.task-commit.patch

commit f7964e4569f1f42f92ed1d1127e58eb553a156d4
Author: Marcin Skalski <skalskimarcin33@gmail.com>
Date:   Mon Jul 27 14:04:40 2026 +0200

    refactor(mesh): remove routing zoneEgress flag
    
    Signed-off-by: Marcin Skalski <skalskimarcin33@gmail.com>

diff --git a/UPGRADE.md b/UPGRADE.md
index fa213b691a..674ef8eeb7 100644
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -89,6 +89,19 @@ regardless of what the mesh's former `meshServices.mode` was set to.
 None. A `Mesh` spec that still sets `meshServices` continues to apply
 successfully; the field is silently ignored by the control plane.
 
+### `routing.zoneEgress` removed from the `Mesh` schema
+
+The `routing.zoneEgress` boolean has been removed from the `Mesh` resource
+spec. Cross-zone and `MeshExternalService` traffic now uses ZoneEgress based on
+actual zone egress topology plus mTLS, rather than an explicit mesh-level
+toggle.
+
+**Action required**
+
+Remove any `routing.zoneEgress` entries from stored `Mesh` resources and
+manifests before upgrading. After the upgrade, that field no longer exists in
+the schema and is ignored during deserialization.
+
 ### MeshService mode no longer disables zone proxy listeners, inspect endpoints, or MeshIdentity initialization
 
 The control plane now generates mesh-scoped zone proxy listeners and serves
diff --git a/api/mesh/v1alpha1/mesh.pb.go b/api/mesh/v1alpha1/mesh.pb.go
index eef68d074b..dee759e8bd 100644
--- a/api/mesh/v1alpha1/mesh.pb.go
+++ b/api/mesh/v1alpha1/mesh.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        (unknown)
 // source: api/mesh/v1alpha1/mesh.proto
 
 package v1alpha1
@@ -247,9 +247,6 @@ func (x *CertificateAuthorityBackend) GetRootChain() *CertificateAuthorityBacken
 // Routing defines configuration for the routing in the mesh
 type Routing struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
-	// Enable routing traffic to services in other zone or external services
-	// through ZoneEgress. Default: false
-	ZoneEgress bool `protobuf:"varint,2,opt,name=zoneEgress,proto3" json:"zoneEgress,omitempty"`
 	// If true, blocks traffic to MeshExternalServices.
 	// Default: false
 	DefaultForbidMeshExternalServiceAccess bool `protobuf:"varint,3,opt,name=defaultForbidMeshExternalServiceAccess,proto3" json:"defaultForbidMeshExternalServiceAccess,omitempty"`
@@ -287,13 +284,6 @@ func (*Routing) Descriptor() ([]byte, []int) {
 	return file_api_mesh_v1alpha1_mesh_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *Routing) GetZoneEgress() bool {
-	if x != nil {
-		return x.ZoneEgress
-	}
-	return false
-}
-
 func (x *Routing) GetDefaultForbidMeshExternalServiceAccess() bool {
 	if x != nil {
 		return x.DefaultForbidMeshExternalServiceAccess
@@ -716,12 +706,10 @@ const file_api_mesh_v1alpha1_mesh_proto_rawDesc = "" +
 	"\n" +
 	"\x06STRICT\x10\x00\x12\x0e\n" +
 	"\n" +
-	"PERMISSIVE\x10\x01\"\xa3\x01\n" +
-	"\aRouting\x12\x1e\n" +
-	"\n" +
-	"zoneEgress\x18\x02 \x01(\bR\n" +
-	"zoneEgress\x12V\n" +
-	"&defaultForbidMeshExternalServiceAccess\x18\x03 \x01(\bR&defaultForbidMeshExternalServiceAccessJ\x04\b\x01\x10\x02R\x1alocalityAwareLoadBalancingB-Z+github.com/kumahq/kuma/v3/api/mesh/v1alpha1b\x06proto3"
+	"PERMISSIVE\x10\x01\"\x95\x01\n" +
+	"\aRouting\x12V\n" +
+	"&defaultForbidMeshExternalServiceAccess\x18\x03 \x01(\bR&defaultForbidMeshExternalServiceAccessJ\x04\b\x01\x10\x02J\x04\b\x02\x10\x03R\x1alocalityAwareLoadBalancingR\n" +
+	"zoneEgressB-Z+github.com/kumahq/kuma/v3/api/mesh/v1alpha1b\x06proto3"
 
 var (
 	file_api_mesh_v1alpha1_mesh_proto_rawDescOnce sync.Once
diff --git a/api/mesh/v1alpha1/mesh.proto b/api/mesh/v1alpha1/mesh.proto
index c0c78b8b5f..ed63db626d 100644
--- a/api/mesh/v1alpha1/mesh.proto
+++ b/api/mesh/v1alpha1/mesh.proto
@@ -148,9 +148,8 @@ message Routing {
   reserved 1;
   reserved "localityAwareLoadBalancing";
 
-  // Enable routing traffic to services in other zone or external services
-  // through ZoneEgress. Default: false
-  bool zoneEgress = 2;
+  reserved 2;
+  reserved "zoneEgress";
 
   // If true, blocks traffic to MeshExternalServices.
   // Default: false
diff --git a/app/kumactl/cmd/get/table_printer.go b/app/kumactl/cmd/get/table_printer.go
index 22edc66d60..c8b2613bac 100644
--- a/app/kumactl/cmd/get/table_printer.go
+++ b/app/kumactl/cmd/get/table_printer.go
@@ -30,7 +30,7 @@ var CustomTablePrinters = map[model.ResourceType]RowPrinter{
 		},
 	},
 	model.ScopeMesh: {
-		Headers: []string{"NAME", "mTLS", "ZONEEGRESS", "AGE"},
+		Headers: []string{"NAME", "mTLS", "AGE"},
 		RowFn: func(rootTime time.Time, item model.Resource) []string {
 			mesh := item.(*mesh.MeshResource)
 
@@ -39,15 +39,9 @@ var CustomTablePrinters = map[model.ResourceType]RowPrinter{
 				backend := mesh.GetEnabledCertificateAuthorityBackend()
 				mtls = fmt.Sprintf("%s/%s", backend.Type, backend.Name)
 			}
-
-			zoneEgress := "off"
-			if mesh.Spec.GetRouting().GetZoneEgress() {
-				zoneEgress = "on"
-			}
 			return []string{
 				mesh.GetMeta().GetName(), // NAME
 				mtls,                     // mTLS
-				zoneEgress,               // ZONEEGRESS
 				table.TimeSince(mesh.GetMeta().GetModificationTime(), rootTime), // AGE
 			}
 		},
diff --git a/app/kumactl/cmd/get/testdata/get/get-mesh.golden.json b/app/kumactl/cmd/get/testdata/get/get-mesh.golden.json
index 4e2aa7fada..3b070bf345 100644
--- a/app/kumactl/cmd/get/testdata/get/get-mesh.golden.json
+++ b/app/kumactl/cmd/get/testdata/get/get-mesh.golden.json
@@ -12,8 +12,5 @@
         "type": "builtin"
       }
     ]
-  },
-  "routing": {
-    "zoneEgress": true
   }
 }
diff --git a/app/kumactl/cmd/get/testdata/get/get-mesh.golden.txt b/app/kumactl/cmd/get/testdata/get/get-mesh.golden.txt
index 6eca81c1d0..34e6dcc110 100644
--- a/app/kumactl/cmd/get/testdata/get/get-mesh.golden.txt
+++ b/app/kumactl/cmd/get/testdata/get/get-mesh.golden.txt
@@ -1,2 +1,2 @@
-NAME     mTLS                ZONEEGRESS   AGE
-mesh-1   builtin/builtin-1   on           292y
+NAME     mTLS                AGE
+mesh-1   builtin/builtin-1   292y
diff --git a/app/kumactl/cmd/get/testdata/get/get-mesh.golden.yaml b/app/kumactl/cmd/get/testdata/get/get-mesh.golden.yaml
index b922a75f01..e0ab97845f 100644
--- a/app/kumactl/cmd/get/testdata/get/get-mesh.golden.yaml
+++ b/app/kumactl/cmd/get/testdata/get/get-mesh.golden.yaml
@@ -8,5 +8,3 @@ mtls:
   - name: builtin-1
     type: builtin
   enabledBackend: builtin-1
-routing:
-  zoneEgress: true
diff --git a/app/kumactl/cmd/get/testdata/list/get-meshes.golden.json b/app/kumactl/cmd/get/testdata/list/get-meshes.golden.json
index 221da77623..8afcc8b0ba 100644
--- a/app/kumactl/cmd/get/testdata/list/get-meshes.golden.json
+++ b/app/kumactl/cmd/get/testdata/list/get-meshes.golden.json
@@ -15,9 +15,6 @@
             "type": "builtin"
           }
         ]
-      },
-      "routing": {
-        "zoneEgress": true
       }
     },
     {
diff --git a/app/kumactl/cmd/get/testdata/list/get-meshes.golden.txt b/app/kumactl/cmd/get/testdata/list/get-meshes.golden.txt
index 87769d56e8..f4f61465a5 100644
--- a/app/kumactl/cmd/get/testdata/list/get-meshes.golden.txt
+++ b/app/kumactl/cmd/get/testdata/list/get-meshes.golden.txt
@@ -1,3 +1,3 @@
-NAME    mTLS                ZONEEGRESS   AGE
-mesh1   builtin/builtin-1   on           292y
-mesh2   off                 off          292y
+NAME    mTLS                AGE
+mesh1   builtin/builtin-1   292y
+mesh2   off                 292y
diff --git a/app/kumactl/cmd/get/testdata/list/get-meshes.golden.yaml b/app/kumactl/cmd/get/testdata/list/get-meshes.golden.yaml
index 42d2aa20a8..34c71cfe09 100644
--- a/app/kumactl/cmd/get/testdata/list/get-meshes.golden.yaml
+++ b/app/kumactl/cmd/get/testdata/list/get-meshes.golden.yaml
@@ -8,8 +8,6 @@ items:
       type: builtin
     enabledBackend: builtin-1
   name: mesh1
-  routing:
-    zoneEgress: true
   type: Mesh
 - creationTime: "0001-01-01T00:00:00Z"
   kri: kri_m____mesh2_
diff --git a/app/kumactl/cmd/get/testdata/list/get-meshes.input.yaml b/app/kumactl/cmd/get/testdata/list/get-meshes.input.yaml
index b71fa7fefc..f5973ac797 100644
--- a/app/kumactl/cmd/get/testdata/list/get-meshes.input.yaml
+++ b/app/kumactl/cmd/get/testdata/list/get-meshes.input.yaml
@@ -19,8 +19,6 @@ mtls:
       type: builtin
   enabledBackend: builtin-1
 name: mesh1
-routing:
-  zoneEgress: true
 type: Mesh
 ---
 creationTime: "0001-01-01T00:00:00Z"
diff --git a/app/kumactl/cmd/get/testdata/list/get-meshes.pagination.golden.txt b/app/kumactl/cmd/get/testdata/list/get-meshes.pagination.golden.txt
index 8c62fcc9fc..181e2b8419 100644
--- a/app/kumactl/cmd/get/testdata/list/get-meshes.pagination.golden.txt
+++ b/app/kumactl/cmd/get/testdata/list/get-meshes.pagination.golden.txt
@@ -1,4 +1,4 @@
-NAME    mTLS                ZONEEGRESS   AGE
-mesh1   builtin/builtin-1   on           292y
+NAME    mTLS                AGE
+mesh1   builtin/builtin-1   292y
 
 Rerun command with --offset=1 argument to retrieve more resources
diff --git a/docs/generated/raw/protos/Mesh.json b/docs/generated/raw/protos/Mesh.json
index 3a5c79736a..92c2b3a7dc 100644
--- a/docs/generated/raw/protos/Mesh.json
+++ b/docs/generated/raw/protos/Mesh.json
@@ -198,10 +198,6 @@
         },
         "kuma.mesh.v1alpha1.Routing": {
             "properties": {
-                "zoneEgress": {
-                    "type": "boolean",
-                    "description": "Enable routing traffic to services in other zone or external services through ZoneEgress. Default: false"
-                },
                 "defaultForbidMeshExternalServiceAccess": {
                     "type": "boolean",
                     "description": "If true, blocks traffic to MeshExternalServices. Default: false"
@@ -213,4 +209,4 @@
             "description": "Routing defines configuration for the routing in the mesh"
         }
     }
-}
\ No newline at end of file
+}
diff --git a/docs/generated/raw/protos/Routing.json b/docs/generated/raw/protos/Routing.json
index 1ada8dbb86..e78838c059 100644
--- a/docs/generated/raw/protos/Routing.json
+++ b/docs/generated/raw/protos/Routing.json
@@ -4,10 +4,6 @@
     "definitions": {
         "Routing": {
             "properties": {
-                "zoneEgress": {
-                    "type": "boolean",
-                    "description": "Enable routing traffic to services in other zone or external services through ZoneEgress. Default: false"
-                },
                 "defaultForbidMeshExternalServiceAccess": {
                     "type": "boolean",
                     "description": "If true, blocks traffic to MeshExternalServices. Default: false"
@@ -19,4 +15,4 @@
             "description": "Routing defines configuration for the routing in the mesh"
         }
     }
-}
\ No newline at end of file
+}
diff --git a/pkg/core/resources/apis/mesh/mesh_helpers.go b/pkg/core/resources/apis/mesh/mesh_helpers.go
index c1df2c5e57..988fc2fb90 100644
--- a/pkg/core/resources/apis/mesh/mesh_helpers.go
+++ b/pkg/core/resources/apis/mesh/mesh_helpers.go
@@ -17,13 +17,6 @@ func (m *MeshResource) MTLSEnabled() bool {
 	return m != nil && m.Spec.GetMtls().GetEnabledBackend() != ""
 }
 
-// ZoneEgress works only when mTLS is enabled.
-// Configuration of mTLS is validated on Mesh configuration
-// change and when zoneEgress is enabled.
-func (m *MeshResource) ZoneEgressEnabled() bool {
-	return m != nil && m.Spec.GetRouting().GetZoneEgress()
-}
-
 func (m *MeshResource) GetEnabledCertificateAuthorityBackend() *mesh_proto.CertificateAuthorityBackend {
 	return m.GetCertificateAuthorityBackend(m.Spec.GetMtls().GetEnabledBackend())
 }
diff --git a/pkg/core/resources/apis/mesh/mesh_validator.go b/pkg/core/resources/apis/mesh/mesh_validator.go
index 839bd99040..2d62fe2908 100644
--- a/pkg/core/resources/apis/mesh/mesh_validator.go
+++ b/pkg/core/resources/apis/mesh/mesh_validator.go
@@ -13,7 +13,6 @@ func (m *MeshResource) Validate() error {
 	var verr validators.ValidationError
 	verr.AddError("mtls", validateMtls(m.Spec.Mtls))
 	verr.AddError("constraints", validateConstraints(m.Spec.Constraints))
-	verr.AddError("", validateZoneEgress(m.Spec.Routing, m.Spec.Mtls))
 	return verr.OrNil()
 }
 
@@ -79,16 +78,3 @@ func validateMtls(mtls *mesh_proto.Mesh_Mtls) validators.ValidationError {
 	}
 	return verr
 }
-
-func validateZoneEgress(routing *mesh_proto.Routing, mtls *mesh_proto.Mesh_Mtls) validators.ValidationError {
-	var verr validators.ValidationError
-	if routing == nil {
-		return verr
-	}
-	if routing.ZoneEgress {
-		if mtls.GetEnabledBackend() == "" {
-			verr.AddViolation("mtls", "has to be set when zoneEgress enabled")
-		}
-	}
-	return verr
-}
diff --git a/pkg/core/resources/apis/mesh/mesh_validator_test.go b/pkg/core/resources/apis/mesh/mesh_validator_test.go
index cc238b401e..e9873e42ad 100644
--- a/pkg/core/resources/apis/mesh/mesh_validator_test.go
+++ b/pkg/core/resources/apis/mesh/mesh_validator_test.go
@@ -70,9 +70,7 @@ var _ = Describe("Mesh", func() {
                 restrictions:
                 - tags:
                     k8s.kuma.io/namespace: ns-1
-                    kuma.io/zone: west
-            routing:
-              zoneEgress: true`,
+                    kuma.io/zone: west`,
 				expected: "",
 			}),
 		)
@@ -193,46 +191,6 @@ var _ = Describe("Mesh", func() {
                 - field: mtls.enabledBackend
                   message: has to be set to one of the backends in the mesh`,
 			}),
-			Entry("zoneEgress enabled but mtls not defined", testCase{
-				mesh: `
-                routing:
-                  zoneEgress: true`,
-				expected: `
-                violations:
-                - field: mtls
-                  message: has to be set when zoneEgress enabled`,
-			}),
-			Entry("zoneEgress enabled but multiple ca backends of the same name", testCase{
-				mesh: `
-                mtls:
-                  enabledBackend: backend-1
-                  backends:
-                  - name: backend-1
-                    type: builtin
-                  - name: backend-1
-                    type: builtin
-                routing:
-                  zoneEgress: true`,
-				expected: `
-                violations:
-                - field: mtls.backends
-                  message: cannot have more than 1 backends
-                - field: mtls.backends[1].name
-                  message: '"backend-1" name is already used for another backend'`,
-			}),
-			Entry("zoneEgress and mTLS enabled but no enabledBackend provided", testCase{
-				mesh: `
-                mtls:
-                  backends:
-                  - name: backend-1
-                    type: builtin
-                routing:
-                  zoneEgress: true`,
-				expected: `
-                violations:
-                - field: mtls
-                  message: has to be set when zoneEgress enabled`,
-			}),
 		)
 	})
 })
diff --git a/pkg/plugins/policies/core/xds/meshroute/endpoints.go b/pkg/plugins/policies/core/xds/meshroute/endpoints.go
index 2829b7f1b0..8e1f6bead3 100644
--- a/pkg/plugins/policies/core/xds/meshroute/endpoints.go
+++ b/pkg/plugins/policies/core/xds/meshroute/endpoints.go
@@ -28,7 +28,10 @@ func GenerateEndpoints(
 
 		internalService := !ctx.Mesh.IsExternalService(serviceName)
 		meshExternalService := isMeshExternalService(meshCtx.EndpointMap[serviceName])
-		externalServiceThroughEgress := ctx.Mesh.IsExternalService(serviceName) && !meshExternalService && meshCtx.Resource.ZoneEgressEnabled()
+		externalServiceThroughEgress := ctx.Mesh.IsExternalService(serviceName) &&
+			!meshExternalService &&
+			meshCtx.Resource.MTLSEnabled() &&
+			len(meshCtx.ZoneEgresses) > 0
 		if internalService || meshExternalService || externalServiceThroughEgress {
 			for _, cluster := range service.Clusters() {
 				var endpoints core_xds.EndpointMap
diff --git a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
index 8988577432..8e633a6d05 100644
--- a/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go
@@ -2573,7 +2573,7 @@ func meshContextWithResources(
 		meshBuilder = builders.Mesh()
 	}
 
-	mesh := meshBuilder.WithBuiltinMTLSBackend("ca-1").WithEgressRoutingEnabled().WithEnabledMTLSBackend("ca-1").Build()
+	mesh := meshBuilder.WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1").Build()
 	err := resourceStore.Create(context.Background(), mesh, store.CreateByKey("default", core_model.NoMesh))
 	Expect(err).ToNot(HaveOccurred())
 
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go
index 6c88ab9b40..b6135f9fda 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin.go
@@ -117,9 +117,10 @@ func (p plugin) configureDPP(
 	}
 
 	clusterModifier := func(cluster *envoy_cluster.Cluster, conf api.Conf) error {
+		egressEnabled := meshCtx.Resource.MTLSEnabled() && len(meshCtx.ZoneEgresses) > 0
 		return NewModifier(cluster).
 			Configure(clusterConfigurer(conf)).
-			Configure(If(cluster.LoadAssignment != nil, staticCLAConfigurer(conf, proxy.Dataplane.Spec.TagSet(), proxy.Dataplane.GetMeta().GetLabels(), proxy.Zone, meshCtx.Resource.ZoneEgressEnabled(), generator_metadata.OriginOutbound))).
+			Configure(If(cluster.LoadAssignment != nil, staticCLAConfigurer(conf, proxy.Dataplane.Spec.TagSet(), proxy.Dataplane.GetMeta().GetLabels(), proxy.Zone, egressEnabled, generator_metadata.OriginOutbound))).
 			Modify()
 	}
 
@@ -137,7 +138,7 @@ func (p plugin) configureDPP(
 			}
 		}
 		for _, cla := range endpoints[serviceName] {
-			if err := NewModifier(cla).Configure(claConfigurer(conf, proxy.Dataplane.Spec.TagSet(), proxy.Dataplane.GetMeta().GetLabels(), proxy.Zone, meshCtx.Resource.ZoneEgressEnabled(), generator_metadata.OriginOutbound)).Modify(); err != nil {
+			if err := NewModifier(cla).Configure(claConfigurer(conf, proxy.Dataplane.Spec.TagSet(), proxy.Dataplane.GetMeta().GetLabels(), proxy.Zone, meshCtx.Resource.MTLSEnabled() && len(meshCtx.ZoneEgresses) > 0, generator_metadata.OriginOutbound)).Modify(); err != nil {
 				return err
 			}
 		}
diff --git a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go
index 4b7c943c4d..1e6e292cf1 100644
--- a/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshloadbalancingstrategy/plugin/v1alpha1/plugin_test.go
@@ -1679,6 +1679,11 @@ func serviceName(id kri.Identifier, port int32) string {
 
 func contextWithEgressEnabled() xds_context.Context {
 	return *xds_builders.Context().
-		WithMeshBuilder(samples.MeshMTLSBuilder().WithEgressRoutingEnabled()).
+		WithMeshBuilder(samples.MeshMTLSBuilder()).
+		With(func(ctx *xds_context.Context) {
+			ctx.Mesh.ZoneEgresses = []core_xds.ZoneEgressInstance{
+				{Address: "10.0.0.1", Port: 10002},
+			}
+		}).
 		Build()
 }
diff --git a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
index dce088d75e..7c461f5008 100644
--- a/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
+++ b/pkg/plugins/policies/meshtcproute/plugin/v1alpha1/plugin_test.go
@@ -931,7 +931,7 @@ var _ = Describe("MeshTCPRoute", func() {
 
 func meshContextForMeshExternalService(resources ...core_model.Resource) *xds_context.MeshContext {
 	resourceStore := memory.NewStore()
-	mesh := builders.Mesh().WithBuiltinMTLSBackend("ca-1").WithEgressRoutingEnabled().WithEnabledMTLSBackend("ca-1").Build()
+	mesh := builders.Mesh().WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1").Build()
 	err := resourceStore.Create(context.Background(), mesh, store.CreateByKey("default", core_model.NoMesh))
 	Expect(err).ToNot(HaveOccurred())
 
diff --git a/pkg/test/resources/builders/mesh_builder.go b/pkg/test/resources/builders/mesh_builder.go
index 650221fc9f..ae0898f4bb 100644
--- a/pkg/test/resources/builders/mesh_builder.go
+++ b/pkg/test/resources/builders/mesh_builder.go
@@ -97,14 +97,6 @@ func (m *MeshBuilder) AddBuiltinMTLSBackend(name string) *MeshBuilder {
 	return m
 }
 
-func (m *MeshBuilder) WithEgressRoutingEnabled() *MeshBuilder {
-	if m.res.Spec.Routing == nil {
-		m.res.Spec.Routing = &mesh_proto.Routing{}
-	}
-	m.res.Spec.Routing.ZoneEgress = true
-	return m
-}
-
 func (m *MeshBuilder) WithMeshExternalServiceTrafficForbidden() *MeshBuilder {
 	if m.res.Spec.Routing == nil {
 		m.res.Spec.Routing = &mesh_proto.Routing{}
diff --git a/pkg/xds/generator/egress/internal_services_generator.go b/pkg/xds/generator/egress/internal_services_generator.go
index ad56160d81..e7cb335853 100644
--- a/pkg/xds/generator/egress/internal_services_generator.go
+++ b/pkg/xds/generator/egress/internal_services_generator.go
@@ -15,7 +15,7 @@ func genInternalResources(
 	proxy *core_xds.Proxy,
 	resources *core_xds.MeshResources,
 ) (*core_xds.ResourceSet, []*envoy_listeners.FilterChainBuilder, error) {
-	if !resources.Mesh.ZoneEgressEnabled() {
+	if !resources.Mesh.MTLSEnabled() {
 		return nil, nil, nil
 	}
 
diff --git a/pkg/xds/generator/egress/testdata/input/02.internalservice-only.yaml b/pkg/xds/generator/egress/testdata/input/02.internalservice-only.yaml
index e8ddab36c8..0836ac9ae9 100644
--- a/pkg/xds/generator/egress/testdata/input/02.internalservice-only.yaml
+++ b/pkg/xds/generator/egress/testdata/input/02.internalservice-only.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
   - name: ca-1
     type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/03.mixed-services.yaml b/pkg/xds/generator/egress/testdata/input/03.mixed-services.yaml
index aba1be012f..7575385653 100644
--- a/pkg/xds/generator/egress/testdata/input/03.mixed-services.yaml
+++ b/pkg/xds/generator/egress/testdata/input/03.mixed-services.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
   - name: ca-1
     type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/04.mixed-services-custom-trafficroute.yaml b/pkg/xds/generator/egress/testdata/input/04.mixed-services-custom-trafficroute.yaml
index aba1be012f..7575385653 100644
--- a/pkg/xds/generator/egress/testdata/input/04.mixed-services-custom-trafficroute.yaml
+++ b/pkg/xds/generator/egress/testdata/input/04.mixed-services-custom-trafficroute.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
   - name: ca-1
     type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/05.mixed-services-with-custom-trafficpermissions.yaml b/pkg/xds/generator/egress/testdata/input/05.mixed-services-with-custom-trafficpermissions.yaml
index aba1be012f..7575385653 100644
--- a/pkg/xds/generator/egress/testdata/input/05.mixed-services-with-custom-trafficpermissions.yaml
+++ b/pkg/xds/generator/egress/testdata/input/05.mixed-services-with-custom-trafficpermissions.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
   - name: ca-1
     type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/06.mixed-services-with-external-in-other-zone.yaml b/pkg/xds/generator/egress/testdata/input/06.mixed-services-with-external-in-other-zone.yaml
index 8a031cc884..54cf53c30a 100644
--- a/pkg/xds/generator/egress/testdata/input/06.mixed-services-with-external-in-other-zone.yaml
+++ b/pkg/xds/generator/egress/testdata/input/06.mixed-services-with-external-in-other-zone.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
   - name: ca-1
     type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/subsets-with-external-meshhttproute.yaml b/pkg/xds/generator/egress/testdata/input/subsets-with-external-meshhttproute.yaml
index 92b3ca6e0e..6d11ea1b9a 100644
--- a/pkg/xds/generator/egress/testdata/input/subsets-with-external-meshhttproute.yaml
+++ b/pkg/xds/generator/egress/testdata/input/subsets-with-external-meshhttproute.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
     - name: ca-1
       type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/subsets-with-meshhttproute.yaml b/pkg/xds/generator/egress/testdata/input/subsets-with-meshhttproute.yaml
index b554b571c7..7243cc7579 100644
--- a/pkg/xds/generator/egress/testdata/input/subsets-with-meshhttproute.yaml
+++ b/pkg/xds/generator/egress/testdata/input/subsets-with-meshhttproute.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
     - name: ca-1
       type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/generator/egress/testdata/input/traffic-by-default-meshhttproute.yaml b/pkg/xds/generator/egress/testdata/input/traffic-by-default-meshhttproute.yaml
index 0f6805c672..1834f67d02 100644
--- a/pkg/xds/generator/egress/testdata/input/traffic-by-default-meshhttproute.yaml
+++ b/pkg/xds/generator/egress/testdata/input/traffic-by-default-meshhttproute.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
     - name: ca-1
       type: builtin
-routing:
-  zoneEgress: true
 ---
 type: ZoneEgress
 name: zoneegress-1
diff --git a/pkg/xds/sync/testdata/input/default_resources.yaml b/pkg/xds/sync/testdata/input/default_resources.yaml
index b37278fa50..afb473a58d 100644
--- a/pkg/xds/sync/testdata/input/default_resources.yaml
+++ b/pkg/xds/sync/testdata/input/default_resources.yaml
@@ -5,8 +5,6 @@ mtls:
   backends:
     - name: builtin
       type: builtin
-routing:
-  zoneEgress: true
 ---
 type: Dataplane
 mesh: default
diff --git a/pkg/xds/topology/outbound.go b/pkg/xds/topology/outbound.go
index 2070cddd9a..aad7463dcc 100644
--- a/pkg/xds/topology/outbound.go
+++ b/pkg/xds/topology/outbound.go
@@ -153,7 +153,7 @@ func BuildEdsEndpointMap(
 		meshServiceDestinations[name] = struct{}{}
 	}
 
-	ingressInstances := fillIngressOutbounds(outbound, zoneIngresses, zoneEgresses, localZone, mesh, nil, mesh.ZoneEgressEnabled(), meshServiceDestinations)
+	ingressInstances := fillIngressOutbounds(outbound, zoneIngresses, zoneEgresses, localZone, mesh, nil, mesh.MTLSEnabled() && len(zoneEgresses) > 0, meshServiceDestinations)
 	endpointWeight := uint32(1)
 	if ingressInstances > 0 {
 		endpointWeight = ingressInstances
@@ -416,7 +416,7 @@ func BuildCrossMeshEndpointMap(
 		localZone,
 		mesh,
 		otherMesh,
-		mesh.ZoneEgressEnabled(),
+		mesh.MTLSEnabled() && len(zoneEgresses) > 0,
 		map[core_xds.ServiceName]struct{}{},
 	)
 
diff --git a/pkg/xds/topology/outbound_test.go b/pkg/xds/topology/outbound_test.go
index aa26bb3921..fd4e768ce6 100644
--- a/pkg/xds/topology/outbound_test.go
+++ b/pkg/xds/topology/outbound_test.go
@@ -49,9 +49,6 @@ var _ = Describe("TrafficRoute", func() {
 			Mtls: &mesh_proto.Mesh_Mtls{
 				EnabledBackend: "ca-1",
 			},
-			Routing: &mesh_proto.Routing{
-				ZoneEgress: true,
-			},
 		},
 	}
 	defaultMeshWithoutMTLS := &core_mesh.MeshResource{
diff --git a/pkg/zone/available_services_test.go b/pkg/zone/available_services_test.go
index f50e68c548..e91bf0d1ce 100644
--- a/pkg/zone/available_services_test.go
+++ b/pkg/zone/available_services_test.go
@@ -38,7 +38,7 @@ var _ = Describe("AvailableServices Tracker", func() {
 			resourceStore := memory.NewStore()
 			resManager = manager.NewResourceManager(resourceStore)
 
-			Expect(samples.MeshMTLSBuilder().WithEgressRoutingEnabled().Create(resManager)).To(Succeed())
+			Expect(samples.MeshMTLSBuilder().Create(resManager)).To(Succeed())
 
 			meshContextBuilder = xds_context.NewMeshContextBuilder(
 				resManager,
@@ -105,7 +105,7 @@ var _ = Describe("AvailableServices Tracker", func() {
 			metrics, err := core_metrics.NewMetrics("Zone")
 			Expect(err).ToNot(HaveOccurred())
 
-			Expect(samples.MeshMTLSBuilder().WithEgressRoutingEnabled().Create(resManager)).To(Succeed())
+			Expect(samples.MeshMTLSBuilder().Create(resManager)).To(Succeed())
 
 			meshContextBuilder := xds_context.NewMeshContextBuilder(
 				resManager,
diff --git a/test/e2e_env/kubernetes/gateway/delegated.go b/test/e2e_env/kubernetes/gateway/delegated.go
index a632a85abc..196aa117f2 100644
--- a/test/e2e_env/kubernetes/gateway/delegated.go
+++ b/test/e2e_env/kubernetes/gateway/delegated.go
@@ -49,9 +49,6 @@ spec:
 			}
 			BeforeAll(func() {
 				mesh := samples.MeshMTLSBuilder().WithName(config.Mesh)
-				if config.UseEgress {
-					mesh.WithEgressRoutingEnabled()
-				}
 				err := NewClusterSetup().
 					Install(Yaml(mesh)).
 					Install(MeshTrafficPermissionAllowAllKubernetes(config.Mesh)).
diff --git a/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go b/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go
index 2577674639..2090a8da4f 100644
--- a/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go
+++ b/test/e2e_env/kubernetes/meshexternalservice/meshexternalservice.go
@@ -26,7 +26,7 @@ func MeshExternalServices() {
 		err := NewClusterSetup().
 			Install(YamlK8s(samples.MeshMTLSBuilder().
 				WithName(meshName).
-				WithEgressRoutingEnabled().KubeYaml())).
+				KubeYaml())).
 			Install(Namespace(namespace)).
 			Install(NamespaceWithSidecarInjection(clientNamespace)).
 			Install(democlient.Install(democlient.WithNamespace(clientNamespace), democlient.WithMesh(meshName))).
@@ -163,7 +163,7 @@ spec:
 			Expect(kubernetes.Cluster.Install(YamlK8s(
 				samples.MeshMTLSBuilder().
 					WithName(meshName).
-					WithEgressRoutingEnabled().KubeYaml()),
+					KubeYaml()),
 			)).To(Succeed())
 		})
 
@@ -192,7 +192,7 @@ spec:
 				samples.MeshMTLSBuilder().
 					WithName(meshName).
 					WithMeshExternalServiceTrafficForbidden().
-					WithEgressRoutingEnabled().KubeYaml()),
+					KubeYaml()),
 			)).To(Succeed())
 			Expect(kubernetes.Cluster.Install(YamlK8s(disableMeshPassthrough))).To(Succeed())
 
diff --git a/test/e2e_env/kubernetes/meshtcproute/test.go b/test/e2e_env/kubernetes/meshtcproute/test.go
index 72952dcc1b..144def608a 100644
--- a/test/e2e_env/kubernetes/meshtcproute/test.go
+++ b/test/e2e_env/kubernetes/meshtcproute/test.go
@@ -23,11 +23,11 @@ func Test() {
 		Expect(NewClusterSetup().
 			// MeshExternalService traffic is only ever routed through ZoneEgress
 			// (see docs/madr/decisions/062-meshexternalservice-and-zoneegress.md),
-			// so the mesh needs mTLS + egress routing enabled for the
+			// so the mesh needs mTLS plus an available ZoneEgress for the
 			// MeshTCPRoute-vs-MeshExternalService precedence case below to have
 			// a real backend to route to.
 			Install(Combine(
-				YamlK8s(samples.MeshMTLSBuilder().WithName(meshName).WithEgressRoutingEnabled().KubeYaml()),
+				YamlK8s(samples.MeshMTLSBuilder().WithName(meshName).KubeYaml()),
 				WaitMeshKubernetesReady(meshName),
 			)).
 			Install(MeshTrafficPermissionAllowAllKubernetes(meshName)).
diff --git a/test/e2e_env/multizone/meshhttproute/test.go b/test/e2e_env/multizone/meshhttproute/test.go
index dc03c7ccb3..7eae1fe448 100644
--- a/test/e2e_env/multizone/meshhttproute/test.go
+++ b/test/e2e_env/multizone/meshhttproute/test.go
@@ -21,7 +21,7 @@ func Test() {
 	}, Ordered)
 
 	_ = Describe("Zone Egress", func() {
-		test("meshhttproute-ze", samples.MeshMTLSBuilder().WithEgressRoutingEnabled(), true)
+		test("meshhttproute-ze", samples.MeshMTLSBuilder(), true)
 	}, FlakeAttempts(3), Ordered)
 }
 
diff --git a/test/e2e_env/multizone/meshtrafficpermission/meshtrafficpermission.go b/test/e2e_env/multizone/meshtrafficpermission/meshtrafficpermission.go
index e3bd9840d8..2739fde197 100644
--- a/test/e2e_env/multizone/meshtrafficpermission/meshtrafficpermission.go
+++ b/test/e2e_env/multizone/meshtrafficpermission/meshtrafficpermission.go
@@ -39,8 +39,6 @@ mtls:
   backends:
     - name: ca-1
       type: builtin
-routing:
-  zoneEgress: true
 `, name)
 	return YamlUniversal(mesh)
 }
diff --git a/test/e2e_env/multizone/reachablebackends/reachablebackends.go b/test/e2e_env/multizone/reachablebackends/reachablebackends.go
index 6b561703ff..9b8c822041 100644
--- a/test/e2e_env/multizone/reachablebackends/reachablebackends.go
+++ b/test/e2e_env/multizone/reachablebackends/reachablebackends.go
@@ -126,8 +126,7 @@ spec:
 				Yaml(
 					builders.Mesh().
 						WithName(meshName).
-						WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1").
-						WithEgressRoutingEnabled(),
+						WithBuiltinMTLSBackend("ca-1").WithEnabledMTLSBackend("ca-1"),
 				),
 			).
 			Install(YamlUniversal(disableDefaultPassthrough)).
diff --git a/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go b/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go
index 31f5d11c4c..fd980f6b0a 100644
--- a/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go
+++ b/test/e2e_env/multizone/reachablebackends/reachablebackends_meshservices.go
@@ -34,8 +34,6 @@ mtls:
   backends:
   - name: ca-1
     type: builtin
-routing:
-  zoneEgress: true
 `, meshName)
 
 	disableDefaultPassthrough := fmt.Sprintf(`
diff --git a/test/framework/setup.go b/test/framework/setup.go
index a0b25b9a1b..76fe8d622c 100644
--- a/test/framework/setup.go
+++ b/test/framework/setup.go
@@ -169,24 +169,7 @@ spec:
 }
 
 func MTLSMeshKubernetesWithEgressRouting(name string) InstallFunc {
-	mesh := fmt.Sprintf(`
-apiVersion: kuma.io/v1alpha1
-kind: Mesh
-metadata:
-  name: %s
-spec:
-  routing:
-    zoneEgress: true
-  mtls:
-    enabledBackend: ca-1
-    backends:
-      - name: ca-1
-        type: builtin
-`, name)
-	return Combine(
-		YamlK8s(mesh),
-		WaitMeshKubernetesReady(name),
-	)
+	return MTLSMeshKubernetes(name)
 }
 
 func WaitMeshKubernetesReady(name string) InstallFunc {