docs(mesh): update docs and changelog

app/assets/mesh/dev/raw/crds/kuma.io_circuitbreakers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: circuitbreakers.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_containerpatches.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: containerpatches.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_dataplaneinsights.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_dataplanes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: dataplanes.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_externalservices.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: externalservices.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_faultinjections.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: faultinjections.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_healthchecks.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: healthchecks.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_hostnamegenerators.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
@@ -21,6 +21,11 @@ spec:
   - name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: HostnameGenerator automatically generates DNS hostnames for services
+          in the mesh based on customizable templates. It provides a consistent naming
+          scheme for service discovery by creating predictable hostnames from service
+          labels and metadata, supporting both MeshService, MeshExternalService, and
+          MeshMultiZoneService resources.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshaccesslogs.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,10 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshAccessLog configures access logging for traffic between services
+          in the mesh. It allows you to capture and export request/response logs to
+          various backends (file, TCP, or OpenTelemetry) for monitoring, debugging,
+          and auditing purposes.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshcircuitbreakers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,10 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshCircuitBreaker protects services from cascading failures
+          by limiting connections and detecting unhealthy instances. It provides connection
+          limits to prevent overload and outlier detection to temporarily remove failing
+          endpoints from the load balancing pool.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshes.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_meshexternalservices.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
@@ -25,6 +25,11 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshExternalService represents external services (outside the
+          mesh) that mesh services can communicate with securely. It enables mesh
+          services to reach external APIs, databases, or third-party services by defining
+          endpoints, ports, protocols, and optional TLS configuration for secure outbound
+          connections with hostname-based routing support.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshfaultinjections.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,10 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshFaultInjection allows you to test the resiliency of your
+          services by injecting faults like delays, connection aborts, and response
+          bandwidth limits into the traffic. This is useful for chaos testing and
+          validating that your applications handle failures gracefully.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshgatewayconfigs.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshgatewayconfigs.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_meshgatewayinstances.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshgatewayinstances.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_meshgatewayroutes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshgatewayroutes.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_meshgateways.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshgateways.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_meshglobalratelimits.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshglobalratelimits.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshGlobalRateLimit
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshhealthchecks.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,10 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshHealthCheck enables active health checking of services in
+          the mesh. It periodically probes service endpoints using TCP, HTTP, or gRPC
+          health checks to detect and remove unhealthy instances from the load balancing
+          pool, improving overall service reliability.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshhttproutes.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,12 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: |-
+          NOTICE: This policy defines its own `GetDefault` method so that it can have the given
+          structure for deserialization but still use the generic policy merging
+          machinery.
+          //
+          MeshHTTPRoute configures how HTTP requests are routed between services in the mesh. It enables advanced traffic management including path-based routing, header matching, request/response modification, redirects, URL rewrites, traffic mirroring, and weighted load balancing across service endpoints.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshidentities.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshidentities.kuma.io
 spec:
   group: kuma.io
@@ -21,6 +21,11 @@ spec:
   - name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshIdentity manages service identity and certificate provisioning
+          for workloads in the mesh. It configures how services obtain their identity
+          certificates, supporting multiple providers including bundled certificates
+          (self-signed or user-provided CA), SPIRE integration, and custom SPIFFE
+          ID configuration for secure service-to-service authentication.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshinsights.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshinsights.kuma.io
 spec:
   group: kuma.io

app/assets/mesh/dev/raw/crds/kuma.io_meshloadbalancingstrategies.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,11 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshLoadBalancingStrategy configures how traffic is distributed
+          across service instances. It supports multiple load balancing algorithms
+          (round-robin, least request, ring hash, random, maglev), locality-aware
+          routing to prefer nearby instances, and cross-zone failover strategies for
+          high availability.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshmetrics.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,10 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshMetric enables collection and export of service mesh metrics.
+          It configures sidecar and application metrics scraping, allows customization
+          of which metrics are published, and supports exporting to Prometheus or
+          OpenTelemetry backends for monitoring and observability.
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshmultizoneservices.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
@@ -25,6 +25,9 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: |-
+          MeshMultiZoneService provides global load balancing and service discovery across multiple zones in a multi-zone mesh deployment. It aggregates MeshServices from different zones by label selectors, creating a unified service endpoint with automatic VIP assignment and hostname generation for cross-zone communication and failover.
+          MeshMultizoneServices are only created on global
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshopas.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshopas.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshOPA
         properties:
           apiVersion:
             description: |-

app/assets/mesh/dev/raw/crds/kuma.io_meshpassthroughs.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
@@ -28,6 +28,10 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: MeshPassthrough controls how traffic to external services (outside
+          the mesh) is handled by the sidecar proxy. It allows you to configure passthrough
+          mode to permit, deny, or selectively allow traffic to specific external
+          destinations based on domain names, IPs, or CIDR ranges.
         properties:
           apiVersion:
             description: |-