Repository: kumahq/kuma
Pull request #10920 (2024-07-17 04:40:14)

feat(transparent-proxy): allow `--kuma-dp-user` to accept UIDs and deprecate `--kuma-dp-uid` flag
#### Move Owner UID/Username Processing to Config

- **Enhanced `--kuma-dp-user` Flag:**
  - The `--kuma-dp-user` flag in `kumactl install transparent-proxy` now accepts both usernames and UIDs.
  - The `--kuma-dp-uid` flag has been deprecated in favor of the enhanced `--kuma-dp-user` flag.
  - The `--kuma-dp-user` flag is now optional. If not specified, the system will attempt to use a default UID (`5678`) or the default username (`kuma-dp`).
  - The logic for processing user information (searching for the user) has been moved to the transparent proxy Config.

#### Small Improvements and Refactorings

- **Add `IPFamilyMode` to `Config` and Remove `IPv6` Field:**
  - Replaced the `IPv6` field in `Config` with the `IPFamilyMode` field.
  - This change centralizes the processing of IP family modes within the `Config` struct, simplifying the configuration and usage.

- **Unembed `Executables` from `InitializedExecutables`:**
  - Removed the embedding of the `Executables` struct from `InitializedExecutables`.
  - The fields from `Executables` are not used directly in `InitializedExecutables`, and unembedding helps to reduce clutter and improve code clarity.

- **Adjust Unit Tests for `kumactl install transparent-proxy`:**
  - Updated the unit tests to align with recent changes in handling IPv4 and IPv6 rules generation.
  - Removed the use of `subnetPlaceholder` and unified the IP address for inbound traffic in tests, as there is no different inbound redirection port for IPv6 now.

### Checklist prior to review

<!--
Each of these sections need to be filled by the author when opening the PR.

If something doesn't apply please check the box and add a justification after the `--`
-->

- [x] [Link to relevant issue][1] as well as docs and UI issues
  - https://github.com/kumahq/kuma/issues/8324
- [x] This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS
  - It won't
- [x] Tests (Unit test, E2E tests, manual test on universal and k8s)
  - Existing unit tests adjusted
  - Manually tested on local Ubuntu:24.04 container
  - Don't forget `ci/` labels to run additional/fewer tests
- [x] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)?
  - Updated
- [x] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)? ([this](https://github.com/kumahq/kuma/actions/workflows/auto-backport.yaml) GH action will add "backport" label based on these [file globs](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L6), if you want to prevent it from adding the "backport" label use [no-backport-autolabel](https://github.com/kumahq/kuma/blob/master/.github/workflows/auto-backport.yaml#L8) label)
  - There is no need

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword



Patch:
diff --git a/UPGRADE.md b/UPGRADE.md
index 7e016fbbf..c5914378b 100644
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -92,6 +92,26 @@ networking:
 
 Ensure to update your Dataplane resources to the new format to avoid any validation errors.
 
+#### Deprecation of `--kuma-dp-uid` Flag
+
+In this release, the `--kuma-dp-uid` flag used in the `kumactl install transparent-proxy` command has been deprecated. The functionality of specifying a user by UID is now included in the `--kuma-dp-user` flag, which accepts both usernames and UIDs.
+
+**New Usage Example:**
+
+Instead of using:
+```sh
+kumactl install transparent-proxy --kuma-dp-uid 1234
+```
+
+You should now use:
+```sh
+kumactl install transparent-proxy --kuma-dp-user 1234
+```
+
+If the `--kuma-dp-user` flag is not provided, the system will attempt to use the default UID (`5678`) or the default username (`kuma-dp`).
+
+Please update your scripts and configurations accordingly to accommodate this change.
+
 ## Upgrade to `2.8.x`
 
 ### MeshFaultInjection responseBandwidth.limit
diff --git a/app/cni/pkg/cni/injector_linux.go b/app/cni/pkg/cni/injector_linux.go
index 7bf202f14..b2d2b213d 100644
--- a/app/cni/pkg/cni/injector_linux.go
+++ b/app/cni/pkg/cni/injector_linux.go
@@ -117,7 +117,9 @@ func mapToConfig(intermediateConfig *IntermediateConfig, logWriter *bufio.Writer
 		return nil, err
 	}
 
-	cfg.IPv6 = intermediateConfig.ipFamilyMode != "ipv4"
+	if err := cfg.IPFamilyMode.Set(intermediateConfig.ipFamilyMode); err != nil {
+		return nil, err
+	}
 
 	cfg.Redirect.Inbound.Enabled = !isGateway
 	if cfg.Redirect.Inbound.Enabled {
diff --git a/app/kumactl/cmd/install/install_transparent_proxy.go b/app/kumactl/cmd/install/install_transparent_proxy.go
index ae7670207..56eb5e6e2 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy.go
@@ -5,7 +5,6 @@ package install
 
 import (
 	"fmt"
-	os_user "os/user"
 	"runtime"
 
 	"github.com/pkg/errors"
@@ -14,19 +13,16 @@ import (
 	"github.com/kumahq/kuma/pkg/transparentproxy"
 	"github.com/kumahq/kuma/pkg/transparentproxy/config"
 	"github.com/kumahq/kuma/pkg/transparentproxy/firewalld"
+	"github.com/kumahq/kuma/pkg/transparentproxy/iptables/consts"
 )
 
 type transparentProxyArgs struct {
 	RedirectPortOutBound           string
-	IpFamilyMode                   string
 	RedirectPortInBound            string
-	RedirectPortInBoundV6          string
 	ExcludeInboundPorts            string
 	ExcludeOutboundPorts           string
 	ExcludeOutboundTCPPortsForUIDs []string
 	ExcludeOutboundUDPPortsForUIDs []string
-	UID                            string
-	User                           string
 	AgentDNSListenerPort           string
 	SkipDNSConntrackZoneSplit      bool
 }
@@ -37,13 +33,10 @@ func newInstallTransparentProxy() *cobra.Command {
 	args := transparentProxyArgs{
 		RedirectPortOutBound:           "15001",
 		RedirectPortInBound:            "15006",
-		IpFamilyMode:                   "dualstack",
 		ExcludeInboundPorts:            "",
 		ExcludeOutboundPorts:           "",
 		ExcludeOutboundTCPPortsForUIDs: []string{},
 		ExcludeOutboundUDPPortsForUIDs: []string{},
-		UID:                            "",
-		User:                           "",
 		AgentDNSListenerPort:           "15053",
 		SkipDNSConntrackZoneSplit:      false,
 	}
@@ -57,7 +50,7 @@ Follow the following steps to use the Kuma data plane proxy in Transparent Proxy
 
  1) create a dedicated user for the Kuma data plane proxy, e.g. 'kuma-dp'
  2) run this command as a 'root' user to modify the host's iptables and /etc/resolv.conf
-    - supply the dedicated username with '--kuma-dp-uid'
+    - supply the dedicated username with '--kuma-dp-user'
     - all changes are easly revertible by issuing 'kumactl uninstall transparent-proxy'
     - by default the SSH port tcp/22 will not be redirected to Envoy, but everything else will.
       Use '--exclude-inbound-ports' to provide a comma separated list of ports that should also be excluded
@@ -99,19 +92,28 @@ runuser -u kuma-dp -- \
     --binary-path /usr/local/bin/envoy
 
 `,
-		PreRun: func(cmd *cobra.Command, _ []string) {
+		PreRunE: func(cmd *cobra.Command, _ []string) error {
 			cfg.RuntimeStdout = cmd.OutOrStdout()
 			cfg.RuntimeStderr = cmd.ErrOrStderr()
+
+			// Ensure the Set method is called manually if the --kuma-dp-user flag is not specified.
+			// The Set method contains logic to check for the existence of a user with the default
+			// UID "5678", and if that does not exist, it checks for the default username "kuma-dp".
+			// Since the cobra library does not call the Set method when --kuma-dp-user is not specified,
+			// we need to invoke it manually here to ensure the proper user is set.
+			if kumaDpUser := cmd.Flag("kuma-dp-user"); !kumaDpUser.Changed {
+				if err := cfg.Owner.Set(""); err != nil {
+					return err
+				}
+			}
+
+			return nil
 		},
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			if !cfg.DryRun && runtime.GOOS != "linux" {
 				return errors.Errorf("transparent proxy will work only on Linux OSes")
 			}
 
-			if args.User == "" && args.UID == "" {
-				return errors.Errorf("--kuma-dp-user or --kuma-dp-uid should be supplied")
-			}
-
 			if cfg.Redirect.DNS.CaptureAll && cfg.Redirect.DNS.Enabled {
 				return errors.Errorf("one of --redirect-dns or --redirect-all-dns-traffic should be specified")
 			}
@@ -185,14 +187,14 @@ runuser -u kuma-dp -- \
 
 	cmd.Flags().BoolVar(&cfg.DryRun, "dry-run", cfg.DryRun, "dry run")
 	cmd.Flags().BoolVar(&cfg.Verbose, "verbose", cfg.Verbose, "verbose")
-	cmd.Flags().StringVar(&args.IpFamilyMode, "ip-family-mode", args.IpFamilyMode, "The IP family mode to enable traffic redirection for. Can be 'dualstack' or 'ipv4'")
+	cmd.Flags().Var(&cfg.IPFamilyMode, "ip-family-mode", "The IP family mode to enable traffic redirection for. Can be 'dualstack' or 'ipv4'")
 	cmd.Flags().StringVar(&args.RedirectPortOutBound, "redirect-outbound-port", args.RedirectPortOutBound, "outbound port redirected to Envoy, as specified in dataplane's `networking.transparentProxying.redirectPortOutbound`")
 	cmd.Flags().BoolVar(&cfg.Redirect.Inbound.Enabled, "redirect-inbound", cfg.Redirect.Inbound.Enabled, "redirect the inbound traffic to the Envoy. Should be disabled for Gateway data plane proxies.")
 	cmd.Flags().StringVar(&args.RedirectPortInBound, "redirect-inbound-port", args.RedirectPortInBound, "inbound port redirected to Envoy, as specified in dataplane's `networking.transparentProxying.redirectPortInbound`")
 	cmd.Flags().StringVar(&args.ExcludeInboundPorts, "exclude-inbound-ports", args.ExcludeInboundPorts, "a comma separated list of inbound ports to exclude from redirect to Envoy")
 	cmd.Flags().StringVar(&args.ExcludeOutboundPorts, "exclude-outbound-ports", args.ExcludeOutboundPorts, "a comma separated list of outbound ports to exclude from redirect to Envoy")
-	cmd.Flags().StringVar(&args.User, "kuma-dp-user", args.UID, "the user that will run kuma-dp")
-	cmd.Flags().StringVar(&args.UID, "kuma-dp-uid", args.UID, "the uid of the user that will run kuma-dp")
+	cmd.Flags().Var(&cfg.Owner, "kuma-dp-user", fmt.Sprintf("the username or UID of the user that will run kuma-dp. If not provided, the system will search for a user with the default UID ('%s') or the default username ('%s')", consts.OwnerDefaultUID, consts.OwnerDefaultUsername))
+	cmd.Flags().Var(&cfg.Owner, "kuma-dp-uid", "the uid of the user that will run kuma-dp")
 	cmd.Flags().BoolVar(&cfg.Redirect.DNS.Enabled, "redirect-dns", cfg.Redirect.DNS.Enabled, "redirect only DNS requests targeted to the servers listed in /etc/resolv.conf to a specified port")
 	cmd.Flags().BoolVar(&cfg.Redirect.DNS.CaptureAll, "redirect-all-dns-traffic", cfg.Redirect.DNS.CaptureAll, "redirect all DNS traffic to a specified port, unlike --redirect-dns this will not be limited to the dns servers identified in /etc/resolve.conf")
 	cmd.Flags().StringVar(&args.AgentDNSListenerPort, "redirect-dns-port", args.AgentDNSListenerPort, "the port where the DNS agent is listening")
@@ -226,36 +228,12 @@ runuser -u kuma-dp -- \
 	cmd.Flags().StringArrayVar(&cfg.Redirect.Outbound.ExcludePortsForIPs, "exclude-outbound-ips", []string{}, "specify IP addresses (IPv4 or IPv6, with or without CIDR notation) to be excluded from transparent proxy outbound redirection. Examples: '10.0.0.1', '192.168.0.0/24', 'fe80::1', 'fd00::/8'. This flag can be specified multiple times or with multiple addresses separated by commas to exclude multiple IP addresses or ranges.")
 
 	_ = cmd.Flags().MarkDeprecated("redirect-dns-upstream-target-chain", "This flag has no effect anymore. Will be removed in 2.9.x version")
+	_ = cmd.Flags().MarkDeprecated("kuma-dp-uid", "please use --kuma-dp-user, which accepts both UIDs and usernames")
 
 	return cmd
 }
 
-func findUidGid(uid, user string) (string, string, error) {
-	var u *os_user.User
-	var err error
-
-	if u, err = os_user.LookupId(uid); err != nil {
-		if user != "" {
-			if u, err = os_user.Lookup(user); err != nil {
-				return "", "", errors.Errorf("--kuma-dp-user or --kuma-dp-uid should refer to a valid user on the host")
-			}
-		} else {
-			u = &os_user.User{
-				Uid: uid,
-				Gid: uid,
-			}
-		}
-	}
-
-	return u.Uid, u.Gid, nil
-}
-
 func parseArgs(cfg *config.Config, args *transparentProxyArgs) error {
-	uid, _, err := findUidGid(args.UID, args.User)
-	if err != nil {
-		return errors.Wrapf(err, "unable to find the kuma-dp user")
-	}
-
 	redirectInboundPort, err := transparentproxy.ParseUint16(args.RedirectPortInBound)
 	if err != nil {
 		return errors.Wrap(err, "parsing inbound redirect port failed")
@@ -287,10 +265,6 @@ func parseArgs(cfg *config.Config, args *transparentProxyArgs) error {
 		}
 	}
 
-	cfg.IPv6 = args.IpFamilyMode != "ipv4"
-
-	cfg.Owner.UID = uid
-
 	cfg.Redirect.Inbound.Port = redirectInboundPort
 	cfg.Redirect.Inbound.ExcludePorts = excludeInboundPorts
 
diff --git a/pkg/transparentproxy/config/config.go b/pkg/transparentproxy/config/config.go
index 6348f8739..81c90139e 100644
--- a/pkg/transparentproxy/config/config.go
+++ b/pkg/transparentproxy/config/config.go
@@ -6,6 +6,7 @@ import (
 	"io"
 	"net"
 	"os"
+	"os/user"
 	"slices"
 	"strconv"
 	"strings"
@@ -22,6 +23,40 @@ type Owner struct {
 	UID string
 }
 
+func (c *Owner) String() string {
+	return c.UID
+}
+
+func (c *Owner) Type() string {
+	return "uid|username"
+}
+
+func (c *Owner) Set(s string) error {
+	var ok bool
+
+	if s != "" {
+		if c.UID, ok = findUserUID(s); ok {
+			return nil
+		}
+
+		return errors.Errorf("the specified UID or username ('%s') does not refer to a valid user on the host", s)
+	}
+
+	if c.UID, ok = findUserUID(OwnerDefaultUID); ok {
+		return nil
+	}
+
+	if c.UID, ok = findUserUID(OwnerDefaultUsername); ok {
+		return nil
+	}
+
+	return errors.Errorf(
+		"no UID or username provided, and user with the default UID ('%s') or username ('%s') could not be found",
+		OwnerDefaultUID,
+		OwnerDefaultUsername,
+	)
+}
+
 // ValueOrRangeList is a format acceptable by iptables in which
 // single values are denoted by just a number e.g. 1000
 // multiple values (lists) are denoted by a number separated by a comma e.g. 1000,1001
@@ -406,8 +441,6 @@ type Config struct {
 	//
 	// See also: https://kubernetes.io/blog/2019/03/29/kube-proxy-subtleties-debugging-an-intermittent-connection-reset/
 	DropInvalidPackets bool
-	// IPv6 when set will be used to configure iptables as well as ip6tables
-	IPv6 bool
 	// RuntimeStdout is the place where Any debugging, runtime information
 	// will be placed (os.Stdout by default)
 	RuntimeStdout io.Writer
@@ -453,6 +486,51 @@ type Config struct {
 	// comments. This setting helps in identifying and organizing iptables rules
 	// created by the transparent proxy, making them easier to manage and debug.
 	Comment Comment
+	// IPFamilyMode specifies the IP family mode to be used by the
+	// configuration. It determines whether the system operates in dualstack
+	// mode (supporting both IPv4 and IPv6) or IPv4-only mode. This setting is
+	// crucial for environments where both IP families are in use, ensuring that
+	// the correct iptables rules are applied for the specified IP family.
+	IPFamilyMode IPFamilyMode
+}
+
+type IPFamilyMode string
+
+const (
+	IPFamilyModeDualStack IPFamilyMode = "dualstack"
+	IPFamilyModeIPv4      IPFamilyMode = "ipv4"
+)
+
+// String returns the string representation of the IPFamilyMode.
+// This is used both by fmt.Print and by Cobra in help text.
+func (e *IPFamilyMode) String() string {
+	return string(*e)
+}
+
+// Type returns the type of the IPFamilyMode.
+// This is only used in help text by Cobra.
+func (e *IPFamilyMode) Type() string {
+	return "string"
+}
+
+// Set assigns the IPFamilyMode based on the provided value. It validates the
+// input and sets the appropriate mode or returns an error if the input is
+// invalid.
+func (e *IPFamilyMode) Set(v string) error {
+	switch strings.ToLower(v) {
+	case "": // Default value is "dualstack"
+		*e = IPFamilyModeDualStack
+	case string(IPFamilyModeDualStack), string(IPFamilyModeIPv4):
+		*e = IPFamilyMode(v)
+	default:
+		return errors.Errorf(
+			"must be one of %q or %q",
+			IPFamilyModeDualStack,
+			IPFamilyModeIPv4,
+		)
+	}
+
+	return nil
 }
 
 // InitializedConfigIPvX extends the Config struct by adding fields that require
@@ -500,6 +578,7 @@ type InitializedConfigIPvX struct {
 	// text. This helps in identifying and organizing iptables rules created by
 	// the transparent proxy, making them easier to manage and debug.
 	Comment InitializedComment
+	Owner   Owner
 
 	enabled bool
 }
@@ -552,6 +631,7 @@ func (c Config) Initialize(ctx context.Context) (InitializedConfig, error) {
 			Logger:                 loggerIPv4,
 			LocalhostCIDR:          LocalhostCIDRIPv4,
 			InboundPassthroughCIDR: InboundPassthroughSourceAddressCIDRIPv4,
+			Owner:                  c.Owner,
 			enabled:                true,
 		},
 		DryRun: c.DryRun,
@@ -587,7 +667,7 @@ func (c Config) Initialize(ctx context.Context) (InitializedConfig, error) {
 	initialized.IPv4.Comment = c.Comment.Initialize(e.IPv4)
 	initialized.IPv4.DropInvalidPackets = c.DropInvalidPackets && e.IPv4.Functionality.Tables.Mangle
 
-	if !c.IPv6 {
+	if c.IPFamilyMode == IPFamilyModeIPv4 {
 		return initialized, nil
 	}
 
@@ -617,6 +697,7 @@ func (c Config) Initialize(ctx context.Context) (InitializedConfig, error) {
 		InboundPassthroughCIDR: InboundPassthroughSourceAddressCIDRIPv6,
 		Comment:                c.Comment.Initialize(e.IPv6),
 		DropInvalidPackets:     c.DropInvalidPackets && e.IPv6.Functionality.Tables.Mangle,
+		Owner:                  c.Owner,
 		enabled:                true,
 	}
 
@@ -629,7 +710,6 @@ func (c Config) Initialize(ctx context.Context) (InitializedConfig, error) {
 
 func DefaultConfig() Config {
 	return Config{
-		Owner: Owner{UID: "5678"},
 		Redirect: Redirect{
 			NamePrefix: IptablesChainsPrefix,
 			Inbound: TrafficFlow{
@@ -666,7 +746,6 @@ func DefaultConfig() Config {
 			ProgramsSourcePath: "/tmp/kuma-ebpf",
 		},
 		DropInvalidPackets: false,
-		IPv6:               true,
 		RuntimeStdout:      os.Stdout,
 		RuntimeStderr:      os.Stderr,
 		Verbose:            false,
@@ -687,6 +766,7 @@ func DefaultConfig() Config {
 		Comment: Comment{
 			Disabled: false,
 		},
+		IPFamilyMode: IPFamilyModeDualStack,
 	}
 }
 
@@ -950,3 +1030,19 @@ func configureIPv6OutboundAddress() error {
 
 	return nil
 }
+
+func findUserUID(userOrUID string) (string, bool) {
+	if userOrUID == "" {
+		return "", false
+	}
+
+	if u, err := user.LookupId(userOrUID); err == nil {
+		return u.Uid, true
+	}
+
+	if u, err := user.Lookup(userOrUID); err == nil {
+		return u.Uid, true
+	}
+
+	return "", false
+}
diff --git a/pkg/transparentproxy/config/config_executables.go b/pkg/transparentproxy/config/config_executables.go
index fcca8722d..3b8616e19 100644
--- a/pkg/transparentproxy/config/config_executables.go
+++ b/pkg/transparentproxy/config/config_executables.go
@@ -362,8 +362,7 @@ func (c Executables) Initialize(
 	cfg Config,
 ) (InitializedExecutables, error) {
 	var err error
-
-	initialized := InitializedExecutables{Executables: c}
+	var initialized InitializedExecutables
 
 	loggerIPv4 := l.WithPrefix(IptablesCommandByFamily[false])
 
@@ -371,7 +370,7 @@ func (c Executables) Initialize(
 		return InitializedExecutables{}, errors.Wrap(err, "failed to initialize IPv4 executables")
 	}
 
-	if !cfg.IPv6 {
+	if cfg.IPFamilyMode == IPFamilyModeIPv4 {
 		return initialized, nil
 	}
 
@@ -385,7 +384,6 @@ func (c Executables) Initialize(
 }
 
 type InitializedExecutables struct {
-	Executables
 	IPv4 InitializedExecutablesIPvX
 	IPv6 InitializedExecutablesIPvX
 }
diff --git a/pkg/transparentproxy/iptables/consts/consts.go b/pkg/transparentproxy/iptables/consts/consts.go
index a7193d510..7100c2360 100644
--- a/pkg/transparentproxy/iptables/consts/consts.go
+++ b/pkg/transparentproxy/iptables/consts/consts.go
@@ -188,3 +188,10 @@ const IptablesRuleCommentPrefix = "kuma/mesh/transparent/proxy"
 // chains. The chains named with this prefix are used to apply specific rules
 // necessary for the operation of the transparent proxy.
 const IptablesChainsPrefix = "KUMA_MESH"
+
+// Default user identification constants used for running kuma-dp.
+// These defaults are utilized when no specific user is provided.
+const (
+	OwnerDefaultUID      = "5678"
+	OwnerDefaultUsername = "kuma-dp"
+)
diff --git a/pkg/transparentproxy/kubernetes/kubernetes.go b/pkg/transparentproxy/kubernetes/kubernetes.go
index e7b6d23b3..18ce0c7cd 100644
--- a/pkg/transparentproxy/kubernetes/kubernetes.go
+++ b/pkg/transparentproxy/kubernetes/kubernetes.go
@@ -181,7 +181,7 @@ func (pr *PodRedirect) AsKumactlCommandLine() []string {
 		"--redirect-inbound=" + fmt.Sprintf("%t", pr.RedirectInbound),
 		"--redirect-inbound-port",
 		fmt.Sprintf("%d", pr.RedirectPortInbound),
-		"--kuma-dp-uid",
+		"--kuma-dp-user",
 		pr.UID,
 		"--exclude-inbound-ports",
 		pr.ExcludeInboundPorts,


Test patch:
diff --git a/app/kumactl/cmd/completion/testdata/bash.golden b/app/kumactl/cmd/completion/testdata/bash.golden
index f82278976..a55c9dfd3 100644
--- a/app/kumactl/cmd/completion/testdata/bash.golden
+++ b/app/kumactl/cmd/completion/testdata/bash.golden
@@ -5864,10 +5864,6 @@ _kumactl_install_transparent-proxy()
     local_nonpersistent_flags+=("--ip-family-mode=")
     flags+=("--iptables-logs")
     local_nonpersistent_flags+=("--iptables-logs")
-    flags+=("--kuma-dp-uid=")
-    two_word_flags+=("--kuma-dp-uid")
-    local_nonpersistent_flags+=("--kuma-dp-uid")
-    local_nonpersistent_flags+=("--kuma-dp-uid=")
     flags+=("--kuma-dp-user=")
     two_word_flags+=("--kuma-dp-user")
     local_nonpersistent_flags+=("--kuma-dp-user")
diff --git a/app/kumactl/cmd/install/install_transparent_proxy_test.go b/app/kumactl/cmd/install/install_transparent_proxy_test.go
index f5ac8cb54..c6807f21f 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy_test.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy_test.go
@@ -40,7 +40,7 @@ var _ = Context("kumactl install transparent proxy", func() {
 	DescribeTable("should install transparent proxy",
 		func(given testCase) {
 			// given
-			args := append([]string{"install", "transparent-proxy", "--dry-run"}, given.extraArgs...)
+			args := append([]string{"install", "transparent-proxy", "--dry-run", "--ip-family-mode", "ipv4"}, given.extraArgs...)
 			stdoutBuf, stderrBuf, rootCmd := test.DefaultTestingRootCmd(args...)
 
 			// when
@@ -64,12 +64,9 @@ var _ = Context("kumactl install transparent proxy", func() {
 			Expect(stdout).To(WithTransform(func(in string) string {
 				// Replace some stuff that are environment dependent with placeholders
 				out := regexp.MustCompile(`-o ([^ ]+)`).ReplaceAllString(in, "-o ifPlaceholder")
-				out = regexp.MustCompile(`-([sd]) ([^ ]+)`).ReplaceAllString(out, "-$1 subnetPlaceholder/mask")
 				out = regexp.MustCompile(`-m comment --comment ".*?" `).ReplaceAllString(out, "")
 				out = regexp.MustCompile(`(?m)^-I OUTPUT (\d+) -p udp --dport 53 -m owner --uid-owner (\d+) -j (\w+)$`).
 					ReplaceAllString(out, "-I OUTPUT $1 -p udp --dport 53 -m owner --uid-owner $2 -j dnsJumpTargetPlaceholder")
-				out = strings.ReplaceAll(out, "15006", "inboundPort")
-				out = strings.ReplaceAll(out, "15010", "inboundPort")
 				return out
 			}, matchers.MatchGoldenEqual("testdata", given.goldenFile)))
 		},
@@ -81,13 +78,13 @@ var _ = Context("kumactl install transparent proxy", func() {
 		}),
 		Entry("should generate defaults with user id", testCase{
 			extraArgs: []string{
-				"--kuma-dp-uid", "0",
+				"--kuma-dp-user", "0",
 			},
 			goldenFile: "install-transparent-proxy.defaults.golden.txt",
 		}),
 		Entry("should generate defaults with user id and DNS redirected when no conntrack module present", testCase{
 			extraArgs: []string{
-				"--kuma-dp-uid", "0",
+				"--kuma-dp-user", "0",
 				"--redirect-all-dns-traffic",
 				"--redirect-dns-port", "12345",
 			},
@@ -102,7 +99,7 @@ var _ = Context("kumactl install transparent proxy", func() {
 		}),
 		Entry("should generate defaults with user id and DNS redirected", testCase{
 			extraArgs: []string{
-				"--kuma-dp-uid", "0",
+				"--kuma-dp-user", "0",
 				"--redirect-all-dns-traffic",
 				"--redirect-dns-port", "12345",
 			},
@@ -116,7 +113,7 @@ var _ = Context("kumactl install transparent proxy", func() {
 		}),
 		Entry("should generate defaults with user id and DNS redirected without conntrack zone splitting and log deprecate", testCase{
 			extraArgs: []string{
-				"--kuma-dp-uid", "0",
+				"--kuma-dp-user", "0",
 				"--redirect-all-dns-traffic",
 				"--redirect-dns-port", "12345",
 				"--skip-dns-conntrack-zone-split",
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.defaults.golden.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.defaults.golden.txt
index 53f845201..eda93e4ac 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.defaults.golden.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.defaults.golden.txt
@@ -8,12 +8,12 @@
 -A PREROUTING -p tcp -j KUMA_MESH_INBOUND
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.dns.no-conntrack.golden.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.dns.no-conntrack.golden.txt
index ea46b0508..143ef239c 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.dns.no-conntrack.golden.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.dns.no-conntrack.golden.txt
@@ -10,13 +10,13 @@
 -I OUTPUT 2 -p udp --dport 53 -j REDIRECT --to-ports 12345
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp ! --dport 53 -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp ! --dport 53 -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp ! --dport 53 -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -p tcp --dport 53 -j REDIRECT --to-ports 12345
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports.txt
index 832c81c6c..39b48a203 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports.txt
@@ -11,12 +11,12 @@
 -I OUTPUT 3 -m multiport -p udp --dport 3900,3902,4000:6000 -m owner --uid-owner 303 -j RETURN
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_allprotos.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_allprotos.txt
index f2b50dabe..c07fe37e6 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_allprotos.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_allprotos.txt
@@ -9,12 +9,12 @@
 -I OUTPUT 1 -m multiport -p tcp --dport 1:65535 -m owner --uid-owner 0 -j RETURN
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_onlyuid.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_onlyuid.txt
index e5dac9e51..63eafbe4a 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_onlyuid.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_onlyuid.txt
@@ -10,12 +10,12 @@
 -I OUTPUT 2 -m multiport -p udp --dport 1:65535 -m owner --uid-owner 123 -j RETURN
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_simpler.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_simpler.txt
index 832c81c6c..39b48a203 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_simpler.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_simpler.txt
@@ -11,12 +11,12 @@
 -I OUTPUT 3 -m multiport -p udp --dport 3900,3902,4000:6000 -m owner --uid-owner 303 -j RETURN
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_wildcards.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_wildcards.txt
index 2e6123074..d1cf1384c 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_wildcards.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.excludedports_wildcards.txt
@@ -10,12 +10,12 @@
 -I OUTPUT 2 -m multiport -p udp --dport 1:65535 -m owner --uid-owner 0 -j RETURN
 -A OUTPUT -p tcp -j KUMA_MESH_OUTBOUND
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
--A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports inboundPort
+-A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15006
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 15001
 COMMIT
diff --git a/app/kumactl/cmd/install/testdata/install-transparent-proxy.overrides.golden.txt b/app/kumactl/cmd/install/testdata/install-transparent-proxy.overrides.golden.txt
index 86dbe3268..e9aa16844 100644
--- a/app/kumactl/cmd/install/testdata/install-transparent-proxy.overrides.golden.txt
+++ b/app/kumactl/cmd/install/testdata/install-transparent-proxy.overrides.golden.txt
@@ -12,11 +12,11 @@
 -A KUMA_MESH_INBOUND -p tcp -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp --dport 2000 -j RETURN
 -A KUMA_MESH_OUTBOUND -p tcp --dport 2001 -j RETURN
--A KUMA_MESH_OUTBOUND -s subnetPlaceholder/mask -o ifPlaceholder -j RETURN
--A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d subnetPlaceholder/mask -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
+-A KUMA_MESH_OUTBOUND -s 127.0.0.6/32 -o ifPlaceholder -j RETURN
+-A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder ! -d 127.0.0.1/32 -m owner --uid-owner 0 -j KUMA_MESH_INBOUND_REDIRECT
 -A KUMA_MESH_OUTBOUND -p tcp -o ifPlaceholder -m owner ! --uid-owner 0 -j RETURN
 -A KUMA_MESH_OUTBOUND -m owner --uid-owner 0 -j RETURN
--A KUMA_MESH_OUTBOUND -d subnetPlaceholder/mask -j RETURN
+-A KUMA_MESH_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A KUMA_MESH_OUTBOUND -j KUMA_MESH_OUTBOUND_REDIRECT
 -A KUMA_MESH_INBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 12346
 -A KUMA_MESH_OUTBOUND_REDIRECT -p tcp -j REDIRECT --to-ports 12345
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index 4073124d1..14d665e7b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -131,7 +131,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index 99c84f037..fd30b768b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -139,7 +139,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index f99735d10..47999c8c4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -193,7 +193,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index 3c1c0e06d..310c8ac66 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -131,7 +131,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index a9595a424..0765f1c5c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -125,7 +125,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index 3105c8774..4e5dd0d80 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -132,7 +132,7 @@ spec:
     - --redirect-inbound=false
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index 4073124d1..14d665e7b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -131,7 +131,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index 70600d544..2a746212d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -134,7 +134,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index 4330957f9..0819cab9d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -133,7 +133,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
index a82273d39..3dc9f726b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.10.golden.yaml
@@ -132,7 +132,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index 4845afa05..77fd14687 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -131,7 +131,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index d7f2edb98..ce6662432 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -131,7 +131,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 51ce5b1b3..562e22fa4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -143,7 +143,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
index 93d2363c3..92efabcb1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.14.golden.yaml
@@ -143,7 +143,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
index 4f6c9aadd..0975c61e7 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.15.golden.yaml
@@ -143,7 +143,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
index 7d588ce5c..1bfd367ee 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.16.golden.yaml
@@ -140,7 +140,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - 1234,1235
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
index acc7abcde..3e536c942 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -140,7 +140,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - 1234,5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
index 5dc7c7d25..5f5e3e2f6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -140,7 +140,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
index 029e3c690..e7726db72 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -149,7 +149,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
index fa4917020..a1e36cb1b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
@@ -149,7 +149,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
index b43eab794..a84da41cb 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.21.golden.yaml
@@ -156,7 +156,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
index 17419e925..04dd68d02 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.22.golden.yaml
@@ -144,7 +144,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
index af31d9193..bd63d43f0 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.23.golden.yaml
@@ -153,7 +153,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
index 8099533bf..145b4471e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.24.golden.yaml
@@ -154,7 +154,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
index 9a93cd216..f4665a60d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.25.golden.yaml
@@ -153,7 +153,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
index 97ac35d2f..7834f5500 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.26.golden.yaml
@@ -129,7 +129,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
index 0ec0ac004..e5eeeb445 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.27.golden.yaml
@@ -125,7 +125,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
index e6aaf36f4..205229eef 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.28.golden.yaml
@@ -133,7 +133,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
index e05df62e8..801514495 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.29.golden.yaml
@@ -135,7 +135,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
index 05fe2dc88..48a620f23 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.30.golden.yaml
@@ -129,7 +129,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
index ea9e893f9..3500ea6f0 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.31.golden.yaml
@@ -135,7 +135,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
index 87423a040..16585eb2d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.32.golden.yaml
@@ -125,7 +125,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
index 99959cf54..169218e73 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.33.golden.yaml
@@ -138,7 +138,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml
index 645d24b44..b54470f5f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.35.golden.yaml
@@ -154,7 +154,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml
index 8972dc160..0fa2778b6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.36.golden.yaml
@@ -139,7 +139,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml
index b41e50a35..bac11184d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.37.golden.yaml
@@ -139,7 +139,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml
index 7e090dc8d..a6b1a5980 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.38.golden.yaml
@@ -139,7 +139,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml
index 0af0a4a60..ab9a19cf4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.39.golden.yaml
@@ -139,7 +139,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
index 3e5b72eed..ed488c359 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.01.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
index 7d0af9610..f27ce0718 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.02.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
index 782242e78..227df7c75 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.03.golden.yaml
@@ -98,7 +98,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
index 4c49bb469..d082955ed 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.04.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
index c1b5ad394..6f5987c42 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.05.golden.yaml
@@ -33,7 +33,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
index b92d4f20b..003c47cfe 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.06.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=false
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
index 3e5b72eed..ed488c359 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.07.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
index 6baebe33a..c22d14dee 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.08.golden.yaml
@@ -39,7 +39,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
index b566ca1d1..0bf660655 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.09.golden.yaml
@@ -38,7 +38,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
index 386cff8da..9d80e5d0b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.10.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
index c8e7ac539..99668f8ef 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.11.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
index 0f7143332..f9437b933 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.12.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
index 03ec5bedf..e35752219 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.13.golden.yaml
@@ -48,7 +48,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
index 89d6cabe8..cdaf09ac5 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.14.golden.yaml
@@ -48,7 +48,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
index f14f97e3e..0ca388845 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.15.golden.yaml
@@ -48,7 +48,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
index 89ed3d336..589ac1d39 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.16.golden.yaml
@@ -38,7 +38,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - 1234,1235
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
index c9617abd8..ae77b8ca3 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.17.golden.yaml
@@ -38,7 +38,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - 1234,5678
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
index 231c35592..f2fc52ab6 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.18.golden.yaml
@@ -38,7 +38,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
index 033d9eb8c..29bcdc6c0 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.19.golden.yaml
@@ -54,7 +54,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
index fcceb7b01..7808e354b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.20.golden.yaml
@@ -54,7 +54,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
index 5142f63cd..56e047b50 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.21.golden.yaml
@@ -61,7 +61,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
index bacfd89d7..a9583444e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.22.golden.yaml
@@ -38,7 +38,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
index e3e9b12d3..8641d658f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.23.golden.yaml
@@ -41,7 +41,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
index 1002135ed..ed998153d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.24.golden.yaml
@@ -42,7 +42,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
index 7907650e9..66ae4a899 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.25.golden.yaml
@@ -41,7 +41,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
index 4620e271a..2a29b0ce1 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.26.golden.yaml
@@ -34,7 +34,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
index 0960e43a4..e2f9d1cb0 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.27.golden.yaml
@@ -33,7 +33,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
index df9f3307b..3d34fbe2e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.28.golden.yaml
@@ -35,7 +35,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
index 902b30cb1..a23c88da9 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.29.golden.yaml
@@ -35,7 +35,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
index b55db6053..997a55669 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.30.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
index d2dc75a45..aac58fe6f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.31.golden.yaml
@@ -34,7 +34,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
index ddcbc923b..eb3cba7e8 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.32.golden.yaml
@@ -33,7 +33,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
index 1eaec6736..309751a91 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.33.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml
index 5c14b8d9e..353b1fc7d 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.35.golden.yaml
@@ -36,7 +36,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml
index c24dfc150..d1be0e26f 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.36.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml
index 1c5534538..2b0deaaac 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.37.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml
index c50b91616..1a9c9d19c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.38.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml
index 3e0a6058f..228ae1656 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.sidecar-feature.39.golden.yaml
@@ -37,7 +37,7 @@ spec:
     - --redirect-inbound=true
     - --redirect-inbound-port
     - "15006"
-    - --kuma-dp-uid
+    - --kuma-dp-user
     - "5678"
     - --exclude-inbound-ports
     - ""
diff --git a/pkg/transparentproxy/kubernetes/kubernetes_test.go b/pkg/transparentproxy/kubernetes/kubernetes_test.go
index 8ec9f0f43..83b7432c6 100644
--- a/pkg/transparentproxy/kubernetes/kubernetes_test.go
+++ b/pkg/transparentproxy/kubernetes/kubernetes_test.go
@@ -64,7 +64,7 @@ var _ = Describe("kubernetes", func() {
 				"--redirect-outbound-port", "25100",
 				"--redirect-inbound=" + "true",
 				"--redirect-inbound-port", "25204",
-				"--kuma-dp-uid", "12345",
+				"--kuma-dp-user", "12345",
 				"--exclude-inbound-ports", "12000",
 				"--exclude-outbound-ports", "11000",
 				"--verbose",
@@ -97,7 +97,7 @@ var _ = Describe("kubernetes", func() {
 				"--redirect-outbound-port", "25100",
 				"--redirect-inbound=" + "true",
 				"--redirect-inbound-port", "25204",
-				"--kuma-dp-uid", "12345",
+				"--kuma-dp-user", "12345",
 				"--exclude-inbound-ports", "12000",
 				"--exclude-outbound-ports", "11000",
 				"--verbose",
@@ -122,7 +122,7 @@ var _ = Describe("kubernetes", func() {
 				"--redirect-outbound-port", "25100",
 				"--redirect-inbound=" + "true",
 				"--redirect-inbound-port", "25204",
-				"--kuma-dp-uid", "12345",
+				"--kuma-dp-user", "12345",
 				"--exclude-inbound-ports", "12000",
 				"--exclude-outbound-ports", "11000",
 				"--verbose",
@@ -149,7 +149,7 @@ var _ = Describe("kubernetes", func() {
 				"--redirect-outbound-port", "25100",
 				"--redirect-inbound=" + "false",
 				"--redirect-inbound-port", "25204",
-				"--kuma-dp-uid", "12345",
+				"--kuma-dp-user", "12345",
 				"--exclude-inbound-ports", "12000",
 				"--exclude-outbound-ports", "11000",
 				"--verbose",
@@ -183,7 +183,7 @@ var _ = Describe("kubernetes", func() {
 				"--redirect-outbound-port", "25100",
 				"--redirect-inbound=" + "false",
 				"--redirect-inbound-port", "25204",
-				"--kuma-dp-uid", "12345",
+				"--kuma-dp-user", "12345",
 				"--exclude-inbound-ports", "12000",
 				"--exclude-outbound-ports", "11000",
 				"--verbose",
diff --git a/test/blackbox_network_tests/dns_test.go b/test/blackbox_network_tests/dns_test.go
index 63b1f6e04..7c0c77aeb 100644
--- a/test/blackbox_network_tests/dns_test.go
+++ b/test/blackbox_network_tests/dns_test.go
@@ -224,7 +224,7 @@ var _ = Describe("Outbound IPv6 DNS/UDP traffic to port 53", func() {
 						},
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -400,7 +400,7 @@ var _ = Describe("Outbound IPv6 DNS/UDP traffic to port 53", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -476,7 +476,7 @@ var _ = Describe("Outbound IPv6 DNS/TCP traffic to port 53", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -687,7 +687,7 @@ var _ = Describe("Outbound IPv6 DNS/UDP conntrack zone splitting", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				Owner:         config.Owner{UID: strconv.Itoa(int(uid))},
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
@@ -873,7 +873,7 @@ var _ = Describe("Outbound IPv6 DNS/UDP traffic to port 53 only for addresses in
 					},
 				},
 				RuntimeStdout: io.Discard,
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
 
@@ -1182,7 +1182,7 @@ var _ = Describe("Outbound IPv6 DNS/UDP traffic to port 53 from specific input i
 					// interface name and its network
 					VNet: config.VNet{Networks: []string{"s-peer+:fd00::10:1:2/64"}},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
diff --git a/test/blackbox_network_tests/inbound_redirect_test.go b/test/blackbox_network_tests/inbound_redirect_test.go
index 9ebef7e6b..267a201d5 100644
--- a/test/blackbox_network_tests/inbound_redirect_test.go
+++ b/test/blackbox_network_tests/inbound_redirect_test.go
@@ -124,7 +124,7 @@ var _ = Describe("Inbound IPv6 TCP traffic from any ports", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 				Log: config.LogConfig{
 					Enabled: true,
@@ -294,7 +294,7 @@ var _ = Describe("Inbound IPv6 TCP traffic from any ports except excluded ones",
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -480,7 +480,7 @@ var _ = Describe("Inbound IPv6 TCP traffic only from included ports", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -650,7 +650,7 @@ var _ = Describe("Inbound IPv6 TCP traffic from any ports", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
diff --git a/test/blackbox_network_tests/outbound_redirect_test.go b/test/blackbox_network_tests/outbound_redirect_test.go
index 54dfe1eb3..c8aab52bd 100644
--- a/test/blackbox_network_tests/outbound_redirect_test.go
+++ b/test/blackbox_network_tests/outbound_redirect_test.go
@@ -127,7 +127,7 @@ var _ = Describe("Outbound IPv6 TCP traffic to any address:port", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -442,7 +442,7 @@ var _ = Describe("Outbound IPv6 TCP traffic to any address:port except excluded
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 				Log: config.LogConfig{
 					Enabled: true,
@@ -641,7 +641,7 @@ var _ = Describe("Outbound IPv6 TCP traffic only to included port", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -815,7 +815,7 @@ var _ = Describe("Outbound IPv6 TCP traffic to any address:port", func() {
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -909,7 +909,7 @@ var _ = Describe("Outbound IPv6 TCP traffic to any address:port except ports exc
 						Enabled: true,
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
@@ -1110,7 +1110,7 @@ var _ = Describe("Outbound IPv6 TCP traffic from specific interface to other ip
 						Networks: []string{"s-peer+:fd00::10:1:1/128"},
 					},
 				},
-				IPv6:          true,
+				IPFamilyMode:  config.IPFamilyModeDualStack,
 				RuntimeStdout: io.Discard,
 			}.Initialize(context.Background())
 			Expect(err).ToNot(HaveOccurred())
diff --git a/test/framework/universal_app.go b/test/framework/universal_app.go
index c3f39d944..5372e0251 100644
--- a/test/framework/universal_app.go
+++ b/test/framework/universal_app.go
@@ -484,7 +484,6 @@ func (s *UniversalApp) setupTransparent(builtindns bool) {
 	args := []string{
 		"/usr/bin/kumactl", "install", "transparent-proxy",
 		"--kuma-dp-user", "kuma-dp",
-		"--kuma-dp-uid", "5678",
 		"--skip-dns-conntrack-zone-split",
 		"--exclude-inbound-ports", "22",
 	}