diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 04cfb65148..465d95e2f4 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -99,6 +99,36 @@ func (MeshConfig_AuthPolicy) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptorConfig, []int{0, 1}
 }
 
+type MeshConfig_OutboundTrafficPolicy_Mode int32
+
+const (
+	// outbound traffic will be restricted to services defined in the service registry as well as those defined
+	// through ServiceEntries
+	MeshConfig_OutboundTrafficPolicy_REGISTRY_ONLY MeshConfig_OutboundTrafficPolicy_Mode = 0
+	// outbound traffic to unknown destinations will be allowed
+	MeshConfig_OutboundTrafficPolicy_ALLOW_ANY MeshConfig_OutboundTrafficPolicy_Mode = 1
+	// not implemented. outbound traffic will be restricted to destinations defined in VirtualServices only
+	MeshConfig_OutboundTrafficPolicy_VIRTUAL_SERVICE_ONLY MeshConfig_OutboundTrafficPolicy_Mode = 2
+)
+
+var MeshConfig_OutboundTrafficPolicy_Mode_name = map[int32]string{
+	0: "REGISTRY_ONLY",
+	1: "ALLOW_ANY",
+	2: "VIRTUAL_SERVICE_ONLY",
+}
+var MeshConfig_OutboundTrafficPolicy_Mode_value = map[string]int32{
+	"REGISTRY_ONLY":        0,
+	"ALLOW_ANY":            1,
+	"VIRTUAL_SERVICE_ONLY": 2,
+}
+
+func (x MeshConfig_OutboundTrafficPolicy_Mode) String() string {
+	return proto.EnumName(MeshConfig_OutboundTrafficPolicy_Mode_name, int32(x))
+}
+func (MeshConfig_OutboundTrafficPolicy_Mode) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptorConfig, []int{0, 0, 0}
+}
+
 // MeshConfig defines mesh-wide variables shared by all Envoy instances in the
 // Istio service mesh.
 //
@@ -145,6 +175,8 @@ type MeshConfig struct {
 	IngressControllerMode MeshConfig_IngressControllerMode `protobuf:"varint,9,opt,name=ingress_controller_mode,json=ingressControllerMode,proto3,enum=istio.mesh.v1alpha1.MeshConfig_IngressControllerMode" json:"ingress_controller_mode,omitempty"`
 	// $hide_from_docs
 	AuthPolicy MeshConfig_AuthPolicy `protobuf:"varint,10,opt,name=auth_policy,json=authPolicy,proto3,enum=istio.mesh.v1alpha1.MeshConfig_AuthPolicy" json:"auth_policy,omitempty"`
+	// $hide_from_docs
+	RdsRefreshDelay *google_protobuf.Duration `protobuf:"bytes,11,opt,name=rds_refresh_delay,json=rdsRefreshDelay" json:"rds_refresh_delay,omitempty"`
 	// Flag to control generation of trace spans and request IDs.
 	// Requires a trace span collector defined in the proxy configuration.
 	EnableTracing bool `protobuf:"varint,12,opt,name=enable_tracing,json=enableTracing,proto3" json:"enable_tracing,omitempty"`
@@ -160,11 +192,22 @@ type MeshConfig struct {
 	// and remain constant for the duration of the pod. The rest of the mesh config can be changed
 	// at runtime and config gets distributed dynamically.
 	DefaultConfig *ProxyConfig `protobuf:"bytes,14,opt,name=default_config,json=defaultConfig" json:"default_config,omitempty"`
+	// $hide_from_docs
+	MixerAddress string `protobuf:"bytes,16,opt,name=mixer_address,json=mixerAddress,proto3" json:"mixer_address,omitempty"`
+	// Set the default behavior of the sidecar for handling outbound traffic from the application.
+	// While the default mode should work out of the box, if your application uses one or more external services that
+	// are not known apriori, setting the policy to ALLOW_ANY will cause the sidecars to route traffic to the any
+	// requested destination.
+	// Users are strongly encouraged to use ServiceEntries to explicitly declare any external dependencies,
+	// instead of using allow_any.
+	OutboundTrafficPolicy *MeshConfig_OutboundTrafficPolicy `protobuf:"bytes,17,opt,name=outbound_traffic_policy,json=outboundTrafficPolicy" json:"outbound_traffic_policy,omitempty"`
 	// Enables clide side policy checks.
 	EnableClientSidePolicyCheck bool `protobuf:"varint,19,opt,name=enable_client_side_policy_check,json=enableClientSidePolicyCheck,proto3" json:"enable_client_side_policy_check,omitempty"`
 	// Unix Domain Socket through which envoy communicates with NodeAgent SDS to get key/cert for mTLS.
 	// Use secret-mount files instead of SDS if set to empty.
 	SdsUdsPath string `protobuf:"bytes,20,opt,name=sds_uds_path,json=sdsUdsPath,proto3" json:"sds_uds_path,omitempty"`
+	// $hide_from_docs
+	SdsRefreshDelay *google_protobuf.Duration `protobuf:"bytes,21,opt,name=sds_refresh_delay,json=sdsRefreshDelay" json:"sds_refresh_delay,omitempty"`
 	// ConfigSource describes a source of configuration data for networking
 	// rules, and other Istio configuration artifacts. Multiple data sources
 	// can be configured for a single control plane.
@@ -259,6 +302,13 @@ func (m *MeshConfig) GetAuthPolicy() MeshConfig_AuthPolicy {
 	return MeshConfig_NONE
 }
 
+func (m *MeshConfig) GetRdsRefreshDelay() *google_protobuf.Duration {
+	if m != nil {
+		return m.RdsRefreshDelay
+	}
+	return nil
+}
+
 func (m *MeshConfig) GetEnableTracing() bool {
 	if m != nil {
 		return m.EnableTracing
@@ -287,6 +337,20 @@ func (m *MeshConfig) GetDefaultConfig() *ProxyConfig {
 	return nil
 }
 
+func (m *MeshConfig) GetMixerAddress() string {
+	if m != nil {
+		return m.MixerAddress
+	}
+	return ""
+}
+
+func (m *MeshConfig) GetOutboundTrafficPolicy() *MeshConfig_OutboundTrafficPolicy {
+	if m != nil {
+		return m.OutboundTrafficPolicy
+	}
+	return nil
+}
+
 func (m *MeshConfig) GetEnableClientSidePolicyCheck() bool {
 	if m != nil {
 		return m.EnableClientSidePolicyCheck
@@ -301,6 +365,13 @@ func (m *MeshConfig) GetSdsUdsPath() string {
 	return ""
 }
 
+func (m *MeshConfig) GetSdsRefreshDelay() *google_protobuf.Duration {
+	if m != nil {
+		return m.SdsRefreshDelay
+	}
+	return nil
+}
+
 func (m *MeshConfig) GetConfigSources() []*ConfigSource {
 	if m != nil {
 		return m.ConfigSources
@@ -315,6 +386,24 @@ func (m *MeshConfig) GetEnableSdsTokenMount() bool {
 	return false
 }
 
+type MeshConfig_OutboundTrafficPolicy struct {
+	Mode MeshConfig_OutboundTrafficPolicy_Mode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode" json:"mode,omitempty"`
+}
+
+func (m *MeshConfig_OutboundTrafficPolicy) Reset()         { *m = MeshConfig_OutboundTrafficPolicy{} }
+func (m *MeshConfig_OutboundTrafficPolicy) String() string { return proto.CompactTextString(m) }
+func (*MeshConfig_OutboundTrafficPolicy) ProtoMessage()    {}
+func (*MeshConfig_OutboundTrafficPolicy) Descriptor() ([]byte, []int) {
+	return fileDescriptorConfig, []int{0, 0}
+}
+
+func (m *MeshConfig_OutboundTrafficPolicy) GetMode() MeshConfig_OutboundTrafficPolicy_Mode {
+	if m != nil {
+		return m.Mode
+	}
+	return MeshConfig_OutboundTrafficPolicy_REGISTRY_ONLY
+}
+
 // ConfigSource describes information about a configuration store inside a
 // mesh. A single control plane instance can interact with one or more data
 // sources.
@@ -350,9 +439,11 @@ func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings
 
 func init() {
 	proto.RegisterType((*MeshConfig)(nil), "istio.mesh.v1alpha1.MeshConfig")
+	proto.RegisterType((*MeshConfig_OutboundTrafficPolicy)(nil), "istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy")
 	proto.RegisterType((*ConfigSource)(nil), "istio.mesh.v1alpha1.ConfigSource")
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_IngressControllerMode", MeshConfig_IngressControllerMode_name, MeshConfig_IngressControllerMode_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_AuthPolicy", MeshConfig_AuthPolicy_name, MeshConfig_AuthPolicy_value)
+	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode", MeshConfig_OutboundTrafficPolicy_Mode_name, MeshConfig_OutboundTrafficPolicy_Mode_value)
 }
 func (m *MeshConfig) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
@@ -433,6 +524,16 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 		i++
 		i = encodeVarintConfig(dAtA, i, uint64(m.AuthPolicy))
 	}
+	if m.RdsRefreshDelay != nil {
+		dAtA[i] = 0x5a
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(m.RdsRefreshDelay.Size()))
+		n2, err := m.RdsRefreshDelay.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n2
+	}
 	if m.EnableTracing {
 		dAtA[i] = 0x60
 		i++
@@ -453,11 +554,31 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x72
 		i++
 		i = encodeVarintConfig(dAtA, i, uint64(m.DefaultConfig.Size()))
-		n2, err := m.DefaultConfig.MarshalTo(dAtA[i:])
+		n3, err := m.DefaultConfig.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n2
+		i += n3
+	}
+	if len(m.MixerAddress) > 0 {
+		dAtA[i] = 0x82
+		i++
+		dAtA[i] = 0x1
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(len(m.MixerAddress)))
+		i += copy(dAtA[i:], m.MixerAddress)
+	}
+	if m.OutboundTrafficPolicy != nil {
+		dAtA[i] = 0x8a
+		i++
+		dAtA[i] = 0x1
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(m.OutboundTrafficPolicy.Size()))
+		n4, err := m.OutboundTrafficPolicy.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n4
 	}
 	if m.EnableClientSidePolicyCheck {
 		dAtA[i] = 0x98
@@ -479,6 +600,18 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 		i = encodeVarintConfig(dAtA, i, uint64(len(m.SdsUdsPath)))
 		i += copy(dAtA[i:], m.SdsUdsPath)
 	}
+	if m.SdsRefreshDelay != nil {
+		dAtA[i] = 0xaa
+		i++
+		dAtA[i] = 0x1
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(m.SdsRefreshDelay.Size()))
+		n5, err := m.SdsRefreshDelay.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n5
+	}
 	if len(m.ConfigSources) > 0 {
 		for _, msg := range m.ConfigSources {
 			dAtA[i] = 0xb2
@@ -528,6 +661,29 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
+func (m *MeshConfig_OutboundTrafficPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MeshConfig_OutboundTrafficPolicy) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Mode != 0 {
+		dAtA[i] = 0x8
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(m.Mode))
+	}
+	return i, nil
+}
+
 func (m *ConfigSource) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -553,11 +709,11 @@ func (m *ConfigSource) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintConfig(dAtA, i, uint64(m.TlsSettings.Size()))
-		n3, err := m.TlsSettings.MarshalTo(dAtA[i:])
+		n6, err := m.TlsSettings.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n3
+		i += n6
 	}
 	return i, nil
 }
@@ -609,6 +765,10 @@ func (m *MeshConfig) Size() (n int) {
 	if m.AuthPolicy != 0 {
 		n += 1 + sovConfig(uint64(m.AuthPolicy))
 	}
+	if m.RdsRefreshDelay != nil {
+		l = m.RdsRefreshDelay.Size()
+		n += 1 + l + sovConfig(uint64(l))
+	}
 	if m.EnableTracing {
 		n += 2
 	}
@@ -620,6 +780,14 @@ func (m *MeshConfig) Size() (n int) {
 		l = m.DefaultConfig.Size()
 		n += 1 + l + sovConfig(uint64(l))
 	}
+	l = len(m.MixerAddress)
+	if l > 0 {
+		n += 2 + l + sovConfig(uint64(l))
+	}
+	if m.OutboundTrafficPolicy != nil {
+		l = m.OutboundTrafficPolicy.Size()
+		n += 2 + l + sovConfig(uint64(l))
+	}
 	if m.EnableClientSidePolicyCheck {
 		n += 3
 	}
@@ -627,6 +795,10 @@ func (m *MeshConfig) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovConfig(uint64(l))
 	}
+	if m.SdsRefreshDelay != nil {
+		l = m.SdsRefreshDelay.Size()
+		n += 2 + l + sovConfig(uint64(l))
+	}
 	if len(m.ConfigSources) > 0 {
 		for _, e := range m.ConfigSources {
 			l = e.Size()
@@ -646,6 +818,15 @@ func (m *MeshConfig) Size() (n int) {
 	return n
 }
 
+func (m *MeshConfig_OutboundTrafficPolicy) Size() (n int) {
+	var l int
+	_ = l
+	if m.Mode != 0 {
+		n += 1 + sovConfig(uint64(m.Mode))
+	}
+	return n
+}
+
 func (m *ConfigSource) Size() (n int) {
 	var l int
 	_ = l
@@ -947,6 +1128,39 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RdsRefreshDelay", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.RdsRefreshDelay == nil {
+				m.RdsRefreshDelay = &google_protobuf.Duration{}
+			}
+			if err := m.RdsRefreshDelay.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 12:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field EnableTracing", wireType)
@@ -1029,6 +1243,68 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 16:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MixerAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MixerAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OutboundTrafficPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.OutboundTrafficPolicy == nil {
+				m.OutboundTrafficPolicy = &MeshConfig_OutboundTrafficPolicy{}
+			}
+			if err := m.OutboundTrafficPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 19:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field EnableClientSidePolicyCheck", wireType)
@@ -1078,6 +1354,39 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 			}
 			m.SdsUdsPath = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 21:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SdsRefreshDelay", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SdsRefreshDelay == nil {
+				m.SdsRefreshDelay = &google_protobuf.Duration{}
+			}
+			if err := m.SdsRefreshDelay.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 22:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConfigSources", wireType)
@@ -1199,6 +1508,75 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *MeshConfig_OutboundTrafficPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowConfig
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OutboundTrafficPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OutboundTrafficPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mode", wireType)
+			}
+			m.Mode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Mode |= (MeshConfig_OutboundTrafficPolicy_Mode(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipConfig(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ConfigSource) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -1419,58 +1797,68 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) }
 
 var fileDescriptorConfig = []byte{
-	// 838 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0xdd, 0x4e, 0x23, 0x37,
-	0x18, 0xdd, 0x81, 0x2c, 0x84, 0x2f, 0x7f, 0x83, 0x53, 0x58, 0x43, 0x25, 0x9a, 0x52, 0x95, 0x46,
-	0xa8, 0x9a, 0x68, 0x83, 0x7a, 0xd1, 0x4b, 0x08, 0x9b, 0x2e, 0x51, 0x58, 0xd0, 0x64, 0xb8, 0xe9,
-	0x8d, 0x35, 0xcc, 0x38, 0x33, 0x16, 0x8e, 0x3d, 0x1a, 0x7b, 0xb6, 0xbb, 0xcf, 0xd4, 0x17, 0xe9,
-	0x65, 0x1f, 0xa1, 0xe2, 0x49, 0xaa, 0xb1, 0x27, 0x24, 0x48, 0x91, 0xf6, 0xd2, 0xe7, 0x1c, 0xfb,
-	0x3b, 0xfe, 0xce, 0x67, 0xc3, 0xf1, 0x82, 0xaa, 0x74, 0xf0, 0xf9, 0x7d, 0xc8, 0xb3, 0x34, 0x7c,
-	0x3f, 0x88, 0xa4, 0x98, 0xb3, 0xc4, 0xcb, 0x72, 0xa9, 0x25, 0xea, 0x32, 0xa5, 0x99, 0xf4, 0x4a,
-	0x85, 0xb7, 0x54, 0x1c, 0x9f, 0x24, 0x52, 0x26, 0x9c, 0x0e, 0x8c, 0xe4, 0xb1, 0x98, 0x0f, 0xe2,
-	0x22, 0x0f, 0x35, 0x93, 0xc2, 0x6e, 0x3a, 0x3e, 0x7a, 0x7d, 0x60, 0x96, 0xcb, 0x2f, 0x5f, 0x2b,
-	0xea, 0x5c, 0x50, 0xfd, 0x97, 0xcc, 0x9f, 0x98, 0x48, 0x96, 0x82, 0x8b, 0x41, 0x4c, 0x95, 0x66,
-	0xc2, 0x9c, 0x40, 0xf2, 0x82, 0x53, 0xab, 0x3d, 0xfd, 0x7b, 0x0f, 0xe0, 0x96, 0xaa, 0x74, 0x64,
-	0x0c, 0xa1, 0x5f, 0x01, 0x2d, 0xd8, 0x17, 0x9a, 0x93, 0x28, 0xa5, 0xd1, 0x13, 0x51, 0x34, 0xff,
-	0x4c, 0x73, 0xec, 0xf4, 0x9c, 0xfe, 0x9e, 0xef, 0x1a, 0x66, 0x54, 0x12, 0x33, 0x83, 0x23, 0x0f,
-	0xba, 0x56, 0x9d, 0xd3, 0x4c, 0xe6, 0x7a, 0x29, 0xdf, 0x32, 0xf2, 0x7d, 0x43, 0xf9, 0x86, 0xa9,
-	0xf4, 0x43, 0x38, 0x88, 0x99, 0x0a, 0x1f, 0x39, 0x25, 0x99, 0xe4, 0x2c, 0xfa, 0x6a, 0xcb, 0x28,
-	0xbc, 0xdd, 0x73, 0xfa, 0x75, 0xbf, 0x5b, 0x91, 0xf7, 0x86, 0x33, 0x85, 0x14, 0x3a, 0x87, 0x7d,
-	0x73, 0x37, 0xc2, 0x99, 0xd2, 0x54, 0x90, 0xf2, 0x38, 0x5c, 0xeb, 0x39, 0xfd, 0xb7, 0x7e, 0xc7,
-	0x10, 0x53, 0x83, 0xdf, 0xcb, 0x5c, 0xa3, 0x33, 0xb0, 0x10, 0x49, 0xb5, 0xce, 0xac, 0xf2, 0xad,
-	0x51, 0xb6, 0x0c, 0xfc, 0x51, 0xeb, 0xcc, 0xe8, 0xae, 0xa0, 0x13, 0x49, 0x21, 0x68, 0xa4, 0x89,
-	0x66, 0x0b, 0x2a, 0x0b, 0x8d, 0x77, 0x7a, 0x4e, 0xbf, 0x31, 0x3c, 0xf2, 0x6c, 0xd7, 0xbd, 0x65,
-	0xd7, 0xbd, 0xeb, 0xaa, 0xeb, 0x7e, 0xbb, 0xda, 0x11, 0xd8, 0x0d, 0xe8, 0x27, 0x68, 0x31, 0x91,
-	0xe4, 0x54, 0x29, 0x12, 0xf1, 0x50, 0x29, 0xbc, 0x6b, 0x6e, 0xdd, 0xac, 0xc0, 0x51, 0x89, 0xa1,
-	0x5f, 0xa0, 0xb3, 0x14, 0x95, 0xbd, 0x61, 0x11, 0xc5, 0x75, 0x23, 0x6b, 0x57, 0xf0, 0xcc, 0xa2,
-	0x68, 0x01, 0xef, 0x5e, 0x4e, 0x93, 0x42, 0xe7, 0x92, 0x73, 0x9a, 0x93, 0x85, 0x8c, 0x29, 0xde,
-	0xeb, 0x39, 0xfd, 0xf6, 0xf0, 0x37, 0x6f, 0xc3, 0x90, 0x78, 0xab, 0xe4, 0xbc, 0x9b, 0xaa, 0xee,
-	0xcb, 0xee, 0x5b, 0x19, 0x53, 0xff, 0x80, 0x6d, 0x82, 0xd1, 0x1d, 0x34, 0xc2, 0x42, 0xa7, 0x55,
-	0x0a, 0x18, 0x4c, 0x89, 0xf3, 0x6f, 0x95, 0xb8, 0x2c, 0x74, 0x6a, 0xb3, 0xb9, 0xda, 0xc2, 0x8e,
-	0x0f, 0xe1, 0xcb, 0x1a, 0xfd, 0x0c, 0x6d, 0x2a, 0x4c, 0xb0, 0x3a, 0x0f, 0x23, 0x26, 0x12, 0xdc,
-	0x34, 0x91, 0xb6, 0x2c, 0x1a, 0x58, 0xb0, 0x0c, 0x28, 0x8c, 0xa2, 0xf2, 0x96, 0x5c, 0x26, 0x64,
-	0xce, 0x38, 0xc5, 0x2d, 0xd3, 0x8f, 0x96, 0x85, 0xa7, 0x32, 0x19, 0x33, 0x4e, 0xd1, 0x1f, 0xd0,
-	0x8e, 0xe9, 0x3c, 0x2c, 0xb8, 0x26, 0xf6, 0xa5, 0xe0, 0xb6, 0xc9, 0xa7, 0xb7, 0xd1, 0xe2, 0x7d,
-	0x19, 0xae, 0xf5, 0xe8, 0xb7, 0xaa, 0x7d, 0xd5, 0x3c, 0x5f, 0xc3, 0x0f, 0x95, 0xaf, 0x88, 0x33,
-	0x2a, 0x34, 0x51, 0x2c, 0x7e, 0x3d, 0x7c, 0xb8, 0x6b, 0x8c, 0x7e, 0x6f, 0x65, 0x23, 0xa3, 0x9a,
-	0xb1, 0x78, 0x7d, 0x08, 0x51, 0x0f, 0x9a, 0x2a, 0x56, 0xa4, 0x88, 0x15, 0xc9, 0x42, 0x9d, 0xe2,
-	0xef, 0x8c, 0x67, 0x50, 0xb1, 0x7a, 0x88, 0xd5, 0x7d, 0xa8, 0x53, 0xf4, 0x11, 0xda, 0xd6, 0x28,
-	0x51, 0xb2, 0xc8, 0x23, 0xaa, 0xf0, 0x61, 0x6f, 0xbb, 0xdf, 0x18, 0xfe, 0xb8, 0xd1, 0xb0, 0x35,
-	0x37, 0x33, 0x4a, 0xbf, 0x15, 0xad, 0xad, 0x14, 0xba, 0x80, 0xc3, 0xca, 0x71, 0x59, 0x52, 0xcb,
-	0x27, 0x2a, 0xc8, 0x42, 0x16, 0x42, 0xe3, 0x77, 0xf6, 0x91, 0x58, 0x76, 0x16, 0xab, 0xa0, 0xe4,
-	0x6e, 0x4b, 0xaa, 0x7c, 0x24, 0xeb, 0x7d, 0x95, 0xf9, 0x22, 0xd4, 0x18, 0x1b, 0x97, 0x9d, 0x55,
-	0x67, 0x0d, 0x5c, 0x16, 0x58, 0xbf, 0x3f, 0x99, 0x87, 0x8c, 0x13, 0x99, 0x51, 0x81, 0x8f, 0x6c,
-	0x81, 0x6c, 0x75, 0xf3, 0x71, 0xc8, 0xf8, 0x5d, 0x46, 0xc5, 0xe9, 0xef, 0x70, 0xb0, 0x71, 0xc0,
-	0xd0, 0x2e, 0x6c, 0xdf, 0x8d, 0xc7, 0xee, 0x1b, 0xd4, 0x80, 0xdd, 0xeb, 0x0f, 0xe3, 0xcb, 0x87,
-	0x69, 0xe0, 0x3a, 0x08, 0x60, 0x67, 0x16, 0xf8, 0x37, 0xa3, 0xc0, 0xdd, 0x3a, 0x3d, 0x03, 0x58,
-	0x0d, 0x0e, 0xaa, 0x43, 0xed, 0xd3, 0xdd, 0xa7, 0x0f, 0xee, 0x1b, 0xd4, 0x06, 0xb8, 0x7d, 0x08,
-	0x1e, 0x2e, 0xa7, 0x24, 0x98, 0xce, 0x5c, 0x67, 0x52, 0xab, 0x37, 0xdc, 0xe6, 0xa4, 0x56, 0xef,
-	0xb8, 0xee, 0xa4, 0x56, 0x77, 0xdd, 0xfd, 0x49, 0xad, 0xbe, 0xef, 0xa2, 0x49, 0xad, 0x8e, 0xdc,
-	0xee, 0xa4, 0x56, 0x3f, 0x70, 0x0f, 0x4f, 0x15, 0x34, 0xd7, 0x7b, 0x87, 0x30, 0xec, 0x86, 0x71,
-	0x5c, 0xda, 0xaa, 0xfe, 0xa8, 0xe5, 0x12, 0xdd, 0x40, 0x53, 0xf3, 0xf2, 0xd5, 0x69, 0xcd, 0x44,
-	0xa2, 0xcc, 0x9f, 0xd4, 0x18, 0x9e, 0x55, 0x71, 0xac, 0x3e, 0xc8, 0x65, 0x28, 0x17, 0x5e, 0x30,
-	0x9d, 0xcd, 0x2a, 0xb5, 0xdf, 0xd0, 0x5c, 0x2d, 0x17, 0x57, 0xfd, 0x7f, 0x9e, 0x4f, 0x9c, 0x7f,
-	0x9f, 0x4f, 0x9c, 0xff, 0x9e, 0x4f, 0x9c, 0x3f, 0x8f, 0xed, 0x09, 0x4c, 0x0e, 0xc2, 0x8c, 0x0d,
-	0x5e, 0x7d, 0xc2, 0x8f, 0x3b, 0xe6, 0xdb, 0xb8, 0xf8, 0x3f, 0x00, 0x00, 0xff, 0xff, 0x4a, 0x5f,
-	0x27, 0x27, 0xed, 0x05, 0x00, 0x00,
+	// 1001 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x55, 0xdd, 0x4e, 0xe3, 0x46,
+	0x14, 0x5e, 0x43, 0x16, 0xc2, 0xc9, 0x9f, 0x19, 0x36, 0xcb, 0x90, 0x56, 0x34, 0xa5, 0x2a, 0x1b,
+	0xa1, 0xca, 0xd1, 0x82, 0x7a, 0xd1, 0xde, 0x85, 0x00, 0xbb, 0x59, 0x05, 0x82, 0x6c, 0xb3, 0x15,
+	0xbd, 0x19, 0x19, 0x7b, 0x92, 0x8c, 0x70, 0x3c, 0xae, 0x67, 0xbc, 0x5d, 0xae, 0xfb, 0x58, 0x7d,
+	0x81, 0x5e, 0xf6, 0x11, 0x2a, 0x9e, 0xa4, 0x9a, 0x19, 0x07, 0x42, 0x1b, 0x89, 0xaa, 0x97, 0xfe,
+	0xbe, 0xef, 0xcc, 0xf1, 0xf9, 0xce, 0x39, 0x33, 0xd0, 0x9a, 0x51, 0x31, 0xed, 0x7e, 0x7a, 0x1b,
+	0xc4, 0xe9, 0x34, 0x78, 0xdb, 0x0d, 0x79, 0x32, 0x66, 0x13, 0x27, 0xcd, 0xb8, 0xe4, 0x68, 0x8b,
+	0x09, 0xc9, 0xb8, 0xa3, 0x14, 0xce, 0x5c, 0xd1, 0xda, 0x9d, 0x70, 0x3e, 0x89, 0x69, 0x57, 0x4b,
+	0x6e, 0xf2, 0x71, 0x37, 0xca, 0xb3, 0x40, 0x32, 0x9e, 0x98, 0xa0, 0xd6, 0xce, 0xd3, 0x03, 0xd3,
+	0x8c, 0x7f, 0xbe, 0x2b, 0xa8, 0x83, 0x84, 0xca, 0x5f, 0x79, 0x76, 0xcb, 0x92, 0xc9, 0x5c, 0x70,
+	0xd4, 0x8d, 0xa8, 0x90, 0x2c, 0xd1, 0x27, 0x90, 0x2c, 0x8f, 0xa9, 0xd1, 0xee, 0xfd, 0x56, 0x03,
+	0x38, 0xa7, 0x62, 0xda, 0xd7, 0x3f, 0x84, 0xbe, 0x03, 0x34, 0x63, 0x9f, 0x69, 0x46, 0xc2, 0x29,
+	0x0d, 0x6f, 0x89, 0xa0, 0xd9, 0x27, 0x9a, 0x61, 0xab, 0x6d, 0x75, 0x36, 0x5c, 0x5b, 0x33, 0x7d,
+	0x45, 0x78, 0x1a, 0x47, 0x0e, 0x6c, 0x19, 0x75, 0x46, 0x53, 0x9e, 0xc9, 0xb9, 0x7c, 0x45, 0xcb,
+	0x37, 0x35, 0xe5, 0x6a, 0xa6, 0xd0, 0x1f, 0x42, 0x33, 0x62, 0x22, 0xb8, 0x89, 0x29, 0x49, 0x79,
+	0xcc, 0xc2, 0x3b, 0x93, 0x46, 0xe0, 0xd5, 0xb6, 0xd5, 0x29, 0xbb, 0x5b, 0x05, 0x79, 0xa9, 0x39,
+	0x9d, 0x48, 0xa0, 0x03, 0xd8, 0xd4, 0xb5, 0x91, 0x98, 0x09, 0x49, 0x13, 0xa2, 0x8e, 0xc3, 0xa5,
+	0xb6, 0xd5, 0x79, 0xe9, 0x36, 0x34, 0x31, 0xd4, 0xf8, 0x25, 0xcf, 0x24, 0xda, 0x07, 0x03, 0x91,
+	0xa9, 0x94, 0xa9, 0x51, 0xbe, 0xd4, 0xca, 0x9a, 0x86, 0xdf, 0x4b, 0x99, 0x6a, 0xdd, 0x31, 0x34,
+	0x42, 0x9e, 0x24, 0x34, 0x94, 0x44, 0xb2, 0x19, 0xe5, 0xb9, 0xc4, 0x6b, 0x6d, 0xab, 0x53, 0x39,
+	0xdc, 0x71, 0x8c, 0xeb, 0xce, 0xdc, 0x75, 0xe7, 0xa4, 0x70, 0xdd, 0xad, 0x17, 0x11, 0xbe, 0x09,
+	0x40, 0xdf, 0x40, 0x8d, 0x25, 0x93, 0x8c, 0x0a, 0x41, 0xc2, 0x38, 0x10, 0x02, 0xaf, 0xeb, 0xaa,
+	0xab, 0x05, 0xd8, 0x57, 0x18, 0x7a, 0x03, 0x8d, 0xb9, 0x48, 0x79, 0xc3, 0x42, 0x8a, 0xcb, 0x5a,
+	0x56, 0x2f, 0x60, 0xcf, 0xa0, 0x68, 0x06, 0xdb, 0x0f, 0xa7, 0xf1, 0x44, 0x66, 0x3c, 0x8e, 0x69,
+	0x46, 0x66, 0x3c, 0xa2, 0x78, 0xa3, 0x6d, 0x75, 0xea, 0x87, 0xdf, 0x3b, 0x4b, 0x86, 0xc4, 0x79,
+	0xec, 0x9c, 0x33, 0x28, 0xf2, 0x3e, 0x44, 0x9f, 0xf3, 0x88, 0xba, 0x4d, 0xb6, 0x0c, 0x46, 0x23,
+	0xa8, 0x04, 0xb9, 0x9c, 0x16, 0x5d, 0xc0, 0xa0, 0x53, 0x1c, 0x3c, 0x97, 0xa2, 0x97, 0xcb, 0xa9,
+	0xe9, 0xcd, 0xf1, 0x0a, 0xb6, 0x5c, 0x08, 0x1e, 0xbe, 0xd1, 0x00, 0x36, 0xb3, 0x48, 0x90, 0x8c,
+	0x8e, 0x33, 0x2a, 0xa6, 0x24, 0xa2, 0x71, 0x70, 0x87, 0x2b, 0xcf, 0x78, 0xaa, 0x4f, 0x69, 0x64,
+	0x91, 0x70, 0x4d, 0xd8, 0x89, 0x8a, 0x42, 0xdf, 0x42, 0x9d, 0x26, 0x7a, 0x46, 0x64, 0x16, 0x84,
+	0x2c, 0x99, 0xe0, 0xaa, 0x9e, 0x8e, 0x9a, 0x41, 0x7d, 0x03, 0xaa, 0x5e, 0x07, 0x61, 0xa8, 0x0c,
+	0x8b, 0xf9, 0x84, 0x8c, 0x59, 0x4c, 0x71, 0x4d, 0x5b, 0x5b, 0x33, 0xf0, 0x90, 0x4f, 0xce, 0x58,
+	0x4c, 0xd1, 0x3b, 0xa8, 0x47, 0x74, 0x1c, 0xe4, 0xb1, 0x24, 0x66, 0xe9, 0x70, 0x5d, 0xff, 0x56,
+	0x7b, 0x69, 0xb5, 0x97, 0x6a, 0x4e, 0x4c, 0xb9, 0x6e, 0xad, 0x88, 0x2b, 0x56, 0xe3, 0x0d, 0xd4,
+	0xcc, 0xb0, 0x07, 0x51, 0xa4, 0x2c, 0xc5, 0xb6, 0x4a, 0xa7, 0x6b, 0xa8, 0x6a, 0xa2, 0x67, 0x70,
+	0xf4, 0x0b, 0x6c, 0xf3, 0x5c, 0xde, 0xf0, 0x3c, 0x89, 0x54, 0x09, 0xe3, 0x31, 0x0b, 0xe7, 0x46,
+	0x6f, 0xea, 0xd4, 0xcf, 0xf6, 0x72, 0x54, 0x84, 0xfb, 0x26, 0x7a, 0xc1, 0xf3, 0x26, 0x5f, 0x46,
+	0xa1, 0x13, 0xf8, 0xaa, 0xf0, 0x2c, 0x8c, 0x19, 0x4d, 0x24, 0x11, 0x2c, 0x7a, 0xba, 0x63, 0x78,
+	0x4b, 0x9b, 0xf8, 0x85, 0x91, 0xf5, 0xb5, 0xca, 0x63, 0xd1, 0xe2, 0xae, 0xa1, 0x36, 0x54, 0x45,
+	0x24, 0x48, 0x1e, 0x09, 0x92, 0x06, 0x72, 0x8a, 0x5f, 0x69, 0x3f, 0x41, 0x44, 0xe2, 0x2a, 0x12,
+	0x97, 0x81, 0x9c, 0xaa, 0x36, 0x8b, 0x7f, 0xb5, 0xb9, 0xf9, 0x9f, 0xda, 0x2c, 0xfe, 0xd1, 0xe6,
+	0xf7, 0x50, 0x37, 0xfd, 0x20, 0x82, 0xe7, 0x59, 0x48, 0x05, 0x7e, 0xdd, 0x5e, 0xed, 0x54, 0x0e,
+	0xbf, 0x5e, 0x6a, 0x8e, 0x31, 0xc6, 0xd3, 0x4a, 0xb7, 0x16, 0x2e, 0x7c, 0x09, 0x74, 0x04, 0xaf,
+	0x8b, 0xe2, 0xd5, 0xbf, 0x49, 0x7e, 0x4b, 0x13, 0x32, 0xe3, 0x79, 0x22, 0xf1, 0xb6, 0xb9, 0x56,
+	0x0c, 0xeb, 0x45, 0xc2, 0x57, 0xdc, 0xb9, 0xa2, 0xd4, 0xb5, 0xb2, 0x38, 0x3e, 0x3c, 0x9b, 0x05,
+	0x12, 0x63, 0x5d, 0x70, 0xe3, 0x71, 0x80, 0x34, 0xac, 0x12, 0x2c, 0x5a, 0x49, 0xc6, 0x01, 0x8b,
+	0x09, 0x4f, 0x69, 0x82, 0x77, 0x4c, 0x82, 0xf4, 0xd1, 0xc4, 0xb3, 0x80, 0xc5, 0xa3, 0x94, 0x26,
+	0xad, 0xdf, 0x2d, 0x68, 0x2e, 0xed, 0x23, 0x72, 0xa1, 0xa4, 0x17, 0xdb, 0xd2, 0x5b, 0xf7, 0xe3,
+	0xff, 0x1a, 0x06, 0x47, 0xad, 0xb1, 0x36, 0x56, 0x9f, 0xb5, 0x77, 0x01, 0x25, 0xbd, 0xd8, 0x4d,
+	0xa8, 0xb9, 0xa7, 0xef, 0x06, 0x9e, 0xef, 0x5e, 0x93, 0xd1, 0xc5, 0xf0, 0xda, 0x7e, 0xd1, 0x5a,
+	0x29, 0x5b, 0x68, 0x13, 0x36, 0x7a, 0xc3, 0xe1, 0xe8, 0x27, 0xd2, 0xbb, 0xb8, 0xb6, 0x2d, 0x0d,
+	0x7d, 0x09, 0xaf, 0x3e, 0x0e, 0x5c, 0xff, 0xaa, 0x37, 0x24, 0xde, 0xa9, 0xfb, 0x71, 0xd0, 0x3f,
+	0x35, 0x01, 0x2b, 0x8a, 0xdd, 0xfb, 0x01, 0x9a, 0x4b, 0x2f, 0x14, 0xb4, 0x0e, 0xab, 0xa3, 0xb3,
+	0x33, 0xfb, 0x05, 0xaa, 0xc0, 0xfa, 0xc9, 0xe9, 0x59, 0xef, 0x6a, 0xe8, 0xdb, 0x16, 0x02, 0x58,
+	0xf3, 0x7c, 0x77, 0xd0, 0xf7, 0xed, 0x95, 0xbd, 0x7d, 0x80, 0xc7, 0x8b, 0x02, 0x95, 0xa1, 0x74,
+	0x31, 0xba, 0x38, 0xb5, 0x5f, 0xa0, 0x3a, 0xc0, 0xf9, 0x95, 0xce, 0xe7, 0x0f, 0x3d, 0xdb, 0xfa,
+	0x50, 0x2a, 0x37, 0x6c, 0xfb, 0x43, 0xa9, 0x8c, 0xec, 0xad, 0x3d, 0x01, 0xd5, 0xc5, 0x0e, 0x23,
+	0x0c, 0xeb, 0xf3, 0x2d, 0x33, 0x6f, 0xcf, 0xfc, 0x13, 0x0d, 0xa0, 0x2a, 0x63, 0x75, 0x9b, 0x4a,
+	0xc9, 0x92, 0x89, 0xd0, 0x6f, 0x4d, 0xe5, 0x70, 0xbf, 0x30, 0xf1, 0xf1, 0xe1, 0x9b, 0x5b, 0x79,
+	0xe4, 0xf8, 0x43, 0xcf, 0x2b, 0xd4, 0x6e, 0x45, 0xc6, 0x62, 0xfe, 0x71, 0xdc, 0xf9, 0xe3, 0x7e,
+	0xd7, 0xfa, 0xf3, 0x7e, 0xd7, 0xfa, 0xeb, 0x7e, 0xd7, 0xfa, 0xb9, 0x65, 0x4e, 0x60, 0xbc, 0x1b,
+	0xa4, 0xac, 0xfb, 0xe4, 0x71, 0xbd, 0x59, 0xd3, 0x33, 0x7d, 0xf4, 0x77, 0x00, 0x00, 0x00, 0xff,
+	0xff, 0xaa, 0xfd, 0x16, 0xd2, 0xc5, 0x07, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index 4ed253bc91..8fbd24b69a 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -110,7 +110,8 @@ message MeshConfig {
   // $hide_from_docs
   AuthPolicy auth_policy = 10 [deprecated=true];
 
-  reserved 11;
+  // $hide_from_docs
+  google.protobuf.Duration rds_refresh_delay = 11 [deprecated=true];
 
   // Flag to control generation of trace spans and request IDs.
   // Requires a trace span collector defined in the proxy configuration.
@@ -132,8 +133,31 @@ message MeshConfig {
   ProxyConfig default_config = 14;
 
   reserved 15;
-  reserved 16;
-  reserved 17;
+  
+  // $hide_from_docs
+  string mixer_address = 16 [deprecated=true];
+  
+  message OutboundTrafficPolicy {
+    enum Mode {
+      // outbound traffic will be restricted to services defined in the service registry as well as those defined
+      // through ServiceEntries
+      REGISTRY_ONLY = 0 [deprecated=true];
+      // outbound traffic to unknown destinations will be allowed
+      ALLOW_ANY = 1 [deprecated=true];
+      // not implemented. outbound traffic will be restricted to destinations defined in VirtualServices only
+      VIRTUAL_SERVICE_ONLY = 2 [deprecated=true];
+    }
+    Mode mode = 1 [deprecated=true];
+  }
+
+  // Set the default behavior of the sidecar for handling outbound traffic from the application.
+  // While the default mode should work out of the box, if your application uses one or more external services that
+  // are not known apriori, setting the policy to ALLOW_ANY will cause the sidecars to route traffic to the any
+  // requested destination.
+  // Users are strongly encouraged to use ServiceEntries to explicitly declare any external dependencies,
+  // instead of using allow_any.
+  OutboundTrafficPolicy outbound_traffic_policy = 17 [deprecated=true];
+
   reserved 18;
 
   // Enables clide side policy checks.
@@ -143,7 +167,8 @@ message MeshConfig {
   // Use secret-mount files instead of SDS if set to empty.
   string sds_uds_path = 20;
   
-  reserved 21;
+  // $hide_from_docs
+  google.protobuf.Duration sds_refresh_delay = 21 [deprecated=true];
 
   // ConfigSource describes a source of configuration data for networking
   // rules, and other Istio configuration artifacts. Multiple data sources
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index c78edc388d..a60b6196f5 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -4,7 +4,7 @@
 generator: protoc-gen-docs
 aliases:
   - /docs/reference/config/service-mesh.html
-number_of_entries: 13
+number_of_entries: 15
 ---
 <h2 id="AuthenticationPolicy">AuthenticationPolicy</h2>
 <section>
@@ -236,6 +236,19 @@ <h2 id="MeshConfig">MeshConfig</h2>
 and remain constant for the duration of the pod. The rest of the mesh config can be changed
 at runtime and config gets distributed dynamically.</p>
 
+</td>
+</tr>
+<tr id="MeshConfig-outbound_traffic_policy" class="deprecated ">
+<td><code>outboundTrafficPolicy</code></td>
+<td><code><a href="#MeshConfig-OutboundTrafficPolicy">MeshConfig.OutboundTrafficPolicy</a></code></td>
+<td>
+<p>Set the default behavior of the sidecar for handling outbound traffic from the application.
+While the default mode should work out of the box, if your application uses one or more external services that
+are not known apriori, setting the policy to ALLOW<em>ANY will cause the sidecars to route traffic to the any
+requested destination.
+Users are strongly encouraged to use ServiceEntries to explicitly declare any external dependencies,
+instead of using allow</em>any.</p>
+
 </td>
 </tr>
 <tr id="MeshConfig-enable_client_side_policy_check">
@@ -305,6 +318,61 @@ <h2 id="MeshConfig-IngressControllerMode">MeshConfig.IngressControllerMode</h2>
 a secondary ingress controller (e.g., in addition to a
 cloud-provided ingress controller).</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="MeshConfig-OutboundTrafficPolicy">MeshConfig.OutboundTrafficPolicy</h2>
+<section>
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="MeshConfig-OutboundTrafficPolicy-mode" class="deprecated ">
+<td><code>mode</code></td>
+<td><code><a href="#MeshConfig-OutboundTrafficPolicy-Mode">MeshConfig.OutboundTrafficPolicy.Mode</a></code></td>
+<td>
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="MeshConfig-OutboundTrafficPolicy-Mode">MeshConfig.OutboundTrafficPolicy.Mode</h2>
+<section>
+<table class="enum-values">
+<thead>
+<tr>
+<th>Name</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="MeshConfig-OutboundTrafficPolicy-Mode-REGISTRY_ONLY" class="deprecated ">
+<td><code>REGISTRY_ONLY</code></td>
+<td>
+<p>outbound traffic will be restricted to services defined in the service registry as well as those defined
+through ServiceEntries</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-OutboundTrafficPolicy-Mode-ALLOW_ANY" class="deprecated ">
+<td><code>ALLOW_ANY</code></td>
+<td>
+<p>outbound traffic to unknown destinations will be allowed</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-OutboundTrafficPolicy-Mode-VIRTUAL_SERVICE_ONLY" class="deprecated ">
+<td><code>VIRTUAL_SERVICE_ONLY</code></td>
+<td>
+<p>not implemented. outbound traffic will be restricted to destinations defined in VirtualServices only</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/mesh/v1alpha1/proxy.pb.go b/mesh/v1alpha1/proxy.pb.go
index c1b07a0ddd..e5689b9b77 100644
--- a/mesh/v1alpha1/proxy.pb.go
+++ b/mesh/v1alpha1/proxy.pb.go
@@ -298,6 +298,8 @@ type ProxyConfig struct {
 	ParentShutdownDuration *google_protobuf.Duration `protobuf:"bytes,5,opt,name=parent_shutdown_duration,json=parentShutdownDuration" json:"parent_shutdown_duration,omitempty"`
 	// Address of the discovery service exposing xDS with mTLS connection.
 	DiscoveryAddress string `protobuf:"bytes,6,opt,name=discovery_address,json=discoveryAddress,proto3" json:"discovery_address,omitempty"`
+	// $hide_from_docs
+	DiscoveryRefreshDelay *google_protobuf.Duration `protobuf:"bytes,7,opt,name=discovery_refresh_delay,json=discoveryRefreshDelay" json:"discovery_refresh_delay,omitempty"`
 	// Address of the Zipkin service (e.g. _zipkin:9411_).
 	// DEPRECATED: Use [tracing][istio.mesh.v1alpha1.ProxyConfig.tracing] instead.
 	ZipkinAddress string `protobuf:"bytes,8,opt,name=zipkin_address,json=zipkinAddress,proto3" json:"zipkin_address,omitempty"`
@@ -307,6 +309,8 @@ type ProxyConfig struct {
 	StatsdUdpAddress string `protobuf:"bytes,10,opt,name=statsd_udp_address,json=statsdUdpAddress,proto3" json:"statsd_udp_address,omitempty"`
 	// Port on which Envoy should listen for administrative commands.
 	ProxyAdminPort int32 `protobuf:"varint,11,opt,name=proxy_admin_port,json=proxyAdminPort,proto3" json:"proxy_admin_port,omitempty"`
+	// $hide_from_docs
+	AvailabilityZone string `protobuf:"bytes,12,opt,name=availability_zone,json=availabilityZone,proto3" json:"availability_zone,omitempty"`
 	// Authentication policy defines the global switch to control authentication
 	// for Envoy-to-Envoy communication for istio components Mixer and Pilot.
 	ControlPlaneAuthPolicy AuthenticationPolicy `protobuf:"varint,13,opt,name=control_plane_auth_policy,json=controlPlaneAuthPolicy,proto3,enum=istio.mesh.v1alpha1.AuthenticationPolicy" json:"control_plane_auth_policy,omitempty"`
@@ -376,6 +380,13 @@ func (m *ProxyConfig) GetDiscoveryAddress() string {
 	return ""
 }
 
+func (m *ProxyConfig) GetDiscoveryRefreshDelay() *google_protobuf.Duration {
+	if m != nil {
+		return m.DiscoveryRefreshDelay
+	}
+	return nil
+}
+
 func (m *ProxyConfig) GetZipkinAddress() string {
 	if m != nil {
 		return m.ZipkinAddress
@@ -404,6 +415,13 @@ func (m *ProxyConfig) GetProxyAdminPort() int32 {
 	return 0
 }
 
+func (m *ProxyConfig) GetAvailabilityZone() string {
+	if m != nil {
+		return m.AvailabilityZone
+	}
+	return ""
+}
+
 func (m *ProxyConfig) GetControlPlaneAuthPolicy() AuthenticationPolicy {
 	if m != nil {
 		return m.ControlPlaneAuthPolicy
@@ -643,6 +661,16 @@ func (m *ProxyConfig) MarshalTo(dAtA []byte) (int, error) {
 		i = encodeVarintProxy(dAtA, i, uint64(len(m.DiscoveryAddress)))
 		i += copy(dAtA[i:], m.DiscoveryAddress)
 	}
+	if m.DiscoveryRefreshDelay != nil {
+		dAtA[i] = 0x3a
+		i++
+		i = encodeVarintProxy(dAtA, i, uint64(m.DiscoveryRefreshDelay.Size()))
+		n6, err := m.DiscoveryRefreshDelay.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n6
+	}
 	if len(m.ZipkinAddress) > 0 {
 		dAtA[i] = 0x42
 		i++
@@ -653,11 +681,11 @@ func (m *ProxyConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x4a
 		i++
 		i = encodeVarintProxy(dAtA, i, uint64(m.ConnectTimeout.Size()))
-		n6, err := m.ConnectTimeout.MarshalTo(dAtA[i:])
+		n7, err := m.ConnectTimeout.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n6
+		i += n7
 	}
 	if len(m.StatsdUdpAddress) > 0 {
 		dAtA[i] = 0x52
@@ -670,6 +698,12 @@ func (m *ProxyConfig) MarshalTo(dAtA []byte) (int, error) {
 		i++
 		i = encodeVarintProxy(dAtA, i, uint64(m.ProxyAdminPort))
 	}
+	if len(m.AvailabilityZone) > 0 {
+		dAtA[i] = 0x62
+		i++
+		i = encodeVarintProxy(dAtA, i, uint64(len(m.AvailabilityZone)))
+		i += copy(dAtA[i:], m.AvailabilityZone)
+	}
 	if m.ControlPlaneAuthPolicy != 0 {
 		dAtA[i] = 0x68
 		i++
@@ -714,11 +748,11 @@ func (m *ProxyConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x1
 		i++
 		i = encodeVarintProxy(dAtA, i, uint64(m.Tracing.Size()))
-		n7, err := m.Tracing.MarshalTo(dAtA[i:])
+		n8, err := m.Tracing.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n7
+		i += n8
 	}
 	return i, nil
 }
@@ -817,6 +851,10 @@ func (m *ProxyConfig) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovProxy(uint64(l))
 	}
+	if m.DiscoveryRefreshDelay != nil {
+		l = m.DiscoveryRefreshDelay.Size()
+		n += 1 + l + sovProxy(uint64(l))
+	}
 	l = len(m.ZipkinAddress)
 	if l > 0 {
 		n += 1 + l + sovProxy(uint64(l))
@@ -832,6 +870,10 @@ func (m *ProxyConfig) Size() (n int) {
 	if m.ProxyAdminPort != 0 {
 		n += 1 + sovProxy(uint64(m.ProxyAdminPort))
 	}
+	l = len(m.AvailabilityZone)
+	if l > 0 {
+		n += 1 + l + sovProxy(uint64(l))
+	}
 	if m.ControlPlaneAuthPolicy != 0 {
 		n += 1 + sovProxy(uint64(m.ControlPlaneAuthPolicy))
 	}
@@ -1433,6 +1475,39 @@ func (m *ProxyConfig) Unmarshal(dAtA []byte) error {
 			}
 			m.DiscoveryAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DiscoveryRefreshDelay", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowProxy
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthProxy
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DiscoveryRefreshDelay == nil {
+				m.DiscoveryRefreshDelay = &google_protobuf.Duration{}
+			}
+			if err := m.DiscoveryRefreshDelay.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 8:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ZipkinAddress", wireType)
@@ -1543,6 +1618,35 @@ func (m *ProxyConfig) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AvailabilityZone", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowProxy
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthProxy
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AvailabilityZone = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 13:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ControlPlaneAuthPolicy", wireType)
@@ -1839,57 +1943,59 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/proxy.proto", fileDescriptorProxy) }
 
 var fileDescriptorProxy = []byte{
-	// 819 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x94, 0x41, 0x6f, 0xe3, 0x44,
-	0x14, 0xc7, 0xeb, 0xd2, 0x4d, 0x9c, 0x97, 0x36, 0x75, 0x67, 0x51, 0x71, 0x23, 0x28, 0xa1, 0x48,
-	0x90, 0x05, 0xe4, 0x68, 0xbb, 0x12, 0xe2, 0x02, 0x22, 0xe9, 0x76, 0xd5, 0xac, 0xba, 0xdd, 0xc8,
-	0x75, 0x25, 0xd8, 0xcb, 0x68, 0x32, 0x9e, 0xc6, 0xa3, 0x75, 0x66, 0xac, 0x99, 0x71, 0x21, 0xdc,
-	0xb8, 0xf0, 0xc1, 0x38, 0x71, 0xe4, 0x23, 0xa0, 0x9e, 0xf8, 0x18, 0xc8, 0x33, 0x76, 0x28, 0xa8,
-	0xbb, 0x7b, 0xf3, 0xfc, 0xe7, 0xf7, 0x7f, 0xfe, 0xdb, 0xef, 0xcd, 0xc0, 0xc1, 0x92, 0xe9, 0x6c,
-	0x74, 0xf3, 0x98, 0xe4, 0x45, 0x46, 0x1e, 0x8f, 0x0a, 0x25, 0x7f, 0x5e, 0x45, 0x85, 0x92, 0x46,
-	0xa2, 0x87, 0x5c, 0x1b, 0x2e, 0xa3, 0x0a, 0x88, 0x1a, 0xa0, 0x7f, 0xb8, 0x90, 0x72, 0x91, 0xb3,
-	0x91, 0x45, 0xe6, 0xe5, 0xf5, 0x28, 0x2d, 0x15, 0x31, 0x5c, 0x0a, 0x67, 0x3a, 0xfa, 0x7d, 0x13,
-	0xda, 0x89, 0x22, 0x94, 0x8b, 0x05, 0xfa, 0x16, 0x5a, 0xbf, 0xf0, 0xe2, 0x35, 0x17, 0xa1, 0x37,
-	0xf0, 0x86, 0xdd, 0xe3, 0x4f, 0xa3, 0x7b, 0x2a, 0x46, 0x35, 0x1d, 0xbd, 0xb2, 0xe8, 0xd9, 0x46,
-	0x5c, 0x9b, 0xd0, 0x33, 0xe8, 0xe4, 0x7c, 0x91, 0x19, 0x6d, 0x58, 0x11, 0x6e, 0xda, 0x0a, 0x9f,
-	0xbd, 0xb5, 0xc2, 0x79, 0x43, 0x9f, 0x6d, 0xc4, 0xff, 0x5a, 0xfb, 0x47, 0xd0, 0x72, 0xb5, 0x51,
-	0x08, 0x6d, 0x92, 0xa6, 0x8a, 0x69, 0x6d, 0x13, 0x75, 0xe2, 0x66, 0xd9, 0xff, 0xd5, 0x83, 0xce,
-	0xda, 0xfe, 0x66, 0x0e, 0x7d, 0x02, 0xdb, 0x84, 0x52, 0xa6, 0x35, 0x36, 0xf2, 0x35, 0x13, 0x36,
-	0x56, 0x27, 0xee, 0x3a, 0x2d, 0xa9, 0x24, 0xb4, 0x0f, 0x2d, 0xcd, 0x68, 0xa9, 0x58, 0xf8, 0xde,
-	0xc0, 0x1b, 0xfa, 0x71, 0xbd, 0x42, 0x1f, 0x43, 0x97, 0x12, 0xca, 0x94, 0xc1, 0x05, 0x31, 0x59,
-	0xb8, 0x65, 0x9d, 0xe0, 0xa4, 0x19, 0x31, 0xd9, 0xc4, 0x87, 0x96, 0x51, 0xd5, 0xf2, 0xe8, 0x37,
-	0x1f, 0xba, 0xb3, 0xaa, 0x13, 0x27, 0x52, 0x5c, 0xf3, 0x85, 0xb5, 0xda, 0x27, 0x67, 0xf5, 0x6a,
-	0xab, 0x95, 0x2a, 0x6b, 0x05, 0xcc, 0xb9, 0x20, 0x6a, 0xe5, 0x00, 0x97, 0x0a, 0x9c, 0x64, 0x81,
-	0xcf, 0x61, 0x57, 0x33, 0x75, 0xc3, 0x29, 0xc3, 0x34, 0x2f, 0xb5, 0x61, 0xca, 0xa6, 0xeb, 0xc4,
-	0xbd, 0x5a, 0x3e, 0x71, 0x2a, 0xfa, 0x1e, 0x7a, 0xa9, 0x22, 0x5c, 0xe0, 0xa6, 0xaf, 0x36, 0x68,
-	0xf7, 0xf8, 0x20, 0x72, 0x8d, 0x8f, 0x9a, 0xc6, 0x47, 0x4f, 0x6b, 0x20, 0xde, 0xb1, 0x86, 0x66,
-	0x89, 0x2e, 0x21, 0x2c, 0x88, 0x62, 0xc2, 0x60, 0x9d, 0x95, 0x26, 0x95, 0x3f, 0xdd, 0xa9, 0xf5,
-	0xe0, 0x5d, 0xb5, 0xf6, 0x9d, 0xf5, 0xb2, 0x76, 0xae, 0x8b, 0x7e, 0x09, 0x7b, 0x29, 0xd7, 0x54,
-	0xde, 0x30, 0xb5, 0xc2, 0x4d, 0x6f, 0x5a, 0xf6, 0x0b, 0x82, 0xf5, 0xc6, 0xb8, 0x6e, 0xd2, 0x23,
-	0xe8, 0xb9, 0x11, 0x5a, 0x93, 0x7e, 0x45, 0x4e, 0x36, 0x43, 0x2f, 0xde, 0x71, 0x3b, 0x0d, 0x3a,
-	0x81, 0x5d, 0x2a, 0x85, 0x60, 0xd4, 0x60, 0xc3, 0x97, 0x4c, 0x96, 0x26, 0xec, 0xbc, 0x2b, 0x63,
-	0xaf, 0x76, 0x24, 0xce, 0x80, 0xbe, 0x02, 0xa4, 0x0d, 0x31, 0x3a, 0xc5, 0x65, 0x5a, 0xac, 0x5f,
-	0x09, 0x2e, 0x9c, 0xdb, 0xb9, 0x4a, 0x8b, 0xe6, 0x8d, 0x43, 0x08, 0xec, 0x21, 0xc3, 0x24, 0x5d,
-	0x72, 0x81, 0x0b, 0xa9, 0x4c, 0xd8, 0x1d, 0x78, 0xc3, 0x07, 0x71, 0xcf, 0xea, 0xe3, 0x4a, 0x9e,
-	0x49, 0x65, 0x50, 0x0a, 0x07, 0x54, 0x0a, 0xa3, 0x64, 0x8e, 0x8b, 0x9c, 0x08, 0x86, 0x49, 0x69,
-	0x32, 0x5c, 0xc8, 0x9c, 0xd3, 0x55, 0xb8, 0x33, 0xf0, 0x86, 0xbd, 0xe3, 0x47, 0xf7, 0x9e, 0x87,
-	0x71, 0x69, 0x32, 0x26, 0x0c, 0xa7, 0x36, 0xef, 0xcc, 0x1a, 0xe2, 0xfd, 0xba, 0xd6, 0xac, 0x2a,
-	0x55, 0x11, 0x4e, 0xaf, 0xd2, 0xd3, 0x52, 0x1b, 0xb9, 0xc4, 0xf5, 0x88, 0x5d, 0xf3, 0x9c, 0x85,
-	0x3d, 0x97, 0xde, 0xed, 0xb8, 0x29, 0x7c, 0xc6, 0x73, 0x56, 0xa5, 0xaf, 0xbe, 0x08, 0x0b, 0xb2,
-	0x64, 0x38, 0x67, 0x62, 0x61, 0xb2, 0x70, 0xd7, 0xa5, 0xaf, 0xf4, 0x0b, 0xb2, 0x64, 0xe7, 0x56,
-	0x45, 0x03, 0x3b, 0xb3, 0xb4, 0x54, 0x8a, 0x09, 0xba, 0x0a, 0x03, 0x0b, 0xdd, 0x95, 0xd0, 0x18,
-	0x3e, 0x72, 0x7f, 0x62, 0x2e, 0xa5, 0xd1, 0x46, 0x91, 0x02, 0x1b, 0xb6, 0x2c, 0x72, 0x62, 0x98,
-	0x1b, 0xe3, 0x3d, 0x1b, 0xa2, 0x6f, 0xa1, 0x49, 0xc3, 0x24, 0x35, 0x62, 0xc7, 0x9a, 0xc1, 0x1e,
-	0x17, 0x86, 0x29, 0xca, 0x8a, 0xea, 0x53, 0xf1, 0x52, 0xa6, 0x2c, 0x44, 0xf6, 0xd7, 0x7c, 0x73,
-	0xef, 0xaf, 0xb9, 0x73, 0xaa, 0xa2, 0xa9, 0x98, 0xcb, 0x52, 0xa4, 0xd3, 0x3b, 0x05, 0x5e, 0xc8,
-	0x94, 0xc5, 0x01, 0xff, 0x9f, 0x82, 0xbe, 0x86, 0xb6, 0x71, 0x77, 0x4c, 0xf8, 0xd0, 0x4e, 0xc7,
-	0x87, 0x6f, 0xbb, 0x87, 0xe2, 0x06, 0x3e, 0x7a, 0x02, 0x1f, 0xbc, 0xe1, 0x25, 0x68, 0x1b, 0xfc,
-	0xf8, 0xf4, 0xe9, 0x34, 0x3e, 0x3d, 0x49, 0x82, 0x0d, 0x04, 0xd0, 0x4a, 0x66, 0xf1, 0xcb, 0x1f,
-	0x7e, 0x0c, 0xbc, 0xe7, 0x5b, 0x7e, 0x3b, 0xf0, 0x9f, 0x6f, 0xf9, 0xdb, 0xc1, 0xce, 0x17, 0xdf,
-	0xc1, 0xfb, 0xf7, 0x35, 0x13, 0xf9, 0xb0, 0x75, 0xf1, 0xf2, 0xe2, 0x34, 0xd8, 0x40, 0x3d, 0x80,
-	0x17, 0x57, 0xc9, 0xd5, 0xf8, 0x1c, 0x27, 0xe7, 0x97, 0x81, 0x87, 0xb6, 0xa1, 0x3d, 0xbd, 0x38,
-	0x3b, 0x8d, 0xa7, 0x49, 0xf0, 0x77, 0x7b, 0x32, 0xfc, 0xe3, 0xf6, 0xd0, 0xfb, 0xf3, 0xf6, 0xd0,
-	0xfb, 0xeb, 0xf6, 0xd0, 0x7b, 0xd5, 0x77, 0xa1, 0xb9, 0x1c, 0x91, 0x82, 0x8f, 0xfe, 0x73, 0xf1,
-	0xcf, 0x5b, 0x76, 0xce, 0x9f, 0xfc, 0x13, 0x00, 0x00, 0xff, 0xff, 0x81, 0x53, 0x42, 0xee, 0x10,
-	0x06, 0x00, 0x00,
+	// 862 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x55, 0x5d, 0x6f, 0xe3, 0x44,
+	0x14, 0xad, 0x97, 0xdd, 0x7c, 0xdc, 0xb4, 0xa9, 0x3b, 0x0b, 0x5d, 0x37, 0x82, 0x12, 0x8a, 0x04,
+	0x59, 0x40, 0x8e, 0xb6, 0x2b, 0x21, 0x5e, 0x40, 0x24, 0x6d, 0x57, 0x8d, 0xd4, 0xed, 0x46, 0xae,
+	0x2b, 0x41, 0x5f, 0x46, 0x13, 0xfb, 0x36, 0x1e, 0xad, 0x33, 0x63, 0x8d, 0xc7, 0x85, 0xec, 0x1b,
+	0xfc, 0x34, 0x9e, 0x78, 0xe4, 0x27, 0xa0, 0x3e, 0xf1, 0x33, 0x90, 0x67, 0xec, 0x6c, 0x40, 0xdd,
+	0xed, 0x5b, 0xe6, 0xcc, 0x39, 0x77, 0xce, 0x99, 0x3b, 0xd7, 0x81, 0xbd, 0x05, 0xe6, 0xc9, 0xf0,
+	0xe6, 0x19, 0x4b, 0xb3, 0x84, 0x3d, 0x1b, 0x66, 0x4a, 0xfe, 0xba, 0xf4, 0x33, 0x25, 0xb5, 0x24,
+	0x8f, 0x79, 0xae, 0xb9, 0xf4, 0x4b, 0x82, 0x5f, 0x13, 0x7a, 0xfb, 0x73, 0x29, 0xe7, 0x29, 0x0e,
+	0x0d, 0x65, 0x56, 0x5c, 0x0f, 0xe3, 0x42, 0x31, 0xcd, 0xa5, 0xb0, 0xa2, 0x83, 0x3f, 0x1e, 0x40,
+	0x33, 0x54, 0x2c, 0xe2, 0x62, 0x4e, 0xbe, 0x87, 0xc6, 0x1b, 0x9e, 0xbd, 0xe6, 0xc2, 0x73, 0xfa,
+	0xce, 0xa0, 0x73, 0xf8, 0xb9, 0x7f, 0x47, 0x45, 0xbf, 0x62, 0xfb, 0x57, 0x86, 0x7a, 0xba, 0x11,
+	0x54, 0x22, 0xf2, 0x02, 0xda, 0x29, 0x9f, 0x27, 0x3a, 0xd7, 0x98, 0x79, 0x0f, 0x4c, 0x85, 0x2f,
+	0xde, 0x5b, 0xe1, 0xac, 0x66, 0x9f, 0x6e, 0x04, 0x6f, 0xa5, 0xbd, 0x03, 0x68, 0xd8, 0xda, 0xc4,
+	0x83, 0x26, 0x8b, 0x63, 0x85, 0x79, 0x6e, 0x1c, 0xb5, 0x83, 0x7a, 0xd9, 0xfb, 0xcd, 0x81, 0xf6,
+	0x4a, 0xfe, 0x6e, 0x1e, 0xf9, 0x0c, 0x36, 0x59, 0x14, 0x61, 0x9e, 0x53, 0x2d, 0x5f, 0xa3, 0x30,
+	0xb6, 0xda, 0x41, 0xc7, 0x62, 0x61, 0x09, 0x91, 0x5d, 0x68, 0xe4, 0x18, 0x15, 0x0a, 0xbd, 0x0f,
+	0xfa, 0xce, 0xa0, 0x15, 0x54, 0x2b, 0xf2, 0x29, 0x74, 0x22, 0x16, 0xa1, 0xd2, 0x34, 0x63, 0x3a,
+	0xf1, 0x1e, 0x1a, 0x25, 0x58, 0x68, 0xca, 0x74, 0x32, 0x6e, 0x41, 0x43, 0xab, 0x72, 0x79, 0xf0,
+	0x7b, 0x1b, 0x3a, 0xd3, 0xb2, 0x13, 0x47, 0x52, 0x5c, 0xf3, 0xb9, 0x91, 0x9a, 0x5f, 0x56, 0xea,
+	0x54, 0x52, 0x03, 0x95, 0xd2, 0x92, 0x30, 0xe3, 0x82, 0xa9, 0xa5, 0x25, 0x58, 0x57, 0x60, 0x21,
+	0x43, 0xf8, 0x12, 0xb6, 0x73, 0x54, 0x37, 0x3c, 0x42, 0x1a, 0xa5, 0x45, 0xae, 0x51, 0x19, 0x77,
+	0xed, 0xa0, 0x5b, 0xc1, 0x47, 0x16, 0x25, 0x3f, 0x42, 0x37, 0x56, 0x8c, 0x0b, 0x5a, 0xf7, 0xd5,
+	0x18, 0xed, 0x1c, 0xee, 0xf9, 0xb6, 0xf1, 0x7e, 0xdd, 0x78, 0xff, 0xb8, 0x22, 0x04, 0x5b, 0x46,
+	0x50, 0x2f, 0xc9, 0x05, 0x78, 0x19, 0x53, 0x28, 0x34, 0xcd, 0x93, 0x42, 0xc7, 0xf2, 0x97, 0xb5,
+	0x5a, 0x8f, 0xee, 0xab, 0xb5, 0x6b, 0xa5, 0x17, 0x95, 0x72, 0x55, 0xf4, 0x6b, 0xd8, 0x89, 0x79,
+	0x1e, 0xc9, 0x1b, 0x54, 0x4b, 0x5a, 0xf7, 0xa6, 0x61, 0x12, 0xb8, 0xab, 0x8d, 0x51, 0xd5, 0xa4,
+	0x4b, 0x78, 0xf2, 0x96, 0xac, 0xf0, 0x5a, 0x61, 0x9e, 0xd0, 0x18, 0x53, 0xb6, 0xf4, 0x9a, 0xf7,
+	0x18, 0x18, 0x3f, 0xf0, 0x9c, 0xe0, 0xa3, 0x95, 0x3a, 0xb0, 0xe2, 0xe3, 0x52, 0x4b, 0x9e, 0x42,
+	0xd7, 0xbe, 0xcc, 0x95, 0x81, 0x56, 0x69, 0xc0, 0x48, 0xb6, 0xec, 0x4e, 0xed, 0x60, 0x0c, 0xdb,
+	0x91, 0x14, 0x02, 0x23, 0x4d, 0x35, 0x5f, 0xa0, 0x2c, 0xb4, 0xd7, 0xbe, 0x2f, 0x7a, 0xb7, 0x52,
+	0x84, 0x56, 0x40, 0xbe, 0x01, 0x92, 0x6b, 0xa6, 0xf3, 0x98, 0x16, 0x71, 0xb6, 0x3a, 0x12, 0x6c,
+	0x66, 0xbb, 0x73, 0x19, 0x67, 0xf5, 0x89, 0x03, 0x70, 0xcd, 0xec, 0x52, 0x16, 0x2f, 0xb8, 0xa0,
+	0x99, 0x54, 0xda, 0xeb, 0xf4, 0x9d, 0xc1, 0xa3, 0xa0, 0x6b, 0xf0, 0x51, 0x09, 0x4f, 0xa5, 0xd2,
+	0x64, 0x08, 0x3b, 0xec, 0x86, 0xf1, 0x94, 0xcd, 0x78, 0xca, 0xf5, 0x92, 0xbe, 0x91, 0x02, 0xbd,
+	0xcd, 0x55, 0x12, 0x77, 0x7d, 0xf3, 0x4a, 0x0a, 0x24, 0x31, 0xec, 0x45, 0x52, 0x68, 0x25, 0x53,
+	0x9a, 0xa5, 0x4c, 0x20, 0x65, 0x85, 0x4e, 0x68, 0x26, 0x53, 0x1e, 0x2d, 0xbd, 0xad, 0xbe, 0x33,
+	0xe8, 0x1e, 0x3e, 0xbd, 0x73, 0x2e, 0x47, 0x85, 0x4e, 0x50, 0x68, 0x1e, 0x99, 0x80, 0x53, 0x23,
+	0x08, 0x76, 0xab, 0x5a, 0xd3, 0xb2, 0x54, 0xc9, 0xb0, 0x78, 0x19, 0x37, 0x2a, 0x72, 0x2d, 0x17,
+	0xb4, 0x7a, 0xea, 0xd7, 0x3c, 0x45, 0xaf, 0x6b, 0xe3, 0xda, 0x1d, 0x3b, 0x0d, 0x2f, 0x78, 0x8a,
+	0x65, 0xdc, 0xf2, 0x0a, 0xa8, 0x60, 0x0b, 0xa4, 0x29, 0x8a, 0xb9, 0x4e, 0xbc, 0x6d, 0x1b, 0xb7,
+	0xc4, 0xcf, 0xd9, 0x02, 0xcf, 0x0c, 0x4a, 0xfa, 0x66, 0x76, 0xa2, 0x42, 0x29, 0x14, 0xd1, 0xd2,
+	0x73, 0x0d, 0x69, 0x1d, 0x22, 0x23, 0xf8, 0xc4, 0x5e, 0xdd, 0x4c, 0x4a, 0x9d, 0x6b, 0xc5, 0x32,
+	0xaa, 0x71, 0x91, 0xa5, 0x4c, 0xa3, 0x1d, 0xa7, 0x1d, 0x63, 0xa2, 0x67, 0x48, 0xe3, 0x9a, 0x13,
+	0x56, 0x14, 0x33, 0x5e, 0x08, 0x3b, 0x5c, 0x68, 0x54, 0x11, 0x66, 0x65, 0x54, 0xba, 0x90, 0x31,
+	0x7a, 0xc4, 0x5c, 0xcd, 0x77, 0x77, 0x5e, 0xcd, 0xda, 0x74, 0xfb, 0x13, 0x31, 0x93, 0x85, 0x88,
+	0x27, 0x6b, 0x05, 0x5e, 0xca, 0x18, 0x03, 0x97, 0xff, 0x0f, 0x21, 0xdf, 0x42, 0x53, 0xdb, 0x6f,
+	0x9d, 0xf7, 0xd8, 0x3c, 0xa7, 0x8f, 0xdf, 0xf7, 0x3d, 0x0c, 0x6a, 0xf2, 0xc1, 0x73, 0x78, 0xf2,
+	0x8e, 0x43, 0xc8, 0x26, 0xb4, 0x82, 0x93, 0xe3, 0x49, 0x70, 0x72, 0x14, 0xba, 0x1b, 0x04, 0xa0,
+	0x11, 0x4e, 0x83, 0x57, 0x3f, 0xfd, 0xec, 0x3a, 0x5f, 0xfd, 0x00, 0x1f, 0xde, 0xd5, 0x40, 0xd2,
+	0x82, 0x87, 0xe7, 0xaf, 0xce, 0x4f, 0xdc, 0x0d, 0xd2, 0x05, 0x78, 0x79, 0x19, 0x5e, 0x8e, 0xce,
+	0x68, 0x78, 0x76, 0xe1, 0x3a, 0x64, 0x13, 0x9a, 0x93, 0xf3, 0xd3, 0x93, 0x60, 0x12, 0xba, 0xff,
+	0x34, 0xc7, 0x83, 0x3f, 0x6f, 0xf7, 0x9d, 0xbf, 0x6e, 0xf7, 0x9d, 0xbf, 0x6f, 0xf7, 0x9d, 0xab,
+	0x9e, 0x35, 0xca, 0xe5, 0x90, 0x65, 0x7c, 0xf8, 0x9f, 0x3f, 0x9d, 0x59, 0xc3, 0x0c, 0xc3, 0xf3,
+	0x7f, 0x03, 0x00, 0x00, 0xff, 0xff, 0x65, 0xf7, 0xfe, 0xe0, 0x8c, 0x06, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/proxy.proto b/mesh/v1alpha1/proxy.proto
index 0f78df160b..fcdd14defc 100644
--- a/mesh/v1alpha1/proxy.proto
+++ b/mesh/v1alpha1/proxy.proto
@@ -106,7 +106,8 @@ message ProxyConfig {
   // Address of the discovery service exposing xDS with mTLS connection.
   string discovery_address = 6;
 
-  reserved 7;
+  // $hide_from_docs
+  google.protobuf.Duration discovery_refresh_delay = 7 [deprecated=true];
 
   // Address of the Zipkin service (e.g. _zipkin:9411_).
   // DEPRECATED: Use [tracing][istio.mesh.v1alpha1.ProxyConfig.tracing] instead.
@@ -121,7 +122,8 @@ message ProxyConfig {
   // Port on which Envoy should listen for administrative commands.
   int32 proxy_admin_port = 11;
   
-  reserved 12;
+  // $hide_from_docs
+  string availability_zone = 12 [deprecated=true];
 
   // Authentication policy defines the global switch to control authentication
   // for Envoy-to-Envoy communication for istio components Mixer and Pilot.
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index 0d32c45cae..c13f214454 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -22,12 +22,38 @@
   name='mesh/v1alpha1/config.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xe0\x06\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01J\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x11\x10\x12J\x04\x08\x12\x10\x13J\x04\x08\x15\x10\x16\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xeb\t\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,])
 
 
 
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE = _descriptor.EnumDescriptor(
+  name='Mode',
+  full_name='istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.Mode',
+  filename=None,
+  file=DESCRIPTOR,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='REGISTRY_ONLY', index=0, number=0,
+      options=_descriptor._ParseOptions(descriptor_pb2.EnumValueOptions(), _b('\010\001')),
+      type=None),
+    _descriptor.EnumValueDescriptor(
+      name='ALLOW_ANY', index=1, number=1,
+      options=_descriptor._ParseOptions(descriptor_pb2.EnumValueOptions(), _b('\010\001')),
+      type=None),
+    _descriptor.EnumValueDescriptor(
+      name='VIRTUAL_SERVICE_ONLY', index=2, number=2,
+      options=_descriptor._ParseOptions(descriptor_pb2.EnumValueOptions(), _b('\010\001')),
+      type=None),
+  ],
+  containing_type=None,
+  options=None,
+  serialized_start=1225,
+  serialized_end=1303,
+)
+_sym_db.RegisterEnumDescriptor(_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE)
+
 _MESHCONFIG_INGRESSCONTROLLERMODE = _descriptor.EnumDescriptor(
   name='IngressControllerMode',
   full_name='istio.mesh.v1alpha1.MeshConfig.IngressControllerMode',
@@ -49,8 +75,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=886,
-  serialized_end=943,
+  serialized_start=1305,
+  serialized_end=1362,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -71,12 +97,43 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=945,
-  serialized_end=983,
+  serialized_start=1364,
+  serialized_end=1402,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
 
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY = _descriptor.Descriptor(
+  name='OutboundTrafficPolicy',
+  full_name='istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='mode', full_name='istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.mode', index=0,
+      number=1, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+    _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE,
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1122,
+  serialized_end=1303,
+)
+
 _MESHCONFIG = _descriptor.Descriptor(
   name='MeshConfig',
   full_name='istio.mesh.v1alpha1.MeshConfig',
@@ -162,56 +219,84 @@
       is_extension=False, extension_scope=None,
       options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='enable_tracing', full_name='istio.mesh.v1alpha1.MeshConfig.enable_tracing', index=11,
+      name='rds_refresh_delay', full_name='istio.mesh.v1alpha1.MeshConfig.rds_refresh_delay', index=11,
+      number=11, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='enable_tracing', full_name='istio.mesh.v1alpha1.MeshConfig.enable_tracing', index=12,
       number=12, type=8, cpp_type=7, label=1,
       has_default_value=False, default_value=False,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='access_log_file', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_file', index=12,
+      name='access_log_file', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_file', index=13,
       number=13, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='access_log_format', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_format', index=13,
+      name='access_log_format', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_format', index=14,
       number=24, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='default_config', full_name='istio.mesh.v1alpha1.MeshConfig.default_config', index=14,
+      name='default_config', full_name='istio.mesh.v1alpha1.MeshConfig.default_config', index=15,
       number=14, type=11, cpp_type=10, label=1,
       has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='enable_client_side_policy_check', full_name='istio.mesh.v1alpha1.MeshConfig.enable_client_side_policy_check', index=15,
+      name='mixer_address', full_name='istio.mesh.v1alpha1.MeshConfig.mixer_address', index=16,
+      number=16, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='outbound_traffic_policy', full_name='istio.mesh.v1alpha1.MeshConfig.outbound_traffic_policy', index=17,
+      number=17, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='enable_client_side_policy_check', full_name='istio.mesh.v1alpha1.MeshConfig.enable_client_side_policy_check', index=18,
       number=19, type=8, cpp_type=7, label=1,
       has_default_value=False, default_value=False,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='sds_uds_path', full_name='istio.mesh.v1alpha1.MeshConfig.sds_uds_path', index=16,
+      name='sds_uds_path', full_name='istio.mesh.v1alpha1.MeshConfig.sds_uds_path', index=19,
       number=20, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='config_sources', full_name='istio.mesh.v1alpha1.MeshConfig.config_sources', index=17,
+      name='sds_refresh_delay', full_name='istio.mesh.v1alpha1.MeshConfig.sds_refresh_delay', index=20,
+      number=21, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='config_sources', full_name='istio.mesh.v1alpha1.MeshConfig.config_sources', index=21,
       number=22, type=11, cpp_type=10, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='enable_sds_token_mount', full_name='istio.mesh.v1alpha1.MeshConfig.enable_sds_token_mount', index=18,
+      name='enable_sds_token_mount', full_name='istio.mesh.v1alpha1.MeshConfig.enable_sds_token_mount', index=22,
       number=23, type=8, cpp_type=7, label=1,
       has_default_value=False, default_value=False,
       message_type=None, enum_type=None, containing_type=None,
@@ -220,7 +305,7 @@
   ],
   extensions=[
   ],
-  nested_types=[],
+  nested_types=[_MESHCONFIG_OUTBOUNDTRAFFICPOLICY, ],
   enum_types=[
     _MESHCONFIG_INGRESSCONTROLLERMODE,
     _MESHCONFIG_AUTHPOLICY,
@@ -232,7 +317,7 @@
   oneofs=[
   ],
   serialized_start=155,
-  serialized_end=1019,
+  serialized_end=1414,
 )
 
 
@@ -269,14 +354,20 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1021,
-  serialized_end=1114,
+  serialized_start=1416,
+  serialized_end=1509,
 )
 
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY.containing_type = _MESHCONFIG
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.containing_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
 _MESHCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['ingress_controller_mode'].enum_type = _MESHCONFIG_INGRESSCONTROLLERMODE
 _MESHCONFIG.fields_by_name['auth_policy'].enum_type = _MESHCONFIG_AUTHPOLICY
+_MESHCONFIG.fields_by_name['rds_refresh_delay'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['default_config'].message_type = mesh_dot_v1alpha1_dot_proxy__pb2._PROXYCONFIG
+_MESHCONFIG.fields_by_name['outbound_traffic_policy'].message_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
+_MESHCONFIG.fields_by_name['sds_refresh_delay'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['config_sources'].message_type = _CONFIGSOURCE
 _MESHCONFIG_INGRESSCONTROLLERMODE.containing_type = _MESHCONFIG
 _MESHCONFIG_AUTHPOLICY.containing_type = _MESHCONFIG
@@ -286,11 +377,19 @@
 _sym_db.RegisterFileDescriptor(DESCRIPTOR)
 
 MeshConfig = _reflection.GeneratedProtocolMessageType('MeshConfig', (_message.Message,), dict(
+
+  OutboundTrafficPolicy = _reflection.GeneratedProtocolMessageType('OutboundTrafficPolicy', (_message.Message,), dict(
+    DESCRIPTOR = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY,
+    __module__ = 'mesh.v1alpha1.config_pb2'
+    # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy)
+    ))
+  ,
   DESCRIPTOR = _MESHCONFIG,
   __module__ = 'mesh.v1alpha1.config_pb2'
   # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig)
   ))
 _sym_db.RegisterMessage(MeshConfig)
+_sym_db.RegisterMessage(MeshConfig.OutboundTrafficPolicy)
 
 ConfigSource = _reflection.GeneratedProtocolMessageType('ConfigSource', (_message.Message,), dict(
   DESCRIPTOR = _CONFIGSOURCE,
@@ -302,6 +401,22 @@
 
 DESCRIPTOR.has_options = True
 DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z\032istio.io/api/mesh/v1alpha1'))
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.values_by_name["REGISTRY_ONLY"].has_options = True
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.values_by_name["REGISTRY_ONLY"]._options = _descriptor._ParseOptions(descriptor_pb2.EnumValueOptions(), _b('\010\001'))
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.values_by_name["ALLOW_ANY"].has_options = True
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.values_by_name["ALLOW_ANY"]._options = _descriptor._ParseOptions(descriptor_pb2.EnumValueOptions(), _b('\010\001'))
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.values_by_name["VIRTUAL_SERVICE_ONLY"].has_options = True
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.values_by_name["VIRTUAL_SERVICE_ONLY"]._options = _descriptor._ParseOptions(descriptor_pb2.EnumValueOptions(), _b('\010\001'))
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].has_options = True
+_MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
 _MESHCONFIG.fields_by_name['auth_policy'].has_options = True
 _MESHCONFIG.fields_by_name['auth_policy']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
+_MESHCONFIG.fields_by_name['rds_refresh_delay'].has_options = True
+_MESHCONFIG.fields_by_name['rds_refresh_delay']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
+_MESHCONFIG.fields_by_name['mixer_address'].has_options = True
+_MESHCONFIG.fields_by_name['mixer_address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
+_MESHCONFIG.fields_by_name['outbound_traffic_policy'].has_options = True
+_MESHCONFIG.fields_by_name['outbound_traffic_policy']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
+_MESHCONFIG.fields_by_name['sds_refresh_delay'].has_options = True
+_MESHCONFIG.fields_by_name['sds_refresh_delay']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
 # @@protoc_insertion_point(module_scope)
diff --git a/python/istio_api/mesh/v1alpha1/proxy_pb2.py b/python/istio_api/mesh/v1alpha1/proxy_pb2.py
index 187ad57971..faff41274d 100644
--- a/python/istio_api/mesh/v1alpha1/proxy_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/proxy_pb2.py
@@ -21,7 +21,7 @@
   name='mesh/v1alpha1/proxy.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x19mesh/v1alpha1/proxy.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\"\xfb\x01\n\x07Tracing\x12\x35\n\x06zipkin\x18\x01 \x01(\x0b\x32#.istio.mesh.v1alpha1.Tracing.ZipkinH\x00\x12;\n\tlightstep\x18\x02 \x01(\x0b\x32&.istio.mesh.v1alpha1.Tracing.LightstepH\x00\x1a\x19\n\x06Zipkin\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x1aW\n\tLightstep\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12\x14\n\x0c\x61\x63\x63\x65ss_token\x18\x02 \x01(\t\x12\x0e\n\x06secure\x18\x03 \x01(\x08\x12\x13\n\x0b\x63\x61\x63\x65rt_path\x18\x04 \x01(\tB\x08\n\x06tracer\"\xe6\x05\n\x0bProxyConfig\x12\x13\n\x0b\x63onfig_path\x18\x01 \x01(\t\x12\x13\n\x0b\x62inary_path\x18\x02 \x01(\t\x12\x17\n\x0fservice_cluster\x18\x03 \x01(\t\x12\x31\n\x0e\x64rain_duration\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\x12;\n\x18parent_shutdown_duration\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x19\n\x11\x64iscovery_address\x18\x06 \x01(\t\x12\x1a\n\x0ezipkin_address\x18\x08 \x01(\tB\x02\x18\x01\x12\x32\n\x0f\x63onnect_timeout\x18\t \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12statsd_udp_address\x18\n \x01(\t\x12\x18\n\x10proxy_admin_port\x18\x0b \x01(\x05\x12L\n\x19\x63ontrol_plane_auth_policy\x18\r \x01(\x0e\x32).istio.mesh.v1alpha1.AuthenticationPolicy\x12\x1a\n\x12\x63ustom_config_file\x18\x0e \x01(\t\x12\x18\n\x10stat_name_length\x18\x0f \x01(\x05\x12\x13\n\x0b\x63oncurrency\x18\x10 \x01(\x05\x12%\n\x1dproxy_bootstrap_template_path\x18\x11 \x01(\t\x12S\n\x11interception_mode\x18\x12 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.ProxyConfig.InboundInterceptionMode\x12-\n\x07tracing\x18\x13 \x01(\x0b\x32\x1c.istio.mesh.v1alpha1.Tracing\"3\n\x17InboundInterceptionMode\x12\x0c\n\x08REDIRECT\x10\x00\x12\n\n\x06TPROXY\x10\x01J\x04\x08\x07\x10\x08J\x04\x08\x0c\x10\r*>\n\x14\x41uthenticationPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\x12\x0c\n\x07INHERIT\x10\xe8\x07\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x19mesh/v1alpha1/proxy.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\"\xfb\x01\n\x07Tracing\x12\x35\n\x06zipkin\x18\x01 \x01(\x0b\x32#.istio.mesh.v1alpha1.Tracing.ZipkinH\x00\x12;\n\tlightstep\x18\x02 \x01(\x0b\x32&.istio.mesh.v1alpha1.Tracing.LightstepH\x00\x1a\x19\n\x06Zipkin\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x1aW\n\tLightstep\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12\x14\n\x0c\x61\x63\x63\x65ss_token\x18\x02 \x01(\t\x12\x0e\n\x06secure\x18\x03 \x01(\x08\x12\x13\n\x0b\x63\x61\x63\x65rt_path\x18\x04 \x01(\tB\x08\n\x06tracer\"\xb9\x06\n\x0bProxyConfig\x12\x13\n\x0b\x63onfig_path\x18\x01 \x01(\t\x12\x13\n\x0b\x62inary_path\x18\x02 \x01(\t\x12\x17\n\x0fservice_cluster\x18\x03 \x01(\t\x12\x31\n\x0e\x64rain_duration\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\x12;\n\x18parent_shutdown_duration\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x19\n\x11\x64iscovery_address\x18\x06 \x01(\t\x12>\n\x17\x64iscovery_refresh_delay\x18\x07 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x1a\n\x0ezipkin_address\x18\x08 \x01(\tB\x02\x18\x01\x12\x32\n\x0f\x63onnect_timeout\x18\t \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12statsd_udp_address\x18\n \x01(\t\x12\x18\n\x10proxy_admin_port\x18\x0b \x01(\x05\x12\x1d\n\x11\x61vailability_zone\x18\x0c \x01(\tB\x02\x18\x01\x12L\n\x19\x63ontrol_plane_auth_policy\x18\r \x01(\x0e\x32).istio.mesh.v1alpha1.AuthenticationPolicy\x12\x1a\n\x12\x63ustom_config_file\x18\x0e \x01(\t\x12\x18\n\x10stat_name_length\x18\x0f \x01(\x05\x12\x13\n\x0b\x63oncurrency\x18\x10 \x01(\x05\x12%\n\x1dproxy_bootstrap_template_path\x18\x11 \x01(\t\x12S\n\x11interception_mode\x18\x12 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.ProxyConfig.InboundInterceptionMode\x12-\n\x07tracing\x18\x13 \x01(\x0b\x32\x1c.istio.mesh.v1alpha1.Tracing\"3\n\x17InboundInterceptionMode\x12\x0c\n\x08REDIRECT\x10\x00\x12\n\n\x06TPROXY\x10\x01*>\n\x14\x41uthenticationPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\x12\x0c\n\x07INHERIT\x10\xe8\x07\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,])
 
@@ -46,8 +46,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1081,
-  serialized_end=1143,
+  serialized_start=1164,
+  serialized_end=1226,
 )
 _sym_db.RegisterEnumDescriptor(_AUTHENTICATIONPOLICY)
 
@@ -74,8 +74,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1016,
-  serialized_end=1067,
+  serialized_start=1111,
+  serialized_end=1162,
 )
 _sym_db.RegisterEnumDescriptor(_PROXYCONFIG_INBOUNDINTERCEPTIONMODE)
 
@@ -252,77 +252,91 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='zipkin_address', full_name='istio.mesh.v1alpha1.ProxyConfig.zipkin_address', index=6,
+      name='discovery_refresh_delay', full_name='istio.mesh.v1alpha1.ProxyConfig.discovery_refresh_delay', index=6,
+      number=7, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='zipkin_address', full_name='istio.mesh.v1alpha1.ProxyConfig.zipkin_address', index=7,
       number=8, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='connect_timeout', full_name='istio.mesh.v1alpha1.ProxyConfig.connect_timeout', index=7,
+      name='connect_timeout', full_name='istio.mesh.v1alpha1.ProxyConfig.connect_timeout', index=8,
       number=9, type=11, cpp_type=10, label=1,
       has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='statsd_udp_address', full_name='istio.mesh.v1alpha1.ProxyConfig.statsd_udp_address', index=8,
+      name='statsd_udp_address', full_name='istio.mesh.v1alpha1.ProxyConfig.statsd_udp_address', index=9,
       number=10, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='proxy_admin_port', full_name='istio.mesh.v1alpha1.ProxyConfig.proxy_admin_port', index=9,
+      name='proxy_admin_port', full_name='istio.mesh.v1alpha1.ProxyConfig.proxy_admin_port', index=10,
       number=11, type=5, cpp_type=1, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='control_plane_auth_policy', full_name='istio.mesh.v1alpha1.ProxyConfig.control_plane_auth_policy', index=10,
+      name='availability_zone', full_name='istio.mesh.v1alpha1.ProxyConfig.availability_zone', index=11,
+      number=12, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='control_plane_auth_policy', full_name='istio.mesh.v1alpha1.ProxyConfig.control_plane_auth_policy', index=12,
       number=13, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='custom_config_file', full_name='istio.mesh.v1alpha1.ProxyConfig.custom_config_file', index=11,
+      name='custom_config_file', full_name='istio.mesh.v1alpha1.ProxyConfig.custom_config_file', index=13,
       number=14, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='stat_name_length', full_name='istio.mesh.v1alpha1.ProxyConfig.stat_name_length', index=12,
+      name='stat_name_length', full_name='istio.mesh.v1alpha1.ProxyConfig.stat_name_length', index=14,
       number=15, type=5, cpp_type=1, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='concurrency', full_name='istio.mesh.v1alpha1.ProxyConfig.concurrency', index=13,
+      name='concurrency', full_name='istio.mesh.v1alpha1.ProxyConfig.concurrency', index=15,
       number=16, type=5, cpp_type=1, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='proxy_bootstrap_template_path', full_name='istio.mesh.v1alpha1.ProxyConfig.proxy_bootstrap_template_path', index=14,
+      name='proxy_bootstrap_template_path', full_name='istio.mesh.v1alpha1.ProxyConfig.proxy_bootstrap_template_path', index=16,
       number=17, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='interception_mode', full_name='istio.mesh.v1alpha1.ProxyConfig.interception_mode', index=15,
+      name='interception_mode', full_name='istio.mesh.v1alpha1.ProxyConfig.interception_mode', index=17,
       number=18, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='tracing', full_name='istio.mesh.v1alpha1.ProxyConfig.tracing', index=16,
+      name='tracing', full_name='istio.mesh.v1alpha1.ProxyConfig.tracing', index=18,
       number=19, type=11, cpp_type=10, label=1,
       has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
@@ -342,7 +356,7 @@
   oneofs=[
   ],
   serialized_start=337,
-  serialized_end=1079,
+  serialized_end=1162,
 )
 
 _TRACING_ZIPKIN.containing_type = _TRACING
@@ -357,6 +371,7 @@
 _TRACING.fields_by_name['lightstep'].containing_oneof = _TRACING.oneofs_by_name['tracer']
 _PROXYCONFIG.fields_by_name['drain_duration'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _PROXYCONFIG.fields_by_name['parent_shutdown_duration'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
+_PROXYCONFIG.fields_by_name['discovery_refresh_delay'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _PROXYCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _PROXYCONFIG.fields_by_name['control_plane_auth_policy'].enum_type = _AUTHENTICATIONPOLICY
 _PROXYCONFIG.fields_by_name['interception_mode'].enum_type = _PROXYCONFIG_INBOUNDINTERCEPTIONMODE
@@ -400,6 +415,10 @@
 
 DESCRIPTOR.has_options = True
 DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z\032istio.io/api/mesh/v1alpha1'))
+_PROXYCONFIG.fields_by_name['discovery_refresh_delay'].has_options = True
+_PROXYCONFIG.fields_by_name['discovery_refresh_delay']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
 _PROXYCONFIG.fields_by_name['zipkin_address'].has_options = True
 _PROXYCONFIG.fields_by_name['zipkin_address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
+_PROXYCONFIG.fields_by_name['availability_zone'].has_options = True
+_PROXYCONFIG.fields_by_name['availability_zone']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001'))
 # @@protoc_insertion_point(module_scope)