diff --git a/pkg/api-server/inspect_endpoints.go b/pkg/api-server/inspect_endpoints.go
index 52f68b004e20..29e1062232e6 100644
--- a/pkg/api-server/inspect_endpoints.go
+++ b/pkg/api-server/inspect_endpoints.go
@@ -23,6 +23,7 @@ import (
 	"github.com/kumahq/kuma/pkg/plugins/runtime/gateway/route"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/server/callbacks"
 	"github.com/kumahq/kuma/pkg/xds/sync"
 )
@@ -438,9 +439,9 @@ func newGatewayDataplaneInspectResponse(
 }
 
 func routeToPolicyInspect(
-	policyMap map[inspect.PolicyKey][]envoy.Tags,
+	policyMap map[inspect.PolicyKey][]tags.Tags,
 	des route.Destination,
-) map[inspect.PolicyKey][]envoy.Tags {
+) map[inspect.PolicyKey][]tags.Tags {
 	for kind, p := range des.Policies {
 		policyKey := inspect.PolicyKey{
 			Type: kind,
@@ -473,7 +474,7 @@ func gatewayEntriesByPolicy(
 		for _, info := range info.HostInfos {
 			routeMap := map[inspect.PolicyKey][]api_server_types.PolicyInspectGatewayRouteEntry{}
 			for _, entry := range info.Entries {
-				entryMap := map[inspect.PolicyKey][]envoy.Tags{}
+				entryMap := map[inspect.PolicyKey][]tags.Tags{}
 				if entry.Mirror != nil {
 					entryMap = routeToPolicyInspect(entryMap, entry.Mirror.Forward)
 				}
diff --git a/pkg/api-server/types/gateway.go b/pkg/api-server/types/gateway.go
index 51236bd5d82f..75bdc0773481 100644
--- a/pkg/api-server/types/gateway.go
+++ b/pkg/api-server/types/gateway.go
@@ -3,14 +3,14 @@ package types
 import (
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/model/rest/unversioned"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 type PolicyMap map[core_model.ResourceType]*unversioned.Resource
 
 type Destination struct {
-	Tags     envoy.Tags `json:"tags"`
-	Policies PolicyMap  `json:"policies"`
+	Tags     tags.Tags `json:"tags"`
+	Policies PolicyMap `json:"policies"`
 }
 
 type RouteInspectEntry struct {
@@ -45,8 +45,8 @@ func NewGatewayDataplaneInspectResult() GatewayDataplaneInspectResult {
 }
 
 type PolicyInspectGatewayRouteEntry struct {
-	Route        string       `json:"route"`
-	Destinations []envoy.Tags `json:"destinations"`
+	Route        string      `json:"route"`
+	Destinations []tags.Tags `json:"destinations"`
 }
 
 type PolicyInspectGatewayHostEntry struct {
diff --git a/pkg/core/xds/types.go b/pkg/core/xds/types.go
index b5dd42b40d7e..ce7a36d57fc8 100644
--- a/pkg/core/xds/types.go
+++ b/pkg/core/xds/types.go
@@ -1,22 +1,19 @@
 package xds
 
 import (
-	"context"
 	"fmt"
 	"strings"
 
 	"github.com/pkg/errors"
-	"google.golang.org/protobuf/proto"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	util_tls "github.com/kumahq/kuma/pkg/tls"
-	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
-	"github.com/kumahq/kuma/pkg/xds/envoy/names"
-	xds_tls "github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
+type APIVersion string
+
 // StreamID represents a stream opened by XDS
 type StreamID = int64
 
@@ -121,10 +118,6 @@ type ExternalServiceFaultInjectionMap map[ServiceName][]*core_mesh.FaultInjectio
 
 type ExternalServiceRateLimitMap map[ServiceName][]*core_mesh.RateLimitResource
 
-type CLACache interface {
-	GetCLA(ctx context.Context, meshName, meshHash string, cluster envoy_common.Cluster, apiVersion envoy_common.APIVersion, endpointMap EndpointMap) (proto.Message, error)
-}
-
 // SocketAddressProtocol is the L4 protocol the listener should bind to
 type SocketAddressProtocol int32
 
@@ -137,7 +130,7 @@ const (
 // The data that is specific for the whole mesh should go into MeshContext.
 type Proxy struct {
 	Id                  ProxyId
-	APIVersion          envoy_common.APIVersion // todo(jakubdyszkiewicz) consider moving APIVersion here. pkg/core should not depend on pkg/xds. It should be other way around.
+	APIVersion          APIVersion
 	Dataplane           *core_mesh.DataplaneResource
 	ZoneIngress         *core_mesh.ZoneIngressResource
 	Metadata            *DataplaneMetadata
@@ -160,14 +153,6 @@ type ServerSideMTLSCerts struct {
 	ServerPair util_tls.KeyPair
 }
 
-type identityCertRequest struct {
-	meshName string
-}
-
-func (r identityCertRequest) Name() string {
-	return names.GetSecretName(xds_tls.IdentityCertResource, "secret", r.meshName)
-}
-
 type IdentityCertRequest interface {
 	Name() string
 }
@@ -177,30 +162,6 @@ type CaRequest interface {
 	Name() string
 }
 
-type caRequest struct {
-	meshName string
-}
-
-type allInOneCaRequest struct {
-	meshNames []string
-}
-
-func (r caRequest) Name() string {
-	return names.GetSecretName(xds_tls.MeshCaResource, "secret", r.meshName)
-}
-
-func (r caRequest) MeshName() []string {
-	return []string{r.meshName}
-}
-
-func (r allInOneCaRequest) Name() string {
-	return names.GetSecretName(xds_tls.MeshCaResource, "secret", "all")
-}
-
-func (r allInOneCaRequest) MeshName() []string {
-	return r.meshNames
-}
-
 // SecretsTracker provides a way to ask for a secret and keeps track of which are
 // used, so that they can later be generated and included in the resources.
 type SecretsTracker interface {
@@ -213,54 +174,6 @@ type SecretsTracker interface {
 	UsedAllInOne() bool
 }
 
-type secretsTracker struct {
-	ownMesh   string
-	allMeshes []string
-
-	identity bool
-	meshes   map[string]struct{}
-	allInOne bool
-}
-
-func NewSecretsTracker(ownMesh string, allMeshes []string) SecretsTracker {
-	return &secretsTracker{
-		ownMesh:   ownMesh,
-		allMeshes: allMeshes,
-
-		meshes: map[string]struct{}{},
-	}
-}
-
-func (st *secretsTracker) RequestIdentityCert() IdentityCertRequest {
-	st.identity = true
-	return &identityCertRequest{
-		meshName: st.ownMesh,
-	}
-}
-
-func (st *secretsTracker) RequestCa(mesh string) CaRequest {
-	st.meshes[mesh] = struct{}{}
-	return &caRequest{
-		meshName: mesh,
-	}
-}
-
-func (st *secretsTracker) RequestAllInOneCa() CaRequest {
-	st.allInOne = true
-	return &allInOneCaRequest{
-		meshNames: st.allMeshes,
-	}
-}
-func (st *secretsTracker) UsedIdentity() bool {
-	return st.identity
-}
-func (st *secretsTracker) UsedCas() map[string]struct{} {
-	return st.meshes
-}
-func (st *secretsTracker) UsedAllInOne() bool {
-	return st.allInOne
-}
-
 type MeshResources struct {
 	Mesh                           *core_mesh.MeshResource
 	TrafficRoutes                  []*core_mesh.TrafficRouteResource
diff --git a/pkg/plugins/runtime/gateway/cluster_generator.go b/pkg/plugins/runtime/gateway/cluster_generator.go
index 9c3030ca089d..bdbd36217003 100644
--- a/pkg/plugins/runtime/gateway/cluster_generator.go
+++ b/pkg/plugins/runtime/gateway/cluster_generator.go
@@ -15,6 +15,7 @@ import (
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/envoy/clusters"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/topology"
 )
 
@@ -128,7 +129,7 @@ func (c *ClusterGenerator) generateMeshCluster(
 	builder := newClusterBuilder(info.Proxy.APIVersion, protocol, dest).Configure(
 		clusters.EdsCluster(dest.Destination[mesh_proto.ServiceTag]),
 		clusters.LB(nil /* TODO(jpeach) uses default Round Robin*/),
-		clusters.ClientSideMTLS(info.Proxy.SecretsTracker, mesh, upstreamServiceName, true, []envoy.Tags{dest.Destination}),
+		clusters.ClientSideMTLS(info.Proxy.SecretsTracker, mesh, upstreamServiceName, true, []tags.Tags{dest.Destination}),
 		clusters.ConnectionBufferLimit(DefaultConnectionBuffer),
 	)
 
@@ -174,7 +175,7 @@ func (c *ClusterGenerator) generateExternalCluster(
 }
 
 func newClusterBuilder(
-	version envoy.APIVersion,
+	version core_xds.APIVersion,
 	protocol core_mesh.Protocol,
 	dest *route.Destination,
 ) *clusters.ClusterBuilder {
diff --git a/pkg/plugins/runtime/gateway/connection_policy_generator.go b/pkg/plugins/runtime/gateway/connection_policy_generator.go
index 11fb666ed88a..17fe48411d7d 100644
--- a/pkg/plugins/runtime/gateway/connection_policy_generator.go
+++ b/pkg/plugins/runtime/gateway/connection_policy_generator.go
@@ -7,7 +7,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/gateway/match"
 	"github.com/kumahq/kuma/pkg/plugins/runtime/gateway/route"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 func PopulatePolicies(host GatewayHost, routes []route.Entry) []route.Entry {
@@ -27,7 +27,7 @@ func PopulatePolicies(host GatewayHost, routes []route.Entry) []route.Entry {
 	return routesWithPolicies
 }
 
-func mapPoliciesForDestination(destination envoy.Tags, host GatewayHost) map[model.ResourceType]model.Resource {
+func mapPoliciesForDestination(destination tags.Tags, host GatewayHost) map[model.ResourceType]model.Resource {
 	policies := map[model.ResourceType]model.Resource{}
 
 	for _, policyType := range ConnectionPolicyTypes {
@@ -39,7 +39,7 @@ func mapPoliciesForDestination(destination envoy.Tags, host GatewayHost) map[mod
 	return policies
 }
 
-func matchConnectionPolicy(candidates []match.RankedPolicy, destination envoy.Tags) model.Resource {
+func matchConnectionPolicy(candidates []match.RankedPolicy, destination tags.Tags) model.Resource {
 	var matches []match.RankedPolicy
 
 	for _, c := range candidates {
diff --git a/pkg/plugins/runtime/gateway/route/table.go b/pkg/plugins/runtime/gateway/route/table.go
index d27092cf56e9..da64ae4dbbc3 100644
--- a/pkg/plugins/runtime/gateway/route/table.go
+++ b/pkg/plugins/runtime/gateway/route/table.go
@@ -3,7 +3,7 @@ package route
 import (
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/resources/model"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 // Table stores a collection of routing Entries, aka. a routing table.
@@ -92,7 +92,7 @@ type Redirection struct {
 
 // Destination is a forwarding target (aka Cluster).
 type Destination struct {
-	Destination   envoy.Tags
+	Destination   tags.Tags
 	Weight        uint32
 	RouteProtocol core_mesh.Protocol
 
diff --git a/pkg/xds/cache/cla/cache.go b/pkg/xds/cache/cla/cache.go
index 252565390209..e614792afb58 100644
--- a/pkg/xds/cache/cla/cache.go
+++ b/pkg/xds/cache/cla/cache.go
@@ -36,7 +36,7 @@ func NewCache(
 	}, nil
 }
 
-func (c *Cache) GetCLA(ctx context.Context, meshName, meshHash string, cluster envoy_common.Cluster, apiVersion envoy_common.APIVersion, endpointMap xds.EndpointMap) (proto.Message, error) {
+func (c *Cache) GetCLA(ctx context.Context, meshName, meshHash string, cluster envoy_common.Cluster, apiVersion xds.APIVersion, endpointMap xds.EndpointMap) (proto.Message, error) {
 	key := sha256.Hash(fmt.Sprintf("%s:%s:%s:%s", apiVersion, meshName, cluster.Hash(), meshHash))
 
 	elt, err := c.cache.GetOrRetrieve(ctx, key, once.RetrieverFunc(func(ctx context.Context, key string) (interface{}, error) {
diff --git a/pkg/xds/cache/cla/cache_test.go b/pkg/xds/cache/cla/cache_test.go
index 87f7830c3f76..4216af6703d9 100644
--- a/pkg/xds/cache/cla/cache_test.go
+++ b/pkg/xds/cache/cla/cache_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/kumahq/kuma/pkg/xds/cache/cla"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_endpoints "github.com/kumahq/kuma/pkg/xds/envoy/endpoints/v3"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 var _ = Describe("ClusterLoadAssignment Cache", func() {
@@ -109,7 +110,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 		// when
 		clusterV1 := envoy_common.NewCluster(
 			envoy_common.WithService("backend"),
-			envoy_common.WithTags(envoy_common.Tags{}.WithTags("version", "v1")),
+			envoy_common.WithTags(tags.Tags{}.WithTags("version", "v1")),
 		)
 		claV1, err := claCache.GetCLA(context.Background(), "mesh-0", "", clusterV1, envoy_common.APIV3, endpointMap)
 
@@ -121,7 +122,7 @@ var _ = Describe("ClusterLoadAssignment Cache", func() {
 		// when
 		clusterV2 := envoy_common.NewCluster(
 			envoy_common.WithService("backend"),
-			envoy_common.WithTags(envoy_common.Tags{}.WithTags("version", "v2")),
+			envoy_common.WithTags(tags.Tags{}.WithTags("version", "v2")),
 		)
 		claV2, err := claCache.GetCLA(context.Background(), "mesh-0", "", clusterV2, envoy_common.APIV3, endpointMap)
 
diff --git a/pkg/xds/context/context.go b/pkg/xds/context/context.go
index 9bd532c21737..b2b270cceeb4 100644
--- a/pkg/xds/context/context.go
+++ b/pkg/xds/context/context.go
@@ -6,6 +6,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/datasource"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/xds"
+	"github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/secrets"
 )
 
@@ -22,7 +23,7 @@ type ConnectionInfo struct {
 // ControlPlaneContext contains shared global data and components that are required for generating XDS
 // This data is the same regardless of a data plane proxy and mesh we are generating the data for.
 type ControlPlaneContext struct {
-	CLACache xds.CLACache
+	CLACache envoy.CLACache
 	Secrets  secrets.Secrets
 	Zone     string
 }
diff --git a/pkg/xds/envoy/api_version.go b/pkg/xds/envoy/api_version.go
index adb54ee51401..747c9f2fbfc8 100644
--- a/pkg/xds/envoy/api_version.go
+++ b/pkg/xds/envoy/api_version.go
@@ -1,7 +1,9 @@
 package envoy
 
-type APIVersion string
+import (
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
+)
 
 const (
-	APIV3 APIVersion = "v3"
+	APIV3 core_xds.APIVersion = "v3"
 )
diff --git a/pkg/xds/envoy/clusters/cluster_builder.go b/pkg/xds/envoy/clusters/cluster_builder.go
index 7a345f877fbe..c33af52a2a48 100644
--- a/pkg/xds/envoy/clusters/cluster_builder.go
+++ b/pkg/xds/envoy/clusters/cluster_builder.go
@@ -5,6 +5,7 @@ import (
 
 	envoy_api "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/clusters/v3"
 )
@@ -17,7 +18,7 @@ type ClusterBuilderOpt interface {
 	ApplyTo(config *ClusterBuilderConfig)
 }
 
-func NewClusterBuilder(apiVersion envoy.APIVersion) *ClusterBuilder {
+func NewClusterBuilder(apiVersion core_xds.APIVersion) *ClusterBuilder {
 	return &ClusterBuilder{
 		apiVersion: apiVersion,
 	}
@@ -26,7 +27,7 @@ func NewClusterBuilder(apiVersion envoy.APIVersion) *ClusterBuilder {
 // ClusterBuilder is responsible for generating an Envoy cluster
 // by applying a series of ClusterConfigurers.
 type ClusterBuilder struct {
-	apiVersion envoy.APIVersion
+	apiVersion core_xds.APIVersion
 	config     ClusterBuilderConfig
 }
 
diff --git a/pkg/xds/envoy/clusters/configurers.go b/pkg/xds/envoy/clusters/configurers.go
index 06b3f77c7821..5210ab436736 100644
--- a/pkg/xds/envoy/clusters/configurers.go
+++ b/pkg/xds/envoy/clusters/configurers.go
@@ -7,8 +7,8 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/clusters/v3"
+	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 func OutlierDetection(circuitBreaker *core_mesh.CircuitBreakerResource) ClusterBuilderOpt {
@@ -23,7 +23,7 @@ func CircuitBreaker(circuitBreaker *core_mesh.CircuitBreakerResource) ClusterBui
 	})
 }
 
-func ClientSideMTLS(tracker core_xds.SecretsTracker, mesh *core_mesh.MeshResource, upstreamService string, upstreamTLSReady bool, tags []envoy.Tags) ClusterBuilderOpt {
+func ClientSideMTLS(tracker core_xds.SecretsTracker, mesh *core_mesh.MeshResource, upstreamService string, upstreamTLSReady bool, tags []envoy_tags.Tags) ClusterBuilderOpt {
 	return ClusterBuilderOptFunc(func(config *ClusterBuilderConfig) {
 		config.AddV3(&v3.ClientSideMTLSConfigurer{
 			SecretsTracker:   tracker,
@@ -36,7 +36,7 @@ func ClientSideMTLS(tracker core_xds.SecretsTracker, mesh *core_mesh.MeshResourc
 	})
 }
 
-func CrossMeshClientSideMTLS(tracker core_xds.SecretsTracker, localMesh *core_mesh.MeshResource, upstreamMesh *core_mesh.MeshResource, upstreamService string, upstreamTLSReady bool, tags []envoy.Tags) ClusterBuilderOpt {
+func CrossMeshClientSideMTLS(tracker core_xds.SecretsTracker, localMesh *core_mesh.MeshResource, upstreamMesh *core_mesh.MeshResource, upstreamService string, upstreamTLSReady bool, tags []envoy_tags.Tags) ClusterBuilderOpt {
 	return ClusterBuilderOptFunc(func(config *ClusterBuilderConfig) {
 		config.AddV3(&v3.ClientSideMTLSConfigurer{
 			SecretsTracker:   tracker,
@@ -117,7 +117,7 @@ func HealthCheck(protocol core_mesh.Protocol, healthCheck *core_mesh.HealthCheck
 //     kuma.io/service: backend
 //     version: v1
 //     Only one cluster "backend" is generated for such dataplane, but with lb subset by version.
-func LbSubset(tagSets envoy.TagKeysSlice) ClusterBuilderOptFunc {
+func LbSubset(tagSets envoy_tags.TagKeysSlice) ClusterBuilderOptFunc {
 	return func(config *ClusterBuilderConfig) {
 		config.AddV3(&v3.LbSubsetConfigurer{
 			TagKeysSets: tagSets,
diff --git a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer.go b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer.go
index dcbdeacbb931..2b5c67aebb04 100644
--- a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer.go
+++ b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer.go
@@ -9,8 +9,8 @@ import (
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/util/proto"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_metadata "github.com/kumahq/kuma/pkg/xds/envoy/metadata/v3"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 	envoy_tls "github.com/kumahq/kuma/pkg/xds/envoy/tls/v3"
 )
@@ -20,7 +20,7 @@ type ClientSideMTLSConfigurer struct {
 	UpstreamMesh     *core_mesh.MeshResource
 	UpstreamService  string
 	LocalMesh        *core_mesh.MeshResource
-	Tags             []envoy.Tags
+	Tags             []tags.Tags
 	UpstreamTLSReady bool
 }
 
@@ -37,7 +37,7 @@ func (c *ClientSideMTLSConfigurer) Configure(cluster *envoy_cluster.Cluster) err
 
 	meshName := c.UpstreamMesh.GetMeta().GetName()
 	// there might be a situation when there are multiple sam tags passed here for example two outbound listeners with the same tags, therefore we need to distinguish between them.
-	distinctTags := envoy.DistinctTags(c.Tags)
+	distinctTags := tags.DistinctTags(c.Tags)
 	switch {
 	case len(distinctTags) == 0:
 		transportSocket, err := c.createTransportSocket("")
diff --git a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
index fe426f2106b4..6d153eee8560 100644
--- a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
+++ b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
@@ -6,11 +6,11 @@ import (
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
-	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/envoy/clusters"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 var _ = Describe("EdsClusterConfigurer", func() {
@@ -18,7 +18,7 @@ var _ = Describe("EdsClusterConfigurer", func() {
 	type testCase struct {
 		clusterName   string
 		clientService string
-		tags          []envoy.Tags
+		tags          []tags.Tags
 		mesh          *core_mesh.MeshResource
 		expected      string
 	}
@@ -26,7 +26,7 @@ var _ = Describe("EdsClusterConfigurer", func() {
 	DescribeTable("should generate proper Envoy config",
 		func(given testCase) {
 			// when
-			tracker := core_xds.NewSecretsTracker(given.mesh.GetMeta().GetName(), nil)
+			tracker := envoy.NewSecretsTracker(given.mesh.GetMeta().GetName(), nil)
 			cluster, err := clusters.NewClusterBuilder(envoy.APIV3).
 				Configure(clusters.EdsCluster(given.clusterName)).
 				Configure(clusters.ClientSideMTLS(tracker, given.mesh, given.clientService, true, given.tags)).
@@ -111,7 +111,7 @@ var _ = Describe("EdsClusterConfigurer", func() {
 					},
 				},
 			},
-			tags: []envoy.Tags{
+			tags: []tags.Tags{
 				map[string]string{
 					"kuma.io/service": "backend",
 					"cluster":         "1",
@@ -204,7 +204,7 @@ var _ = Describe("EdsClusterConfigurer", func() {
 					},
 				},
 			},
-			tags: []envoy.Tags{
+			tags: []tags.Tags{
 				{
 					"kuma.io/service": "backend",
 					"version":         "v1",
diff --git a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go
index 85a742a6e381..624afe6ac480 100644
--- a/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go
+++ b/pkg/xds/envoy/clusters/v3/client_side_tls_configurer.go
@@ -9,8 +9,8 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	"github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/util/proto"
-	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_metadata "github.com/kumahq/kuma/pkg/xds/envoy/metadata/v3"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	envoy_tls "github.com/kumahq/kuma/pkg/xds/envoy/tls/v3"
 )
 
@@ -56,7 +56,7 @@ func (c *ClientSideTLSConfigurer) Configure(cluster *envoy_cluster.Cluster) erro
 			cluster.TransportSocketMatches = append(cluster.TransportSocketMatches, &envoy_cluster.Cluster_TransportSocketMatch{
 				Name: ep.Target,
 				Match: &structpb.Struct{
-					Fields: envoy_metadata.MetadataFields(envoy_common.Tags(ep.Tags).WithoutTags(mesh_proto.ServiceTag)),
+					Fields: envoy_metadata.MetadataFields(tags.Tags(ep.Tags).WithoutTags(mesh_proto.ServiceTag)),
 				},
 				TransportSocket: transportSocket,
 			})
diff --git a/pkg/xds/envoy/clusters/v3/lb_subset_configurer.go b/pkg/xds/envoy/clusters/v3/lb_subset_configurer.go
index c54e357c396d..458523c8ffd1 100644
--- a/pkg/xds/envoy/clusters/v3/lb_subset_configurer.go
+++ b/pkg/xds/envoy/clusters/v3/lb_subset_configurer.go
@@ -3,11 +3,11 @@ package clusters
 import (
 	envoy_cluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 type LbSubsetConfigurer struct {
-	TagKeysSets envoy.TagKeysSlice
+	TagKeysSets tags.TagKeysSlice
 }
 
 var _ ClusterConfigurer = &LbSubsetConfigurer{}
diff --git a/pkg/xds/envoy/clusters/v3/lb_subset_configurer_test.go b/pkg/xds/envoy/clusters/v3/lb_subset_configurer_test.go
index ff6ac2cdd65e..de98de7d1a4e 100644
--- a/pkg/xds/envoy/clusters/v3/lb_subset_configurer_test.go
+++ b/pkg/xds/envoy/clusters/v3/lb_subset_configurer_test.go
@@ -8,13 +8,14 @@ import (
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/envoy/clusters"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 var _ = Describe("LbSubset", func() {
 
 	type testCase struct {
 		clusterName string
-		tags        envoy.TagKeysSlice
+		tags        tags.TagKeysSlice
 		expected    string
 	}
 
@@ -36,7 +37,7 @@ var _ = Describe("LbSubset", func() {
 		},
 		Entry("LbSubset is empty if there are no tags", testCase{
 			clusterName: "backend",
-			tags:        []envoy.TagKeys{},
+			tags:        []tags.TagKeys{},
 			expected: `
             connectTimeout: 5s
             edsClusterConfig:
@@ -48,7 +49,7 @@ var _ = Describe("LbSubset", func() {
 		}),
 		Entry("LbSubset is set when more than service tag is set", testCase{
 			clusterName: "backend",
-			tags: []envoy.TagKeys{
+			tags: []tags.TagKeys{
 				{"version"},
 				{"cluster", "version"},
 			},
diff --git a/pkg/xds/envoy/endpoints/endpoints.go b/pkg/xds/envoy/endpoints/endpoints.go
index 5d053c6a0658..b721d7f1a325 100644
--- a/pkg/xds/envoy/endpoints/endpoints.go
+++ b/pkg/xds/envoy/endpoints/endpoints.go
@@ -10,7 +10,7 @@ import (
 	endpoints_v3 "github.com/kumahq/kuma/pkg/xds/envoy/endpoints/v3"
 )
 
-func CreateClusterLoadAssignment(clusterName string, endpoints []core_xds.Endpoint, apiVersion envoy_common.APIVersion) (proto.Message, error) {
+func CreateClusterLoadAssignment(clusterName string, endpoints []core_xds.Endpoint, apiVersion core_xds.APIVersion) (proto.Message, error) {
 	switch apiVersion {
 	case envoy_common.APIV3:
 		return endpoints_v3.CreateClusterLoadAssignment(clusterName, endpoints), nil
diff --git a/pkg/xds/envoy/listeners/filter_chain_builder.go b/pkg/xds/envoy/listeners/filter_chain_builder.go
index e5e9bdf53188..f9f6c940111e 100644
--- a/pkg/xds/envoy/listeners/filter_chain_builder.go
+++ b/pkg/xds/envoy/listeners/filter_chain_builder.go
@@ -7,6 +7,7 @@ import (
 	"github.com/pkg/errors"
 	"google.golang.org/protobuf/types/known/anypb"
 
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/listeners/v3"
 )
@@ -19,7 +20,7 @@ type FilterChainBuilderOpt interface {
 	ApplyTo(config *FilterChainBuilderConfig)
 }
 
-func NewFilterChainBuilder(apiVersion envoy.APIVersion) *FilterChainBuilder {
+func NewFilterChainBuilder(apiVersion core_xds.APIVersion) *FilterChainBuilder {
 	return &FilterChainBuilder{
 		apiVersion: apiVersion,
 	}
@@ -28,7 +29,7 @@ func NewFilterChainBuilder(apiVersion envoy.APIVersion) *FilterChainBuilder {
 // FilterChainBuilder is responsible for generating an Envoy filter chain
 // by applying a series of FilterChainConfigurers.
 type FilterChainBuilder struct {
-	apiVersion envoy.APIVersion
+	apiVersion core_xds.APIVersion
 	config     FilterChainBuilderConfig
 }
 
diff --git a/pkg/xds/envoy/listeners/listener_builder.go b/pkg/xds/envoy/listeners/listener_builder.go
index 33eed603f96c..8731bff14415 100644
--- a/pkg/xds/envoy/listeners/listener_builder.go
+++ b/pkg/xds/envoy/listeners/listener_builder.go
@@ -4,6 +4,7 @@ import (
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	"github.com/pkg/errors"
 
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/listeners/v3"
 )
@@ -16,7 +17,7 @@ type ListenerBuilderOpt interface {
 	ApplyTo(config *ListenerBuilderConfig)
 }
 
-func NewListenerBuilder(apiVersion envoy.APIVersion) *ListenerBuilder {
+func NewListenerBuilder(apiVersion core_xds.APIVersion) *ListenerBuilder {
 	return &ListenerBuilder{
 		apiVersion: apiVersion,
 	}
@@ -25,7 +26,7 @@ func NewListenerBuilder(apiVersion envoy.APIVersion) *ListenerBuilder {
 // ListenerBuilder is responsible for generating an Envoy listener
 // by applying a series of ListenerConfigurers.
 type ListenerBuilder struct {
-	apiVersion envoy.APIVersion
+	apiVersion core_xds.APIVersion
 	config     ListenerBuilderConfig
 }
 
diff --git a/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go b/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
index 205d3870e288..f297a8d13a84 100644
--- a/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
+++ b/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
@@ -29,7 +29,7 @@ var _ = Describe("ServerMtlsConfigurer", func() {
 	DescribeTable("should generate proper Envoy config",
 		func(given testCase) {
 			// when
-			tracker := core_xds.NewSecretsTracker(given.mesh.GetMeta().GetName(), nil)
+			tracker := envoy_common.NewSecretsTracker(given.mesh.GetMeta().GetName(), nil)
 			listener, err := NewListenerBuilder(envoy_common.APIV3).
 				Configure(InboundListener(given.listenerName, given.listenerAddress, given.listenerPort, given.listenerProtocol)).
 				Configure(FilterChain(NewFilterChainBuilder(envoy_common.APIV3).
diff --git a/pkg/xds/envoy/metadata/v3/metadata.go b/pkg/xds/envoy/metadata/v3/metadata.go
index f906320439d7..9defff437f0d 100644
--- a/pkg/xds/envoy/metadata/v3/metadata.go
+++ b/pkg/xds/envoy/metadata/v3/metadata.go
@@ -5,10 +5,10 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
-	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
-func EndpointMetadata(tags envoy_common.Tags) *envoy_core.Metadata {
+func EndpointMetadata(tags tags.Tags) *envoy_core.Metadata {
 	tags = tags.WithoutTags(mesh_proto.ServiceTag) // service name is already in cluster name, we don't need it in metadata
 	if len(tags) == 0 {
 		return nil
@@ -26,7 +26,7 @@ func EndpointMetadata(tags envoy_common.Tags) *envoy_core.Metadata {
 	}
 }
 
-func LbMetadata(tags envoy_common.Tags) *envoy_core.Metadata {
+func LbMetadata(tags tags.Tags) *envoy_core.Metadata {
 	tags = tags.WithoutTags(mesh_proto.ServiceTag) // service name is already in cluster name, we don't need it in metadata
 	if len(tags) == 0 {
 		return nil
@@ -41,7 +41,7 @@ func LbMetadata(tags envoy_common.Tags) *envoy_core.Metadata {
 	}
 }
 
-func MetadataFields(tags envoy_common.Tags) map[string]*structpb.Value {
+func MetadataFields(tags tags.Tags) map[string]*structpb.Value {
 	fields := map[string]*structpb.Value{}
 	for key, value := range tags {
 		fields[key] = &structpb.Value{
@@ -55,8 +55,8 @@ func MetadataFields(tags envoy_common.Tags) map[string]*structpb.Value {
 
 const TagsKey = "io.kuma.tags"
 
-func ExtractTags(metadata *envoy_core.Metadata) envoy_common.Tags {
-	tags := envoy_common.Tags{}
+func ExtractTags(metadata *envoy_core.Metadata) tags.Tags {
+	tags := tags.Tags{}
 	for key, value := range metadata.GetFilterMetadata()[TagsKey].GetFields() {
 		tags[key] = value.GetStringValue()
 	}
diff --git a/pkg/xds/envoy/routes/route_configuration_builder.go b/pkg/xds/envoy/routes/route_configuration_builder.go
index af1703fd8a41..829870e120e8 100644
--- a/pkg/xds/envoy/routes/route_configuration_builder.go
+++ b/pkg/xds/envoy/routes/route_configuration_builder.go
@@ -4,6 +4,7 @@ import (
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	"github.com/pkg/errors"
 
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/routes/v3"
 )
@@ -16,7 +17,7 @@ type RouteConfigurationBuilderOpt interface {
 	ApplyTo(config *RouteConfigurationBuilderConfig)
 }
 
-func NewRouteConfigurationBuilder(apiVersion envoy.APIVersion) *RouteConfigurationBuilder {
+func NewRouteConfigurationBuilder(apiVersion core_xds.APIVersion) *RouteConfigurationBuilder {
 	return &RouteConfigurationBuilder{
 		apiVersion: apiVersion,
 	}
@@ -25,7 +26,7 @@ func NewRouteConfigurationBuilder(apiVersion envoy.APIVersion) *RouteConfigurati
 // RouteConfigurationBuilder is responsible for generating an Envoy RouteConfiguration
 // by applying a series of RouteConfigurationConfigurers.
 type RouteConfigurationBuilder struct {
-	apiVersion envoy.APIVersion
+	apiVersion core_xds.APIVersion
 	config     RouteConfigurationBuilderConfig
 }
 
diff --git a/pkg/xds/envoy/routes/virtual_host_builder.go b/pkg/xds/envoy/routes/virtual_host_builder.go
index 2fdf3ac55116..4ba2075c55c1 100644
--- a/pkg/xds/envoy/routes/virtual_host_builder.go
+++ b/pkg/xds/envoy/routes/virtual_host_builder.go
@@ -4,6 +4,7 @@ import (
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	"github.com/pkg/errors"
 
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	"github.com/kumahq/kuma/pkg/xds/envoy"
 	v3 "github.com/kumahq/kuma/pkg/xds/envoy/routes/v3"
 )
@@ -16,7 +17,7 @@ type VirtualHostBuilderOpt interface {
 	ApplyTo(config *VirtualHostBuilderConfig)
 }
 
-func NewVirtualHostBuilder(apiVersion envoy.APIVersion) *VirtualHostBuilder {
+func NewVirtualHostBuilder(apiVersion core_xds.APIVersion) *VirtualHostBuilder {
 	return &VirtualHostBuilder{
 		apiVersion: apiVersion,
 	}
@@ -25,7 +26,7 @@ func NewVirtualHostBuilder(apiVersion envoy.APIVersion) *VirtualHostBuilder {
 // VirtualHostBuilder is responsible for generating an Envoy VirtualHost
 // by applying a series of VirtualHostConfigurers.
 type VirtualHostBuilder struct {
-	apiVersion envoy.APIVersion
+	apiVersion core_xds.APIVersion
 	config     VirtualHostBuilderConfig
 }
 
diff --git a/pkg/xds/envoy/tags/match.go b/pkg/xds/envoy/tags/match.go
index 2b36acc44deb..d58c6ab26aa5 100644
--- a/pkg/xds/envoy/tags/match.go
+++ b/pkg/xds/envoy/tags/match.go
@@ -1,13 +1,185 @@
 package tags
 
 import (
+	"errors"
 	"fmt"
+	"sort"
 	"strings"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_policy "github.com/kumahq/kuma/pkg/core/policy"
 )
 
+type Tags map[string]string
+
+func (t Tags) WithoutTags(tags ...string) Tags {
+	tagSet := map[string]bool{}
+	for _, t := range tags {
+		tagSet[t] = true
+	}
+	result := Tags{}
+	for tagName, tagValue := range t {
+		if !tagSet[tagName] {
+			result[tagName] = tagValue
+		}
+	}
+	return result
+}
+
+func (t Tags) WithTags(keysAndValues ...string) Tags {
+	result := Tags{}
+	for tagName, tagValue := range t {
+		result[tagName] = tagValue
+	}
+	for i := 0; i < len(keysAndValues); {
+		key, value := keysAndValues[i], keysAndValues[i+1]
+		result[key] = value
+		i += 2
+	}
+	return result
+}
+
+func (t Tags) Keys() TagKeys {
+	var keys []string
+	for key := range t {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func (t Tags) String() string {
+	var pairs []string
+	for _, key := range t.Keys() {
+		pairs = append(pairs, fmt.Sprintf("%s=%s", key, t[key]))
+	}
+	return strings.Join(pairs, ",")
+}
+
+type TagsSlice []Tags
+type TagKeys []string
+type TagKeysSlice []TagKeys
+
+func (t TagsSlice) ToTagKeysSlice() TagKeysSlice {
+	out := []TagKeys{}
+	for _, v := range t {
+		out = append(out, v.Keys())
+	}
+	return out
+}
+
+// Transform applies each transformer to each TagKeys and returns a sorted unique TagKeysSlice.
+func (t TagKeysSlice) Transform(transformers ...TagKeyTransformer) TagKeysSlice {
+	allSlices := map[string]TagKeys{}
+	for _, tagKeys := range t {
+		res := tagKeys.Transform(transformers...)
+		if len(res) > 0 {
+			h := strings.Join(res, ", ")
+			allSlices[h] = res
+		}
+	}
+	out := TagKeysSlice{}
+	for _, n := range allSlices {
+		out = append(out, n)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		for k := 0; k < len(out[i]) && k < len(out[j]); k++ {
+			if out[i][k] != out[j][k] {
+				return out[i][k] < out[j][k]
+			}
+		}
+		return len(out[i]) < len(out[j])
+	})
+	return out
+}
+
+type TagKeyTransformer interface {
+	Apply(slice TagKeys) TagKeys
+}
+type TagKeyTransformerFunc func(slice TagKeys) TagKeys
+
+func (f TagKeyTransformerFunc) Apply(slice TagKeys) TagKeys {
+	return f(slice)
+}
+
+// Transform applies a list of transformers on the tag keys and return a new set of keys (always return sorted, unique sets).
+func (t TagKeys) Transform(transformers ...TagKeyTransformer) TagKeys {
+	tmp := t
+	for _, tr := range transformers {
+		tmp = tr.Apply(tmp)
+	}
+	// Make tags unique and sorted
+	tagSet := map[string]bool{}
+	out := TagKeys{}
+	for _, n := range tmp {
+		if !tagSet[n] {
+			tagSet[n] = true
+			out = append(out, n)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+func Without(tags ...string) TagKeyTransformer {
+	tagSet := map[string]bool{}
+	for _, t := range tags {
+		tagSet[t] = true
+	}
+	return TagKeyTransformerFunc(func(slice TagKeys) TagKeys {
+		out := []string{}
+		for _, t := range slice {
+			if !tagSet[t] {
+				out = append(out, t)
+			}
+		}
+		return out
+	})
+}
+
+func With(tags ...string) TagKeyTransformer {
+	return TagKeyTransformerFunc(func(slice TagKeys) TagKeys {
+		res := make([]string, len(tags)+len(slice))
+		copy(res, slice)
+		copy(res[len(slice):], tags)
+		return res
+	})
+}
+
+func TagsFromString(tagsString string) (Tags, error) {
+	result := Tags{}
+	tagPairs := strings.Split(tagsString, ",")
+	for _, pair := range tagPairs {
+		split := strings.Split(pair, "=")
+		if len(split) != 2 {
+			return nil, errors.New("invalid format of tags, pairs should be separated by , and key should be separated from value by =")
+		}
+		result[split[0]] = split[1]
+	}
+	return result, nil
+}
+
+func DistinctTags(tags []Tags) []Tags {
+	used := map[string]bool{}
+	var result []Tags
+	for _, tag := range tags {
+		str := tag.String()
+		if !used[str] {
+			result = append(result, tag)
+			used[str] = true
+		}
+	}
+	return result
+}
+
+func TagKeySlice(tags []Tags) TagKeysSlice {
+	r := make([]TagKeys, len(tags))
+	for i := range tags {
+		r[i] = tags[i].Keys()
+	}
+	return r
+}
+
 func MatchingRegex(tags mesh_proto.SingleValueTagSet) (re string) {
 	for _, key := range tags.Keys() {
 		keyIsEqual := fmt.Sprintf(`&%s=`, key)
diff --git a/pkg/xds/envoy/tls/sni.go b/pkg/xds/envoy/tls/sni.go
index 2021d6d2fb24..23664c548d38 100644
--- a/pkg/xds/envoy/tls/sni.go
+++ b/pkg/xds/envoy/tls/sni.go
@@ -4,10 +4,10 @@ import (
 	"fmt"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
-func SNIFromTags(tags envoy.Tags) string {
+func SNIFromTags(tags tags.Tags) string {
 	extraTags := tags.WithoutTags(mesh_proto.ServiceTag).String()
 	service := tags[mesh_proto.ServiceTag]
 	if extraTags == "" {
diff --git a/pkg/xds/envoy/types.go b/pkg/xds/envoy/types.go
index 3c59fc76a910..02617e4c6e31 100644
--- a/pkg/xds/envoy/types.go
+++ b/pkg/xds/envoy/types.go
@@ -1,21 +1,24 @@
 package envoy
 
 import (
+	"context"
 	"fmt"
 	"sort"
-	"strings"
 
 	envoy_types "github.com/envoyproxy/go-control-plane/pkg/cache/types"
 	"github.com/pkg/errors"
+	"google.golang.org/protobuf/proto"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 type Cluster struct {
 	service           string
 	name              string
 	weight            uint32
-	tags              Tags
+	tags              tags.Tags
 	mesh              string
 	isExternalService bool
 	lb                *mesh_proto.TrafficRoute_LoadBalancer
@@ -25,7 +28,7 @@ type Cluster struct {
 func (c *Cluster) Service() string { return c.service }
 func (c *Cluster) Name() string    { return c.name }
 func (c *Cluster) Weight() uint32  { return c.weight }
-func (c *Cluster) Tags() Tags      { return c.tags }
+func (c *Cluster) Tags() tags.Tags { return c.tags }
 
 // Mesh returns a non-empty string only if the cluster is in a different mesh
 // from the context.
@@ -95,7 +98,7 @@ func WithWeight(weight uint32) NewClusterOpt {
 	})
 }
 
-func WithTags(tags Tags) NewClusterOpt {
+func WithTags(tags tags.Tags) NewClusterOpt {
 	return newClusterOptFunc(func(cluster *Cluster) {
 		cluster.tags = tags
 	})
@@ -119,175 +122,6 @@ func WithExternalService(isExternalService bool) NewClusterOpt {
 	})
 }
 
-type Tags map[string]string
-type TagsSlice []Tags
-type TagKeys []string
-type TagKeysSlice []TagKeys
-
-func (t TagsSlice) ToTagKeysSlice() TagKeysSlice {
-	out := []TagKeys{}
-	for _, v := range t {
-		out = append(out, v.Keys())
-	}
-	return out
-}
-
-// Transform applies each transformer to each TagKeys and returns a sorted unique TagKeysSlice.
-func (t TagKeysSlice) Transform(transformers ...TagKeyTransformer) TagKeysSlice {
-	allSlices := map[string]TagKeys{}
-	for _, tagKeys := range t {
-		res := tagKeys.Transform(transformers...)
-		if len(res) > 0 {
-			h := strings.Join(res, ", ")
-			allSlices[h] = res
-		}
-	}
-	out := TagKeysSlice{}
-	for _, n := range allSlices {
-		out = append(out, n)
-	}
-	sort.Slice(out, func(i, j int) bool {
-		for k := 0; k < len(out[i]) && k < len(out[j]); k++ {
-			if out[i][k] != out[j][k] {
-				return out[i][k] < out[j][k]
-			}
-		}
-		return len(out[i]) < len(out[j])
-	})
-	return out
-}
-
-type TagKeyTransformer interface {
-	Apply(slice TagKeys) TagKeys
-}
-type TagKeyTransformerFunc func(slice TagKeys) TagKeys
-
-func (f TagKeyTransformerFunc) Apply(slice TagKeys) TagKeys {
-	return f(slice)
-}
-
-// Transform applies a list of transformers on the tag keys and return a new set of keys (always return sorted, unique sets).
-func (t TagKeys) Transform(transformers ...TagKeyTransformer) TagKeys {
-	tmp := t
-	for _, tr := range transformers {
-		tmp = tr.Apply(tmp)
-	}
-	// Make tags unique and sorted
-	tagSet := map[string]bool{}
-	out := TagKeys{}
-	for _, n := range tmp {
-		if !tagSet[n] {
-			tagSet[n] = true
-			out = append(out, n)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-func Without(tags ...string) TagKeyTransformer {
-	tagSet := map[string]bool{}
-	for _, t := range tags {
-		tagSet[t] = true
-	}
-	return TagKeyTransformerFunc(func(slice TagKeys) TagKeys {
-		out := []string{}
-		for _, t := range slice {
-			if !tagSet[t] {
-				out = append(out, t)
-			}
-		}
-		return out
-	})
-}
-
-func With(tags ...string) TagKeyTransformer {
-	return TagKeyTransformerFunc(func(slice TagKeys) TagKeys {
-		res := make([]string, len(tags)+len(slice))
-		copy(res, slice)
-		copy(res[len(slice):], tags)
-		return res
-	})
-}
-
-func (t Tags) WithoutTags(tags ...string) Tags {
-	tagSet := map[string]bool{}
-	for _, t := range tags {
-		tagSet[t] = true
-	}
-	result := Tags{}
-	for tagName, tagValue := range t {
-		if !tagSet[tagName] {
-			result[tagName] = tagValue
-		}
-	}
-	return result
-}
-
-func (t Tags) WithTags(keysAndValues ...string) Tags {
-	result := Tags{}
-	for tagName, tagValue := range t {
-		result[tagName] = tagValue
-	}
-	for i := 0; i < len(keysAndValues); {
-		key, value := keysAndValues[i], keysAndValues[i+1]
-		result[key] = value
-		i += 2
-	}
-	return result
-}
-
-func (t Tags) Keys() TagKeys {
-	var keys []string
-	for key := range t {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-	return keys
-}
-
-func (t Tags) String() string {
-	var pairs []string
-	for _, key := range t.Keys() {
-		pairs = append(pairs, fmt.Sprintf("%s=%s", key, t[key]))
-	}
-	return strings.Join(pairs, ",")
-}
-
-func TagsFromString(tagsString string) (Tags, error) {
-	result := Tags{}
-	tagPairs := strings.Split(tagsString, ",")
-	for _, pair := range tagPairs {
-		split := strings.Split(pair, "=")
-		if len(split) != 2 {
-			return nil, errors.New("invalid format of tags, pairs should be separated by , and key should be separated from value by =")
-		}
-		result[split[0]] = split[1]
-	}
-	return result, nil
-}
-
-func DistinctTags(tags []Tags) []Tags {
-	used := map[string]bool{}
-	var result []Tags
-	for _, tag := range tags {
-		str := tag.String()
-		if !used[str] {
-			result = append(result, tag)
-			used[str] = true
-		}
-	}
-	return result
-}
-
-func TagKeySlice(tags []Tags) TagKeysSlice {
-	r := make([]TagKeys, len(tags))
-	for i := range tags {
-		r[i] = tags[i].Keys()
-	}
-	return r
-}
-
 type Service struct {
 	name               string
 	clusters           []Cluster
@@ -302,8 +136,8 @@ func (c *Service) Add(cluster Cluster) {
 	}
 }
 
-func (c *Service) Tags() []Tags {
-	var result []Tags
+func (c *Service) Tags() []tags.Tags {
+	var result []tags.Tags
 	for _, cluster := range c.clusters {
 		result = append(result, cluster.Tags())
 	}
@@ -361,6 +195,10 @@ func (sa ServicesAccumulator) Add(clusters ...Cluster) {
 	}
 }
 
+type CLACache interface {
+	GetCLA(ctx context.Context, meshName, meshHash string, cluster Cluster, apiVersion core_xds.APIVersion, endpointMap core_xds.EndpointMap) (proto.Message, error)
+}
+
 type NamedResource interface {
 	envoy_types.Resource
 	GetName() string
diff --git a/pkg/xds/envoy/types_test.go b/pkg/xds/envoy/types_test.go
index 4c4f1e85bf45..23e7caf9e1b9 100644
--- a/pkg/xds/envoy/types_test.go
+++ b/pkg/xds/envoy/types_test.go
@@ -4,7 +4,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	envoy "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 var _ = Describe("Ingress Dataplane", func() {
diff --git a/pkg/xds/generator/egress/external_services_generator.go b/pkg/xds/generator/egress/external_services_generator.go
index bc3456375e10..5da9a7712f1f 100644
--- a/pkg/xds/generator/egress/external_services_generator.go
+++ b/pkg/xds/generator/egress/external_services_generator.go
@@ -58,7 +58,7 @@ func (g *ExternalServicesGenerator) Generate(
 
 func (*ExternalServicesGenerator) generateCDS(
 	meshName string,
-	apiVersion envoy_common.APIVersion,
+	apiVersion core_xds.APIVersion,
 	services map[string]bool,
 	endpointMap core_xds.EndpointMap,
 	isIPV6 bool,
@@ -128,8 +128,8 @@ func (*ExternalServicesGenerator) buildServices(
 }
 
 func (g *ExternalServicesGenerator) addFilterChains(
-	apiVersion envoy_common.APIVersion,
-	destinationsPerService map[string][]envoy_common.Tags,
+	apiVersion core_xds.APIVersion,
+	destinationsPerService map[string][]tags.Tags,
 	endpointMap core_xds.EndpointMap,
 	meshResources *core_xds.MeshResources,
 	listenerBuilder *envoy_listeners.ListenerBuilder,
diff --git a/pkg/xds/generator/egress/generator.go b/pkg/xds/generator/egress/generator.go
index 0cfa0fab8610..42a2ca4b3950 100644
--- a/pkg/xds/generator/egress/generator.go
+++ b/pkg/xds/generator/egress/generator.go
@@ -11,6 +11,7 @@ import (
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	envoy_listeners "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
 	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
+	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	generator_secrets "github.com/kumahq/kuma/pkg/xds/generator/secrets"
 )
 
@@ -41,7 +42,7 @@ type Generator struct {
 }
 
 func makeListenerBuilder(
-	apiVersion envoy_common.APIVersion,
+	apiVersion core_xds.APIVersion,
 	zoneEgress *core_mesh.ZoneEgressResource,
 ) *envoy_listeners.ListenerBuilder {
 	networking := zoneEgress.Spec.GetNetworking()
@@ -75,7 +76,7 @@ func (g Generator) Generate(
 		meshName := meshResources.Mesh.GetMeta().GetName()
 
 		// Secrets are generated in relation to a mesh so we need to create a new tracker
-		secretsTracker := core_xds.NewSecretsTracker(meshName, []string{meshName})
+		secretsTracker := envoy_common.NewSecretsTracker(meshName, []string{meshName})
 		proxy.SecretsTracker = secretsTracker
 
 		for _, generator := range g.ZoneEgressGenerators {
@@ -129,8 +130,8 @@ func (g Generator) Generate(
 
 func buildDestinations(
 	trafficRoutes []*core_mesh.TrafficRouteResource,
-) map[string][]envoy_common.Tags {
-	destinations := map[string][]envoy_common.Tags{}
+) map[string][]envoy_tags.Tags {
+	destinations := map[string][]envoy_tags.Tags{}
 
 	for _, tr := range trafficRoutes {
 		for _, split := range tr.Spec.Conf.GetSplitWithDestination() {
diff --git a/pkg/xds/generator/egress/internal_services_generator.go b/pkg/xds/generator/egress/internal_services_generator.go
index 943e2e349668..45af78ddc690 100644
--- a/pkg/xds/generator/egress/internal_services_generator.go
+++ b/pkg/xds/generator/egress/internal_services_generator.go
@@ -9,6 +9,7 @@ import (
 	envoy_endpoints "github.com/kumahq/kuma/pkg/xds/envoy/endpoints"
 	envoy_listeners "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
 	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
@@ -56,7 +57,7 @@ func (g *InternalServicesGenerator) Generate(
 
 func (*InternalServicesGenerator) generateEDS(
 	meshName string,
-	apiVersion envoy_common.APIVersion,
+	apiVersion core_xds.APIVersion,
 	services map[string]bool,
 	endpointMap core_xds.EndpointMap,
 ) ([]*core_xds.Resource, error) {
@@ -86,16 +87,16 @@ func (*InternalServicesGenerator) generateEDS(
 
 func (*InternalServicesGenerator) generateCDS(
 	meshName string,
-	apiVersion envoy_common.APIVersion,
+	apiVersion core_xds.APIVersion,
 	services map[string]bool,
-	destinationsPerService map[string][]envoy_common.Tags,
+	destinationsPerService map[string][]tags.Tags,
 ) ([]*core_xds.Resource, error) {
 	var resources []*core_xds.Resource
 
 	for serviceName := range services {
-		tagSlice := envoy_common.TagsSlice(append(destinationsPerService[serviceName], destinationsPerService[mesh_proto.MatchAllTag]...))
+		tagSlice := tags.TagsSlice(append(destinationsPerService[serviceName], destinationsPerService[mesh_proto.MatchAllTag]...))
 
-		tagKeySlice := tagSlice.ToTagKeysSlice().Transform(envoy_common.Without(mesh_proto.ServiceTag), envoy_common.With("mesh"))
+		tagKeySlice := tagSlice.ToTagKeysSlice().Transform(tags.Without(mesh_proto.ServiceTag), tags.With("mesh"))
 
 		// There is a case where multiple meshes contain services with
 		// the same names, so we cannot use just "serviceName" as a cluster
@@ -144,8 +145,8 @@ func (*InternalServicesGenerator) buildServices(
 }
 
 func (*InternalServicesGenerator) addFilterChains(
-	apiVersion envoy_common.APIVersion,
-	destinationsPerService map[string][]envoy_common.Tags,
+	apiVersion core_xds.APIVersion,
+	destinationsPerService map[string][]tags.Tags,
 	proxy *core_xds.Proxy,
 	listenerBuilder *envoy_listeners.ListenerBuilder,
 	meshResources *core_xds.MeshResources,
diff --git a/pkg/xds/generator/inbound_proxy_generator_test.go b/pkg/xds/generator/inbound_proxy_generator_test.go
index 03fbc58ae31a..f9e47a23d5cb 100644
--- a/pkg/xds/generator/inbound_proxy_generator_test.go
+++ b/pkg/xds/generator/inbound_proxy_generator_test.go
@@ -69,7 +69,7 @@ var _ = Describe("InboundProxyGenerator", func() {
 					},
 					Spec: &dataplane,
 				},
-				SecretsTracker: model.NewSecretsTracker(ctx.Mesh.Resource.Meta.GetName(), []string{ctx.Mesh.Resource.Meta.GetName()}),
+				SecretsTracker: envoy_common.NewSecretsTracker(ctx.Mesh.Resource.Meta.GetName(), []string{ctx.Mesh.Resource.Meta.GetName()}),
 				APIVersion:     envoy_common.APIV3,
 				Policies: model.MatchedPolicies{
 
diff --git a/pkg/xds/generator/ingress_generator.go b/pkg/xds/generator/ingress_generator.go
index 8fdcded24f9e..deff330b21d8 100644
--- a/pkg/xds/generator/ingress_generator.go
+++ b/pkg/xds/generator/ingress_generator.go
@@ -12,6 +12,7 @@ import (
 	envoy_endpoints "github.com/kumahq/kuma/pkg/xds/envoy/endpoints"
 	envoy_listeners "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
 	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
@@ -66,8 +67,8 @@ func (i IngressGenerator) Generate(ctx xds_context.Context, proxy *core_xds.Prox
 func (i IngressGenerator) generateLDS(
 	proxy *core_xds.Proxy,
 	ingress *core_mesh.ZoneIngressResource,
-	destinationsPerService map[string][]envoy_common.Tags,
-	apiVersion envoy_common.APIVersion,
+	destinationsPerService map[string][]tags.Tags,
+	apiVersion core_xds.APIVersion,
 ) (envoy_common.NamedResource, error) {
 	inboundListenerName := envoy_names.GetInboundListenerName(proxy.ZoneIngress.Spec.GetNetworking().GetAddress(), proxy.ZoneIngress.Spec.GetNetworking().GetPort())
 	inboundListenerBuilder := envoy_listeners.NewListenerBuilder(apiVersion).
@@ -113,8 +114,8 @@ func (i IngressGenerator) generateLDS(
 
 func (_ IngressGenerator) destinations(
 	ingressProxy *core_xds.ZoneIngressProxy,
-) map[string][]envoy_common.Tags {
-	destinations := map[string][]envoy_common.Tags{}
+) map[string][]tags.Tags {
+	destinations := map[string][]tags.Tags{}
 	for _, tr := range ingressProxy.TrafficRouteList.Items {
 		for _, split := range tr.Spec.Conf.GetSplitWithDestination() {
 			service := split.Destination[mesh_proto.ServiceTag]
@@ -153,7 +154,7 @@ func (_ IngressGenerator) destinations(
 				}
 				destinations[service] = append(
 					destinations[service],
-					envoy_common.Tags(mesh_proto.Merge(selector.GetMatch(), gateway.Spec.GetTags(), listener.GetTags())),
+					tags.Tags(mesh_proto.Merge(selector.GetMatch(), gateway.Spec.GetTags(), listener.GetTags())),
 				)
 			}
 		}
@@ -173,12 +174,12 @@ func (_ IngressGenerator) services(proxy *core_xds.Proxy) []string {
 
 func (i IngressGenerator) generateCDS(
 	services []string,
-	destinationsPerService map[string][]envoy_common.Tags,
-	apiVersion envoy_common.APIVersion,
+	destinationsPerService map[string][]tags.Tags,
+	apiVersion core_xds.APIVersion,
 ) (resources []*core_xds.Resource, _ error) {
 	for _, service := range services {
-		tagSlice := envoy_common.TagsSlice(append(destinationsPerService[service], destinationsPerService[mesh_proto.MatchAllTag]...))
-		tagKeySlice := tagSlice.ToTagKeysSlice().Transform(envoy_common.Without(mesh_proto.ServiceTag), envoy_common.With("mesh"))
+		tagSlice := tags.TagsSlice(append(destinationsPerService[service], destinationsPerService[mesh_proto.MatchAllTag]...))
+		tagKeySlice := tagSlice.ToTagKeysSlice().Transform(tags.Without(mesh_proto.ServiceTag), tags.With("mesh"))
 		edsCluster, err := envoy_clusters.NewClusterBuilder(apiVersion).
 			Configure(envoy_clusters.EdsCluster(service)).
 			Configure(envoy_clusters.LbSubset(tagKeySlice)).
@@ -199,7 +200,7 @@ func (i IngressGenerator) generateCDS(
 func (_ IngressGenerator) generateEDS(
 	proxy *core_xds.Proxy,
 	services []string,
-	apiVersion envoy_common.APIVersion,
+	apiVersion core_xds.APIVersion,
 ) (resources []*core_xds.Resource, err error) {
 	for _, service := range services {
 		endpoints := proxy.Routing.OutboundTargets[service]
diff --git a/pkg/xds/generator/modifications/modifications.go b/pkg/xds/generator/modifications/modifications.go
index 925981415386..aedae12be333 100644
--- a/pkg/xds/generator/modifications/modifications.go
+++ b/pkg/xds/generator/modifications/modifications.go
@@ -9,7 +9,7 @@ import (
 	modifications_v3 "github.com/kumahq/kuma/pkg/xds/generator/modifications/v3"
 )
 
-func Apply(resources *core_xds.ResourceSet, modifications []*mesh_proto.ProxyTemplate_Modifications, apiVersion envoy_common.APIVersion) error {
+func Apply(resources *core_xds.ResourceSet, modifications []*mesh_proto.ProxyTemplate_Modifications, apiVersion core_xds.APIVersion) error {
 	switch apiVersion {
 	case envoy_common.APIV3:
 		return modifications_v3.Apply(resources, modifications)
diff --git a/pkg/xds/generator/outbound_proxy_generator.go b/pkg/xds/generator/outbound_proxy_generator.go
index cc82bfe26ae8..ec258ac0b0a6 100644
--- a/pkg/xds/generator/outbound_proxy_generator.go
+++ b/pkg/xds/generator/outbound_proxy_generator.go
@@ -16,6 +16,7 @@ import (
 	envoy_clusters "github.com/kumahq/kuma/pkg/xds/envoy/clusters"
 	envoy_listeners "github.com/kumahq/kuma/pkg/xds/envoy/listeners"
 	envoy_names "github.com/kumahq/kuma/pkg/xds/envoy/names"
+	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 var outboundLog = core.Log.WithName("outbound-proxy-generator")
@@ -177,7 +178,7 @@ func (OutboundProxyGenerator) generateLDS(ctx xds_context.Context, proxy *model.
 		Configure(envoy_listeners.OutboundListener(outboundListenerName, oface.DataplaneIP, oface.DataplanePort, model.SocketAddressProtocolTCP)).
 		Configure(envoy_listeners.FilterChain(filterChainBuilder)).
 		Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
-		Configure(envoy_listeners.TagsMetadata(envoy_common.Tags(outbound.GetTagsIncludingLegacy()).WithoutTags(mesh_proto.MeshTag))).
+		Configure(envoy_listeners.TagsMetadata(envoy_tags.Tags(outbound.GetTagsIncludingLegacy()).WithoutTags(mesh_proto.MeshTag))).
 		Build()
 	if err != nil {
 		return nil, errors.Wrapf(err, "could not generate listener %s for service %s", outboundListenerName, serviceName)
@@ -203,7 +204,7 @@ func (g OutboundProxyGenerator) generateCDS(ctx xds_context.Context, services en
 				Configure(envoy_clusters.HealthCheck(protocol, healthCheck))
 
 			clusterName := cluster.Name()
-			clusterTags := []envoy_common.Tags{cluster.Tags()}
+			clusterTags := []envoy_tags.Tags{cluster.Tags()}
 
 			if service.HasExternalService() {
 				if ctx.Mesh.Resource.ZoneEgressEnabled() {
@@ -382,7 +383,7 @@ func (OutboundProxyGenerator) determineRoutes(
 				// The mesh tag is set here if this destination is generated
 				// from a MeshGateway virtual outbound and is not part of the
 				// service tags
-				envoy_common.WithTags(envoy_common.Tags(destination.Destination).WithoutTags(mesh_proto.MeshTag)),
+				envoy_common.WithTags(envoy_tags.Tags(destination.Destination).WithoutTags(mesh_proto.MeshTag)),
 				envoy_common.WithTimeout(timeoutConf),
 				envoy_common.WithLB(route.Spec.GetConf().GetLoadBalancer()),
 				envoy_common.WithExternalService(isExternalService),
diff --git a/pkg/xds/generator/outbound_proxy_generator_test.go b/pkg/xds/generator/outbound_proxy_generator_test.go
index 3fe1c7ed37b4..6cc10768aacd 100644
--- a/pkg/xds/generator/outbound_proxy_generator_test.go
+++ b/pkg/xds/generator/outbound_proxy_generator_test.go
@@ -320,7 +320,7 @@ var _ = Describe("OutboundProxyGenerator", func() {
 					},
 					Spec: dataplane,
 				},
-				SecretsTracker: model.NewSecretsTracker(given.ctx.Mesh.Resource.Meta.GetName(), meshes),
+				SecretsTracker: envoy_common.NewSecretsTracker(given.ctx.Mesh.Resource.Meta.GetName(), meshes),
 				APIVersion:     envoy_common.APIV3,
 				Routing: model.Routing{
 					TrafficRoutes: model.RouteMap{
diff --git a/pkg/xds/generator/prometheus_endpoint_generator_test.go b/pkg/xds/generator/prometheus_endpoint_generator_test.go
index 5fe833d6cc3f..2e5f95ebdc24 100644
--- a/pkg/xds/generator/prometheus_endpoint_generator_test.go
+++ b/pkg/xds/generator/prometheus_endpoint_generator_test.go
@@ -63,7 +63,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 					},
 					Spec: &mesh_proto.Dataplane{},
 				},
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 			},
 		}),
@@ -80,7 +80,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -127,7 +127,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -175,7 +175,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -251,7 +251,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -306,7 +306,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -361,7 +361,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -436,7 +436,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -502,7 +502,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
@@ -567,7 +567,7 @@ var _ = Describe("PrometheusEndpointGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", "demo.backend-01"),
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
diff --git a/pkg/xds/generator/proxy_template_profile_source_test.go b/pkg/xds/generator/proxy_template_profile_source_test.go
index 23531b6c83c5..a17f39615511 100644
--- a/pkg/xds/generator/proxy_template_profile_source_test.go
+++ b/pkg/xds/generator/proxy_template_profile_source_test.go
@@ -27,11 +27,11 @@ type dummyCLACache struct {
 	outboundTargets core_xds.EndpointMap
 }
 
-func (d *dummyCLACache) GetCLA(ctx context.Context, meshName, meshHash string, cluster envoy_common.Cluster, apiVersion envoy_common.APIVersion, endpointMap core_xds.EndpointMap) (proto.Message, error) {
+func (d *dummyCLACache) GetCLA(ctx context.Context, meshName, meshHash string, cluster envoy_common.Cluster, apiVersion core_xds.APIVersion, endpointMap core_xds.EndpointMap) (proto.Message, error) {
 	return endpoints.CreateClusterLoadAssignment(cluster.Service(), d.outboundTargets[cluster.Service()]), nil
 }
 
-var _ core_xds.CLACache = &dummyCLACache{}
+var _ envoy_common.CLACache = &dummyCLACache{}
 
 var _ = Describe("ProxyTemplateProfileSource", func() {
 
@@ -102,7 +102,7 @@ var _ = Describe("ProxyTemplateProfileSource", func() {
 					},
 					Spec: dataplane,
 				},
-				SecretsTracker: core_xds.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Routing: core_xds.Routing{
 					TrafficRoutes: core_xds.RouteMap{
diff --git a/pkg/xds/generator/proxy_template_test.go b/pkg/xds/generator/proxy_template_test.go
index 42ff246dd363..9e5634e2db68 100644
--- a/pkg/xds/generator/proxy_template_test.go
+++ b/pkg/xds/generator/proxy_template_test.go
@@ -81,7 +81,7 @@ var _ = Describe("ProxyTemplateGenerator", func() {
 							},
 						},
 					},
-					SecretsTracker: model.NewSecretsTracker("demo", []string{"demo"}),
+					SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 					APIVersion:     envoy_common.APIV3,
 				},
 				template: &mesh_proto.ProxyTemplate{
@@ -157,7 +157,7 @@ var _ = Describe("ProxyTemplateGenerator", func() {
 						},
 						Spec: dataplane,
 					},
-					SecretsTracker: model.NewSecretsTracker("demo", []string{"demo"}),
+					SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 					APIVersion:     envoy_common.APIV3,
 					Metadata:       &model.DataplaneMetadata{},
 				}
diff --git a/pkg/xds/generator/secrets/generator_test.go b/pkg/xds/generator/secrets/generator_test.go
index e7a3bb842306..71e6eb5ca40f 100644
--- a/pkg/xds/generator/secrets/generator_test.go
+++ b/pkg/xds/generator/secrets/generator_test.go
@@ -56,7 +56,7 @@ var _ = Describe("SecretsGenerator", func() {
 						Mesh: "demo",
 					},
 				},
-				SecretsTracker: core_xds.NewSecretsTracker("", nil),
+				SecretsTracker: envoy_common.NewSecretsTracker("", nil),
 				APIVersion:     envoy_common.APIV3,
 			},
 		}),
@@ -87,7 +87,7 @@ var _ = Describe("SecretsGenerator", func() {
 						},
 					},
 				},
-				SecretsTracker: core_xds.NewSecretsTracker("", nil),
+				SecretsTracker: envoy_common.NewSecretsTracker("", nil),
 				APIVersion:     envoy_common.APIV3,
 			},
 		}),
@@ -155,7 +155,7 @@ var _ = Describe("SecretsGenerator", func() {
 						},
 					},
 				},
-				SecretsTracker: core_xds.NewSecretsTracker("default", []string{"default"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("default", []string{"default"}),
 				APIVersion:     envoy_common.APIV3,
 			},
 			identity: true,
@@ -252,7 +252,7 @@ var _ = Describe("SecretsGenerator", func() {
 			},
 			proxy: &core_xds.Proxy{
 				Id:             *core_xds.BuildProxyId("", mesh_proto.ZoneEgressServiceName),
-				SecretsTracker: core_xds.NewSecretsTracker("mesh-1", []string{"mesh-1", "mesh-2"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("mesh-1", []string{"mesh-1", "mesh-2"}),
 				APIVersion:     envoy_common.APIV3,
 			},
 			expected: "envoy-config-dataplane.golden.yaml",
@@ -328,7 +328,7 @@ var _ = Describe("SecretsGenerator", func() {
 						},
 					},
 				},
-				SecretsTracker: core_xds.NewSecretsTracker("mesh-2", []string{"mesh-1", "mesh-2"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("mesh-2", []string{"mesh-1", "mesh-2"}),
 			},
 			identity: true,
 			usedCas: map[string]struct{}{
diff --git a/pkg/xds/ingress/dataplane.go b/pkg/xds/ingress/dataplane.go
index c17292c17db9..1ac86d84032f 100644
--- a/pkg/xds/ingress/dataplane.go
+++ b/pkg/xds/ingress/dataplane.go
@@ -11,7 +11,7 @@ import (
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	"github.com/kumahq/kuma/pkg/core/resources/manager"
 	"github.com/kumahq/kuma/pkg/core/xds"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	envoy "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/topology"
 )
 
diff --git a/pkg/xds/ingress/outbound.go b/pkg/xds/ingress/outbound.go
index 40558f2b5ab6..6231989520c3 100644
--- a/pkg/xds/ingress/outbound.go
+++ b/pkg/xds/ingress/outbound.go
@@ -4,7 +4,7 @@ import (
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	"github.com/kumahq/kuma/pkg/xds/envoy/tags"
 	"github.com/kumahq/kuma/pkg/xds/topology"
 )
 
@@ -27,7 +27,7 @@ func BuildEndpointMap(
 			if !ok {
 				continue
 			}
-			withMesh := envoy.Tags(inbound.Tags).WithTags("mesh", dataplane.GetMeta().GetMesh())
+			withMesh := tags.Tags(inbound.Tags).WithTags("mesh", dataplane.GetMeta().GetMesh())
 			if !selectors.Matches(withMesh) {
 				continue
 			}
@@ -59,7 +59,7 @@ func BuildEndpointMap(
 				outbound[serviceName] = append(outbound[serviceName], core_xds.Endpoint{
 					Target: dpNetworking.GetAddress(),
 					Port:   listener.GetPort(),
-					Tags: envoy.Tags(mesh_proto.Merge(
+					Tags: tags.Tags(mesh_proto.Merge(
 						dpTags, gateway.Spec.GetTags(), listener.GetTags(),
 					)).WithTags("mesh", dataplane.GetMeta().GetMesh()),
 					Weight: 1,
@@ -74,7 +74,7 @@ func BuildEndpointMap(
 		if !ok {
 			continue
 		}
-		withMesh := envoy.Tags(es.Spec.GetTags()).WithTags("mesh", es.GetMeta().GetMesh())
+		withMesh := tags.Tags(es.Spec.GetTags()).WithTags("mesh", es.GetMeta().GetMesh())
 		if !selectors.Matches(withMesh) {
 			continue
 		}
diff --git a/pkg/xds/server/v3/snapshot_generator_test.go b/pkg/xds/server/v3/snapshot_generator_test.go
index 2f6c3fea53a6..4d9711ba69bf 100644
--- a/pkg/xds/server/v3/snapshot_generator_test.go
+++ b/pkg/xds/server/v3/snapshot_generator_test.go
@@ -124,7 +124,7 @@ var _ = Describe("Reconcile", func() {
 
 			proxy := &model.Proxy{
 				Id:             *model.BuildProxyId("", "demo.web1"),
-				SecretsTracker: model.NewSecretsTracker("demo", []string{"demo"}),
+				SecretsTracker: envoy_common.NewSecretsTracker("demo", []string{"demo"}),
 				APIVersion:     envoy_common.APIV3,
 				Dataplane: &core_mesh.DataplaneResource{
 					Meta: &test_model.ResourceMeta{
diff --git a/pkg/xds/sync/components.go b/pkg/xds/sync/components.go
index 8c29cf684cfa..37753118cced 100644
--- a/pkg/xds/sync/components.go
+++ b/pkg/xds/sync/components.go
@@ -7,8 +7,8 @@ import (
 	"github.com/kumahq/kuma/pkg/core"
 	core_runtime "github.com/kumahq/kuma/pkg/core/runtime"
 	"github.com/kumahq/kuma/pkg/core/user"
+	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
 	xds_metrics "github.com/kumahq/kuma/pkg/xds/metrics"
 )
 
@@ -19,7 +19,7 @@ var (
 func DefaultDataplaneProxyBuilder(
 	config kuma_cp.Config,
 	metadataTracker DataplaneMetadataTracker,
-	apiVersion envoy.APIVersion,
+	apiVersion core_xds.APIVersion,
 ) *DataplaneProxyBuilder {
 	return &DataplaneProxyBuilder{
 		MetadataTracker: metadataTracker,
@@ -31,7 +31,7 @@ func DefaultDataplaneProxyBuilder(
 func DefaultIngressProxyBuilder(
 	rt core_runtime.Runtime,
 	metadataTracker DataplaneMetadataTracker,
-	apiVersion envoy.APIVersion,
+	apiVersion core_xds.APIVersion,
 ) *IngressProxyBuilder {
 	return &IngressProxyBuilder{
 		ResManager:         rt.ResourceManager(),
@@ -48,7 +48,7 @@ func DefaultEgressProxyBuilder(
 	ctx context.Context,
 	rt core_runtime.Runtime,
 	metadataTracker DataplaneMetadataTracker,
-	apiVersion envoy.APIVersion,
+	apiVersion core_xds.APIVersion,
 ) *EgressProxyBuilder {
 	return &EgressProxyBuilder{
 		ctx:                ctx,
@@ -70,7 +70,7 @@ func DefaultDataplaneWatchdogFactory(
 	egressReconciler SnapshotReconciler,
 	xdsMetrics *xds_metrics.Metrics,
 	envoyCpCtx *xds_context.ControlPlaneContext,
-	apiVersion envoy.APIVersion,
+	apiVersion core_xds.APIVersion,
 ) (DataplaneWatchdogFactory, error) {
 	ctx := user.Ctx(context.Background(), user.ControlPlane)
 	config := rt.Config()
diff --git a/pkg/xds/sync/dataplane_proxy_builder.go b/pkg/xds/sync/dataplane_proxy_builder.go
index ed38fe1adc49..b85021aed039 100644
--- a/pkg/xds/sync/dataplane_proxy_builder.go
+++ b/pkg/xds/sync/dataplane_proxy_builder.go
@@ -30,7 +30,7 @@ type DataplaneProxyBuilder struct {
 	MetadataTracker DataplaneMetadataTracker
 
 	Zone       string
-	APIVersion envoy.APIVersion
+	APIVersion core_xds.APIVersion
 }
 
 func (p *DataplaneProxyBuilder) Build(ctx context.Context, key core_model.ResourceKey, meshContext xds_context.MeshContext) (*core_xds.Proxy, error) {
@@ -58,7 +58,7 @@ func (p *DataplaneProxyBuilder) Build(ctx context.Context, key core_model.Resour
 		allMeshNames = append(allMeshNames, mesh.GetMeta().GetName())
 	}
 
-	secretsTracker := core_xds.NewSecretsTracker(meshName, allMeshNames)
+	secretsTracker := envoy.NewSecretsTracker(meshName, allMeshNames)
 
 	proxy := &core_xds.Proxy{
 		Id:             core_xds.FromResourceKey(key),
diff --git a/pkg/xds/sync/egress_proxy_builder.go b/pkg/xds/sync/egress_proxy_builder.go
index a20057236d28..bfb2db3b7f00 100644
--- a/pkg/xds/sync/egress_proxy_builder.go
+++ b/pkg/xds/sync/egress_proxy_builder.go
@@ -14,7 +14,6 @@ import (
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/core/xds"
 	xds_cache "github.com/kumahq/kuma/pkg/xds/cache/mesh"
-	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	xds_topology "github.com/kumahq/kuma/pkg/xds/topology"
 )
 
@@ -28,7 +27,7 @@ type EgressProxyBuilder struct {
 	meshCache          *xds_cache.Cache
 
 	zone       string
-	apiVersion envoy_common.APIVersion
+	apiVersion xds.APIVersion
 }
 
 func (p *EgressProxyBuilder) Build(
diff --git a/pkg/xds/sync/ingress_proxy_builder.go b/pkg/xds/sync/ingress_proxy_builder.go
index 61be73325d65..a1b10773a780 100644
--- a/pkg/xds/sync/ingress_proxy_builder.go
+++ b/pkg/xds/sync/ingress_proxy_builder.go
@@ -13,7 +13,6 @@ import (
 	core_store "github.com/kumahq/kuma/pkg/core/resources/store"
 	"github.com/kumahq/kuma/pkg/core/xds"
 	xds_cache "github.com/kumahq/kuma/pkg/xds/cache/mesh"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/ingress"
 	xds_topology "github.com/kumahq/kuma/pkg/xds/topology"
 )
@@ -25,7 +24,7 @@ type IngressProxyBuilder struct {
 	MetadataTracker    DataplaneMetadataTracker
 	meshCache          *xds_cache.Cache
 
-	apiVersion envoy.APIVersion
+	apiVersion xds.APIVersion
 	zone       string
 }
 
diff --git a/pkg/xds/topology/outbound.go b/pkg/xds/topology/outbound.go
index b12e632db59b..833c33832797 100644
--- a/pkg/xds/topology/outbound.go
+++ b/pkg/xds/topology/outbound.go
@@ -13,7 +13,7 @@ import (
 	"github.com/kumahq/kuma/pkg/core/datasource"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	"github.com/kumahq/kuma/pkg/xds/envoy"
+	envoy_tags "github.com/kumahq/kuma/pkg/xds/envoy/tags"
 )
 
 const (
@@ -492,7 +492,7 @@ func NewExternalServiceEndpoint(
 	if es.TLSEnabled {
 		name := externalService.Meta.GetName()
 
-		tags = envoy.Tags(tags).
+		tags = envoy_tags.Tags(tags).
 			WithTags(mesh_proto.ExternalServiceTag, name)
 	}