Repository: linkerd/linkerd2
Pull request #13250 (2024-10-31 09:01:09)

policy: Make global egress network namespace configurable
In a previous PR (#13246) we introduced an egress networks namespace that is used to create `EgressNetwork` objects that affect all client workloads.

This change makes this namespace configurable through helm values. Additionally, we unify the naming convention of the arguments to use **egress** as opposed to **external**

Signed-off-by: Zahari Dichev <zaharidichev@gmail.com>


Patch:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e3315d9c5..fa273a591 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -199,7 +199,7 @@ jobs:
         #  mv choco/linkerd.*.nupkg "target/release/linkerd2-cli-stable-$v.nupkg" || true
       - name: Create release
         id: create_release
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191
+        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8
         with:
           name: "${{ needs.tag.outputs.tag }}"
           generate_release_notes: true
@@ -264,7 +264,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Log into GCP
-        uses: "google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70"
+        uses: "google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f"
         with:
           credentials_json: ${{ secrets.LINKERD_SITE_TOKEN }}
       - name: Edge Helm chart creation and upload
diff --git a/Cargo.lock b/Cargo.lock
index ccd919e62..646e8520b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -97,7 +97,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -108,7 +108,7 @@ checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -299,7 +299,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -373,7 +373,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -384,7 +384,7 @@ checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -553,7 +553,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1049,7 +1049,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_json",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1468,7 +1468,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1584,7 +1584,7 @@ dependencies = [
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1615,7 +1615,7 @@ checksum = "3c0f5fad0874fc7abcd4d750e76917eaebbecaa2c20bde22e1dbeeba8beb758c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1697,7 +1697,7 @@ checksum = "440f724eba9f6996b75d63681b0a92b06947f1457076d503a4d2e2c8f56442b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1720,7 +1720,7 @@ dependencies = [
  "itertools",
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -1943,7 +1943,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -2022,7 +2022,7 @@ checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -2033,7 +2033,7 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -2157,9 +2157,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.82"
+version = "2.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83540f837a8afc019423a8edb95b52a8effe46957ee402287f4292fae35be021"
+checksum = "e89275301d38033efb81a6e60e3497e734dfcc62571f2854bf4b16690398824c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2174,22 +2174,22 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "thiserror"
-version = "1.0.65"
+version = "1.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d11abd9594d9b38965ef50805c5e469ca9cc6f197f883f717e0269a3057b3d5"
+checksum = "5d171f59dbaa811dbbb1aee1e73db92ec2b122911a48e1390dfe327a821ddede"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.65"
+version = "1.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae71770322cbd277e69d762a16c444af02aa0575ac0d174f0b9562d3b37f8602"
+checksum = "b08be0f17bd307950653ce45db00cd31200d82b624b36e181337d9c7d92765b5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -2253,7 +2253,7 @@ checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -2440,7 +2440,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
@@ -2636,7 +2636,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
  "wasm-bindgen-shared",
 ]
 
@@ -2658,7 +2658,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -2791,7 +2791,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.82",
+ "syn 2.0.86",
 ]
 
 [[package]]
diff --git a/charts/linkerd-control-plane/README.md b/charts/linkerd-control-plane/README.md
index 300c31eab..d951f43d0 100644
--- a/charts/linkerd-control-plane/README.md
+++ b/charts/linkerd-control-plane/README.md
@@ -166,6 +166,7 @@ Kubernetes: `>=1.22.0-0`
 | destinationController.readinessProbe.timeoutSeconds | int | `1` |  |
 | disableHeartBeat | bool | `false` | Set to true to not start the heartbeat cronjob |
 | disableIPv6 | bool | `true` | disables routing IPv6 traffic in addition to IPv4 traffic through the proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni v1.4.0) |
+| egress.globalEgressNetworkNamespace | string | `"linkerd-egress"` | The namespace that is used to store egress configuration that affects all client workloads in the cluster |
 | enableEndpointSlices | bool | `true` | enables the use of EndpointSlice informers for the destination service; enableEndpointSlices should be set to true only if EndpointSlice K8s feature gate is on |
 | enableH2Upgrade | bool | `true` | Allow proxies to perform transparent HTTP/2 upgrading |
 | enablePSP | bool | `false` | Add a PSP resource and bind it to the control plane ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
diff --git a/charts/linkerd-control-plane/templates/destination.yaml b/charts/linkerd-control-plane/templates/destination.yaml
index f6eb4d444..41395c21a 100644
--- a/charts/linkerd-control-plane/templates/destination.yaml
+++ b/charts/linkerd-control-plane/templates/destination.yaml
@@ -348,6 +348,7 @@ spec:
         - --log-level={{.Values.policyController.logLevel | default "linkerd=info,warn"}}
         - --log-format={{.Values.controllerLogFormat}}
         - --default-opaque-ports={{.Values.proxy.opaquePorts}}
+        - --global-egress-network-namespace={{.Values.egress.globalEgressNetworkNamespace}}
         {{- if .Values.policyController.probeNetworks }}
         - --probe-networks={{.Values.policyController.probeNetworks | join ","}}
         {{- end}}
diff --git a/charts/linkerd-control-plane/values.yaml b/charts/linkerd-control-plane/values.yaml
index c51a4eb5a..543be4bdf 100644
--- a/charts/linkerd-control-plane/values.yaml
+++ b/charts/linkerd-control-plane/values.yaml
@@ -662,3 +662,10 @@ podMonitor:
   proxy:
     # -- Enables the creation of PodMonitor for the data-plane
     enabled: true
+
+
+# Egress related configuration
+egress:
+  # -- The namespace that is used to store egress configuration that affects all client workloads in the cluster
+  globalEgressNetworkNamespace: linkerd-egress
+  
\ No newline at end of file
diff --git a/charts/linkerd-crds/README.md b/charts/linkerd-crds/README.md
index e1c865613..90eff2c4f 100644
--- a/charts/linkerd-crds/README.md
+++ b/charts/linkerd-crds/README.md
@@ -66,6 +66,8 @@ Kubernetes: `>=1.22.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | enableHttpRoutes | bool | `true` |  |
+| enableTcpRoutes | bool | `true` |  |
+| enableTlsRoutes | bool | `true` |  |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0)
diff --git a/go.mod b/go.mod
index a0fc728fe..882484b5e 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/emicklei/proto v1.13.2
 	github.com/evanphx/json-patch v5.9.0+incompatible
 	github.com/fatih/color v1.18.0
-	github.com/fsnotify/fsnotify v1.7.0
+	github.com/fsnotify/fsnotify v1.8.0
 	github.com/go-openapi/spec v0.21.0
 	github.com/go-test/deep v1.1.1
 	github.com/golang/protobuf v1.5.4
@@ -43,13 +43,13 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 	helm.sh/helm/v3 v3.16.2
 	k8s.io/api v0.31.2
-	k8s.io/apiextensions-apiserver v0.31.1
+	k8s.io/apiextensions-apiserver v0.31.2
 	k8s.io/apimachinery v0.31.2
 	k8s.io/client-go v0.31.2
-	k8s.io/code-generator v0.31.1
+	k8s.io/code-generator v0.31.2
 	k8s.io/endpointslice v0.31.2
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kube-aggregator v0.31.1
+	k8s.io/kube-aggregator v0.31.2
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	sigs.k8s.io/gateway-api v0.8.1
 	sigs.k8s.io/yaml v1.4.0
diff --git a/go.sum b/go.sum
index 3b9090eeb..4d7d4a255 100644
--- a/go.sum
+++ b/go.sum
@@ -136,8 +136,8 @@ github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7Dlme
 github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
 github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -725,16 +725,16 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.31.2 h1:3wLBbL5Uom/8Zy98GRPXpJ254nEFpl+hwndmk9RwmL0=
 k8s.io/api v0.31.2/go.mod h1:bWmGvrGPssSK1ljmLzd3pwCQ9MgoTsRCuK35u6SygUk=
-k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40=
-k8s.io/apiextensions-apiserver v0.31.1/go.mod h1:tWMPR3sgW+jsl2xm9v7lAyRF1rYEK71i9G5dRtkknoQ=
+k8s.io/apiextensions-apiserver v0.31.2 h1:W8EwUb8+WXBLu56ser5IudT2cOho0gAKeTOnywBLxd0=
+k8s.io/apiextensions-apiserver v0.31.2/go.mod h1:i+Geh+nGCJEGiCGR3MlBDkS7koHIIKWVfWeRFiOsUcM=
 k8s.io/apimachinery v0.31.2 h1:i4vUt2hPK56W6mlT7Ry+AO8eEsyxMD1U44NR22CLTYw=
 k8s.io/apimachinery v0.31.2/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
 k8s.io/cli-runtime v0.31.1 h1:/ZmKhmZ6hNqDM+yf9s3Y4KEYakNXUn5sod2LWGGwCuk=
 k8s.io/cli-runtime v0.31.1/go.mod h1:pKv1cDIaq7ehWGuXQ+A//1OIF+7DI+xudXtExMCbe9U=
 k8s.io/client-go v0.31.2 h1:Y2F4dxU5d3AQj+ybwSMqQnpZH9F30//1ObxOKlTI9yc=
 k8s.io/client-go v0.31.2/go.mod h1:NPa74jSVR/+eez2dFsEIHNa+3o09vtNaWwWwb1qSxSs=
-k8s.io/code-generator v0.31.1 h1:GvkRZEP2g2UnB2QKT2Dgc/kYxIkDxCHENv2Q1itioVs=
-k8s.io/code-generator v0.31.1/go.mod h1:oL2ky46L48osNqqZAeOcWWy0S5BXj50vVdwOtTefqIs=
+k8s.io/code-generator v0.31.2 h1:xLWxG0HEpMSHfcM//3u3Ro2Hmc6AyyLINQS//Z2GEOI=
+k8s.io/code-generator v0.31.2/go.mod h1:eEQHXgBU/m7LDaToDoiz3t97dUUVyOblQdwOr8rivqc=
 k8s.io/component-base v0.31.2 h1:Z1J1LIaC0AV+nzcPRFqfK09af6bZ4D1nAOpWsy9owlA=
 k8s.io/component-base v0.31.2/go.mod h1:9PeyyFN/drHjtJZMCTkSpQJS3U9OXORnHQqMLDz0sUQ=
 k8s.io/endpointslice v0.31.2 h1:FzelGpchzLs92ULniao/rFSq08ewMzAA3Clw+WOgl3U=
@@ -743,8 +743,8 @@ k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 h1:NGrVE502P0s0/1hudf8zjgwki1
 k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-aggregator v0.31.1 h1:vrYBTTs3xMrpiEsmBjsLETZE9uuX67oQ8B3i1BFfMPw=
-k8s.io/kube-aggregator v0.31.1/go.mod h1:+aW4NX50uneozN+BtoCxI4g7ND922p8Wy3tWKFDiWVk=
+k8s.io/kube-aggregator v0.31.2 h1:Uw1zUP2D/4wiSjKWVVzSOcCGLuW/+IdRwjjC0FJooYU=
+k8s.io/kube-aggregator v0.31.2/go.mod h1:41/VIXH+/Qcg9ERNAY6bRF/WQR6xL1wFgYagdHac1X4=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index d34bb3730..8f3533a3c 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -89,6 +89,12 @@ type (
 		DestinationProxyResources   *Resources `json:"destinationProxyResources"`
 		IdentityProxyResources      *Resources `json:"identityProxyResources"`
 		ProxyInjectorProxyResources *Resources `json:"proxyInjectorProxyResources"`
+		Egress                      *Egress    `json:"egress"`
+	}
+
+	// Resources represents the computational resources setup for a given container
+	Egress struct {
+		GlobalEgressNetworkNamespace string `json:"globalEgressNetworkNamespace"`
 	}
 
 	// Controller contains the fields to set the controller container
diff --git a/policy-controller/k8s/index/src/cluster_info.rs b/policy-controller/k8s/index/src/cluster_info.rs
index 00213ad2a..f360f8a76 100644
--- a/policy-controller/k8s/index/src/cluster_info.rs
+++ b/policy-controller/k8s/index/src/cluster_info.rs
@@ -35,7 +35,7 @@ pub struct ClusterInfo {
 
     /// The namespace that is designated for egress configuration
     /// affecting all workloads across the cluster
-    pub global_external_network_namespace: Arc<String>,
+    pub global_egress_network_namespace: Arc<String>,
 }
 
 impl ClusterInfo {
diff --git a/policy-controller/k8s/index/src/outbound/index.rs b/policy-controller/k8s/index/src/outbound/index.rs
index 60546d760..9486fbf87 100644
--- a/policy-controller/k8s/index/src/outbound/index.rs
+++ b/policy-controller/k8s/index/src/outbound/index.rs
@@ -33,7 +33,7 @@ pub struct Index {
     resource_info: HashMap<ResourceRef, ResourceInfo>,
 
     cluster_networks: Vec<linkerd_k8s_api::Cidr>,
-    global_external_network_namespace: Arc<String>,
+    global_egress_network_namespace: Arc<String>,
 
     // holds a no-op sender to which all clients that have been returned
     // a Fallback policy are subsribed. It is used to force these clients
@@ -405,8 +405,7 @@ impl kubert::index::IndexNamespacedResource<linkerd_k8s_api::EgressNetwork> for
 impl Index {
     pub fn shared(cluster_info: Arc<ClusterInfo>) -> SharedIndex {
         let cluster_networks = cluster_info.networks.clone();
-        let global_external_network_namespace =
-            cluster_info.global_external_network_namespace.clone();
+        let global_egress_network_namespace = cluster_info.global_egress_network_namespace.clone();
 
         let (fallback_polcy_tx, _) = watch::channel(());
         Arc::new(RwLock::new(Self {
@@ -419,7 +418,7 @@ impl Index {
             resource_info: HashMap::default(),
             cluster_networks: cluster_networks.into_iter().map(Cidr::from).collect(),
             fallback_polcy_tx,
-            global_external_network_namespace,
+            global_egress_network_namespace,
         }))
     }
 
@@ -495,7 +494,7 @@ impl Index {
         egress_network::resolve_egress_network(
             addr,
             source_namespace,
-            &self.global_external_network_namespace,
+            &self.global_egress_network_namespace,
             self.egress_networks_by_ref.values(),
         )
         .map(|r| (r.namespace, r.name))
diff --git a/policy-controller/k8s/index/src/outbound/index/egress_network.rs b/policy-controller/k8s/index/src/outbound/index/egress_network.rs
index 3d2424b8a..3f361e76f 100644
--- a/policy-controller/k8s/index/src/outbound/index/egress_network.rs
+++ b/policy-controller/k8s/index/src/outbound/index/egress_network.rs
@@ -67,12 +67,12 @@ impl EgressNetwork {
 pub(crate) fn resolve_egress_network<'n>(
     addr: IpAddr,
     source_namespace: String,
-    global_external_network_namespace: &str,
+    global_egress_network_namespace: &str,
     nets: impl Iterator<Item = &'n EgressNetwork>,
 ) -> Option<super::ResourceRef> {
     let (same_ns, rest): (Vec<_>, Vec<_>) = nets
         .filter(|en| {
-            en.namespace == source_namespace || en.namespace == *global_external_network_namespace
+            en.namespace == source_namespace || en.namespace == *global_egress_network_namespace
         })
         .partition(|un| un.namespace == source_namespace);
     let to_pick_from = if !same_ns.is_empty() { same_ns } else { rest };
diff --git a/policy-controller/src/main.rs b/policy-controller/src/main.rs
index 13e371ea2..a6facb367 100644
--- a/policy-controller/src/main.rs
+++ b/policy-controller/src/main.rs
@@ -101,8 +101,8 @@ struct Args {
     #[clap(long)]
     allow_l5d_request_headers: bool,
 
-    #[clap(long, default_value = "linkerd-external")]
-    global_external_network_namespace: String,
+    #[clap(long, default_value = "linkerd-egress")]
+    global_egress_network_namespace: String,
 }
 
 #[tokio::main]
@@ -125,7 +125,7 @@ async fn main() -> Result<()> {
         default_opaque_ports,
         patch_timeout_ms,
         allow_l5d_request_headers,
-        global_external_network_namespace,
+        global_egress_network_namespace,
     } = Args::parse();
 
     let server = if admission_controller_disabled {
@@ -135,7 +135,7 @@ async fn main() -> Result<()> {
     };
 
     let probe_networks = probe_networks.map(|IpNets(nets)| nets).unwrap_or_default();
-    let global_external_network_namespace = Arc::new(global_external_network_namespace);
+    let global_egress_network_namespace = Arc::new(global_egress_network_namespace);
     let default_opaque_ports = parse_portset(&default_opaque_ports)?;
     let cluster_info = Arc::new(ClusterInfo {
         networks: cluster_networks.clone(),
@@ -146,7 +146,7 @@ async fn main() -> Result<()> {
         default_detect_timeout: DETECT_TIMEOUT,
         default_opaque_ports,
         probe_networks,
-        global_external_network_namespace,
+        global_egress_network_namespace,
     });
 
     // Build the API index data structures which will maintain information


Test patch:
diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
index 2f1e1bd02..717acd340 100644
--- a/cli/cmd/install_test.go
+++ b/cli/cmd/install_test.go
@@ -161,6 +161,7 @@ func TestRender(t *testing.T) {
 		ProxyInjector:      defaultValues.ProxyInjector,
 		ProfileValidator:   defaultValues.ProfileValidator,
 		PolicyValidator:    defaultValues.PolicyValidator,
+		Egress:             defaultValues.Egress,
 	}
 
 	haValues, err := testInstallOptionsHA(true)
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index f298d1772..a596706a2 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1620,6 +1622,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 3569ddddb..9346fd49a 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1618,6 +1620,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index e3533592a..1b954e22b 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1618,6 +1620,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: my.custom.registry/linkerd-io/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 3569ddddb..9346fd49a 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1618,6 +1620,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 0f9a680d3..1e1abffcf 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1618,6 +1620,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index 5f6e5eefd..7ba108b06 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1607,6 +1609,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_gid_output.golden b/cli/cmd/testdata/install_gid_output.golden
index 4eea9b424..33a7c9d06 100755
--- a/cli/cmd/testdata/install_gid_output.golden
+++ b/cli/cmd/testdata/install_gid_output.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1625,6 +1627,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 68983ffec..1e7f0c5d8 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -552,6 +552,8 @@ data:
         request: 50Mi
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1751,6 +1753,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 31744bf6e..d3b2aabc7 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -552,6 +552,8 @@ data:
         request: 50Mi
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1751,6 +1753,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index af250a3cb..f62a3f131 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -474,6 +474,8 @@ data:
     destinationResources: null
     disableHeartBeat: true
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1549,6 +1551,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index 3e9ac80f1..88fe31eed 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -544,6 +544,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1593,6 +1595,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:linkerd-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index 7292e33f3..c835b3509 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -553,6 +553,8 @@ data:
         request: 50Mi
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1726,6 +1728,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:linkerd-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
index 1ae526fcd..bdd907607 100755
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
@@ -553,6 +553,8 @@ data:
         request: 50Mi
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1733,6 +1735,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:linkerd-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 0fb773341..1e052097a 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -553,6 +553,8 @@ data:
         request: 50Mi
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1738,6 +1740,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:linkerd-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index f8dd7d535..523baca20 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -548,6 +548,8 @@ data:
         request: 50Mi
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: true
@@ -1716,6 +1718,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:linkerd-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 8757c76e3..94f6d555b 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1611,6 +1613,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 932add8be..7e4a83127 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -523,6 +523,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: false
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: false
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1549,6 +1551,7 @@ spec:
         - --log-level=log-level
         - --log-format=ControllerLogFormat
         - --default-opaque-ports=25,443,587,3306,5432,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=1.0.0.0/0,2.0.0.0/0
         image: PolicyControllerImageName:PolicyControllerVersion
         imagePullPolicy: ImagePullPolicy
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index a83653692..f0a655f93 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1618,6 +1620,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 6b2b1e34a..97add172d 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -543,6 +543,8 @@ data:
     destinationResources: null
     disableHeartBeat: false
     disableIPv6: true
+    egress:
+      globalEgressNetworkNamespace: linkerd-egress
     enableEndpointSlices: true
     enableH2Upgrade: true
     enablePodAntiAffinity: false
@@ -1618,6 +1620,7 @@ spec:
         - --log-level=info
         - --log-format=plain
         - --default-opaque-ports=25,587,3306,4444,5432,6379,9300,11211
+        - --global-egress-network-namespace=linkerd-egress
         - --probe-networks=0.0.0.0/0,::/0
         image: cr.l5d.io/linkerd/policy-controller:install-control-plane-version
         imagePullPolicy: IfNotPresent
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index 4ac0e8506..c63f04c80 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -249,6 +249,7 @@ func TestNewValues(t *testing.T) {
 		ProxyInjector:    &ProxyInjector{Webhook: Webhook{TLS: &TLS{}, NamespaceSelector: namespaceSelectorInjector}},
 		ProfileValidator: &Webhook{TLS: &TLS{}, NamespaceSelector: namespaceSelectorSimple},
 		PolicyValidator:  &Webhook{TLS: &TLS{}, NamespaceSelector: namespaceSelectorSimple},
+		Egress:           &Egress{GlobalEgressNetworkNamespace: "linkerd-egress"},
 	}
 
 	// pin the versions to ensure consistent test result.
diff --git a/policy-controller/k8s/index/src/inbound/tests.rs b/policy-controller/k8s/index/src/inbound/tests.rs
index cb668ed82..2b0e09910 100644
--- a/policy-controller/k8s/index/src/inbound/tests.rs
+++ b/policy-controller/k8s/index/src/inbound/tests.rs
@@ -225,7 +225,7 @@ impl TestConfig {
             default_detect_timeout: detect_timeout,
             default_opaque_ports: Default::default(),
             probe_networks,
-            global_external_network_namespace: Arc::new("linkerd-external".to_string()),
+            global_egress_network_namespace: Arc::new("linkerd-egress".to_string()),
         };
         let index = Index::shared(cluster.clone());
         Self {
diff --git a/policy-controller/k8s/index/src/outbound/tests.rs b/policy-controller/k8s/index/src/outbound/tests.rs
index 4c91dbe0a..83ef6937d 100644
--- a/policy-controller/k8s/index/src/outbound/tests.rs
+++ b/policy-controller/k8s/index/src/outbound/tests.rs
@@ -84,7 +84,7 @@ impl TestConfig {
             default_detect_timeout: detect_timeout,
             default_opaque_ports: Default::default(),
             probe_networks,
-            global_external_network_namespace: Arc::new("linkerd-external".to_string()),
+            global_egress_network_namespace: Arc::new("linkerd-egress".to_string()),
         };
         let index = Index::shared(Arc::new(cluster));
         Self { index }