Repository: kumahq/kuma
Pull request #3459 (2021-12-09 15:32:28)

fix(kuma-dp): fix conntrack collisions 
### Summary

When there are a lot of DNS queries and a smaller set of ephemeral ports, conntrack collisions could cause DNS traffic to bypass the mesh. The original fix is in Istio's transparentproxy but came in after we vendored that code. 

Original fix here: (https://github.com/istio/istio/pull/33572).

I also pulled across the Istio package's test changes but it looks like we skip tests for this vendored package anyway? Should we bring these back in?

Should probably also backport this.

### Full changelog

Implement conntrack zones in the iptables rules based on a fix in Istio

### Issues resolved

N / A

### Documentation

N / A

### Testing

- [ ] Unit tests
- [ ] E2E tests
- [ ] Manual testing on Universal
- [ ] Manual testing on Kubernetes

### Backwards compatibility

- [ ] Update [`UPGRADE.md`](UPGRADE.md) with any steps users will need to take
      when upgrading.
- [X] Add `backport-to-stable` label if the code is backwards compatible. Otherwise, list breaking changes.

Signed-off-by: John Harris <john.harris@konghq.com>


codecov-commenter: # [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) Report
> Merging [#3459](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (047042c) into [master](https://codecov.io/gh/kumahq/kuma/commit/d265972b0174636ef0e30afa98ba57e9da1c45f1?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (d265972) will **increase** coverage by `0.03%`.
> The diff coverage is `76.54%`.

[![Impacted file tree graph](https://codecov.io/gh/kumahq/kuma/pull/3459/graphs/tree.svg?width=650&height=150&src=pr&token=D7Yvqs6rwV&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)

```diff
@@            Coverage Diff             @@
##           master    #3459      +/-   ##
==========================================
+ Coverage   52.29%   52.33%   +0.03%     
==========================================
  Files         940      940              
  Lines       54445    54526      +81     
==========================================
+ Hits        28472    28534      +62     
- Misses      23755    23773      +18     
- Partials     2218     2219       +1     
```


| [Impacted Files](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) | Coverage Δ | |
|---|---|---|
| [...entproxy/istio/tools/istio-iptables/pkg/cmd/run.go](https://codecov.io/gh/kumahq/kuma/pull/3459/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3RyYW5zcGFyZW50cHJveHkvaXN0aW8vdG9vbHMvaXN0aW8taXB0YWJsZXMvcGtnL2NtZC9ydW4uZ28=) | `54.42% <76.54%> (+4.18%)` | :arrow_up: |
| [pkg/plugins/runtime/gateway/route/sorter.go](https://codecov.io/gh/kumahq/kuma/pull/3459/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3BsdWdpbnMvcnVudGltZS9nYXRld2F5L3JvdXRlL3NvcnRlci5nbw==) | `61.53% <0.00%> (-10.26%)` | :arrow_down: |
| [pkg/xds/generator/direct\_access\_proxy\_generator.go](https://codecov.io/gh/kumahq/kuma/pull/3459/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3hkcy9nZW5lcmF0b3IvZGlyZWN0X2FjY2Vzc19wcm94eV9nZW5lcmF0b3IuZ28=) | `84.70% <0.00%> (-1.18%)` | :arrow_down: |
| [pkg/core/resources/manager/cache.go](https://codecov.io/gh/kumahq/kuma/pull/3459/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcmVzb3VyY2VzL21hbmFnZXIvY2FjaGUuZ28=) | `85.71% <0.00%> (ø)` | |
| [pkg/dns/vips\_allocator.go](https://codecov.io/gh/kumahq/kuma/pull/3459/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2Rucy92aXBzX2FsbG9jYXRvci5nbw==) | `73.75% <0.00%> (+1.41%)` | :arrow_up: |
| [pkg/kds/client/sink.go](https://codecov.io/gh/kumahq/kuma/pull/3459/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2tkcy9jbGllbnQvc2luay5nbw==) | `67.56% <0.00%> (+8.10%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Last update [d265972...047042c](https://codecov.io/gh/kumahq/kuma/pull/3459?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).

lahabana: @mergifyio update
lahabana: @johnharris85 thanks! Do you want to look at reenabling the tests? 
mergify[bot]: > update

#### ✅ Branch has been successfully updated



<!--
DO NOT EDIT
-*- Mergify Payload -*-
{"command": "update", "conclusion": "success"}
-*- Mergify Payload End -*-
-->

bartsmykla: @johnharris85 Hi John, as we discussed yesterday I want to help with finishing this PR. Would you be able to allow me to contribute to your fork please?
bartsmykla: As our e2e tests for universal are done from inside of a docker
container, to make the networking work, we are bridging docker
network to the host, which results in additional iptables rules
inside every container within this network. Problem with these
rules is that it's doing some NAT'ing for DNS udp datagrams with
addition of randomly picked (during the container startup) port.
It's problematic for this conntrack change as it works inside
the `raw` table and among others `PREROUTING` chain and expects
the datagrams from known port (53), which the earlier described
NAT'ing is changing. This probably could be fixed by rethinking
some of the rules, but as it's an edge case, after consultation
with the team I decided it's not worth the time needed to properly
solve it and instead I introduced to a `--skip-dns-conntrack-zone-split`
flag for `kumactl install transparent-proxy`, which allows us to
skip attaching the conntrack-collision iptables rules. This change
was necessary for making some of the tests to work (univeral).

I also fixed the code to include our flag for capturing all dns
traffic and instead of hardcoding port `15053`, to use the one
from the configuration.

Patch:
diff --git a/app/kumactl/cmd/install/install_transparent_proxy.go b/app/kumactl/cmd/install/install_transparent_proxy.go
index 2c9312cb6..92191a1a0 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy.go
@@ -22,46 +22,48 @@ import (
 )
 
 type transparentProxyArgs struct {
-	DryRun                 bool
-	Verbose                bool
-	RedirectPortOutBound   string
-	RedirectInbound        bool
-	RedirectPortInBound    string
-	RedirectPortInBoundV6  string
-	ExcludeInboundPorts    string
-	ExcludeOutboundPorts   string
-	UID                    string
-	User                   string
-	RedirectDNS            bool
-	RedirectAllDNSTraffic  bool
-	AgentDNSListenerPort   string
-	DNSUpstreamTargetChain string
-	SkipResolvConf         bool
-	StoreFirewalld         bool
-	KumaCpIP               net.IP
+	DryRun                    bool
+	Verbose                   bool
+	RedirectPortOutBound      string
+	RedirectInbound           bool
+	RedirectPortInBound       string
+	RedirectPortInBoundV6     string
+	ExcludeInboundPorts       string
+	ExcludeOutboundPorts      string
+	UID                       string
+	User                      string
+	RedirectDNS               bool
+	RedirectAllDNSTraffic     bool
+	AgentDNSListenerPort      string
+	DNSUpstreamTargetChain    string
+	SkipResolvConf            bool
+	StoreFirewalld            bool
+	KumaCpIP                  net.IP
+	SkipDNSConntrackZoneSplit bool
 }
 
 var defaultCpIP = net.IPv4(0, 0, 0, 0)
 
 func newInstallTransparentProxy() *cobra.Command {
 	args := transparentProxyArgs{
-		DryRun:                 false,
-		Verbose:                false,
-		RedirectPortOutBound:   "15001",
-		RedirectInbound:        true,
-		RedirectPortInBound:    "15006",
-		RedirectPortInBoundV6:  "15010",
-		ExcludeInboundPorts:    "",
-		ExcludeOutboundPorts:   "",
-		UID:                    "",
-		User:                   "",
-		RedirectDNS:            false,
-		RedirectAllDNSTraffic:  false,
-		AgentDNSListenerPort:   "15053",
-		DNSUpstreamTargetChain: "RETURN",
-		SkipResolvConf:         false,
-		StoreFirewalld:         false,
-		KumaCpIP:               defaultCpIP,
+		DryRun:                    false,
+		Verbose:                   false,
+		RedirectPortOutBound:      "15001",
+		RedirectInbound:           true,
+		RedirectPortInBound:       "15006",
+		RedirectPortInBoundV6:     "15010",
+		ExcludeInboundPorts:       "",
+		ExcludeOutboundPorts:      "",
+		UID:                       "",
+		User:                      "",
+		RedirectDNS:               false,
+		RedirectAllDNSTraffic:     false,
+		AgentDNSListenerPort:      "15053",
+		DNSUpstreamTargetChain:    "RETURN",
+		SkipResolvConf:            false,
+		StoreFirewalld:            false,
+		KumaCpIP:                  defaultCpIP,
+		SkipDNSConntrackZoneSplit: false,
 	}
 	cmd := &cobra.Command{
 		Use:   "transparent-proxy",
@@ -175,6 +177,7 @@ runuser -u kuma-dp -- \
 	cmd.Flags().BoolVar(&args.SkipResolvConf, "skip-resolv-conf", args.SkipResolvConf, "skip modifying the host `/etc/resolv.conf`")
 	cmd.Flags().BoolVar(&args.StoreFirewalld, "store-firewalld", args.StoreFirewalld, "store the iptables changes with firewalld")
 	cmd.Flags().IPVar(&args.KumaCpIP, "kuma-cp-ip", args.KumaCpIP, "the IP address of the Kuma CP which exposes the DNS service on port 53.")
+	cmd.Flags().BoolVar(&args.SkipDNSConntrackZoneSplit, "skip-dns-conntrack-zone-split", args.SkipDNSConntrackZoneSplit, "skip applying conntrack zone splitting iptables rules")
 
 	return cmd
 }
@@ -217,20 +220,21 @@ func modifyIpTables(cmd *cobra.Command, args *transparentProxyArgs) error {
 		_, _ = cmd.OutOrStdout().Write([]byte("kumactl is about to apply the iptables rules that will enable transparent proxying on the machine. The SSH connection may drop. If that happens, just reconnect again.\n"))
 	}
 	output, err := tp.Setup(&config.TransparentProxyConfig{
-		DryRun:                 args.DryRun,
-		Verbose:                args.Verbose,
-		RedirectPortOutBound:   args.RedirectPortOutBound,
-		RedirectInBound:        args.RedirectInbound,
-		RedirectPortInBound:    args.RedirectPortInBound,
-		RedirectPortInBoundV6:  args.RedirectPortInBoundV6,
-		ExcludeInboundPorts:    args.ExcludeInboundPorts,
-		ExcludeOutboundPorts:   args.ExcludeOutboundPorts,
-		UID:                    uid,
-		GID:                    gid,
-		RedirectDNS:            args.RedirectDNS,
-		RedirectAllDNSTraffic:  args.RedirectAllDNSTraffic,
-		AgentDNSListenerPort:   args.AgentDNSListenerPort,
-		DNSUpstreamTargetChain: args.DNSUpstreamTargetChain,
+		DryRun:                    args.DryRun,
+		Verbose:                   args.Verbose,
+		RedirectPortOutBound:      args.RedirectPortOutBound,
+		RedirectInBound:           args.RedirectInbound,
+		RedirectPortInBound:       args.RedirectPortInBound,
+		RedirectPortInBoundV6:     args.RedirectPortInBoundV6,
+		ExcludeInboundPorts:       args.ExcludeInboundPorts,
+		ExcludeOutboundPorts:      args.ExcludeOutboundPorts,
+		UID:                       uid,
+		GID:                       gid,
+		RedirectDNS:               args.RedirectDNS,
+		RedirectAllDNSTraffic:     args.RedirectAllDNSTraffic,
+		AgentDNSListenerPort:      args.AgentDNSListenerPort,
+		DNSUpstreamTargetChain:    args.DNSUpstreamTargetChain,
+		SkipDNSConntrackZoneSplit: args.SkipDNSConntrackZoneSplit,
 	})
 	if err != nil {
 		return errors.Wrap(err, "failed to setup transparent proxy")
diff --git a/docs/cmd/kumactl/kumactl_install_transparent-proxy.md b/docs/cmd/kumactl/kumactl_install_transparent-proxy.md
index cd0bd7d53..086ea7267 100644
--- a/docs/cmd/kumactl/kumactl_install_transparent-proxy.md
+++ b/docs/cmd/kumactl/kumactl_install_transparent-proxy.md
@@ -79,6 +79,7 @@ kumactl install transparent-proxy [flags]
       --redirect-inbound-port networking.transparentProxying.redirectPortInbound        inbound port redirected to Envoy, as specified in dataplane's networking.transparentProxying.redirectPortInbound (default "15006")
       --redirect-inbound-port-v6 networking.transparentProxying.redirectPortInboundV6   IPv6 inbound port redirected to Envoy, as specified in dataplane's networking.transparentProxying.redirectPortInboundV6 (default "15010")
       --redirect-outbound-port networking.transparentProxying.redirectPortOutbound      outbound port redirected to Envoy, as specified in dataplane's networking.transparentProxying.redirectPortOutbound (default "15001")
+      --skip-dns-conntrack-zone-split                                                   skip applying conntrack zone splitting iptables rules
       --skip-resolv-conf /etc/resolv.conf                                               skip modifying the host /etc/resolv.conf
       --store-firewalld                                                                 store the iptables changes with firewalld
       --verbose                                                                         verbose
diff --git a/pkg/core/xds/types.go b/pkg/core/xds/types.go
index c8bcdaa0f..239304f8d 100644
--- a/pkg/core/xds/types.go
+++ b/pkg/core/xds/types.go
@@ -132,6 +132,12 @@ type Proxy struct {
 	Metadata    *DataplaneMetadata
 	Routing     Routing
 	Policies    MatchedPolicies
+
+	ZoneEgressProxy *ZoneEgressProxy
+}
+
+type ZoneEgressProxy struct {
+	Meshes *core_mesh.MeshResourceList
 }
 
 type VIPDomains struct {
diff --git a/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go b/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go
index 49b70ac55..edb6fb55e 100644
--- a/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go
+++ b/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_controller.go
@@ -115,6 +115,8 @@ func (r *GatewayReconciler) createOrUpdateInstance(ctx context.Context, gateway
 	return instance, nil
 }
 
+const gatewayIndexField = ".metadata.gateway"
+
 // gatewaysForRoute returns a function that calculates which Gateways might
 // be affected by changes in an HTTPRoute so they can be reconciled.
 func gatewaysForRoute(l logr.Logger, client kube_client.Client) kube_handler.MapFunc {
@@ -147,6 +149,30 @@ func gatewaysForRoute(l logr.Logger, client kube_client.Client) kube_handler.Map
 }
 
 func (r *GatewayReconciler) SetupWithManager(mgr kube_ctrl.Manager) error {
+	// This index helps us list routes that point to a Gateway in
+	// attachedListenersForGateway.
+	if err := mgr.GetFieldIndexer().IndexField(context.Background(), &gatewayapi.HTTPRoute{}, gatewayIndexField, func(obj kube_client.Object) []string {
+		route := obj.(*gatewayapi.HTTPRoute)
+
+		var names []string
+
+		for _, parentRef := range route.Spec.ParentRefs {
+			namespace := route.Namespace
+			if parentRef.Namespace != nil {
+				namespace = string(*parentRef.Namespace)
+			}
+
+			names = append(
+				names,
+				kube_types.NamespacedName{Namespace: namespace, Name: string(parentRef.Name)}.String(),
+			)
+		}
+
+		return names
+	}); err != nil {
+		return err
+	}
+
 	return kube_ctrl.NewControllerManagedBy(mgr).
 		For(&gatewayapi.Gateway{}).
 		Owns(&mesh_k8s.Gateway{}).
diff --git a/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_status.go b/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_status.go
index 72e9cb3af..3934ccc0b 100644
--- a/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_status.go
+++ b/pkg/plugins/runtime/k8s/controllers/gatewayapi/gateway_status.go
@@ -2,6 +2,9 @@ package gatewayapi
 
 import (
 	"context"
+	"fmt"
+	"reflect"
+	"strings"
 
 	"github.com/pkg/errors"
 	kube_apierrs "k8s.io/apimachinery/pkg/api/errors"
@@ -21,7 +24,13 @@ func (r *GatewayReconciler) updateStatus(
 	listenerConditions ListenerConditions,
 ) error {
 	updated := gateway.DeepCopy()
-	mergeGatewayStatus(updated, gatewayInstance, listenerConditions)
+
+	attachedListeners, err := attachedRoutesForListeners(ctx, gateway, r.Client)
+	if err != nil {
+		return err
+	}
+
+	mergeGatewayStatus(updated, gatewayInstance, listenerConditions, attachedListeners)
 
 	if err := r.Client.Status().Patch(ctx, updated, kube_client.MergeFrom(gateway)); err != nil {
 		if kube_apierrs.IsNotFound(err) {
@@ -33,7 +42,7 @@ func (r *GatewayReconciler) updateStatus(
 	return nil
 }
 
-func gatewayAddresses(gateway *gatewayapi.Gateway, instance *mesh_k8s.GatewayInstance) []gatewayapi.GatewayAddress {
+func gatewayAddresses(instance *mesh_k8s.GatewayInstance) []gatewayapi.GatewayAddress {
 	ipType := gatewayapi.IPAddressType
 	hostnameType := gatewayapi.HostnameAddressType
 
@@ -59,7 +68,68 @@ func gatewayAddresses(gateway *gatewayapi.Gateway, instance *mesh_k8s.GatewayIns
 	return addrs
 }
 
-func mergeGatewayListenerStatuses(gateway *gatewayapi.Gateway, conditions ListenerConditions) []gatewayapi.ListenerStatus {
+const everyListener = gatewayapi.SectionName("")
+
+type attachedRoutes struct {
+	// num is the number of allowed routes for a listener
+	num int32
+	// invalidRoutes can be empty
+	invalidRoutes []string
+}
+
+// AttachedRoutesForListeners tracks the relevant status for routes pointing to a
+// listener.
+type AttachedRoutesForListeners map[gatewayapi.SectionName]attachedRoutes
+
+// attachedRoutesForListeners returns a function that calculates the
+// conditions for routes attached to a Gateway.
+func attachedRoutesForListeners(
+	ctx context.Context,
+	gateway *gatewayapi.Gateway,
+	client kube_client.Client,
+) (AttachedRoutesForListeners, error) {
+	var routes gatewayapi.HTTPRouteList
+	if err := client.List(ctx, &routes, kube_client.MatchingFields{
+		gatewayIndexField: kube_client.ObjectKeyFromObject(gateway).String(),
+	}); err != nil {
+		return nil, errors.Wrap(err, "unexpected error listing HTTPRoutes")
+	}
+
+	attachedRoutes := AttachedRoutesForListeners{}
+
+	for _, route := range routes.Items {
+		for _, parentRef := range route.Spec.ParentRefs {
+			sectionName := everyListener
+			if parentRef.SectionName != nil {
+				sectionName = *parentRef.SectionName
+			}
+
+			for _, refStatus := range route.Status.Parents {
+				if reflect.DeepEqual(refStatus.ParentRef, parentRef) {
+					attached := attachedRoutes[sectionName]
+					attached.num++
+
+					if kube_apimeta.IsStatusConditionFalse(refStatus.Conditions, string(gatewayapi.ConditionRouteResolvedRefs)) {
+						attached.invalidRoutes = append(attached.invalidRoutes, kube_client.ObjectKeyFromObject(&route).String())
+					}
+
+					attachedRoutes[sectionName] = attached
+				}
+			}
+		}
+	}
+
+	return attachedRoutes, nil
+}
+
+// mergeGatewayListenerStatuses takes the statuses of the attached Routes and
+// the other calculated conditions for this listener and returns a
+// ListenerStatus.
+func mergeGatewayListenerStatuses(
+	gateway *gatewayapi.Gateway,
+	conditions ListenerConditions,
+	attachedRouteStatuses AttachedRoutesForListeners,
+) []gatewayapi.ListenerStatus {
 	previousStatuses := map[gatewayapi.SectionName]gatewayapi.ListenerStatus{}
 
 	for _, status := range gateway.Status.Listeners {
@@ -72,10 +142,10 @@ func mergeGatewayListenerStatuses(gateway *gatewayapi.Gateway, conditions Listen
 	// existing one
 	for name, conditions := range conditions {
 		previousStatus := gatewayapi.ListenerStatus{
-			Name: name,
-			// TODO it's difficult to determine this number with Kuma, so we
-			// leave it at 0
+			Name:           name,
 			AttachedRoutes: 0,
+			// TODO this should be Listener.AllowedRoutes with invalid kinds
+			// removed, i.e. it may be empty
 			SupportedKinds: []gatewayapi.RouteGroupKind{{Kind: common.HTTPRouteKind}},
 		}
 
@@ -88,6 +158,27 @@ func mergeGatewayListenerStatuses(gateway *gatewayapi.Gateway, conditions Listen
 			kube_apimeta.SetStatusCondition(&previousStatus.Conditions, condition)
 		}
 
+		// Check resolved status for routes for this listener and for
+		// non-specific parents.
+		previousStatus.AttachedRoutes = attachedRouteStatuses[name].num + attachedRouteStatuses[everyListener].num
+
+		// If we can't resolve refs on a route and our listener condition
+		// ResolvedRefs is otherwise true, set it to false.
+		invalidRoutes := append(attachedRouteStatuses[everyListener].invalidRoutes, attachedRouteStatuses[name].invalidRoutes...)
+
+		if len(invalidRoutes) > 0 &&
+			kube_apimeta.IsStatusConditionTrue(previousStatus.Conditions, string(gatewayapi.ListenerConditionResolvedRefs)) {
+			// We only set the ResolvedRefs condition and don't set ready false
+			message := fmt.Sprintf("Attached HTTPRoutes %s have unresolved BackendRefs", strings.Join(invalidRoutes, ", "))
+			kube_apimeta.SetStatusCondition(&previousStatus.Conditions, kube_meta.Condition{
+				Type:               string(gatewayapi.ListenerConditionResolvedRefs),
+				Status:             kube_meta.ConditionFalse,
+				Reason:             string(gatewayapi.ListenerReasonRefNotPermitted),
+				Message:            message,
+				ObservedGeneration: gateway.GetGeneration(),
+			})
+		}
+
 		statuses = append(statuses, previousStatus)
 	}
 
@@ -95,10 +186,15 @@ func mergeGatewayListenerStatuses(gateway *gatewayapi.Gateway, conditions Listen
 }
 
 // mergeGatewayStatus updates the status by mutating the given Gateway.
-func mergeGatewayStatus(gateway *gatewayapi.Gateway, instance *mesh_k8s.GatewayInstance, listenerConditions ListenerConditions) {
-	gateway.Status.Addresses = gatewayAddresses(gateway, instance)
+func mergeGatewayStatus(
+	gateway *gatewayapi.Gateway,
+	instance *mesh_k8s.GatewayInstance,
+	listenerConditions ListenerConditions,
+	attachedListeners AttachedRoutesForListeners,
+) {
+	gateway.Status.Addresses = gatewayAddresses(instance)
 
-	gateway.Status.Listeners = mergeGatewayListenerStatuses(gateway, listenerConditions)
+	gateway.Status.Listeners = mergeGatewayListenerStatuses(gateway, listenerConditions, attachedListeners)
 
 	readinessStatus := kube_meta.ConditionFalse
 	readinessReason := gatewayapi.GatewayReasonListenersNotReady
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
index 6d6b4bbba..ba95c0efc 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
@@ -284,6 +284,7 @@ func (i *KumaInjector) NewInitContainer(pod *kube_core.Pod) (kube_core.Container
 			Capabilities: &kube_core.Capabilities{
 				Add: []kube_core.Capability{
 					kube_core.Capability("NET_ADMIN"),
+					kube_core.Capability("NET_RAW"),
 				},
 			},
 		},
diff --git a/pkg/transparentproxy/istio/config/config.go b/pkg/transparentproxy/istio/config/config.go
index fc95474bb..da8f73c80 100644
--- a/pkg/transparentproxy/istio/config/config.go
+++ b/pkg/transparentproxy/istio/config/config.go
@@ -1,18 +1,19 @@
 package config
 
 type TransparentProxyConfig struct {
-	DryRun                 bool
-	Verbose                bool
-	RedirectPortOutBound   string
-	RedirectInBound        bool
-	RedirectPortInBound    string
-	RedirectPortInBoundV6  string
-	ExcludeInboundPorts    string
-	ExcludeOutboundPorts   string
-	UID                    string
-	GID                    string
-	RedirectDNS            bool
-	RedirectAllDNSTraffic  bool
-	AgentDNSListenerPort   string
-	DNSUpstreamTargetChain string
+	DryRun                    bool
+	Verbose                   bool
+	RedirectPortOutBound      string
+	RedirectInBound           bool
+	RedirectPortInBound       string
+	RedirectPortInBoundV6     string
+	ExcludeInboundPorts       string
+	ExcludeOutboundPorts      string
+	UID                       string
+	GID                       string
+	RedirectDNS               bool
+	RedirectAllDNSTraffic     bool
+	AgentDNSListenerPort      string
+	DNSUpstreamTargetChain    string
+	SkipDNSConntrackZoneSplit bool
 }
diff --git a/pkg/transparentproxy/istio/istio.go b/pkg/transparentproxy/istio/istio.go
index 86492b183..de8b9a8c6 100644
--- a/pkg/transparentproxy/istio/istio.go
+++ b/pkg/transparentproxy/istio/istio.go
@@ -43,6 +43,7 @@ func (tp *IstioTransparentProxy) Setup(cfg *config.TransparentProxyConfig) (stri
 	viper.Set(constants.RedirectAllDNSTraffic, cfg.RedirectAllDNSTraffic)
 	viper.Set(constants.AgentDNSListenerPort, cfg.AgentDNSListenerPort)
 	viper.Set(constants.DNSUpstreamTargetChain, cfg.DNSUpstreamTargetChain)
+	viper.Set(constants.SkipDNSConntrackZoneSplit, cfg.SkipDNSConntrackZoneSplit)
 
 	if !cfg.Verbose {
 		tp.redirectStdOutStdErr()
diff --git a/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/cleanup.go b/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/cleanup.go
index 931f3702b..f33dbedc5 100644
--- a/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/cleanup.go
+++ b/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/cleanup.go
@@ -42,7 +42,7 @@ func removeOldChains(cfg *config.Config, ext dep.Dependencies, cmd string) {
 		common.HandleDNSUDP(common.DeleteOps, builder.NewIptablesBuilder(), ext, cmd,
 			cfg.AgentDNSListenerPort,
 			cfg.DNSUpstreamTargetChain,
-			cfg.ProxyUID, cfg.ProxyGID, cfg.DNSServersV4)
+			cfg.ProxyUID, cfg.ProxyGID, cfg.DNSServersV4, cfg.RedirectAllDNSTraffic, cfg.SkipDNSConntrackZoneSplit)
 		common.HandleDNSUDPv6(common.DeleteOps, builder.NewIptablesBuilder(), ext, cmd,
 			cfg.AgentDNSListenerPort,
 			constants.RETURN, // we cannot use iptConfigurator.cfg.DNSUpstreamTargetChain because the target might be available only in IP V4
diff --git a/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/root.go b/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/root.go
index 9fd1dde59..424353d28 100644
--- a/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/root.go
+++ b/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/cmd/root.go
@@ -23,7 +23,6 @@ import (
 	"github.com/miekg/dns"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
-
 	"istio.io/pkg/env"
 
 	"github.com/kumahq/kuma/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/config"
@@ -51,13 +50,14 @@ var rootCmd = &cobra.Command{
 
 func constructConfig() *config.Config {
 	cfg := &config.Config{
-		DryRun:                 viper.GetBool(constants.DryRun),
-		ProxyUID:               viper.GetString(constants.ProxyUID),
-		ProxyGID:               viper.GetString(constants.ProxyGID),
-		RedirectDNS:            viper.GetBool(constants.RedirectDNS),
-		RedirectAllDNSTraffic:  viper.GetBool(constants.RedirectAllDNSTraffic),
-		AgentDNSListenerPort:   viper.GetString(constants.AgentDNSListenerPort),
-		DNSUpstreamTargetChain: viper.GetString(constants.DNSUpstreamTargetChain),
+		DryRun:                    viper.GetBool(constants.DryRun),
+		ProxyUID:                  viper.GetString(constants.ProxyUID),
+		ProxyGID:                  viper.GetString(constants.ProxyGID),
+		RedirectDNS:               viper.GetBool(constants.RedirectDNS),
+		RedirectAllDNSTraffic:     viper.GetBool(constants.RedirectAllDNSTraffic),
+		AgentDNSListenerPort:      viper.GetString(constants.AgentDNSListenerPort),
+		DNSUpstreamTargetChain:    viper.GetString(constants.DNSUpstreamTargetChain),
+		SkipDNSConntrackZoneSplit: viper.GetBool(constants.SkipDNSConntrackZoneSplit),
 	}
 
 	// TODO: Make this more configurable, maybe with an allowlist of users to be captured for output instead of a denylist.
@@ -136,6 +136,11 @@ func bindFlags(cmd *cobra.Command, args []string) {
 		handleError(err)
 	}
 	viper.SetDefault(constants.DNSUpstreamTargetChain, constants.RETURN)
+
+	if err := viper.BindPFlag(constants.SkipDNSConntrackZoneSplit, cmd.Flags().Lookup(constants.SkipDNSConntrackZoneSplit)); err != nil {
+		handleError(err)
+	}
+	viper.SetDefault(constants.SkipDNSConntrackZoneSplit, false)
 }
 
 // https://github.com/spf13/viper/issues/233.
@@ -157,6 +162,8 @@ func init() {
 	rootCmd.Flags().String(constants.AgentDNSListenerPort, constants.IstioAgentDNSListenerPort, "set listen port for DNS agent")
 
 	rootCmd.Flags().String(constants.DNSUpstreamTargetChain, constants.RETURN, "(optional) the iptables chain where the upstream DNS requests should be directed to. It is only applied for IP V4. Use with care.")
+
+	rootCmd.Flags().String(constants.SkipDNSConntrackZoneSplit, constants.RETURN, "Skip applying conntrack zone splitting iptables rules")
 }
 
 func GetCommand() *cobra.Command {
diff --git a/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/config/config.go b/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/config/config.go
index e53503b6f..de6f04ee1 100644
--- a/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/config/config.go
+++ b/pkg/transparentproxy/istio/tools/istio-clean-iptables/pkg/config/config.go
@@ -22,15 +22,16 @@ import (
 // Command line options
 // nolint: maligned
 type Config struct {
-	DryRun                 bool     `json:"DRY_RUN"`
-	ProxyUID               string   `json:"PROXY_UID"`
-	ProxyGID               string   `json:"PROXY_GID"`
-	RedirectDNS            bool     `json:"REDIRECT_DNS"`
-	RedirectAllDNSTraffic  bool     `json:"REDIRECT_ALL_DNS_TRAFFIC"`
-	DNSServersV4           []string `json:"DNS_SERVERS_V4"`
-	DNSServersV6           []string `json:"DNS_SERVERS_V6"`
-	AgentDNSListenerPort   string   `json:"AGENT_DNS_LISTENER_PORT"`
-	DNSUpstreamTargetChain string   `json:"DNS_UPSTREAM_TARGET_CHAIN"`
+	DryRun                    bool     `json:"DRY_RUN"`
+	ProxyUID                  string   `json:"PROXY_UID"`
+	ProxyGID                  string   `json:"PROXY_GID"`
+	RedirectDNS               bool     `json:"REDIRECT_DNS"`
+	RedirectAllDNSTraffic     bool     `json:"REDIRECT_ALL_DNS_TRAFFIC"`
+	DNSServersV4              []string `json:"DNS_SERVERS_V4"`
+	DNSServersV6              []string `json:"DNS_SERVERS_V6"`
+	AgentDNSListenerPort      string   `json:"AGENT_DNS_LISTENER_PORT"`
+	DNSUpstreamTargetChain    string   `json:"DNS_UPSTREAM_TARGET_CHAIN"`
+	SkipDNSConntrackZoneSplit bool     `json:"SKIP_DNS_CONNTRACK_ZONE_SPLIT"`
 }
 
 func (c *Config) String() string {
@@ -51,5 +52,6 @@ func (c *Config) Print() {
 	fmt.Printf("DNS_SERVERS=%s,%s\n", c.DNSServersV4, c.DNSServersV6)
 	fmt.Printf("AGENT_DNS_LISTENER_PORT=%s\n", c.AgentDNSListenerPort)
 	fmt.Printf("DNS_UPSTREAM_TARGET_CHAIN=%s\n", c.DNSUpstreamTargetChain)
+	fmt.Printf("SKIP_DNS_CONNTRACK_ZONE_SPLIT=%t\n", c.SkipDNSConntrackZoneSplit)
 	fmt.Println("")
 }
diff --git a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/root.go b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/root.go
index b8990ae23..f991a0d55 100644
--- a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/root.go
+++ b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/root.go
@@ -26,7 +26,6 @@ import (
 	"github.com/miekg/dns"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
-
 	"istio.io/pkg/env"
 
 	"github.com/kumahq/kuma/pkg/transparentproxy/istio/tools/istio-iptables/pkg/config"
@@ -77,32 +76,33 @@ var rootCmd = &cobra.Command{
 
 func constructConfig() *config.Config {
 	cfg := &config.Config{
-		DryRun:                  viper.GetBool(constants.DryRun),
-		RestoreFormat:           viper.GetBool(constants.RestoreFormat),
-		ProxyPort:               viper.GetString(constants.EnvoyPort),
-		InboundCapturePort:      viper.GetString(constants.InboundCapturePort),
-		InboundCapturePortV6:    viper.GetString(constants.InboundCapturePortV6),
-		InboundTunnelPort:       viper.GetString(constants.InboundTunnelPort),
-		ProxyUID:                viper.GetString(constants.ProxyUID),
-		ProxyGID:                viper.GetString(constants.ProxyGID),
-		InboundInterceptionMode: viper.GetString(constants.InboundInterceptionMode),
-		InboundTProxyMark:       viper.GetString(constants.InboundTProxyMark),
-		InboundTProxyRouteTable: viper.GetString(constants.InboundTProxyRouteTable),
-		InboundPortsInclude:     viper.GetString(constants.InboundPorts),
-		InboundPortsExclude:     viper.GetString(constants.LocalExcludePorts),
-		OutboundPortsInclude:    viper.GetString(constants.OutboundPorts),
-		OutboundPortsExclude:    viper.GetString(constants.LocalOutboundPortsExclude),
-		OutboundIPRangesInclude: viper.GetString(constants.ServiceCidr),
-		OutboundIPRangesExclude: viper.GetString(constants.ServiceExcludeCidr),
-		KubevirtInterfaces:      viper.GetString(constants.KubeVirtInterfaces),
-		IptablesProbePort:       uint16(viper.GetUint(constants.IptablesProbePort)),
-		ProbeTimeout:            viper.GetDuration(constants.ProbeTimeout),
-		SkipRuleApply:           viper.GetBool(constants.SkipRuleApply),
-		RunValidation:           viper.GetBool(constants.RunValidation),
-		RedirectDNS:             viper.GetBool(constants.RedirectDNS),
-		RedirectAllDNSTraffic:   viper.GetBool(constants.RedirectAllDNSTraffic),
-		AgentDNSListenerPort:    viper.GetString(constants.AgentDNSListenerPort),
-		DNSUpstreamTargetChain:  viper.GetString(constants.DNSUpstreamTargetChain),
+		DryRun:                    viper.GetBool(constants.DryRun),
+		RestoreFormat:             viper.GetBool(constants.RestoreFormat),
+		ProxyPort:                 viper.GetString(constants.EnvoyPort),
+		InboundCapturePort:        viper.GetString(constants.InboundCapturePort),
+		InboundCapturePortV6:      viper.GetString(constants.InboundCapturePortV6),
+		InboundTunnelPort:         viper.GetString(constants.InboundTunnelPort),
+		ProxyUID:                  viper.GetString(constants.ProxyUID),
+		ProxyGID:                  viper.GetString(constants.ProxyGID),
+		InboundInterceptionMode:   viper.GetString(constants.InboundInterceptionMode),
+		InboundTProxyMark:         viper.GetString(constants.InboundTProxyMark),
+		InboundTProxyRouteTable:   viper.GetString(constants.InboundTProxyRouteTable),
+		InboundPortsInclude:       viper.GetString(constants.InboundPorts),
+		InboundPortsExclude:       viper.GetString(constants.LocalExcludePorts),
+		OutboundPortsInclude:      viper.GetString(constants.OutboundPorts),
+		OutboundPortsExclude:      viper.GetString(constants.LocalOutboundPortsExclude),
+		OutboundIPRangesInclude:   viper.GetString(constants.ServiceCidr),
+		OutboundIPRangesExclude:   viper.GetString(constants.ServiceExcludeCidr),
+		KubevirtInterfaces:        viper.GetString(constants.KubeVirtInterfaces),
+		IptablesProbePort:         uint16(viper.GetUint(constants.IptablesProbePort)),
+		ProbeTimeout:              viper.GetDuration(constants.ProbeTimeout),
+		SkipRuleApply:             viper.GetBool(constants.SkipRuleApply),
+		RunValidation:             viper.GetBool(constants.RunValidation),
+		RedirectDNS:               viper.GetBool(constants.RedirectDNS),
+		RedirectAllDNSTraffic:     viper.GetBool(constants.RedirectAllDNSTraffic),
+		AgentDNSListenerPort:      viper.GetString(constants.AgentDNSListenerPort),
+		DNSUpstreamTargetChain:    viper.GetString(constants.DNSUpstreamTargetChain),
+		SkipDNSConntrackZoneSplit: viper.GetBool(constants.SkipDNSConntrackZoneSplit),
 	}
 
 	// TODO: Make this more configurable, maybe with an allowlist of users to be captured for output instead of a denylist.
@@ -346,6 +346,11 @@ func bindFlags(cmd *cobra.Command, args []string) {
 		handleError(err)
 	}
 	viper.SetDefault(constants.DNSUpstreamTargetChain, constants.RETURN)
+
+	if err := viper.BindPFlag(constants.SkipDNSConntrackZoneSplit, cmd.Flags().Lookup(constants.SkipDNSConntrackZoneSplit)); err != nil {
+		handleError(err)
+	}
+	viper.SetDefault(constants.SkipDNSConntrackZoneSplit, false)
 }
 
 // https://github.com/spf13/viper/issues/233.
@@ -420,6 +425,8 @@ func init() {
 	rootCmd.Flags().String(constants.AgentDNSListenerPort, constants.IstioAgentDNSListenerPort, "set listen port for DNS agent")
 
 	rootCmd.Flags().String(constants.DNSUpstreamTargetChain, constants.RETURN, "(optional) the iptables chain where the upstream DNS requests should be directed to. It is only applied for IP V4. Use with care.")
+
+	rootCmd.Flags().String(constants.SkipDNSConntrackZoneSplit, constants.RETURN, "Skip applying conntrack zone splitting iptables rules")
 }
 
 func GetCommand() *cobra.Command {
diff --git a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run.go b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run.go
index 43515e127..17cba6ab9 100644
--- a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run.go
+++ b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run.go
@@ -126,6 +126,7 @@ func (iptConfigurator *IptablesConfigurator) logConfig() {
 	fmt.Printf("ISTIO_SERVICE_CIDR=%s\n", os.Getenv("ISTIO_SERVICE_CIDR"))
 	fmt.Printf("ISTIO_SERVICE_EXCLUDE_CIDR=%s\n", os.Getenv("ISTIO_SERVICE_EXCLUDE_CIDR"))
 	fmt.Printf("ISTIO_META_DNS_CAPTURE=%s\n", os.Getenv("ISTIO_META_DNS_CAPTURE"))
+	fmt.Printf("SKIP_CONNTRACK_ZONE_SPLIT=%s\n", os.Getenv("SKIP_CONNTRACK_ZONE_SPLIT"))
 	fmt.Println("")
 	iptConfigurator.cfg.Print()
 }
@@ -222,7 +223,7 @@ func (iptConfigurator *IptablesConfigurator) handleInboundIpv6Rules(ipv6RangesEx
 	// Use this chain also for redirecting inbound traffic to the common Envoy port
 	// when not using TPROXY.
 	iptConfigurator.iptables.AppendRuleV6(constants.ISTIOINREDIRECT, constants.NAT, "-p", constants.TCP, "-j",
-		constants.REDIRECT, "--to-ports", iptConfigurator.cfg.InboundCapturePortV6) //Kuma changed
+		constants.REDIRECT, "--to-ports", iptConfigurator.cfg.InboundCapturePortV6) // Kuma changed
 
 	// Handling of inbound ports. Traffic will be redirected to Envoy, which will process and forward
 	// to the local service. If not set, no inbound port will be intercepted by istio iptablesOrFail.
@@ -572,7 +573,9 @@ func (iptConfigurator *IptablesConfigurator) run() {
 			iptConfigurator.cfg.AgentDNSListenerPort,
 			iptConfigurator.cfg.DNSUpstreamTargetChain,
 			iptConfigurator.cfg.ProxyUID, iptConfigurator.cfg.ProxyGID,
-			iptConfigurator.cfg.DNSServersV4)
+			iptConfigurator.cfg.DNSServersV4,
+			iptConfigurator.cfg.RedirectAllDNSTraffic,
+			iptConfigurator.cfg.SkipDNSConntrackZoneSplit)
 
 		if iptConfigurator.cfg.EnableInboundIPv6 {
 			HandleDNSUDPv6(
@@ -602,7 +605,8 @@ func (iptConfigurator *IptablesConfigurator) run() {
 // This helps the creation logic of DNS UDP rules in sync with the deletion.
 func HandleDNSUDP(
 	ops Ops, iptables *builder.IptablesBuilderImpl, ext dep.Dependencies,
-	cmd, agentDNSListenerPort, dnsUpstreamTargetChain, proxyUID, proxyGID string, dnsServersV4 []string) {
+	cmd, agentDNSListenerPort, dnsUpstreamTargetChain, proxyUID, proxyGID string, dnsServersV4 []string,
+	captureAllDNS bool, skipDNSConntrackZoneSplit bool) {
 	const paramIdxRaw = 4
 	var raw []string
 	opsStr := opsToString[ops]
@@ -668,10 +672,137 @@ func HandleDNSUDP(
 			ext.RunQuietlyAndIgnore(cmd, raw...)
 		}
 	}
+
+	if !skipDNSConntrackZoneSplit {
+		// Split UDP DNS traffic to separate conntrack zones
+		addConntrackZoneDNSUDP(ops, iptables, ext, cmd, proxyUID, proxyGID, dnsServersV4, captureAllDNS, agentDNSListenerPort)
+	}
 }
 
 // kuma changes start
 
+// addConntrackZoneDNSUDP is a helper function to add iptables rules to split DNS traffic
+// in two separate conntrack zones to avoid issues with UDP conntrack race conditions.
+// Traffic that goes from istio to DNS servers and vice versa are zone 1 and traffic from
+// DNS client to istio and vice versa goes to zone 2
+func addConntrackZoneDNSUDP(
+	ops Ops, iptables *builder.IptablesBuilderImpl, ext dep.Dependencies,
+	cmd, proxyUID, proxyGID string, dnsServersV4 []string, captureAllDNS bool, agentDNSListenerPort string) {
+	const paramIdxRaw = 4
+	var raw []string
+	opsStr := opsToString[ops]
+	table := constants.RAW
+	chainOUTPUT := constants.OUTPUT
+	chainPREROUTING := constants.PREROUTING
+
+	// TODO: add ip6 as well
+	for _, uid := range split(proxyUID) {
+		// Packets with dst port 53 from istio to zone 1. These are Istio calls to upstream resolvers
+		raw = []string{
+			"-t", table, opsStr, chainOUTPUT,
+			"-p", "udp", "--dport", "53", "-m", "owner", "--uid-owner", uid, "-j", constants.CT, "--zone", "1",
+		}
+		switch ops {
+		case AppendOps:
+			iptables.AppendRuleV4(chainOUTPUT, table, raw[paramIdxRaw:]...)
+		case DeleteOps:
+			ext.RunQuietlyAndIgnore(cmd, raw...)
+		}
+		// Packets with src port 15053 from istio to zone 2. These are Istio response packets to application clients
+		raw = []string{
+			"-t", table, opsStr, chainOUTPUT,
+			"-p", "udp", "--sport", agentDNSListenerPort, "-m", "owner", "--uid-owner", uid, "-j", constants.CT, "--zone", "2",
+		}
+		switch ops {
+		case AppendOps:
+			iptables.AppendRuleV4(chainOUTPUT, table, raw[paramIdxRaw:]...)
+		case DeleteOps:
+			ext.RunQuietlyAndIgnore(cmd, raw...)
+		}
+	}
+	for _, gid := range split(proxyGID) {
+		// Packets with dst port 53 from istio to zone 1. These are Istio calls to upstream resolvers
+		raw = []string{
+			"-t", table, opsStr, chainOUTPUT,
+			"-p", "udp", "--dport", "53", "-m", "owner", "--gid-owner", gid, "-j", constants.CT, "--zone", "1",
+		}
+		switch ops {
+		case AppendOps:
+			iptables.AppendRuleV4(chainOUTPUT, table, raw[paramIdxRaw:]...)
+		case DeleteOps:
+			ext.RunQuietlyAndIgnore(cmd, raw...)
+		}
+		// Packets with src port 15053 from istio to zone 2. These are Istio response packets to application clients
+		raw = []string{
+			"-t", table, opsStr, chainOUTPUT,
+			"-p", "udp", "--sport", agentDNSListenerPort, "-m", "owner", "--gid-owner", gid, "-j", constants.CT, "--zone", "2",
+		}
+		switch ops {
+		case AppendOps:
+			iptables.AppendRuleV4(chainOUTPUT, table, raw[paramIdxRaw:]...)
+		case DeleteOps:
+			ext.RunQuietlyAndIgnore(cmd, raw...)
+		}
+	}
+
+	if captureAllDNS {
+		// Not specifying destination address is useful for the CNI case where pod DNS server address cannot be decided.
+
+		// Mark all UDP dns traffic with dst port 53 as zone 2. These are application client packets towards DNS resolvers.
+		raw = []string{
+			"-t", table, opsStr, chainOUTPUT,
+			"-p", "udp", "--dport", "53",
+			"-j", constants.CT, "--zone", "2",
+		}
+		switch ops {
+		case AppendOps:
+			iptables.AppendRuleV4(chainOUTPUT, table, raw[paramIdxRaw:]...)
+		case DeleteOps:
+			ext.RunQuietlyAndIgnore(cmd, raw...)
+		}
+		// Mark all UDP dns traffic with src port 53 as zone 1. These are response packets from the DNS resolvers.
+		raw = []string{
+			"-t", table, opsStr, chainPREROUTING,
+			"-p", "udp", "--sport", "53",
+			"-j", constants.CT, "--zone", "1",
+		}
+		switch ops {
+		case AppendOps:
+			iptables.AppendRuleV4(chainPREROUTING, table, raw[paramIdxRaw:]...)
+		case DeleteOps:
+			ext.RunQuietlyAndIgnore(cmd, raw...)
+		}
+	} else {
+		// Go through all DNS servers in etc/resolv.conf and mark the packets based on these destination addresses.
+		for _, s := range dnsServersV4 {
+			// Mark all UDP dns traffic with dst port 53 as zone 2. These are application client packets towards DNS resolvers.
+			raw = []string{
+				"-t", table, opsStr, chainOUTPUT,
+				"-p", "udp", "--dport", "53", "-d", s + "/32",
+				"-j", constants.CT, "--zone", "2",
+			}
+			switch ops {
+			case AppendOps:
+				iptables.AppendRuleV4(chainOUTPUT, table, raw[paramIdxRaw:]...)
+			case DeleteOps:
+				ext.RunQuietlyAndIgnore(cmd, raw...)
+			}
+			// Mark all UDP dns traffic with src port 53 as zone 1. These are response packets from the DNS resolvers.
+			raw = []string{
+				"-t", table, opsStr, chainPREROUTING,
+				"-p", "udp", "--sport", "53", "-d", s + "/32",
+				"-j", constants.CT, "--zone", "1",
+			}
+			switch ops {
+			case AppendOps:
+				iptables.AppendRuleV4(chainPREROUTING, table, raw[paramIdxRaw:]...)
+			case DeleteOps:
+				ext.RunQuietlyAndIgnore(cmd, raw...)
+			}
+		}
+	}
+}
+
 // HandleDNSUDPv6 is a IPv6 helper function to tackle with DNS UDP specific operations.
 // This helps the creation logic of DNS UDP rules in sync with the deletion.
 func HandleDNSUDPv6(
@@ -820,6 +951,5 @@ func (iptConfigurator *IptablesConfigurator) executeCommands() {
 		iptConfigurator.executeIptablesCommands(iptConfigurator.iptables.BuildV4())
 		// Execute ip6tables commands
 		iptConfigurator.executeIptablesCommands(iptConfigurator.iptables.BuildV6())
-
 	}
 }
diff --git a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/config/config.go b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/config/config.go
index 3e06e5a59..4cf146f55 100644
--- a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/config/config.go
+++ b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/config/config.go
@@ -23,35 +23,36 @@ import (
 // Command line options
 // nolint: maligned
 type Config struct {
-	ProxyPort               string        `json:"PROXY_PORT"`
-	InboundCapturePort      string        `json:"INBOUND_CAPTURE_PORT"`
-	InboundCapturePortV6    string        `json:"INBOUND_CAPTURE_PORT_V6"`
-	InboundTunnelPort       string        `json:"INBOUND_TUNNEL_PORT"`
-	ProxyUID                string        `json:"PROXY_UID"`
-	ProxyGID                string        `json:"PROXY_GID"`
-	InboundInterceptionMode string        `json:"INBOUND_INTERCEPTION_MODE"`
-	InboundTProxyMark       string        `json:"INBOUND_TPROXY_MARK"`
-	InboundTProxyRouteTable string        `json:"INBOUND_TPROXY_ROUTE_TABLE"`
-	InboundPortsInclude     string        `json:"INBOUND_PORTS_INCLUDE"`
-	InboundPortsExclude     string        `json:"INBOUND_PORTS_EXCLUDE"`
-	OutboundPortsInclude    string        `json:"OUTBOUND_PORTS_INCLUDE"`
-	OutboundPortsExclude    string        `json:"OUTBOUND_PORTS_EXCLUDE"`
-	OutboundIPRangesInclude string        `json:"OUTBOUND_IPRANGES_INCLUDE"`
-	OutboundIPRangesExclude string        `json:"OUTBOUND_IPRANGES_EXCLUDE"`
-	KubevirtInterfaces      string        `json:"KUBEVIRT_INTERFACES"`
-	IptablesProbePort       uint16        `json:"IPTABLES_PROBE_PORT"`
-	ProbeTimeout            time.Duration `json:"PROBE_TIMEOUT"`
-	DryRun                  bool          `json:"DRY_RUN"`
-	RestoreFormat           bool          `json:"RESTORE_FORMAT"`
-	SkipRuleApply           bool          `json:"SKIP_RULE_APPLY"`
-	RunValidation           bool          `json:"RUN_VALIDATION"`
-	RedirectDNS             bool          `json:"REDIRECT_DNS"`
-	RedirectAllDNSTraffic   bool          `json:"REDIRECT_ALL_DNS_TRAFFIC"`
-	EnableInboundIPv6       bool          `json:"ENABLE_INBOUND_IPV6"`
-	DNSServersV4            []string      `json:"DNS_SERVERS_V4"`
-	DNSServersV6            []string      `json:"DNS_SERVERS_V6"`
-	AgentDNSListenerPort    string        `json:"AGENT_DNS_LISTENER_PORT"`
-	DNSUpstreamTargetChain  string        `json:"DNS_UPSTREAM_TARGET_CHAIN"`
+	ProxyPort                 string        `json:"PROXY_PORT"`
+	InboundCapturePort        string        `json:"INBOUND_CAPTURE_PORT"`
+	InboundCapturePortV6      string        `json:"INBOUND_CAPTURE_PORT_V6"`
+	InboundTunnelPort         string        `json:"INBOUND_TUNNEL_PORT"`
+	ProxyUID                  string        `json:"PROXY_UID"`
+	ProxyGID                  string        `json:"PROXY_GID"`
+	InboundInterceptionMode   string        `json:"INBOUND_INTERCEPTION_MODE"`
+	InboundTProxyMark         string        `json:"INBOUND_TPROXY_MARK"`
+	InboundTProxyRouteTable   string        `json:"INBOUND_TPROXY_ROUTE_TABLE"`
+	InboundPortsInclude       string        `json:"INBOUND_PORTS_INCLUDE"`
+	InboundPortsExclude       string        `json:"INBOUND_PORTS_EXCLUDE"`
+	OutboundPortsInclude      string        `json:"OUTBOUND_PORTS_INCLUDE"`
+	OutboundPortsExclude      string        `json:"OUTBOUND_PORTS_EXCLUDE"`
+	OutboundIPRangesInclude   string        `json:"OUTBOUND_IPRANGES_INCLUDE"`
+	OutboundIPRangesExclude   string        `json:"OUTBOUND_IPRANGES_EXCLUDE"`
+	KubevirtInterfaces        string        `json:"KUBEVIRT_INTERFACES"`
+	IptablesProbePort         uint16        `json:"IPTABLES_PROBE_PORT"`
+	ProbeTimeout              time.Duration `json:"PROBE_TIMEOUT"`
+	DryRun                    bool          `json:"DRY_RUN"`
+	RestoreFormat             bool          `json:"RESTORE_FORMAT"`
+	SkipRuleApply             bool          `json:"SKIP_RULE_APPLY"`
+	RunValidation             bool          `json:"RUN_VALIDATION"`
+	RedirectDNS               bool          `json:"REDIRECT_DNS"`
+	RedirectAllDNSTraffic     bool          `json:"REDIRECT_ALL_DNS_TRAFFIC"`
+	EnableInboundIPv6         bool          `json:"ENABLE_INBOUND_IPV6"`
+	DNSServersV4              []string      `json:"DNS_SERVERS_V4"`
+	DNSServersV6              []string      `json:"DNS_SERVERS_V6"`
+	AgentDNSListenerPort      string        `json:"AGENT_DNS_LISTENER_PORT"`
+	DNSUpstreamTargetChain    string        `json:"DNS_UPSTREAM_TARGET_CHAIN"`
+	SkipDNSConntrackZoneSplit bool          `json:"SKIP_DNS_CONNTRACK_ZONE_SPLIT"`
 }
 
 func (c *Config) String() string {
@@ -87,5 +88,6 @@ func (c *Config) Print() {
 	fmt.Printf("DNS_SERVERS=%s,%s\n", c.DNSServersV4, c.DNSServersV6)
 	fmt.Printf("AGENT_DNS_LISTENER_PORT=%s\n", c.AgentDNSListenerPort)
 	fmt.Printf("DNS_UPSTREAM_TARGET_CHAIN=%s\n", c.DNSUpstreamTargetChain)
+	fmt.Printf("SKIP_DNS_CONNTRACK_ZONE_SPLIT=%t\n", c.SkipDNSConntrackZoneSplit)
 	fmt.Println("")
 }
diff --git a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/constants/constants.go b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/constants/constants.go
index 72994464a..bcfae2ef5 100644
--- a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/constants/constants.go
+++ b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/constants/constants.go
@@ -21,6 +21,7 @@ const (
 	MANGLE = "mangle"
 	NAT    = "nat"
 	FILTER = "filter"
+	RAW    = "raw"
 )
 
 // Built-in iptables chains
@@ -51,6 +52,7 @@ const (
 	REJECT   = "REJECT"
 	REDIRECT = "REDIRECT"
 	MARK     = "MARK"
+	CT       = "CT"
 )
 
 // iptables chains
@@ -92,6 +94,7 @@ const (
 	RedirectAllDNSTraffic     = "redirect-all-dns-traffic"
 	AgentDNSListenerPort      = "agent-dns-listener-port"
 	DNSUpstreamTargetChain    = "dns-upstream-target-chain"
+	SkipDNSConntrackZoneSplit = "skip-dns-conntrack-zone-split"
 )
 
 const (
diff --git a/pkg/xds/envoy/secrets/v3/ca_secret.go b/pkg/xds/envoy/secrets/v3/ca_secret.go
index 8cefdec5b..c1dfc18f8 100644
--- a/pkg/xds/envoy/secrets/v3/ca_secret.go
+++ b/pkg/xds/envoy/secrets/v3/ca_secret.go
@@ -7,12 +7,13 @@ import (
 	envoy_auth "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
+	"github.com/kumahq/kuma/pkg/xds/envoy/names"
 	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
-func CreateCaSecret(secret *core_xds.CaSecret) *envoy_auth.Secret {
+func CreateCaSecret(secret *core_xds.CaSecret, mesh string) *envoy_auth.Secret {
 	return &envoy_auth.Secret{
-		Name: tls.MeshCaResource,
+		Name: names.GetSecretName(tls.MeshCaResource, "secret", mesh),
 		Type: &envoy_auth.Secret_ValidationContext{
 			ValidationContext: &envoy_auth.CertificateValidationContext{
 				TrustedCa: &envoy_core.DataSource{
diff --git a/pkg/xds/envoy/secrets/v3/identity_secret.go b/pkg/xds/envoy/secrets/v3/identity_secret.go
index 8a62a697f..6c671fd05 100644
--- a/pkg/xds/envoy/secrets/v3/identity_secret.go
+++ b/pkg/xds/envoy/secrets/v3/identity_secret.go
@@ -7,12 +7,13 @@ import (
 	envoy_auth "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
+	"github.com/kumahq/kuma/pkg/xds/envoy/names"
 	"github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
-func CreateIdentitySecret(secret *core_xds.IdentitySecret) *envoy_auth.Secret {
+func CreateIdentitySecret(secret *core_xds.IdentitySecret, mesh string) *envoy_auth.Secret {
 	return &envoy_auth.Secret{
-		Name: tls.IdentityCertResource,
+		Name: names.GetSecretName(tls.IdentityCertResource, "secret", mesh),
 		Type: &envoy_auth.Secret_TlsCertificate{
 			TlsCertificate: &envoy_auth.TlsCertificate{
 				CertificateChain: &envoy_core.DataSource{
diff --git a/pkg/xds/envoy/tls/v3/tls.go b/pkg/xds/envoy/tls/v3/tls.go
index bcdacc4ca..361e54e28 100644
--- a/pkg/xds/envoy/tls/v3/tls.go
+++ b/pkg/xds/envoy/tls/v3/tls.go
@@ -8,6 +8,7 @@ import (
 	"github.com/kumahq/kuma/pkg/tls"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
+	"github.com/kumahq/kuma/pkg/xds/envoy/names"
 	xds_tls "github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
@@ -19,7 +20,7 @@ func CreateDownstreamTlsContext(ctx xds_context.Context) (*envoy_tls.DownstreamT
 		return nil, nil
 	}
 	validationSANMatcher := MeshSpiffeIDPrefixMatcher(ctx.Mesh.Resource.Meta.GetName())
-	commonTlsContext, err := createCommonTlsContext(validationSANMatcher)
+	commonTlsContext, err := createCommonTlsContext(ctx, validationSANMatcher)
 	if err != nil {
 		return nil, err
 	}
@@ -46,7 +47,7 @@ func CreateUpstreamTlsContext(ctx xds_context.Context, upstreamService string, s
 	} else {
 		validationSANMatcher = ServiceSpiffeIDMatcher(ctx.Mesh.Resource.Meta.GetName(), upstreamService)
 	}
-	commonTlsContext, err := createCommonTlsContext(validationSANMatcher)
+	commonTlsContext, err := createCommonTlsContext(ctx, validationSANMatcher)
 	if err != nil {
 		return nil, err
 	}
@@ -57,9 +58,14 @@ func CreateUpstreamTlsContext(ctx xds_context.Context, upstreamService string, s
 	}, nil
 }
 
-func createCommonTlsContext(validationSANMatcher *envoy_type_matcher.StringMatcher) (*envoy_tls.CommonTlsContext, error) {
-	meshCaSecret := NewSecretConfigSource(xds_tls.MeshCaResource)
-	identitySecret := NewSecretConfigSource(xds_tls.IdentityCertResource)
+func createCommonTlsContext(
+	ctx xds_context.Context,
+	validationSANMatcher *envoy_type_matcher.StringMatcher,
+) (*envoy_tls.CommonTlsContext, error) {
+	meshName := ctx.Mesh.Resource.GetMeta().GetName()
+	meshCaSecret := NewSecretConfigSource(names.GetSecretName(xds_tls.MeshCaResource, "secret", meshName))
+	identitySecret := NewSecretConfigSource(names.GetSecretName(xds_tls.IdentityCertResource, "secret", meshName))
+
 	return &envoy_tls.CommonTlsContext{
 		ValidationContextType: &envoy_tls.CommonTlsContext_CombinedValidationContext{
 			CombinedValidationContext: &envoy_tls.CommonTlsContext_CombinedCertificateValidationContext{
diff --git a/pkg/xds/generator/secrets_generator.go b/pkg/xds/generator/secrets_generator.go
index 05cf1b094..b9e77fcf6 100644
--- a/pkg/xds/generator/secrets_generator.go
+++ b/pkg/xds/generator/secrets_generator.go
@@ -1,6 +1,7 @@
 package generator
 
 import (
+	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_secrets "github.com/kumahq/kuma/pkg/xds/envoy/secrets/v3"
@@ -14,29 +15,55 @@ type SecretsProxyGenerator struct {
 
 var _ ResourceGenerator = SecretsProxyGenerator{}
 
-func (s SecretsProxyGenerator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
-	if !ctx.Mesh.Resource.MTLSEnabled() {
-		return nil, nil
-	}
-	identity, ca, err := ctx.ControlPlane.Secrets.Get(proxy.Dataplane, ctx.Mesh.Resource)
-	if err != nil {
-		return nil, err
+func createSecrets(
+	ctx xds_context.Context,
+	proxy *core_xds.Proxy,
+	meshes []*core_mesh.MeshResource,
+) (*core_xds.ResourceSet, error) {
+	var resources *core_xds.ResourceSet
+
+	for _, mesh := range meshes {
+		if !mesh.MTLSEnabled() {
+			continue
+		}
+
+		if resources == nil {
+			resources = core_xds.NewResourceSet()
+		}
+
+		identity, ca, err := ctx.ControlPlane.Secrets.Get(proxy.Dataplane, mesh)
+		if err != nil {
+			return nil, err
+		}
+
+		meshName := mesh.GetMeta().GetName()
+		identitySecret := envoy_secrets.CreateIdentitySecret(identity, meshName)
+		caSecret := envoy_secrets.CreateCaSecret(ca, meshName)
+
+		resources.Add(
+			&core_xds.Resource{
+				Name:     identitySecret.Name,
+				Origin:   OriginSecrets,
+				Resource: identitySecret,
+			},
+			&core_xds.Resource{
+				Name:     caSecret.Name,
+				Origin:   OriginSecrets,
+				Resource: caSecret,
+			},
+		)
 	}
 
-	resources := core_xds.NewResourceSet()
-	identitySecret := envoy_secrets.CreateIdentitySecret(identity)
-	caSecret := envoy_secrets.CreateCaSecret(ca)
-	resources.Add(
-		&core_xds.Resource{
-			Name:     identitySecret.Name,
-			Origin:   OriginSecrets,
-			Resource: identitySecret,
-		},
-		&core_xds.Resource{
-			Name:     caSecret.Name,
-			Origin:   OriginSecrets,
-			Resource: caSecret,
-		},
-	)
 	return resources, nil
 }
+
+func (s SecretsProxyGenerator) Generate(
+	ctx xds_context.Context,
+	proxy *core_xds.Proxy,
+) (*core_xds.ResourceSet, error) {
+	if proxy.ZoneEgressProxy != nil {
+		return createSecrets(ctx, proxy, proxy.ZoneEgressProxy.Meshes.Items)
+	}
+
+	return createSecrets(ctx, proxy, []*core_mesh.MeshResource{ctx.Mesh.Resource})
+}


Test patch:
diff --git a/app/kumactl/cmd/completion/testdata/bash.golden b/app/kumactl/cmd/completion/testdata/bash.golden
index f45d1e6e4..a03d30830 100644
--- a/app/kumactl/cmd/completion/testdata/bash.golden
+++ b/app/kumactl/cmd/completion/testdata/bash.golden
@@ -3259,6 +3259,8 @@ _kumactl_install_transparent-proxy()
     two_word_flags+=("--redirect-outbound-port")
     local_nonpersistent_flags+=("--redirect-outbound-port")
     local_nonpersistent_flags+=("--redirect-outbound-port=")
+    flags+=("--skip-dns-conntrack-zone-split")
+    local_nonpersistent_flags+=("--skip-dns-conntrack-zone-split")
     flags+=("--skip-resolv-conf")
     local_nonpersistent_flags+=("--skip-resolv-conf")
     flags+=("--store-firewalld")
diff --git a/app/kumactl/cmd/install/install_transparent_proxy_test.go b/app/kumactl/cmd/install/install_transparent_proxy_test.go
index 53fea198f..af60d4bcb 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy_test.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy_test.go
@@ -69,7 +69,7 @@ var _ = Describe("kumactl install tracing", func() {
 			},
 			goldenFile: "install-transparent-proxy.defaults.golden.txt",
 		}),
-		Entry("should generate defaults with user id and DNS redirected ", testCase{
+		Entry("should generate defaults with user id and DNS redirected", testCase{
 			extraArgs: []string{
 				"--kuma-dp-uid", "0",
 				"--kuma-cp-ip", "1.2.3.4",
@@ -80,6 +80,18 @@ var _ = Describe("kumactl install tracing", func() {
 			},
 			goldenFile: "install-transparent-proxy.dns.golden.txt",
 		}),
+		Entry("should generate defaults with user id and DNS redirected without conntrack zone splitting", testCase{
+			extraArgs: []string{
+				"--kuma-dp-uid", "0",
+				"--kuma-cp-ip", "1.2.3.4",
+				"--skip-resolv-conf",
+				"--redirect-all-dns-traffic",
+				"--redirect-dns-port", "12345",
+				"--redirect-dns-upstream-target-chain", "DOCKER_OUTPUT",
+				"--skip-dns-conntrack-zone-split",
+			},
+			goldenFile: "install-transparent-proxy.dns.golden.txt",
+		}),
 		Entry("should generate defaults with overrides", testCase{
 			extraArgs: []string{
 				"--kuma-dp-user", "root",
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index 00d975cf8..10f304683 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -150,6 +150,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index 291023f75..2f0370e16 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -158,6 +158,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index f17ab7b5a..3262bce28 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -212,6 +212,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   nodeSelector:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index 53fe6b6f9..c1559ff73 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -150,6 +150,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index 87de6af12..0f9451d2c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -143,6 +143,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
 status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index 8eca4e06f..883138e07 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -151,6 +151,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index 00d975cf8..10f304683 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -150,6 +150,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index 3f12102ca..fd8f82391 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -153,6 +153,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index 4e8ebeee7..b7235b034 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -152,6 +152,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index e3e6108c2..20371a222 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -151,6 +151,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index 65d7ac47e..629a47f88 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -150,6 +150,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 621e5ed42..d8f9fcef9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -150,6 +150,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
index 13f5fc31c..62849a84a 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
@@ -162,6 +162,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
index e5cab1049..4455bcebd 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
@@ -162,6 +162,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
index c36a033f6..bc396a5f6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
@@ -162,6 +162,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
index 553cfd494..cf87e1fa8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -159,6 +159,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
index de50dec80..70c2b83b5 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -159,6 +159,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
index 7b78f27e6..2a0578036 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -159,6 +159,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
index c36a033f6..bc396a5f6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
@@ -162,6 +162,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
index 13f5fc31c..62849a84a 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
@@ -162,6 +162,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
index 3ba1a76a1..63181cb33 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
@@ -167,6 +167,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
index 26fc2c96b..899439609 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
@@ -163,6 +163,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
index 4c58251cd..f395ac025 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
@@ -174,6 +174,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
index bcbb2c9ab..a4b54cd58 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
@@ -175,6 +175,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
index 86f84564c..c910fae54 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
@@ -174,6 +174,7 @@ spec:
       capabilities:
         add:
         - NET_ADMIN
+        - NET_RAW
       runAsGroup: 0
       runAsUser: 0
   volumes:
diff --git a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run_test.go b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run_test.go
index a605a95ae..f27db8682 100644
--- a/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run_test.go
+++ b/pkg/transparentproxy/istio/tools/istio-iptables/pkg/cmd/run_test.go
@@ -160,6 +160,16 @@ func TestRulesWithIpRange(t *testing.T) {
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2",
+		"iptables -t raw -A PREROUTING -p udp --sport 53 -d 127.0.0.53/32 -j CT --zone 1",
 	}
 	if !reflect.DeepEqual(actual, expected) {
 		t.Errorf("Output mismatch. Expected: \n%#v ; Actual: \n%#v", expected, actual)
@@ -215,6 +225,12 @@ func TestRulesWithTproxy(t *testing.T) {
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2",
+		"iptables -t raw -A PREROUTING -p udp --sport 53 -d 127.0.0.53/32 -j CT --zone 1",
 		"iptables -t mangle -A PREROUTING -p tcp -m mark --mark 1337 -j CONNMARK --save-mark",
 		"iptables -t mangle -A OUTPUT -p tcp -m connmark --mark 1337 -j CONNMARK --restore-mark",
 		"iptables -t mangle -I MESH_INBOUND 1 -p tcp -m mark --mark 1337 -j RETURN",
@@ -716,6 +732,16 @@ func TestHandleInboundIpv4RulesWithUidGid(t *testing.T) {
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2",
+		"iptables -t raw -A PREROUTING -p udp --sport 53 -d 127.0.0.53/32 -j CT --zone 1",
 	}
 
 	if !reflect.DeepEqual(actual, expected) {
@@ -800,6 +826,16 @@ func TestRulesWithLoopbackIpInOutboundIpRanges(t *testing.T) {
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j RETURN",
 		"iptables -t nat -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j REDIRECT --to-port 15053",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 3 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 3 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --uid-owner 4 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --uid-owner 4 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1",
+		"iptables -t raw -A OUTPUT -p udp --sport 15053 -m owner --gid-owner 2 -j CT --zone 2",
+		"iptables -t raw -A OUTPUT -p udp --dport 53 -d 127.0.0.53/32 -j CT --zone 2",
+		"iptables -t raw -A PREROUTING -p udp --sport 53 -d 127.0.0.53/32 -j CT --zone 1",
 	}
 	if !reflect.DeepEqual(actual, expected) {
 		t.Errorf("Output mismatch. Expected: \n%#v ; Actual: \n%#v", expected, actual)
diff --git a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
index 8491dd4d3..a4661dbb4 100644
--- a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
+++ b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
@@ -83,12 +83,12 @@ var _ = Describe("EdsClusterConfigurer", func() {
                       matchSubjectAltNames:
                       - exact: spiffe://default/backend
                     validationContextSdsSecretConfig:
-                      name: mesh_ca
+                      name: mesh_ca:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
-                  - name: identity_cert
+                  - name: identity_cert:secret:default
                     sdsConfig:
                       ads: {}
                       resourceApiVersion: V3
@@ -150,12 +150,12 @@ var _ = Describe("EdsClusterConfigurer", func() {
                         matchSubjectAltNames:
                         - exact: spiffe://default/backend
                       validationContextSdsSecretConfig:
-                        name: mesh_ca
+                        name: mesh_ca:secret:default
                         sdsConfig:
                           ads: {}
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
-                    - name: identity_cert
+                    - name: identity_cert:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
@@ -175,12 +175,12 @@ var _ = Describe("EdsClusterConfigurer", func() {
                         matchSubjectAltNames:
                         - exact: spiffe://default/backend
                       validationContextSdsSecretConfig:
-                        name: mesh_ca
+                        name: mesh_ca:secret:default
                         sdsConfig:
                           ads: {}
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
-                    - name: identity_cert
+                    - name: identity_cert:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
@@ -235,12 +235,12 @@ var _ = Describe("EdsClusterConfigurer", func() {
                       matchSubjectAltNames:
                       - exact: spiffe://default/backend
                     validationContextSdsSecretConfig:
-                      name: mesh_ca
+                      name: mesh_ca:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
-                  - name: identity_cert
+                  - name: identity_cert:secret:default
                     sdsConfig:
                       ads: {}
                       resourceApiVersion: V3
diff --git a/pkg/xds/envoy/listeners/v3/server_mtls__with_cp_configurer_test.go b/pkg/xds/envoy/listeners/v3/server_mtls__with_cp_configurer_test.go
index ede03a4dd..e8bacbf2d 100644
--- a/pkg/xds/envoy/listeners/v3/server_mtls__with_cp_configurer_test.go
+++ b/pkg/xds/envoy/listeners/v3/server_mtls__with_cp_configurer_test.go
@@ -95,7 +95,7 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                   '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
                   commonTlsContext:
                     tlsCertificateSdsSecretConfigs:
-                    - name: identity_cert
+                    - name: identity_cert:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
diff --git a/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go b/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
index 3346c2d4c..816f7ffa6 100644
--- a/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
+++ b/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
@@ -98,12 +98,12 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                         matchSubjectAltNames:
                         - prefix: spiffe://default/
                       validationContextSdsSecretConfig:
-                        name: mesh_ca
+                        name: mesh_ca:secret:default
                         sdsConfig:
                           ads: {}
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
-                    - name: identity_cert
+                    - name: identity_cert:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
@@ -164,12 +164,12 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                         matchSubjectAltNames:
                         - prefix: spiffe://default/
                       validationContextSdsSecretConfig:
-                        name: mesh_ca
+                        name: mesh_ca:secret:default
                         sdsConfig:
                           ads: {}
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
-                    - name: identity_cert
+                    - name: identity_cert:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
diff --git a/pkg/xds/envoy/tls/v3/tls_test.go b/pkg/xds/envoy/tls/v3/tls_test.go
index c391951b6..6ca028da8 100644
--- a/pkg/xds/envoy/tls/v3/tls_test.go
+++ b/pkg/xds/envoy/tls/v3/tls_test.go
@@ -83,12 +83,12 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                       matchSubjectAltNames:
                       - prefix: spiffe://default/
                     validationContextSdsSecretConfig:
-                      name: mesh_ca
+                      name: mesh_ca:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
-                  - name: identity_cert
+                  - name: identity_cert:secret:default
                     sdsConfig:
                       ads: {}
                       resourceApiVersion: V3
@@ -172,12 +172,12 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                       matchSubjectAltNames:
                       - exact: spiffe://default/backend
                     validationContextSdsSecretConfig:
-                      name: mesh_ca
+                      name: mesh_ca:secret:default
                       sdsConfig:
                         ads: {}
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
-                  - name: identity_cert
+                  - name: identity_cert:secret:default
                     sdsConfig:
                       ads: {}
                       resourceApiVersion: V3`,
diff --git a/pkg/xds/generator/secrets_generator_test.go b/pkg/xds/generator/secrets_generator_test.go
index debf6d8e1..61d1c75a0 100644
--- a/pkg/xds/generator/secrets_generator_test.go
+++ b/pkg/xds/generator/secrets_generator_test.go
@@ -9,6 +9,7 @@ import (
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
 	core_mesh "github.com/kumahq/kuma/pkg/core/resources/apis/mesh"
+	"github.com/kumahq/kuma/pkg/core/resources/model"
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	. "github.com/kumahq/kuma/pkg/test/matchers"
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
@@ -84,6 +85,9 @@ var _ = Describe("SecretsGenerator", func() {
 				},
 				Mesh: xds_context.MeshContext{
 					Resource: &core_mesh.MeshResource{
+						Meta: &test_model.ResourceMeta{
+							Name: "default",
+						},
 						Spec: &mesh_proto.Mesh{
 							Mtls: &mesh_proto.Mesh_Mtls{
 								EnabledBackend: "ca-1",
@@ -113,7 +117,135 @@ var _ = Describe("SecretsGenerator", func() {
 				},
 				APIVersion: envoy_common.APIV3,
 			},
-			expected: "envoy-config.golden.yaml",
+			expected: "envoy-config-zipkin.golden.yaml",
+		}),
+		Entry("should create secrets when multiple meshes present (egress)", testCase{
+			ctx: xds_context.Context{
+				ControlPlane: &xds_context.ControlPlaneContext{
+					Secrets: &xds.TestSecrets{},
+				},
+				Mesh: xds_context.MeshContext{
+					Resource: &core_mesh.MeshResource{
+						Meta: &test_model.ResourceMeta{
+							Name: "default",
+						},
+						Spec: &mesh_proto.Mesh{
+							Mtls: &mesh_proto.Mesh_Mtls{
+								EnabledBackend: "ca-1",
+								Backends: []*mesh_proto.CertificateAuthorityBackend{
+									{
+										Name: "ca-1",
+										Type: "builtin",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			proxy: &core_xds.Proxy{
+				Id: *core_xds.BuildProxyId("", "demo.backend-01"),
+				Dataplane: &core_mesh.DataplaneResource{
+					Meta: &test_model.ResourceMeta{
+						Name: "backend-01",
+						Mesh: "demo",
+					},
+					Spec: &mesh_proto.Dataplane{
+						Networking: &mesh_proto.Dataplane_Networking{
+							Address: "192.168.0.1",
+						},
+					},
+				},
+				APIVersion: envoy_common.APIV3,
+				ZoneEgressProxy: &core_xds.ZoneEgressProxy{
+					Meshes: &core_mesh.MeshResourceList{
+						Items: []*core_mesh.MeshResource{
+							{
+								Meta: &test_model.ResourceMeta{
+									Name: "mesh-1",
+								},
+								Spec: &mesh_proto.Mesh{
+									Mtls: &mesh_proto.Mesh_Mtls{
+										EnabledBackend: "ca-1",
+										Backends: []*mesh_proto.CertificateAuthorityBackend{
+											{
+												Name: "ca-1",
+												Type: "builtin",
+											},
+										},
+									},
+								},
+							},
+							{
+								Meta: &test_model.ResourceMeta{
+									Name: "mesh-2",
+								},
+								Spec: &mesh_proto.Mesh{
+									Mtls: &mesh_proto.Mesh_Mtls{
+										EnabledBackend: "ca-1",
+										Backends: []*mesh_proto.CertificateAuthorityBackend{
+											{
+												Name: "ca-1",
+												Type: "builtin",
+											},
+										},
+									},
+								},
+							},
+							{
+								Meta: &test_model.ResourceMeta{
+									Name: "mesh-3",
+								},
+								Spec: &mesh_proto.Mesh{
+									Mtls: &mesh_proto.Mesh_Mtls{
+										EnabledBackend: "ca-1",
+										Backends: []*mesh_proto.CertificateAuthorityBackend{
+											{
+												Name: "ca-1",
+												Type: "builtin",
+											},
+										},
+									},
+								},
+							},
+							{
+								Meta: &test_model.ResourceMeta{
+									Name: "mesh-4",
+								},
+								Spec: &mesh_proto.Mesh{
+									Mtls: &mesh_proto.Mesh_Mtls{
+										EnabledBackend: "ca-1",
+										Backends: []*mesh_proto.CertificateAuthorityBackend{
+											{
+												Name: "ca-1",
+												Type: "builtin",
+											},
+										},
+									},
+								},
+							},
+							{
+								Meta: &test_model.ResourceMeta{
+									Name: "mesh-5",
+								},
+								Spec: &mesh_proto.Mesh{
+									Mtls: &mesh_proto.Mesh_Mtls{
+										EnabledBackend: "ca-1",
+										Backends: []*mesh_proto.CertificateAuthorityBackend{
+											{
+												Name: "ca-1",
+												Type: "builtin",
+											},
+										},
+									},
+								},
+							},
+						},
+						Pagination: model.Pagination{},
+					},
+				},
+			},
+			expected: "envoy-config-egress.golden.yaml",
 		}),
 	)
 })
diff --git a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
index 26ce7074e..90e8c3352 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
@@ -60,12 +60,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -205,12 +205,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -246,12 +246,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -305,12 +305,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
diff --git a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
index 31de24cd0..beafcaf05 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
@@ -61,12 +61,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -207,12 +207,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -249,12 +249,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -309,12 +309,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
diff --git a/pkg/xds/generator/testdata/inbound-proxy/5-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/5-envoy-config.golden.yaml
index f42fc30d7..f22b46601 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/5-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/5-envoy-config.golden.yaml
@@ -90,12 +90,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -477,12 +477,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -552,12 +552,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -681,12 +681,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
diff --git a/pkg/xds/generator/testdata/inbound-proxy/6-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/6-envoy-config.golden.yaml
index d4b69f81c..115a5d630 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/6-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/6-envoy-config.golden.yaml
@@ -91,12 +91,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -479,12 +479,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -555,12 +555,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -685,12 +685,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://default/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:default
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:default
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
diff --git a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
index 410169e81..bff1860af 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
@@ -26,12 +26,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://mesh1/api-http
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:mesh1
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:mesh1
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -68,12 +68,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://mesh1/api-tcp
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:mesh1
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:mesh1
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -106,12 +106,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://mesh1/backend
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:mesh1
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:mesh1
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -143,12 +143,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://mesh1/db
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:mesh1
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:mesh1
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -180,12 +180,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://mesh1/db
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:mesh1
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:mesh1
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
diff --git a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
index b2b370971..378cbb68a 100644
--- a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
@@ -20,12 +20,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/db
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -63,12 +63,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/elastic
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -170,12 +170,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -247,19 +247,19 @@ resources:
           statPrefix: elastic
     name: outbound:127.0.0.1:59200
     trafficDirection: OUTBOUND
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
index f54cf2c41..c34f6e99b 100644
--- a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
@@ -20,12 +20,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/db
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -63,12 +63,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/elastic
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -191,12 +191,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -304,19 +304,19 @@ resources:
     name: outbound:passthrough:ipv4
     trafficDirection: OUTBOUND
     useOriginalDst: true
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
index 6717c33ff..4e277df6e 100644
--- a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
@@ -20,12 +20,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/db
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -63,12 +63,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/elastic
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -203,12 +203,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -313,12 +313,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -357,19 +357,19 @@ resources:
           statPrefix: elastic
     name: outbound:127.0.0.1:59200
     trafficDirection: OUTBOUND
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
index cabda4e2a..bd78e9cc1 100644
--- a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
@@ -20,12 +20,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/db
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -63,12 +63,12 @@ resources:
               matchSubjectAltNames:
               - exact: spiffe://demo/elastic
             validationContextSdsSecretConfig:
-              name: mesh_ca
+              name: mesh_ca:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
-          - name: identity_cert
+          - name: identity_cert:secret:demo
             sdsConfig:
               ads: {}
               resourceApiVersion: V3
@@ -224,12 +224,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -351,12 +351,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -414,19 +414,19 @@ resources:
     name: outbound:passthrough:ipv4
     trafficDirection: OUTBOUND
     useOriginalDst: true
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml b/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
index 0fde3bd3d..8a872b9c4 100644
--- a/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
@@ -79,12 +79,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
diff --git a/pkg/xds/generator/testdata/secrets/envoy-config-egress.golden.yaml b/pkg/xds/generator/testdata/secrets/envoy-config-egress.golden.yaml
new file mode 100644
index 000000000..e8bc5863c
--- /dev/null
+++ b/pkg/xds/generator/testdata/secrets/envoy-config-egress.golden.yaml
@@ -0,0 +1,81 @@
+resources:
+- name: identity_cert:secret:mesh-1
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: identity_cert:secret:mesh-1
+    tlsCertificate:
+      certificateChain:
+        inlineBytes: Q0VSVA==
+      privateKey:
+        inlineBytes: S0VZ
+- name: identity_cert:secret:mesh-2
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: identity_cert:secret:mesh-2
+    tlsCertificate:
+      certificateChain:
+        inlineBytes: Q0VSVA==
+      privateKey:
+        inlineBytes: S0VZ
+- name: identity_cert:secret:mesh-3
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: identity_cert:secret:mesh-3
+    tlsCertificate:
+      certificateChain:
+        inlineBytes: Q0VSVA==
+      privateKey:
+        inlineBytes: S0VZ
+- name: identity_cert:secret:mesh-4
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: identity_cert:secret:mesh-4
+    tlsCertificate:
+      certificateChain:
+        inlineBytes: Q0VSVA==
+      privateKey:
+        inlineBytes: S0VZ
+- name: identity_cert:secret:mesh-5
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: identity_cert:secret:mesh-5
+    tlsCertificate:
+      certificateChain:
+        inlineBytes: Q0VSVA==
+      privateKey:
+        inlineBytes: S0VZ
+- name: mesh_ca:secret:mesh-1
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: mesh_ca:secret:mesh-1
+    validationContext:
+      trustedCa:
+        inlineBytes: Q0E=
+- name: mesh_ca:secret:mesh-2
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: mesh_ca:secret:mesh-2
+    validationContext:
+      trustedCa:
+        inlineBytes: Q0E=
+- name: mesh_ca:secret:mesh-3
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: mesh_ca:secret:mesh-3
+    validationContext:
+      trustedCa:
+        inlineBytes: Q0E=
+- name: mesh_ca:secret:mesh-4
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: mesh_ca:secret:mesh-4
+    validationContext:
+      trustedCa:
+        inlineBytes: Q0E=
+- name: mesh_ca:secret:mesh-5
+  resource:
+    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
+    name: mesh_ca:secret:mesh-5
+    validationContext:
+      trustedCa:
+        inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/secrets/envoy-config.golden.yaml b/pkg/xds/generator/testdata/secrets/envoy-config-zipkin.golden.yaml
similarity index 73%
rename from pkg/xds/generator/testdata/secrets/envoy-config.golden.yaml
rename to pkg/xds/generator/testdata/secrets/envoy-config-zipkin.golden.yaml
index 48fd601d8..4d9810d3e 100644
--- a/pkg/xds/generator/testdata/secrets/envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/secrets/envoy-config-zipkin.golden.yaml
@@ -1,17 +1,17 @@
 resources:
-- name: identity_cert
+- name: identity_cert:secret:default
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:default
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:default
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:default
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
index b55566a0b..f2b60868e 100644
--- a/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
@@ -81,12 +81,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -127,19 +127,19 @@ resources:
     name: outbound:passthrough:ipv4
     trafficDirection: OUTBOUND
     useOriginalDst: true
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/generator/testdata/template-proxy/2-envoy-config.golden.yaml b/pkg/xds/generator/testdata/template-proxy/2-envoy-config.golden.yaml
index 7eda590a2..adb2d6efa 100644
--- a/pkg/xds/generator/testdata/template-proxy/2-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/template-proxy/2-envoy-config.golden.yaml
@@ -65,12 +65,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -111,19 +111,19 @@ resources:
     name: outbound:passthrough:ipv4
     trafficDirection: OUTBOUND
     useOriginalDst: true
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/pkg/xds/server/v3/testdata/envoy-config.golden.yaml b/pkg/xds/server/v3/testdata/envoy-config.golden.yaml
index d78b79834..235e0866b 100644
--- a/pkg/xds/server/v3/testdata/envoy-config.golden.yaml
+++ b/pkg/xds/server/v3/testdata/envoy-config.golden.yaml
@@ -81,12 +81,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -136,12 +136,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -178,12 +178,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -220,12 +220,12 @@ resources:
                 matchSubjectAltNames:
                 - prefix: spiffe://demo/
               validationContextSdsSecretConfig:
-                name: mesh_ca
+                name: mesh_ca:secret:demo
                 sdsConfig:
                   ads: {}
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
-            - name: identity_cert
+            - name: identity_cert:secret:demo
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
@@ -266,19 +266,19 @@ resources:
     name: outbound:passthrough:ipv4
     trafficDirection: OUTBOUND
     useOriginalDst: true
-- name: identity_cert
+- name: identity_cert:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: identity_cert
+    name: identity_cert:secret:demo
     tlsCertificate:
       certificateChain:
         inlineBytes: Q0VSVA==
       privateKey:
         inlineBytes: S0VZ
-- name: mesh_ca
+- name: mesh_ca:secret:demo
   resource:
     '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
-    name: mesh_ca
+    name: mesh_ca:secret:demo
     validationContext:
       trustedCa:
         inlineBytes: Q0E=
diff --git a/test/framework/universal_app.go b/test/framework/universal_app.go
index 697dfa50f..bf0924b15 100644
--- a/test/framework/universal_app.go
+++ b/test/framework/universal_app.go
@@ -177,14 +177,14 @@ networking:
 var defaultDockerOptions = docker.RunOptions{
 	Command: nil,
 	Detach:  true,
-	//Entrypoint:           "",
+	// Entrypoint:           "",
 	EnvironmentVariables: nil,
 	Init:                 false,
-	//Name:                 "",
+	// Name:                 "",
 	Privileged: false,
 	Remove:     true,
 	Tty:        false,
-	//User:                 "",
+	// User:                 "",
 	Volumes:      nil,
 	OtherOptions: []string{},
 	Logger:       nil,
@@ -440,6 +440,7 @@ func (s *UniversalApp) setupTransparent(cpIp string, builtindns bool) {
 		"/usr/bin/kumactl", "install", "transparent-proxy",
 		"--kuma-dp-user", "kuma-dp",
 		"--kuma-cp-ip", cpIp,
+		"--skip-dns-conntrack-zone-split",
 	}
 
 	if builtindns {