current implementation reproduces https://docs.google.com/document/d/1o6kd61gBVvUtYAqTN6JqJGlUAsatmlq2mmoBkQThEFg/edit for simplicity
We should explore if it's possible to use one single proxy data plane side. E.g:
We could change the kube endpoint IP advertised address in the dataplane to match the management kas svc ip, or relying on source ip instead of dst to discriminate.