", oface)
+	}
+
+	for j, destination := range route.Spec.Conf {
+		service, ok := destination.Destination[kuma_mesh.ServiceTag]
+		if !ok { // should not happen since we validate traffic route
+			return nil, errors.Errorf("trafficroute{name=%q}.%s: mandatory tag %q is missing: %v", route.GetMeta().GetName(), validators.RootedAt("conf").Index(j).Field("destination"), kuma_mesh.ServiceTag, destination.Destination)
 		}
-		resources.AddNamed(routeConfiguration)
+		if destination.Weight == 0 {
+			// 0 assumes no traffic is passed there. Envoy doesn't support 0 weight, so instead of passing it to Envoy we just skip such cluster.
+			continue
+		}
+		subsets = append(subsets, envoy_common.ClusterSubset{
+			ClusterName: service,
+			Weight:      destination.Weight,
+			Tags:        destination.Destination,
+		})
 	}
-	return resources.List(), nil
+	return
+}
+
+func (_ OutboundProxyGenerator) generateRDS(proxy *model.Proxy, subsets []envoy_common.ClusterSubset, outbound *kuma_mesh.Dataplane_Networking_Outbound) (*envoy_api_v2.RouteConfiguration, error) {
+	serviceName := outbound.GetTagsIncludingLegacy()[kuma_mesh.ServiceTag]
+
+	return envoy_routes.NewRouteConfigurationBuilder().
+		Configure(envoy_routes.CommonRouteConfiguration(envoy_names.GetOutboundRouteName(serviceName))).
+		Configure(envoy_routes.TagsHeader(proxy.Dataplane.Spec.Tags())).
+		Configure(envoy_routes.VirtualHost(envoy_routes.NewVirtualHostBuilder().
+			Configure(envoy_routes.CommonVirtualHost(serviceName)).
+			Configure(envoy_routes.DefaultRoute(subsets...)))).
+		Build()
 }
diff --git a/pkg/xds/generator/outbound_proxy_generator_test.go b/pkg/xds/generator/outbound_proxy_generator_test.go
index f6f1bc467938..147f7a94dffb 100644
--- a/pkg/xds/generator/outbound_proxy_generator_test.go
+++ b/pkg/xds/generator/outbound_proxy_generator_test.go
@@ -7,7 +7,6 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
 	. "github.com/onsi/gomega"
-	gtypes "github.com/onsi/gomega/types"
 
 	mesh_proto "github.com/Kong/kuma/api/mesh/v1alpha1"
 	mesh_core "github.com/Kong/kuma/pkg/core/resources/apis/mesh"
@@ -75,12 +74,17 @@ var _ = Describe("OutboundProxyGenerator", func() {
 				Id: model.ProxyId{Name: "side-car", Mesh: "default"},
 				Dataplane: &mesh_core.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
+						Name:    "dp-1",
+						Mesh:    given.ctx.Mesh.Resource.Meta.GetName(),
 						Version: "1",
 					},
 					Spec: dataplane,
 				},
 				TrafficRoutes: model.RouteMap{
-					"api-http": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 40001,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 								Weight:      100,
@@ -88,7 +92,10 @@ var _ = Describe("OutboundProxyGenerator", func() {
 							}},
 						},
 					},
-					"api-tcp": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 40002,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 								Weight:      100,
@@ -96,7 +103,10 @@ var _ = Describe("OutboundProxyGenerator", func() {
 							}},
 						},
 					},
-					"backend": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 18080,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 								Weight:      100,
@@ -104,7 +114,10 @@ var _ = Describe("OutboundProxyGenerator", func() {
 							}},
 						},
 					},
-					"db": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 54321,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 								Weight:      10,
@@ -235,7 +248,7 @@ var _ = Describe("OutboundProxyGenerator", func() {
 `,
 			expected: "03.envoy.golden.yaml",
 		}),
-		Entry("4. transparent_proxying=true, mtls=true, outbound=4", testCase{
+		Entry("04. transparent_proxying=true, mtls=true, outbound=4", testCase{
 			ctx: mtlsCtx,
 			dataplane: `
             networking:
@@ -283,7 +296,10 @@ var _ = Describe("OutboundProxyGenerator", func() {
 				Spec: dataplane,
 			},
 			TrafficRoutes: model.RouteMap{
-				"backend.kuma-system": &mesh_core.TrafficRouteResource{
+				mesh_proto.OutboundInterface{
+					DataplaneIP:   "127.0.0.1",
+					DataplanePort: 18080,
+				}: &mesh_core.TrafficRouteResource{
 					Spec: mesh_proto.TrafficRoute{
 						Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 							Weight:      100,
@@ -291,7 +307,10 @@ var _ = Describe("OutboundProxyGenerator", func() {
 						}},
 					},
 				},
-				"db.kuma-system": &mesh_core.TrafficRouteResource{
+				mesh_proto.OutboundInterface{
+					DataplaneIP:   "127.0.0.1",
+					DataplanePort: 54321,
+				}: &mesh_core.TrafficRouteResource{
 					Spec: mesh_proto.TrafficRoute{
 						Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 							Weight:      100,
@@ -338,145 +357,4 @@ var _ = Describe("OutboundProxyGenerator", func() {
 		Expect(err).ToNot(HaveOccurred())
 		Expect(actual).To(MatchYAML(expected))
 	})
-
-	Describe("fail when a user-defined configuration (Dataplane, TrafficRoute, etc) is not valid", func() {
-
-		type testCase struct {
-			ctx                xds_context.Context
-			dataplane          string
-			chaos              func(*model.Proxy)
-			expectedErrMatcher gtypes.GomegaMatcher
-		}
-
-		noExtraChaos := func(*model.Proxy) {}
-
-		DescribeTable("Generate Envoy xDS resources",
-			func(given testCase) {
-				// setup
-				gen := &generator.OutboundProxyGenerator{}
-
-				dataplane := mesh_proto.Dataplane{}
-				Expect(util_proto.FromYAML([]byte(given.dataplane), &dataplane)).To(Succeed())
-
-				proxy := &model.Proxy{
-					Id: model.ProxyId{Name: "side-car", Mesh: "default"},
-					Dataplane: &mesh_core.DataplaneResource{
-						Meta: &test_model.ResourceMeta{
-							Version: "1",
-						},
-						Spec: dataplane,
-					},
-					TrafficRoutes: model.RouteMap{
-						"backend": &mesh_core.TrafficRouteResource{
-							Spec: mesh_proto.TrafficRoute{
-								Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
-									Weight:      100,
-									Destination: mesh_proto.MatchService("backend"),
-								}},
-							},
-						},
-						"db": &mesh_core.TrafficRouteResource{
-							Spec: mesh_proto.TrafficRoute{
-								Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
-									Weight:      10,
-									Destination: mesh_proto.TagSelector{"service": "db", "role": "master"},
-								}, {
-									Weight:      90,
-									Destination: mesh_proto.TagSelector{"service": "db", "role": "replica"},
-								}, {
-									Weight:      0, // should be excluded from Envoy configuration
-									Destination: mesh_proto.TagSelector{"service": "db", "role": "canary"},
-								}},
-							},
-						},
-					},
-					OutboundSelectors: model.DestinationMap{
-						"backend": model.TagSelectorSet{
-							{"service": "backend"},
-						},
-						"db": model.TagSelectorSet{
-							{"service": "db", "role": "master"},
-							{"service": "db", "role": "replica"},
-							{"service": "db", "role": "canary"},
-						},
-					},
-					OutboundTargets: model.EndpointMap{
-						"backend": []model.Endpoint{
-							{Target: "192.168.0.1", Port: 8081, Tags: map[string]string{"service": "backend", "region": "us"}},
-							{Target: "192.168.0.2", Port: 8082},
-						},
-						"db": []model.Endpoint{
-							{Target: "192.168.0.3", Port: 5432, Tags: map[string]string{"service": "db", "role": "master"}},
-						},
-					},
-					Metadata: &model.DataplaneMetadata{},
-				}
-
-				By("introducing an error into configuration")
-				given.chaos(proxy)
-
-				// when
-				rs, err := gen.Generate(given.ctx, proxy)
-
-				// then
-				Expect(err).To(HaveOccurred())
-				// and
-				Expect(err.Error()).To(given.expectedErrMatcher)
-				// and
-				Expect(rs).To(BeNil())
-			},
-			Entry("dataplane with an invalid outbound interface", testCase{
-				ctx: plainCtx,
-				dataplane: `
-                networking:
-                  outbound:
-                  - interface: 127:not-a-port
-                    service: backend
-`,
-				chaos:              noExtraChaos,
-				expectedErrMatcher: HavePrefix(`invalid DATAPLANE_IP in "127:not-a-port": "127" is not a valid IP address`),
-			}),
-			Entry("dataplane with an outbound interface that has no route", testCase{
-				ctx: plainCtx,
-				dataplane: `
-                networking:
-                  outbound:
-                  - port: 18080
-                    service: backend
-`,
-				chaos: func(proxy *model.Proxy) {
-					// simulate missing route
-					proxy.TrafficRoutes = nil
-				},
-				expectedErrMatcher: Equal(`dataplane.networking.outbound[0]{service="backend"}: has no TrafficRoute`),
-			}),
-			Entry("dataplane with an outbound interface that has a route without destination", testCase{
-				ctx: plainCtx,
-				dataplane: `
-                networking:
-                  outbound:
-                  - port: 18080
-                    service: backend
-`,
-				chaos: func(proxy *model.Proxy) {
-					// simulate missing route
-					proxy.TrafficRoutes = model.RouteMap{
-						"backend": &mesh_core.TrafficRouteResource{
-							Meta: &test_model.ResourceMeta{
-								Name: "route-without-destination",
-							},
-							Spec: mesh_proto.TrafficRoute{
-								Sources:      []*mesh_proto.Selector{{Match: mesh_proto.MatchAnyService()}},
-								Destinations: []*mesh_proto.Selector{{Match: mesh_proto.MatchAnyService()}},
-								Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
-									Weight: 100, Destination: map[string]string{"not-a-service": "value"},
-								}},
-							},
-						},
-					}
-				},
-				expectedErrMatcher: Equal(`trafficroute{name="route-without-destination"}.conf[0].destination: mandatory tag "service" is missing: map[not-a-service:value]`),
-			}),
-		)
-	})
 })
diff --git a/pkg/xds/generator/proxy_template_profile_source_test.go b/pkg/xds/generator/proxy_template_profile_source_test.go
index 004851470554..e4b3fe0c250c 100644
--- a/pkg/xds/generator/proxy_template_profile_source_test.go
+++ b/pkg/xds/generator/proxy_template_profile_source_test.go
@@ -65,7 +65,10 @@ var _ = Describe("ProxyTemplateProfileSource", func() {
 					Spec: dataplane,
 				},
 				TrafficRoutes: model.RouteMap{
-					"db": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 54321,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 								Weight:      100,
@@ -73,7 +76,10 @@ var _ = Describe("ProxyTemplateProfileSource", func() {
 							}},
 						},
 					},
-					"elastic": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 59200,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 								Weight:      100,
diff --git a/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml b/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml
index 38ab46ff7898..ac2dc8400ded 100644
--- a/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/ingress/01.envoy.golden.yaml
@@ -14,13 +14,14 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      region: eu
-                      service: backend
                 statPrefix: backend
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            region: eu
+                      name: backend
         - filterChainMatch:
             serverNames:
               - backend{version=v1}
@@ -28,13 +29,14 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      service: backend
-                      version: v1
                 statPrefix: backend
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            version: v1
+                      name: backend
         - filterChainMatch:
             serverNames:
               - backend{region=eu,version=v1}
@@ -42,14 +44,15 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      region: eu
-                      service: backend
-                      version: v1
                 statPrefix: backend
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            region: eu
+                            version: v1
+                      name: backend
         - filterChainMatch:
             serverNames:
               - backend
@@ -58,10 +61,6 @@ resources:
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
                 cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      service: backend
                 statPrefix: backend
         - filterChainMatch:
             serverNames:
@@ -70,13 +69,14 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      region: us
-                      service: backend
                 statPrefix: backend
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            region: us
+                      name: backend
         - filterChainMatch:
             serverNames:
               - backend{version=v2}
@@ -84,13 +84,14 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      service: backend
-                      version: v2
                 statPrefix: backend
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            version: v2
+                      name: backend
         - filterChainMatch:
             serverNames:
               - backend{region=us,version=v2}
@@ -98,14 +99,15 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      region: us
-                      service: backend
-                      version: v2
                 statPrefix: backend
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            region: us
+                            version: v2
+                      name: backend
         - filterChainMatch:
             serverNames:
               - backend
@@ -114,10 +116,6 @@ resources:
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
                 cluster: backend
-                metadataMatch:
-                  filterMetadata:
-                    envoy.lb:
-                      service: backend
                 statPrefix: backend
       listenerFilters:
         - config: {}
@@ -148,7 +146,6 @@ resources:
                 filterMetadata:
                   envoy.lb:
                     region: eu
-                    service: backend
                     version: v1
             - endpoint:
                 address:
@@ -159,5 +156,4 @@ resources:
                 filterMetadata:
                   envoy.lb:
                     region: us
-                    service: backend
-                    version: v2
\ No newline at end of file
+                    version: v2
diff --git a/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml
index 151f117424c1..82a791580a9b 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml
@@ -1,256 +1,252 @@
 resources:
-- name: backend
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
-    connectTimeout: 5s
-    edsClusterConfig:
-      edsConfig:
-        ads: {}
-    name: backend
-    type: EDS
-- name: backend
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-    clusterName: backend
-    endpoints:
-    - lbEndpoints:
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.1
-              portValue: 8081
-        metadata:
-          filterMetadata:
-            envoy.lb:
-              region: us
-              service: backend
-- name: outbound:127.0.0.1:18080
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
-    trafficDirection: OUTBOUND
-    address:
-      socketAddress:
-        address: 127.0.0.1
-        portValue: 18080
-    filterChains:
-    - filters:
-      - name: envoy.tcp_proxy
-        typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-          cluster: backend
-          statPrefix: backend
-    name: outbound:127.0.0.1:18080
-- name: db{role=master}
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
-    altStatName: db_role_master_
-    connectTimeout: 5s
-    edsClusterConfig:
-      edsConfig:
-        ads: {}
-    name: db{role=master}
-    type: EDS
-- name: db{role=master}
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-    clusterName: db{role=master}
-    endpoints:
-    - lbEndpoints:
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.3
-              portValue: 5432
-        metadata:
-          filterMetadata:
-            envoy.lb:
-              role: master
-              service: db
-- name: db{role=replica}
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
-    altStatName: db_role_replica_
-    connectTimeout: 5s
-    edsClusterConfig:
-      edsConfig:
-        ads: {}
-    name: db{role=replica}
-    type: EDS
-- name: db{role=replica}
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-    clusterName: db{role=replica}
-    endpoints:
-    - {}
-- name: outbound:127.0.0.1:54321
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
-    trafficDirection: OUTBOUND
-    address:
-      socketAddress:
-        address: 127.0.0.1
-        portValue: 54321
-    filterChains:
-    - filters:
-      - name: envoy.tcp_proxy
-        typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-          statPrefix: db
-          weightedClusters:
-            clusters:
-            - name: db{role=master}
-              weight: 10
-            - name: db{role=replica}
-              weight: 90
-    name: outbound:127.0.0.1:54321
-- name: api-http
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
-    connectTimeout: 5s
-    edsClusterConfig:
-      edsConfig:
-        ads: {}
-    name: api-http
-    outlierDetection:
-      enforcingConsecutive5xx: 100
-      enforcingConsecutiveGatewayFailure: 0
-      enforcingConsecutiveLocalOriginFailure: 0
-      enforcingFailurePercentage: 0
-      enforcingSuccessRate: 0
-    type: EDS
-- name: api-http
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-    clusterName: api-http
-    endpoints:
-    - lbEndpoints:
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.4
-              portValue: 8084
-        metadata:
-          filterMetadata:
-            envoy.lb:
-              protocol: http
-              region: us
-              service: api-http
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.5
-              portValue: 8085
-        metadata:
-          filterMetadata:
-            envoy.lb:
-              protocol: http
-              region: eu
-              service: api-http
-- name: outbound:127.0.0.1:40001
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
-    trafficDirection: OUTBOUND
-    address:
-      socketAddress:
-        address: 127.0.0.1
-        portValue: 40001
-    filterChains:
-    - filters:
-      - name: envoy.http_connection_manager
-        typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
-          accessLog:
-          - name: envoy.file_access_log
-            typedConfig:
-              '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
-              format: |
-                [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "gateway" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
-              path: /var/log
-          httpFilters:
-          - name: envoy.router
-          rds:
-            configSource:
-              ads: {}
-            routeConfigName: outbound:api-http
-          statPrefix: api-http
-    name: outbound:127.0.0.1:40001
-- name: outbound:api-http
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.RouteConfiguration
-    name: outbound:api-http
-    requestHeadersToAdd:
-      - header:
-          key: x-kuma-tags
-          value: '&service=gateway&'
-    validateClusters: true
-    virtualHosts:
-    - domains:
-      - '*'
+  - name: outbound:127.0.0.1:18080
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 18080
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: backend
+                statPrefix: backend
+      name: outbound:127.0.0.1:18080
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:54321
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 54321
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                statPrefix: db
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            role: master
+                      name: db
+                      weight: 10
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            role: replica
+                      name: db
+                      weight: 90
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:40001
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 40001
+      filterChains:
+        - filters:
+            - name: envoy.http_connection_manager
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+                accessLog:
+                  - name: envoy.file_access_log
+                    typedConfig:
+                      '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
+                      format: |
+                        [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "gateway" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
+                      path: /var/log
+                httpFilters:
+                  - name: envoy.router
+                rds:
+                  configSource:
+                    ads: {}
+                  routeConfigName: outbound:api-http
+                statPrefix: api-http
+      name: outbound:127.0.0.1:40001
+      trafficDirection: OUTBOUND
+  - name: outbound:api-http
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.RouteConfiguration
+      name: outbound:api-http
+      requestHeadersToAdd:
+        - header:
+            key: x-kuma-tags
+            value: '&service=gateway&'
+      validateClusters: true
+      virtualHosts:
+        - domains:
+            - '*'
+          name: api-http
+          routes:
+            - match:
+                prefix: /
+              route:
+                cluster: api-http
+  - name: outbound:127.0.0.1:40002
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 40002
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                accessLog:
+                  - name: envoy.http_grpc_access_log
+                    typedConfig:
+                      '@type': type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
+                      commonConfig:
+                        grpcService:
+                          envoyGrpc:
+                            clusterName: access_log_sink
+                        logName: |
+                          logstash:1234;[%START_TIME%] %RESPONSE_FLAGS% mesh1 10.0.0.1(gateway)->%UPSTREAM_HOST%(api-tcp) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
+                cluster: api-tcp
+                statPrefix: api-tcp
+      name: outbound:127.0.0.1:40002
+      trafficDirection: OUTBOUND
+  - name: api-http
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Cluster
+      connectTimeout: 5s
+      edsClusterConfig:
+        edsConfig:
+          ads: {}
       name: api-http
-      routes:
-      - match:
-          prefix: /
-        route:
-          cluster: api-http
-- name: api-tcp
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Cluster
-    connectTimeout: 5s
-    edsClusterConfig:
-      edsConfig:
-        ads: {}
-    name: api-tcp
-    type: EDS
-- name: api-tcp
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-    clusterName: api-tcp
-    endpoints:
-    - lbEndpoints:
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.6
-              portValue: 8086
-        metadata:
-          filterMetadata:
-            envoy.lb:
-              protocol: http
-              region: us
-              service: api-tcp
-      - endpoint:
-          address:
-            socketAddress:
-              address: 192.168.0.7
-              portValue: 8087
-        metadata:
-          filterMetadata:
-            envoy.lb:
-              region: eu
-              service: api-tcp
-- name: outbound:127.0.0.1:40002
-  resource:
-    '@type': type.googleapis.com/envoy.api.v2.Listener
-    trafficDirection: OUTBOUND
-    address:
-      socketAddress:
-        address: 127.0.0.1
-        portValue: 40002
-    filterChains:
-    - filters:
-      - name: envoy.tcp_proxy
-        typedConfig:
-          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-          accessLog:
-          - name: envoy.http_grpc_access_log
-            typedConfig:
-              '@type': type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
-              commonConfig:
-                grpcService:
-                  envoyGrpc:
-                    clusterName: access_log_sink
-                logName: |
-                  logstash:1234;[%START_TIME%] %RESPONSE_FLAGS% mesh1 10.0.0.1(gateway)->%UPSTREAM_HOST%(api-tcp) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
-          cluster: api-tcp
-          statPrefix: api-tcp
-    name: outbound:127.0.0.1:40002
+      outlierDetection:
+        enforcingConsecutive5xx: 100
+        enforcingConsecutiveGatewayFailure: 0
+        enforcingConsecutiveLocalOriginFailure: 0
+        enforcingFailurePercentage: 0
+        enforcingSuccessRate: 0
+      type: EDS
+  - name: api-tcp
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Cluster
+      connectTimeout: 5s
+      edsClusterConfig:
+        edsConfig:
+          ads: {}
+      name: api-tcp
+      type: EDS
+  - name: backend
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Cluster
+      connectTimeout: 5s
+      edsClusterConfig:
+        edsConfig:
+          ads: {}
+      name: backend
+      type: EDS
+  - name: db
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Cluster
+      connectTimeout: 5s
+      edsClusterConfig:
+        edsConfig:
+          ads: {}
+      lbSubsetConfig:
+        fallbackPolicy: ANY_ENDPOINT
+        subsetSelectors:
+          - fallbackPolicy: NO_FALLBACK
+            keys:
+              - role
+      name: db
+      type: EDS
+  - name: api-http
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: api-http
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.4
+                    portValue: 8084
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    protocol: http
+                    region: us
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.5
+                    portValue: 8085
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    protocol: http
+                    region: eu
+  - name: api-tcp
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: api-tcp
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.6
+                    portValue: 8086
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    protocol: http
+                    region: us
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.7
+                    portValue: 8087
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    region: eu
+  - name: backend
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: backend
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.1
+                    portValue: 8081
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    region: us
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.2
+                    portValue: 8082
+  - name: db
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: db
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.3
+                    portValue: 5432
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    role: master
diff --git a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
index b112d19ab38d..543cb7ea1ece 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
@@ -1,12 +1,143 @@
 resources:
-  - name: backend
+  - name: outbound:127.0.0.1:18080
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 18080
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: backend
+                statPrefix: backend
+      name: outbound:127.0.0.1:18080
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:54321
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 54321
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                statPrefix: db
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            role: master
+                      name: db
+                      weight: 10
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            role: replica
+                      name: db
+                      weight: 90
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:40001
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 40001
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.http_connection_manager
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
+                accessLog:
+                  - name: envoy.file_access_log
+                    typedConfig:
+                      '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
+                      format: |
+                        [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "web" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
+                      path: /var/log
+                httpFilters:
+                  - name: envoy.router
+                rds:
+                  configSource:
+                    ads: {}
+                  routeConfigName: outbound:api-http
+                statPrefix: api-http
+      name: outbound:127.0.0.1:40001
+      trafficDirection: OUTBOUND
+  - name: outbound:api-http
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.RouteConfiguration
+      name: outbound:api-http
+      requestHeadersToAdd:
+        - header:
+            key: x-kuma-tags
+            value: '&service=web&'
+      validateClusters: true
+      virtualHosts:
+        - domains:
+            - '*'
+          name: api-http
+          routes:
+            - match:
+                prefix: /
+              route:
+                cluster: api-http
+  - name: outbound:127.0.0.1:40002
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 40002
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                accessLog:
+                  - name: envoy.http_grpc_access_log
+                    typedConfig:
+                      '@type': type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
+                      commonConfig:
+                        grpcService:
+                          envoyGrpc:
+                            clusterName: access_log_sink
+                        logName: |
+                          logstash:1234;[%START_TIME%] %RESPONSE_FLAGS% mesh1 10.0.0.1(web)->%UPSTREAM_HOST%(api-tcp) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
+                cluster: api-tcp
+                statPrefix: api-tcp
+      name: outbound:127.0.0.1:40002
+      trafficDirection: OUTBOUND
+  - name: api-http
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
       connectTimeout: 5s
       edsClusterConfig:
         edsConfig:
           ads: {}
-      name: backend
+      name: api-http
+      outlierDetection:
+        enforcingConsecutive5xx: 100
+        enforcingConsecutiveGatewayFailure: 0
+        enforcingConsecutiveLocalOriginFailure: 0
+        enforcingFailurePercentage: 0
+        enforcingSuccessRate: 0
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
@@ -15,7 +146,7 @@ resources:
             combinedValidationContext:
               defaultValidationContext:
                 matchSubjectAltNames:
-                  - exact: spiffe://mesh1/backend
+                  - exact: spiffe://mesh1/api-http
               validationContextSdsSecretConfig:
                 name: mesh_ca
                 sdsConfig:
@@ -42,51 +173,16 @@ resources:
                                 inlineBytes: MTIzNDU=
                           statPrefix: sds_identity_cert
                           targetUri: kuma-system:5677
-          sni: backend
+          sni: api-http
       type: EDS
-  - name: backend
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: backend
-      endpoints:
-        - lbEndpoints:
-            - endpoint:
-                address:
-                  socketAddress:
-                    address: 192.168.0.1
-                    portValue: 8081
-              metadata:
-                filterMetadata:
-                  envoy.lb:
-                    region: us
-                    service: backend
-  - name: outbound:127.0.0.1:18080
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 18080
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: backend
-                statPrefix: backend
-      name: outbound:127.0.0.1:18080
-      trafficDirection: OUTBOUND
-  - name: db{role=master}
+  - name: api-tcp
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
-      altStatName: db_role_master_
       connectTimeout: 5s
       edsClusterConfig:
         edsConfig:
           ads: {}
-      name: db{role=master}
+      name: api-tcp
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
@@ -95,7 +191,7 @@ resources:
             combinedValidationContext:
               defaultValidationContext:
                 matchSubjectAltNames:
-                  - exact: spiffe://mesh1/db
+                  - exact: spiffe://mesh1/api-tcp
               validationContextSdsSecretConfig:
                 name: mesh_ca
                 sdsConfig:
@@ -122,33 +218,16 @@ resources:
                                 inlineBytes: MTIzNDU=
                           statPrefix: sds_identity_cert
                           targetUri: kuma-system:5677
-          sni: db{role=master}
+          sni: api-tcp
       type: EDS
-  - name: db{role=master}
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db{role=master}
-      endpoints:
-        - lbEndpoints:
-            - endpoint:
-                address:
-                  socketAddress:
-                    address: 192.168.0.3
-                    portValue: 5432
-              metadata:
-                filterMetadata:
-                  envoy.lb:
-                    role: master
-                    service: db
-  - name: db{role=replica}
+  - name: backend
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
-      altStatName: db_role_replica_
       connectTimeout: 5s
       edsClusterConfig:
         edsConfig:
           ads: {}
-      name: db{role=replica}
+      name: backend
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
@@ -157,7 +236,7 @@ resources:
             combinedValidationContext:
               defaultValidationContext:
                 matchSubjectAltNames:
-                  - exact: spiffe://mesh1/db
+                  - exact: spiffe://mesh1/backend
               validationContextSdsSecretConfig:
                 name: mesh_ca
                 sdsConfig:
@@ -184,51 +263,22 @@ resources:
                                 inlineBytes: MTIzNDU=
                           statPrefix: sds_identity_cert
                           targetUri: kuma-system:5677
-          sni: db{role=replica}
+          sni: backend
       type: EDS
-  - name: db{role=replica}
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db{role=replica}
-      endpoints:
-        - {}
-  - name: outbound:127.0.0.1:54321
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 54321
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                statPrefix: db
-                weightedClusters:
-                  clusters:
-                    - name: db{role=master}
-                      weight: 10
-                    - name: db{role=replica}
-                      weight: 90
-      name: outbound:127.0.0.1:54321
-      trafficDirection: OUTBOUND
-  - name: api-http
+  - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
       connectTimeout: 5s
       edsClusterConfig:
         edsConfig:
           ads: {}
-      name: api-http
-      outlierDetection:
-        enforcingConsecutive5xx: 100
-        enforcingConsecutiveGatewayFailure: 0
-        enforcingConsecutiveLocalOriginFailure: 0
-        enforcingFailurePercentage: 0
-        enforcingSuccessRate: 0
+      lbSubsetConfig:
+        fallbackPolicy: ANY_ENDPOINT
+        subsetSelectors:
+          - fallbackPolicy: NO_FALLBACK
+            keys:
+              - role
+      name: db
       transportSocket:
         name: envoy.transport_sockets.tls
         typedConfig:
@@ -237,7 +287,7 @@ resources:
             combinedValidationContext:
               defaultValidationContext:
                 matchSubjectAltNames:
-                  - exact: spiffe://mesh1/api-http
+                  - exact: spiffe://mesh1/db
               validationContextSdsSecretConfig:
                 name: mesh_ca
                 sdsConfig:
@@ -264,7 +314,7 @@ resources:
                                 inlineBytes: MTIzNDU=
                           statPrefix: sds_identity_cert
                           targetUri: kuma-system:5677
-          sni: api-http
+          sni: db
       type: EDS
   - name: api-http
     resource:
@@ -282,7 +332,6 @@ resources:
                   envoy.lb:
                     protocol: http
                     region: us
-                    service: api-http
             - endpoint:
                 address:
                   socketAddress:
@@ -293,100 +342,6 @@ resources:
                   envoy.lb:
                     protocol: http
                     region: eu
-                    service: api-http
-  - name: outbound:127.0.0.1:40001
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 40001
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.http_connection_manager
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
-                accessLog:
-                  - name: envoy.file_access_log
-                    typedConfig:
-                      '@type': type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
-                      format: |
-                        [%START_TIME%] mesh1 "%REQ(:method)% %REQ(x-envoy-original-path?:path)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(x-envoy-upstream-service-time)% "%REQ(x-forwarded-for)%" "%REQ(user-agent)%" "%REQ(x-request-id)%" "%REQ(:authority)%" "web" "api-http" "10.0.0.1" "%UPSTREAM_HOST%"
-                      path: /var/log
-                httpFilters:
-                  - name: envoy.router
-                rds:
-                  configSource:
-                    ads: {}
-                  routeConfigName: outbound:api-http
-                statPrefix: api-http
-      name: outbound:127.0.0.1:40001
-      trafficDirection: OUTBOUND
-  - name: outbound:api-http
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.RouteConfiguration
-      name: outbound:api-http
-      requestHeadersToAdd:
-        - header:
-            key: x-kuma-tags
-            value: '&service=web&'
-      validateClusters: true
-      virtualHosts:
-        - domains:
-            - '*'
-          name: api-http
-          routes:
-            - match:
-                prefix: /
-              route:
-                cluster: api-http
-  - name: api-tcp
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Cluster
-      connectTimeout: 5s
-      edsClusterConfig:
-        edsConfig:
-          ads: {}
-      name: api-tcp
-      transportSocket:
-        name: envoy.transport_sockets.tls
-        typedConfig:
-          '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
-          commonTlsContext:
-            combinedValidationContext:
-              defaultValidationContext:
-                matchSubjectAltNames:
-                  - exact: spiffe://mesh1/api-tcp
-              validationContextSdsSecretConfig:
-                name: mesh_ca
-                sdsConfig:
-                  apiConfigSource:
-                    apiType: GRPC
-                    grpcServices:
-                      - googleGrpc:
-                          channelCredentials:
-                            sslCredentials:
-                              rootCerts:
-                                inlineBytes: MTIzNDU=
-                          statPrefix: sds_mesh_ca
-                          targetUri: kuma-system:5677
-            tlsCertificateSdsSecretConfigs:
-              - name: identity_cert
-                sdsConfig:
-                  apiConfigSource:
-                    apiType: GRPC
-                    grpcServices:
-                      - googleGrpc:
-                          channelCredentials:
-                            sslCredentials:
-                              rootCerts:
-                                inlineBytes: MTIzNDU=
-                          statPrefix: sds_identity_cert
-                          targetUri: kuma-system:5677
-          sni: api-tcp
-      type: EDS
   - name: api-tcp
     resource:
       '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
@@ -403,7 +358,6 @@ resources:
                   envoy.lb:
                     protocol: http
                     region: us
-                    service: api-tcp
             - endpoint:
                 address:
                   socketAddress:
@@ -413,32 +367,38 @@ resources:
                 filterMetadata:
                   envoy.lb:
                     region: eu
-                    service: api-tcp
-  - name: outbound:127.0.0.1:40002
+  - name: backend
     resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 40002
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                accessLog:
-                  - name: envoy.http_grpc_access_log
-                    typedConfig:
-                      '@type': type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
-                      commonConfig:
-                        grpcService:
-                          envoyGrpc:
-                            clusterName: access_log_sink
-                        logName: |
-                          logstash:1234;[%START_TIME%] %RESPONSE_FLAGS% mesh1 10.0.0.1(web)->%UPSTREAM_HOST%(api-tcp) took %DURATION%ms, sent %BYTES_SENT% bytes, received: %BYTES_RECEIVED% bytes
-                cluster: api-tcp
-                statPrefix: api-tcp
-      name: outbound:127.0.0.1:40002
-      trafficDirection: OUTBOUND
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: backend
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.1
+                    portValue: 8081
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    region: us
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.2
+                    portValue: 8082
+  - name: db
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: db
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.3
+                    portValue: 5432
+              metadata:
+                filterMetadata:
+                  envoy.lb:
+                    role: master
diff --git a/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml
index e77caccf4e47..899d12af97b2 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/cluster-dots.envoy.golden.yaml
@@ -1,24 +1,7 @@
 resources:
-  - name: backend.kuma-system
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Cluster
-      connectTimeout: 5s
-      edsClusterConfig:
-        edsConfig:
-          ads: {}
-      name: backend.kuma-system
-      altStatName: backend_kuma-system
-      type: EDS
-  - name: backend.kuma-system
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: backend.kuma-system
-      endpoints:
-        - {}
   - name: outbound:127.0.0.1:18080
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Listener
-      trafficDirection: OUTBOUND
       address:
         socketAddress:
           address: 127.0.0.1
@@ -31,26 +14,10 @@ resources:
                 cluster: backend.kuma-system
                 statPrefix: backend_kuma-system
       name: outbound:127.0.0.1:18080
-  - name: db{version=3.2.0}
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Cluster
-      connectTimeout: 5s
-      edsClusterConfig:
-        edsConfig:
-          ads: {}
-      name: db{version=3.2.0}
-      altStatName: db_version_3_2_0_
-      type: EDS
-  - name: db{version=3.2.0}
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db{version=3.2.0}
-      endpoints:
-        - {}
+      trafficDirection: OUTBOUND
   - name: outbound:127.0.0.1:54321
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Listener
-      trafficDirection: OUTBOUND
       address:
         socketAddress:
           address: 127.0.0.1
@@ -60,6 +27,56 @@ resources:
             - name: envoy.tcp_proxy
               typedConfig:
                 '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: db{version=3.2.0}
                 statPrefix: db_kuma-system
-      name: outbound:127.0.0.1:54321
\ No newline at end of file
+                weightedClusters:
+                  clusters:
+                    - metadataMatch:
+                        filterMetadata:
+                          envoy.lb:
+                            version: 3.2.0
+                      name: db
+                      weight: 100
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: backend.kuma-system
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Cluster
+      altStatName: backend_kuma-system
+      connectTimeout: 5s
+      edsClusterConfig:
+        edsConfig:
+          ads: {}
+      name: backend.kuma-system
+      type: EDS
+  - name: db
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Cluster
+      connectTimeout: 5s
+      edsClusterConfig:
+        edsConfig:
+          ads: {}
+      lbSubsetConfig:
+        fallbackPolicy: ANY_ENDPOINT
+        subsetSelectors:
+          - fallbackPolicy: NO_FALLBACK
+            keys:
+              - version
+      name: db
+      type: EDS
+  - name: backend.kuma-system
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: backend.kuma-system
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.1
+                    portValue: 8082
+  - name: db
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: db
+      endpoints:
+        - {}
diff --git a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
index 377c51726263..c88d13f256b7 100644
--- a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
@@ -72,6 +72,38 @@ resources:
               requireClientCertificate: true
       name: inbound:192.168.0.1:80
       trafficDirection: INBOUND
+  - name: outbound:127.0.0.1:54321
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 54321
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: db
+                statPrefix: db
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:59200
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 59200
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: elastic
+                statPrefix: elastic
+      name: outbound:127.0.0.1:59200
+      trafficDirection: OUTBOUND
   - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -117,38 +149,6 @@ resources:
                           targetUri: kuma-system:5677
           sni: db
       type: EDS
-  - name: db
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db
-      endpoints:
-        - lbEndpoints:
-            - endpoint:
-                address:
-                  socketAddress:
-                    address: 192.168.0.3
-                    portValue: 5432
-              metadata:
-                filterMetadata:
-                  envoy.lb:
-                    role: master
-                    service: db
-  - name: outbound:127.0.0.1:54321
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 54321
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: db
-                statPrefix: db
-      name: outbound:127.0.0.1:54321
-      trafficDirection: OUTBOUND
   - name: elastic
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -200,34 +200,29 @@ resources:
                           targetUri: kuma-system:5677
           sni: elastic
       type: EDS
-  - name: elastic
+  - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: elastic
+      clusterName: db
       endpoints:
         - lbEndpoints:
             - endpoint:
                 address:
                   socketAddress:
-                    address: 192.168.0.4
-                    portValue: 9200
+                    address: 192.168.0.3
+                    portValue: 5432
               metadata:
                 filterMetadata:
                   envoy.lb:
-                    service: elastic
-  - name: outbound:127.0.0.1:59200
+                    role: master
+  - name: elastic
     resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 59200
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: elastic
-                statPrefix: elastic
-      name: outbound:127.0.0.1:59200
-      trafficDirection: OUTBOUND
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: elastic
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.4
+                    portValue: 9200
diff --git a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
index 9fb155cc16b9..b1bc315fafd0 100644
--- a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
@@ -100,6 +100,42 @@ resources:
               requireClientCertificate: true
       name: inbound:192.168.0.1:80
       trafficDirection: INBOUND
+  - name: outbound:127.0.0.1:54321
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 54321
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: db
+                statPrefix: db
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:59200
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 59200
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: elastic
+                statPrefix: elastic
+      name: outbound:127.0.0.1:59200
+      trafficDirection: OUTBOUND
   - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -145,40 +181,6 @@ resources:
                           targetUri: kuma-system:5677
           sni: db
       type: EDS
-  - name: db
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db
-      endpoints:
-        - lbEndpoints:
-            - endpoint:
-                address:
-                  socketAddress:
-                    address: 192.168.0.3
-                    portValue: 5432
-              metadata:
-                filterMetadata:
-                  envoy.lb:
-                    role: master
-                    service: db
-  - name: outbound:127.0.0.1:54321
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 54321
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: db
-                statPrefix: db
-      name: outbound:127.0.0.1:54321
-      trafficDirection: OUTBOUND
   - name: elastic
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -230,36 +232,29 @@ resources:
                           targetUri: kuma-system:5677
           sni: elastic
       type: EDS
-  - name: elastic
+  - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: elastic
+      clusterName: db
       endpoints:
         - lbEndpoints:
             - endpoint:
                 address:
                   socketAddress:
-                    address: 192.168.0.4
-                    portValue: 9200
+                    address: 192.168.0.3
+                    portValue: 5432
               metadata:
                 filterMetadata:
                   envoy.lb:
-                    service: elastic
-  - name: outbound:127.0.0.1:59200
+                    role: master
+  - name: elastic
     resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 59200
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: elastic
-                statPrefix: elastic
-      name: outbound:127.0.0.1:59200
-      trafficDirection: OUTBOUND
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: elastic
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.4
+                    portValue: 9200
diff --git a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
index ac0a72e76fa0..618a3e190911 100644
--- a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
@@ -194,6 +194,38 @@ resources:
               requireClientCertificate: true
       name: inbound:192.168.0.1:80
       trafficDirection: INBOUND
+  - name: outbound:127.0.0.1:54321
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 54321
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: db
+                statPrefix: db
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:59200
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 59200
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: elastic
+                statPrefix: elastic
+      name: outbound:127.0.0.1:59200
+      trafficDirection: OUTBOUND
   - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -239,38 +271,6 @@ resources:
                           targetUri: kuma-system:5677
           sni: db
       type: EDS
-  - name: db
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db
-      endpoints:
-        - lbEndpoints:
-            - endpoint:
-                address:
-                  socketAddress:
-                    address: 192.168.0.3
-                    portValue: 5432
-              metadata:
-                filterMetadata:
-                  envoy.lb:
-                    role: master
-                    service: db
-  - name: outbound:127.0.0.1:54321
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 54321
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: db
-                statPrefix: db
-      name: outbound:127.0.0.1:54321
-      trafficDirection: OUTBOUND
   - name: elastic
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -322,34 +322,29 @@ resources:
                           targetUri: kuma-system:5677
           sni: elastic
       type: EDS
-  - name: elastic
+  - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: elastic
+      clusterName: db
       endpoints:
         - lbEndpoints:
             - endpoint:
                 address:
                   socketAddress:
-                    address: 192.168.0.4
-                    portValue: 9200
+                    address: 192.168.0.3
+                    portValue: 5432
               metadata:
                 filterMetadata:
                   envoy.lb:
-                    service: elastic
-  - name: outbound:127.0.0.1:59200
+                    role: master
+  - name: elastic
     resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 59200
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: elastic
-                statPrefix: elastic
-      name: outbound:127.0.0.1:59200
-      trafficDirection: OUTBOUND
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: elastic
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.4
+                    portValue: 9200
diff --git a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
index 554b3a0d1601..bab0ab926652 100644
--- a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
@@ -222,6 +222,42 @@ resources:
               requireClientCertificate: true
       name: inbound:192.168.0.1:80
       trafficDirection: INBOUND
+  - name: outbound:127.0.0.1:54321
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 54321
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: db
+                statPrefix: db
+      name: outbound:127.0.0.1:54321
+      trafficDirection: OUTBOUND
+  - name: outbound:127.0.0.1:59200
+    resource:
+      '@type': type.googleapis.com/envoy.api.v2.Listener
+      address:
+        socketAddress:
+          address: 127.0.0.1
+          portValue: 59200
+      deprecatedV1:
+        bindToPort: false
+      filterChains:
+        - filters:
+            - name: envoy.tcp_proxy
+              typedConfig:
+                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
+                cluster: elastic
+                statPrefix: elastic
+      name: outbound:127.0.0.1:59200
+      trafficDirection: OUTBOUND
   - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -267,40 +303,6 @@ resources:
                           targetUri: kuma-system:5677
           sni: db
       type: EDS
-  - name: db
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: db
-      endpoints:
-        - lbEndpoints:
-            - endpoint:
-                address:
-                  socketAddress:
-                    address: 192.168.0.3
-                    portValue: 5432
-              metadata:
-                filterMetadata:
-                  envoy.lb:
-                    role: master
-                    service: db
-  - name: outbound:127.0.0.1:54321
-    resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 54321
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: db
-                statPrefix: db
-      name: outbound:127.0.0.1:54321
-      trafficDirection: OUTBOUND
   - name: elastic
     resource:
       '@type': type.googleapis.com/envoy.api.v2.Cluster
@@ -352,36 +354,29 @@ resources:
                           targetUri: kuma-system:5677
           sni: elastic
       type: EDS
-  - name: elastic
+  - name: db
     resource:
       '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
-      clusterName: elastic
+      clusterName: db
       endpoints:
         - lbEndpoints:
             - endpoint:
                 address:
                   socketAddress:
-                    address: 192.168.0.4
-                    portValue: 9200
+                    address: 192.168.0.3
+                    portValue: 5432
               metadata:
                 filterMetadata:
                   envoy.lb:
-                    service: elastic
-  - name: outbound:127.0.0.1:59200
+                    role: master
+  - name: elastic
     resource:
-      '@type': type.googleapis.com/envoy.api.v2.Listener
-      address:
-        socketAddress:
-          address: 127.0.0.1
-          portValue: 59200
-      deprecatedV1:
-        bindToPort: false
-      filterChains:
-        - filters:
-            - name: envoy.tcp_proxy
-              typedConfig:
-                '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
-                cluster: elastic
-                statPrefix: elastic
-      name: outbound:127.0.0.1:59200
-      trafficDirection: OUTBOUND
+      '@type': type.googleapis.com/envoy.api.v2.ClusterLoadAssignment
+      clusterName: elastic
+      endpoints:
+        - lbEndpoints:
+            - endpoint:
+                address:
+                  socketAddress:
+                    address: 192.168.0.4
+                    portValue: 9200
diff --git a/pkg/xds/generator/transparent_proxy_generator.go b/pkg/xds/generator/transparent_proxy_generator.go
index 80a874e6ee0f..f026a5e809d9 100644
--- a/pkg/xds/generator/transparent_proxy_generator.go
+++ b/pkg/xds/generator/transparent_proxy_generator.go
@@ -24,7 +24,7 @@ func (_ TransparentProxyGenerator) Generate(ctx xds_context.Context, proxy *mode
 	listener, err := envoy_listeners.NewListenerBuilder().
 		Configure(envoy_listeners.OutboundListener("catch_all", "0.0.0.0", redirectPort)).
 		Configure(envoy_listeners.FilterChain(envoy_listeners.NewFilterChainBuilder().
-			Configure(envoy_listeners.TcpProxy("pass_through", envoy_common.ClusterInfo{Name: "pass_through"})).
+			Configure(envoy_listeners.TcpProxy("pass_through", envoy_common.ClusterSubset{ClusterName: "pass_through"})).
 			Configure(envoy_listeners.NetworkAccessLog(meshName, envoy_listeners.TrafficDirectionUnspecified, sourceService, "external", proxy.Logs[mesh_core.PassThroughService], proxy)))).
 		Configure(envoy_listeners.OriginalDstForwarder()).
 		Build()
diff --git a/pkg/xds/topology/router.go b/pkg/xds/topology/router.go
index 9eb938e9f29c..42ded6157e36 100644
--- a/pkg/xds/topology/router.go
+++ b/pkg/xds/topology/router.go
@@ -58,11 +58,17 @@ func BuildRouteMap(dataplane *mesh_core.DataplaneResource, routes []*mesh_core.T
 
 	routeMap := core_xds.RouteMap{}
 	for _, oface := range dataplane.Spec.Networking.GetOutbound() {
-		policy, exists := policyMap[oface.Service]
+		serviceName := oface.GetTagsIncludingLegacy()[mesh_proto.ServiceTag]
+		policy, exists := policyMap[serviceName]
+		outbound, err := dataplane.Spec.Networking.ToOutboundInterface(oface)
+		if err != nil {
+			// ignore invalid outbounds
+			continue
+		}
 		if exists {
-			routeMap[oface.Service] = policy.(*mesh_core.TrafficRouteResource)
+			routeMap[outbound] = policy.(*mesh_core.TrafficRouteResource)
 		} else {
-			routeMap[oface.Service] = &mesh_core.TrafficRouteResource{
+			routeMap[outbound] = &mesh_core.TrafficRouteResource{
 				Meta: &pseudoMeta{
 					Name: "(implicit default route)",
 				},
@@ -71,11 +77,11 @@ func BuildRouteMap(dataplane *mesh_core.DataplaneResource, routes []*mesh_core.T
 						Match: mesh_proto.MatchAnyService(),
 					}},
 					Destinations: []*mesh_proto.Selector{{
-						Match: mesh_proto.MatchService(oface.Service),
+						Match: mesh_proto.MatchService(serviceName),
 					}},
 					Conf: []*mesh_proto.TrafficRoute_WeightedDestination{{
 						Weight:      100,
-						Destination: mesh_proto.MatchService(oface.Service),
+						Destination: mesh_proto.MatchTags(oface.GetTagsIncludingLegacy()),
 					}},
 				},
 			}
@@ -89,7 +95,13 @@ func BuildRouteMap(dataplane *mesh_core.DataplaneResource, routes []*mesh_core.T
 func BuildDestinationMap(dataplane *mesh_core.DataplaneResource, routes core_xds.RouteMap) core_xds.DestinationMap {
 	destinations := core_xds.DestinationMap{}
 	for _, oface := range dataplane.Spec.Networking.GetOutbound() {
-		route, ok := routes[oface.Service]
+		serviceName := oface.GetTagsIncludingLegacy()[mesh_proto.ServiceTag]
+		outbound, err := dataplane.Spec.Networking.ToOutboundInterface(oface)
+		if err != nil {
+			// ignore invalid outbounds
+			continue
+		}
+		route, ok := routes[outbound]
 		if ok {
 			for _, destination := range route.Spec.Conf {
 				service, ok := destination.Destination[mesh_proto.ServiceTag]
@@ -101,7 +113,7 @@ func BuildDestinationMap(dataplane *mesh_core.DataplaneResource, routes core_xds
 				destinations[service] = destinations[service].Add(mesh_proto.MatchTags(destination.Destination))
 			}
 		} else {
-			destinations[oface.Service] = destinations[oface.Service].Add(mesh_proto.MatchService(oface.Service))
+			destinations[serviceName] = destinations[serviceName].Add(mesh_proto.MatchService(serviceName))
 		}
 	}
 	return destinations
diff --git a/pkg/xds/topology/router_test.go b/pkg/xds/topology/router_test.go
index c09176544f50..fd8f07d54e96 100644
--- a/pkg/xds/topology/router_test.go
+++ b/pkg/xds/topology/router_test.go
@@ -142,13 +142,15 @@ var _ = Describe("TrafficRoute", func() {
 			// and
 			Expect(routes).To(HaveLen(2))
 			// and
-			Expect(routes).To(HaveKey("redis"))
-			Expect(routes["redis"].Meta.GetName()).To(Equal(routeRedis.Meta.GetName()))
-			Expect(routes["redis"].Spec).To(Equal(routeRedis.Spec))
+			out1 := mesh_proto.OutboundInterface{DataplaneIP: "127.0.0.1", DataplanePort: 10001}
+			Expect(routes).To(HaveKey(out1))
+			Expect(routes[out1].Meta.GetName()).To(Equal(routeRedis.Meta.GetName()))
+			Expect(routes[out1].Spec).To(Equal(routeRedis.Spec))
 			// and
-			Expect(routes).To(HaveKey("elastic"))
-			Expect(routes["elastic"].Meta.GetName()).To(Equal(routeElastic.Meta.GetName()))
-			Expect(routes["elastic"].Spec).To(Equal(routeElastic.Spec))
+			out2 := mesh_proto.OutboundInterface{DataplaneIP: "127.0.0.1", DataplanePort: 10002}
+			Expect(routes).To(HaveKey(out2))
+			Expect(routes[out2].Meta.GetName()).To(Equal(routeElastic.Meta.GetName()))
+			Expect(routes[out2].Spec).To(Equal(routeElastic.Spec))
 		})
 	})
 
@@ -218,15 +220,24 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
-								{Service: "elastic"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
+								{
+									Port:    1235,
+									Service: "elastic",
+								},
 							},
 						},
 					},
 				},
 				routes: nil,
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &PseudoMeta{
 							Name: "(implicit default route)",
 						},
@@ -243,7 +254,10 @@ var _ = Describe("TrafficRoute", func() {
 							}},
 						},
 					},
-					"elastic": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1235,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &PseudoMeta{
 							Name: "(implicit default route)",
 						},
@@ -270,8 +284,14 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
-								{Service: "elastic"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
+								{
+									Port:    1235,
+									Service: "elastic",
+								},
 							},
 						},
 					},
@@ -298,7 +318,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &PseudoMeta{
 							Name: "(implicit default route)",
 						},
@@ -315,7 +338,10 @@ var _ = Describe("TrafficRoute", func() {
 							}},
 						},
 					},
-					"elastic": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1235,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "everything-to-elastic-v1",
 						},
@@ -330,7 +356,10 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
 							},
 						},
 					},
@@ -378,7 +407,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "everything-to-hollygrail",
 						},
@@ -393,7 +425,10 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend", "region": "eu"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
 							},
 						},
 					},
@@ -439,7 +474,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "more-specific",
 						},
@@ -454,7 +492,10 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend", "region": "eu"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
 							},
 						},
 					},
@@ -500,7 +541,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "more-specific",
 						},
@@ -515,7 +559,10 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend", "region": "eu"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
 							},
 						},
 					},
@@ -561,7 +608,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "more-specific",
 						},
@@ -576,7 +626,10 @@ var _ = Describe("TrafficRoute", func() {
 								{Tags: map[string]string{"service": "backend", "region": "eu"}},
 							},
 							Outbound: []*mesh_proto.Dataplane_Networking_Outbound{
-								{Service: "redis"},
+								{
+									Port:    1234,
+									Service: "redis",
+								},
 							},
 						},
 					},
@@ -624,7 +677,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				expected: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 1234,
+					}: &mesh_core.TrafficRouteResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "equally-specific-2",
 						},
@@ -685,7 +741,10 @@ var _ = Describe("TrafficRoute", func() {
 					},
 				},
 				routes: core_xds.RouteMap{
-					"redis": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 10001,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{
 								{
@@ -699,7 +758,10 @@ var _ = Describe("TrafficRoute", func() {
 							},
 						},
 					},
-					"elastic": &mesh_core.TrafficRouteResource{
+					mesh_proto.OutboundInterface{
+						DataplaneIP:   "127.0.0.1",
+						DataplanePort: 10002,
+					}: &mesh_core.TrafficRouteResource{
 						Spec: mesh_proto.TrafficRoute{
 							Conf: []*mesh_proto.TrafficRoute_WeightedDestination{
 								{