Repository: linkerd/linkerd2
Pull request #12658 (2024-05-28 23:38:34)

feat(cli): Add json output to link, unlink, allow, and allow-scrapes commands
We add an `-o/--output` flag to the remaining commands which render kubernetes resources and do not yet have this flag.  The supported values for this flag are "yaml" (default) and "json".  The commands are:

* linkerd mulitcluster allow
* linkerd multicluster link
* linkerd multicluster unlink
* linkerd viz allow-scrapes

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->


adleong: Marking as draft until https://github.com/linkerd/linkerd2/pull/12641 merges so that we can reuse library functions defined there.

Patch:
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index e0b706f5f..4aa3f7d15 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
       - run: go install gotest.tools/gotestsum@v0.4.2
       - run: gotestsum -- -cover -coverprofile=coverage.out -v -mod=readonly ./...
-      - uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c
+      - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673
         with:
           files: ./coverage.out
           flags: unittests,golang
@@ -41,7 +41,7 @@ jobs:
           export NODE_ENV=test
           bin/web --frozen-lockfile
           bin/web test --reporters="jest-progress-bar-reporter" --reporters="./gh_ann_reporter.js" --coverage
-      - uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c
+      - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673
         with:
           directory: ./web/app/coverage
           flags: unittests,javascript
@@ -58,6 +58,6 @@ jobs:
       - shell: bash
         run: mkdir -p target && cd target && bin/scurl -v https://github.com/xd009642/tarpaulin/releases/download/0.27.3/cargo-tarpaulin-x86_64-unknown-linux-musl.tar.gz | tar zxvf - && chmod 755 cargo-tarpaulin
       - run: target/cargo-tarpaulin tarpaulin --workspace --out Xml
-      - uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c
+      - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673
         with:
           flags: unittests,rust
diff --git a/.proxy-version b/.proxy-version
index 702d1b4e4..371db4ec0 100644
--- a/.proxy-version
+++ b/.proxy-version
@@ -1,1 +1,1 @@
-v2.235.0
+v2.236.0
diff --git a/Cargo.lock b/Cargo.lock
index 5880edf32..4bfc07789 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -178,9 +178,9 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.72"
+version = "0.3.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17c6a35df3749d2e8bb1b7b21a976d82b15548788d2735b9d82f329268f71a11"
+checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
 dependencies = [
  "addr2line",
  "cc",
@@ -421,6 +421,17 @@ dependencies = [
  "crypto-common",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "drain"
 version = "0.1.2"
@@ -711,9 +722,9 @@ checksum = "add0ab9360ddbd88cfeb3bd9574a1d85cfdfa14db10b3e21d3700dbc4328758f"
 
 [[package]]
 name = "httparse"
-version = "1.9.2"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f3935c160d00ac752e09787e6e6bfc26494c2183cc922f1bc678a60d4733bc2"
+checksum = "d0e7a4dd27b9476dc40cb050d3632d3bba3a70ddbff012285f7f8559a1e7e545"
 
 [[package]]
 name = "httpdate"
@@ -814,6 +825,124 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f8ac670d7422d7f76b32e17a5db556510825b29ec9154f235977c9caba61036"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -822,12 +951,14 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "idna"
-version = "0.5.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+checksum = "4716a3a0933a1d01c2f72450e89596eb51dd34ef3c211ccd875acdf1f8fe47ed"
 dependencies = [
- "unicode-bidi",
- "unicode-normalization",
+ "icu_normalizer",
+ "icu_properties",
+ "smallvec",
+ "utf8_iter",
 ]
 
 [[package]]
@@ -1341,6 +1472,12 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
+[[package]]
+name = "litemap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704"
+
 [[package]]
 name = "lock_api"
 version = "0.4.12"
@@ -1380,9 +1517,9 @@ checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "mime"
@@ -1441,9 +1578,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.35.0"
+version = "0.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8ec7ab813848ba4522158d5517a6093db1ded27575b070f4177b8d12b41db5e"
+checksum = "576dfe1fc8f9df304abb159d767a29d0476f7750fbf8aa7ad07816004a207434"
 dependencies = [
  "memchr",
 ]
@@ -2137,6 +2274,12 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -2171,6 +2314,17 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.61"
@@ -2202,20 +2356,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "tinyvec"
-version = "1.6.0"
+name = "tinystr"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
 dependencies = [
- "tinyvec_macros",
+ "displaydoc",
+ "zerovec",
 ]
 
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "tokio"
 version = "1.38.0"
@@ -2533,27 +2682,12 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"
 
-[[package]]
-name = "unicode-bidi"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
-[[package]]
-name = "unicode-normalization"
-version = "0.1.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
-dependencies = [
- "tinyvec",
-]
-
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
@@ -2568,9 +2702,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.0"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
+checksum = "f7c25da092f0a868cdf09e8674cd3b7ef3a7d92a24253e663a2fb85e2496de56"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2583,6 +2717,18 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "valuable"
 version = "0.1.0"
@@ -2840,6 +2986,42 @@ version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
+[[package]]
+name = "yoke"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+ "synstructure",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.7.34"
@@ -2860,8 +3042,51 @@ dependencies = [
  "syn 2.0.66",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+
+[[package]]
+name = "zerovec"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb2cc8827d6c0994478a15c53f374f46fbd41bea663d809b14744bc42e6b109c"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97cf56601ee5052b4417d90c8755c6683473c926039908196cf35d99f893ebe7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
diff --git a/charts/linkerd-control-plane/README.md b/charts/linkerd-control-plane/README.md
index 6c57ad3ec..f69488440 100644
--- a/charts/linkerd-control-plane/README.md
+++ b/charts/linkerd-control-plane/README.md
@@ -252,7 +252,7 @@ Kubernetes: `>=1.22.0-0`
 | proxy.livenessProbe | object | `{"initialDelaySeconds":10,"timeoutSeconds":1}` | LivenessProbe timeout and delay configuration |
 | proxy.logFormat | string | `"plain"` | Log format (`plain` or `json`) for the proxy |
 | proxy.logHTTPHeaders | `off` or `insecure` | `"off"` | If set to `off`, will prevent the proxy from logging HTTP headers. If set to `insecure`, HTTP headers may be logged verbatim. Note that setting this to `insecure` is not alone sufficient to log HTTP headers; the proxy logLevel must also be set to debug. |
-| proxy.logLevel | string | `"warn,linkerd=info,trust_dns=error"` | Log level for the proxy |
+| proxy.logLevel | string | `"warn,linkerd=info,hickory=error"` | Log level for the proxy |
 | proxy.nativeSidecar | bool | `false` | Enable KEP-753 native sidecars This is an experimental feature. It requires Kubernetes >= 1.29. If enabled, .proxy.waitBeforeExitSeconds should not be used. |
 | proxy.opaquePorts | string | `"25,587,3306,4444,5432,6379,9300,11211"` | Default set of opaque ports - SMTP (25,587) server-first - MYSQL (3306) server-first - Galera (4444) server-first - PostgreSQL (5432) server-first - Redis (6379) server-first - ElasticSearch (9300) server-first - Memcached (11211) clients do not issue any preamble, which breaks detection |
 | proxy.outbound.server.http2.keepAliveInterval | string | `"10s"` | The interval at which PINGs are issued to local application HTTP/2 clients. |
@@ -282,7 +282,7 @@ Kubernetes: `>=1.22.0-0`
 | proxyInit.ignoreOutboundPorts | string | `"4567,4568"` | Default set of outbound ports to skip via iptables - Galera (4567,4568) |
 | proxyInit.image.name | string | `"cr.l5d.io/linkerd/proxy-init"` | Docker image for the proxy-init container |
 | proxyInit.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy-init container image |
-| proxyInit.image.version | string | `"v2.4.0"` | Tag for the proxy-init container image |
+| proxyInit.image.version | string | `"v2.4.1"` | Tag for the proxy-init container image |
 | proxyInit.iptablesMode | string | `"legacy"` | Variant of iptables that will be used to configure routing. Currently, proxy-init can be run either in 'nft' or in 'legacy' mode. The mode will control which utility binary will be called. The host must support whichever mode will be used |
 | proxyInit.kubeAPIServerPorts | string | `"443,6443"` | Default set of ports to skip via iptables for control plane components so they can communicate with the Kubernetes API Server |
 | proxyInit.logFormat | string | plain | Log format (`plain` or `json`) for the proxy-init |
diff --git a/charts/linkerd-control-plane/values.yaml b/charts/linkerd-control-plane/values.yaml
index d5e21e0e8..07188fe22 100644
--- a/charts/linkerd-control-plane/values.yaml
+++ b/charts/linkerd-control-plane/values.yaml
@@ -150,7 +150,7 @@ proxy:
     # @default -- linkerdVersion
     version: ""
   # -- Log level for the proxy
-  logLevel: warn,linkerd=info,trust_dns=error
+  logLevel: warn,linkerd=info,hickory=error
   # -- Log format (`plain` or `json`) for the proxy
   logFormat: plain
   # -- (`off` or `insecure`) If set to `off`, will prevent the proxy from
@@ -292,7 +292,7 @@ proxyInit:
     # @default -- imagePullPolicy
     pullPolicy: ""
     # -- Tag for the proxy-init container image
-    version: v2.4.0
+    version: v2.4.1
   resources:
     cpu:
       # -- Maximum amount of CPU units that the proxy-init container can use
diff --git a/charts/linkerd2-cni/README.md b/charts/linkerd2-cni/README.md
index f3d81767b..862b11dc6 100644
--- a/charts/linkerd2-cni/README.md
+++ b/charts/linkerd2-cni/README.md
@@ -25,14 +25,14 @@ Kubernetes: `>=1.22.0-0`
 | commonLabels | object | `{}` | Labels to apply to all resources |
 | destCNIBinDir | string | `"/opt/cni/bin"` | Directory on the host where the CNI configuration will be placed |
 | destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside |
-| disableIPv6 | bool | `false` | Disables adding IPv6 rules on top of IPv4 rules |
+| disableIPv6 | bool | `true` | Disables adding IPv6 rules on top of IPv4 rules |
 | enablePSP | bool | `false` | Add a PSP resource and bind it to the linkerd-cni ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
 | extraInitContainers | list | `[]` | Add additional initContainers to the daemonset |
 | ignoreInboundPorts | string | `""` | Default set of inbound ports to skip via iptables |
 | ignoreOutboundPorts | string | `""` | Default set of outbound ports to skip via iptables |
 | image.name | string | `"cr.l5d.io/linkerd/cni-plugin"` | Docker image for the CNI plugin |
 | image.pullPolicy | string | `"IfNotPresent"` | Pull policy for the linkerd-cni container |
-| image.version | string | `"v1.5.0"` | Tag for the CNI container Docker image |
+| image.version | string | `"v1.5.1"` | Tag for the CNI container Docker image |
 | imagePullSecrets | list | `[]` |  |
 | inboundProxyPort | int | `4143` | Inbound port for the proxy container |
 | iptablesMode | string | `"legacy"` | Variant of iptables that will be used to configure routing |
diff --git a/charts/linkerd2-cni/values.yaml b/charts/linkerd2-cni/values.yaml
index 8dd4672f4..dbebce81a 100644
--- a/charts/linkerd2-cni/values.yaml
+++ b/charts/linkerd2-cni/values.yaml
@@ -61,7 +61,7 @@ image:
   # -- Docker image for the CNI plugin
   name: "cr.l5d.io/linkerd/cni-plugin"
   # -- Tag for the CNI container Docker image
-  version: "v1.5.0"
+  version: "v1.5.1"
   # -- Pull policy for the linkerd-cni container
   pullPolicy: IfNotPresent
 
diff --git a/cli/cmd/diagnostics_profile.go b/cli/cmd/diagnostics_profile.go
index 713146d22..948a7560d 100644
--- a/cli/cmd/diagnostics_profile.go
+++ b/cli/cmd/diagnostics_profile.go
@@ -33,7 +33,7 @@ func newDiagProfileOptions() *diagProfileOptions {
 func newCmdDiagnosticsProfile() *cobra.Command {
 	options := newDiagProfileOptions()
 
-	example := `  # Get the service profile for the service or endopint at 10.20.2.4:8080
+	example := `  # Get the service profile for the service or endpoint at 10.20.2.4:8080
   linkerd diagnostics profile 10.20.2.4:8080`
 
 	cmd := &cobra.Command{
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index 7aa4dde44..06cf4d225 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -59,7 +59,7 @@
         "--outbound-ports-to-ignore",
         "4567,4568"
       ],
-      "image": "cr.l5d.io/linkerd/proxy-init:v2.4.0",
+      "image": "cr.l5d.io/linkerd/proxy-init:v2.4.1",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
@@ -181,7 +181,7 @@
         },
         {
           "name": "LINKERD2_PROXY_LOG",
-          "value": "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          "value": "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         },
         {
           "name": "LINKERD2_PROXY_LOG_FORMAT",
diff --git a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
index 1d15a0f78..deceb9772 100644
--- a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
@@ -69,7 +69,7 @@
         "--outbound-ports-to-ignore",
         "34567"
       ],
-      "image": "cr.l5d.io/linkerd/proxy-init:v2.4.0",
+      "image": "cr.l5d.io/linkerd/proxy-init:v2.4.1",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
@@ -167,7 +167,7 @@
         },
         {
           "name": "LINKERD2_PROXY_LOG",
-          "value": "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          "value": "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         },
         {
           "name": "LINKERD2_PROXY_LOG_FORMAT",
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index e956b2075..067c1dee6 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -59,7 +59,7 @@
         "--outbound-ports-to-ignore",
         "4567,4568"
       ],
-      "image": "cr.l5d.io/linkerd/proxy-init:v2.4.0",
+      "image": "cr.l5d.io/linkerd/proxy-init:v2.4.1",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
@@ -157,7 +157,7 @@
         },
         {
           "name": "LINKERD2_PROXY_LOG",
-          "value": "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          "value": "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         },
         {
           "name": "LINKERD2_PROXY_LOG_FORMAT",
diff --git a/deny.toml b/deny.toml
index d9c747e12..958b8fd0c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,7 +15,15 @@ ignore = []
 
 [licenses]
 unlicensed = "deny"
-allow = ["Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "MIT"]
+allow = [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "MIT",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+]
 deny = []
 copyleft = "deny"
 allow-osi-fsf-free = "neither"
@@ -28,16 +36,6 @@ exceptions = [
         "OpenSSL",
     ], name = "ring", version = "*" },
 
-    # The Unicode-DFS--2016 license is necessary for unicode-ident because they
-    # use data from the unicode tables to generate the tables which are
-    # included in the application. We do not distribute those data files so
-    # this is not a problem for us. See https://github.com/dtolnay/unicode-ident/pull/9/files
-    # for more details.
-    { allow = [
-        "MIT",
-        "Apache-2.0",
-        "Unicode-DFS-2016",
-    ], name = "unicode-ident" },
     { allow = [
         "Zlib",
     ], name = "adler32" },
diff --git a/go.mod b/go.mod
index 1b8f8d55a..81ab6cee7 100644
--- a/go.mod
+++ b/go.mod
@@ -39,17 +39,17 @@ require (
 	golang.org/x/tools v0.22.0
 	google.golang.org/grpc v1.64.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0
-	google.golang.org/protobuf v1.34.1
+	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v2 v2.4.0
-	helm.sh/helm/v3 v3.15.1
-	k8s.io/api v0.30.1
+	helm.sh/helm/v3 v3.15.2
+	k8s.io/api v0.30.2
 	k8s.io/apiextensions-apiserver v0.30.1
-	k8s.io/apimachinery v0.30.1
-	k8s.io/client-go v0.30.1
-	k8s.io/code-generator v0.30.1
-	k8s.io/endpointslice v0.30.1
+	k8s.io/apimachinery v0.30.2
+	k8s.io/client-go v0.30.2
+	k8s.io/code-generator v0.30.2
+	k8s.io/endpointslice v0.30.2
 	k8s.io/klog/v2 v2.120.1
-	k8s.io/kube-aggregator v0.30.1
+	k8s.io/kube-aggregator v0.30.2
 	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
 	sigs.k8s.io/gateway-api v0.8.1
 	sigs.k8s.io/yaml v1.4.0
@@ -71,13 +71,13 @@ require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v24.0.6+incompatible // indirect
-	github.com/docker/distribution v2.8.2+incompatible // indirect
-	github.com/docker/docker v24.0.9+incompatible // indirect
+	github.com/distribution/reference v0.5.0 // indirect
+	github.com/docker/cli v25.0.1+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v25.0.5+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.2 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
@@ -114,11 +114,10 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc6 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -152,10 +151,10 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/cli-runtime v0.30.0 // indirect
-	k8s.io/component-base v0.30.1 // indirect
+	k8s.io/component-base v0.30.2 // indirect
 	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	oras.land/oras-go v1.2.4 // indirect
+	oras.land/oras-go v1.2.5 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.14.3 // indirect
diff --git a/go.sum b/go.sum
index 55f94ec4e..04c26319b 100644
--- a/go.sum
+++ b/go.sum
@@ -99,22 +99,22 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
-github.com/docker/cli v24.0.6+incompatible h1:fF+XCQCgJjjQNIMjzaSmiKJSCcfcXb3TWTcc7GAneOY=
-github.com/docker/cli v24.0.6+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
-github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.9+incompatible h1:HPGzNmwfLZWdxHqK9/II92pyi1EpYKsAqcl4G0Of9v0=
-github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
+github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v25.0.1+incompatible h1:mFpqnrS6Hsm3v1k7Wa/BO23oz0k121MTbTO1lpcGSkU=
+github.com/docker/cli v25.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v25.0.5+incompatible h1:UmQydMduGkrD5nQde1mecF/YnSbTOaPeFIeP5C4W+DE=
+github.com/docker/docker v25.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
-github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
-github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1 h1:ZClxb8laGDf5arXfYcAtECDFgAgHklGI8CxgjHnXKJ4=
 github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/emicklei/go-restful/v3 v3.11.2 h1:1onLa9DcsMYO9P+CXaL0dStDqQ2EHHXLiz+BtnqkLAU=
@@ -330,8 +330,6 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -347,8 +345,8 @@ github.com/onsi/gomega v1.31.0 h1:54UJxxj6cPInHS3a35wm6BK/F9nHYueZ1NVujHDrnXE=
 github.com/onsi/gomega v1.31.0/go.mod h1:DW9aCi7U6Yi40wNVAvT6kzFnEVEI5n3DloYBiKiT6zk=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
-github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/image-spec v1.1.0-rc6 h1:XDqvyKsJEbRtATzkgItUqBA7QHk58yxX1Ov9HERHNqU=
+github.com/opencontainers/image-spec v1.1.0-rc6/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
@@ -713,8 +711,8 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
-google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -736,42 +734,42 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.15.1 h1:22ztacHz4gMqhXNqCQ9NAg6BFWoRUryNLvnkz6OVyw0=
-helm.sh/helm/v3 v3.15.1/go.mod h1:fvfoRcB8UKRUV5jrIfOTaN/pG1TPhuqSb56fjYdTKXg=
+helm.sh/helm/v3 v3.15.2 h1:/3XINUFinJOBjQplGnjw92eLGpgXXp1L8chWPkCkDuw=
+helm.sh/helm/v3 v3.15.2/go.mod h1:FzSIP8jDQaa6WAVg9F+OkKz7J0ZmAga4MABtTbsb9WQ=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.30.1 h1:kCm/6mADMdbAxmIh0LBjS54nQBE+U4KmbCfIkF5CpJY=
-k8s.io/api v0.30.1/go.mod h1:ddbN2C0+0DIiPntan/bye3SW3PdwLa11/0yqwvuRrJM=
+k8s.io/api v0.30.2 h1:+ZhRj+28QT4UOH+BKznu4CBgPWgkXO7XAvMcMl0qKvI=
+k8s.io/api v0.30.2/go.mod h1:ULg5g9JvOev2dG0u2hig4Z7tQ2hHIuS+m8MNZ+X6EmI=
 k8s.io/apiextensions-apiserver v0.30.1 h1:4fAJZ9985BmpJG6PkoxVRpXv9vmPUOVzl614xarePws=
 k8s.io/apiextensions-apiserver v0.30.1/go.mod h1:R4GuSrlhgq43oRY9sF2IToFh7PVlF1JjfWdoG3pixk4=
-k8s.io/apimachinery v0.30.1 h1:ZQStsEfo4n65yAdlGTfP/uSHMQSoYzU/oeEbkmF7P2U=
-k8s.io/apimachinery v0.30.1/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
+k8s.io/apimachinery v0.30.2 h1:fEMcnBj6qkzzPGSVsAZtQThU62SmQ4ZymlXRC5yFSCg=
+k8s.io/apimachinery v0.30.2/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
 k8s.io/cli-runtime v0.30.0 h1:0vn6/XhOvn1RJ2KJOC6IRR2CGqrpT6QQF4+8pYpWQ48=
 k8s.io/cli-runtime v0.30.0/go.mod h1:vATpDMATVTMA79sZ0YUCzlMelf6rUjoBzlp+RnoM+cg=
-k8s.io/client-go v0.30.1 h1:uC/Ir6A3R46wdkgCV3vbLyNOYyCJ8oZnjtJGKfytl/Q=
-k8s.io/client-go v0.30.1/go.mod h1:wrAqLNs2trwiCH/wxxmT/x3hKVH9PuV0GGW0oDoHVqc=
-k8s.io/code-generator v0.30.1 h1:ZsG++q5Vt0ScmKCeLhynUuWgcwFGg1Hl1AGfatqPJBI=
-k8s.io/code-generator v0.30.1/go.mod h1:hFgxRsvOUg79mbpbVKfjJvRhVz1qLoe40yZDJ/hwRH4=
-k8s.io/component-base v0.30.1 h1:bvAtlPh1UrdaZL20D9+sWxsJljMi0QZ3Lmw+kmZAaxQ=
-k8s.io/component-base v0.30.1/go.mod h1:e/X9kDiOebwlI41AvBHuWdqFriSRrX50CdwA9TFaHLI=
-k8s.io/endpointslice v0.30.1 h1:o7nd6yT8AdBKx31U4IUnukneT9bVtlMRPM9X9Rnq3+I=
-k8s.io/endpointslice v0.30.1/go.mod h1:C9F7mJDSTbXKTJ+RyUJuJ+OX5+Ub9rJYrS3oBIclzz0=
+k8s.io/client-go v0.30.2 h1:sBIVJdojUNPDU/jObC+18tXWcTJVcwyqS9diGdWHk50=
+k8s.io/client-go v0.30.2/go.mod h1:JglKSWULm9xlJLx4KCkfLLQ7XwtlbflV6uFFSHTMgVs=
+k8s.io/code-generator v0.30.2 h1:ZY1+aGkqZVwKIyGsOzquaeZ5rSfE6wZHur8z3jQAaiw=
+k8s.io/code-generator v0.30.2/go.mod h1:RQP5L67QxqgkVquk704CyvWFIq0e6RCMmLTXxjE8dVA=
+k8s.io/component-base v0.30.2 h1:pqGBczYoW1sno8q9ObExUqrYSKhtE5rW3y6gX88GZII=
+k8s.io/component-base v0.30.2/go.mod h1:yQLkQDrkK8J6NtP+MGJOws+/PPeEXNpwFixsUI7h/OE=
+k8s.io/endpointslice v0.30.2 h1:d11My11frxpBD+55vx1lHeO2JlH9YQS8Xqt7EInvPLA=
+k8s.io/endpointslice v0.30.2/go.mod h1:DGJe7hJrcKnuuIT8XljHj5yc5AcaA6kCCo85m2JWzdg=
 k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 h1:NGrVE502P0s0/1hudf8zjgwki1X/TByhmAoILTarmzo=
 k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
 k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
 k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-aggregator v0.30.1 h1:ymR2BsxDacTKwzKTuNhGZttuk009c+oZbSeD+IPX5q4=
-k8s.io/kube-aggregator v0.30.1/go.mod h1:SFbqWsM6ea8dHd3mPLsZFzJHbjBOS5ykIgJh4znZ5iQ=
+k8s.io/kube-aggregator v0.30.2 h1:0+yk/ED6foCprY8VmkDPUhngjaAPKsNTXB/UrtvbIz0=
+k8s.io/kube-aggregator v0.30.2/go.mod h1:EhqCfDdxysNWXk1wRL9SEHAdo1DKl6EULQagztkBcXE=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-oras.land/oras-go v1.2.4 h1:djpBY2/2Cs1PV87GSJlxv4voajVOMZxqqtq9AB8YNvY=
-oras.land/oras-go v1.2.4/go.mod h1:DYcGfb3YF1nKjcezfX2SNlDAeQFKSXmf+qrFmrh4324=
+oras.land/oras-go v1.2.5 h1:XpYuAwAb0DfQsunIyMfeET92emK8km3W4yEzZvUbsTo=
+oras.land/oras-go v1.2.5/go.mod h1:PuAwRShRZCsZb7g8Ar3jKKQR/2A/qN+pkYxIOd/FAoo=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/multicluster/cmd/allow.go b/multicluster/cmd/allow.go
index bc04915a3..5d955c879 100644
--- a/multicluster/cmd/allow.go
+++ b/multicluster/cmd/allow.go
@@ -24,6 +24,7 @@ type (
 		namespace          string
 		serviceAccountName string
 		ignoreCluster      bool
+		output             string
 	}
 )
 
@@ -31,6 +32,7 @@ func newAllowCommand() *cobra.Command {
 	opts := allowOptions{
 		namespace:     defaultMulticlusterNamespace,
 		ignoreCluster: false,
+		output:        "yaml",
 	}
 
 	cmd := &cobra.Command{
@@ -69,16 +71,15 @@ func newAllowCommand() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			stdout.Write(buf.Bytes())
-			stdout.Write([]byte("---\n"))
 
-			return nil
+			return pkgcmd.RenderYAMLAs(&buf, stdout, opts.output)
 		},
 	}
 
 	cmd.Flags().StringVar(&opts.namespace, "namespace", defaultMulticlusterNamespace, "The destination namespace for the service account.")
 	cmd.Flags().BoolVar(&opts.ignoreCluster, "ignore-cluster", false, "Ignore cluster configuration")
 	cmd.Flags().StringVar(&opts.serviceAccountName, "service-account-name", "", "The name of the multicluster access service account")
+	cmd.PersistentFlags().StringVarP(&opts.output, "output", "o", "yaml", "Output format. One of: json|yaml")
 
 	pkgcmd.ConfigureNamespaceFlagCompletion(
 		cmd, []string{"namespace"},
diff --git a/multicluster/cmd/link.go b/multicluster/cmd/link.go
index c49c3ecc3..0fd8e5589 100644
--- a/multicluster/cmd/link.go
+++ b/multicluster/cmd/link.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"bytes"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -56,6 +57,7 @@ type (
 		gatewayPort             uint32
 		ha                      bool
 		enableGateway           bool
+		output                  string
 	}
 )
 
@@ -181,9 +183,19 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 				},
 			}
 
-			credsOut, err := yaml.Marshal(creds)
-			if err != nil {
-				return err
+			var credsOut []byte
+			if opts.output == "yaml" {
+				credsOut, err = yaml.Marshal(creds)
+				if err != nil {
+					return err
+				}
+			} else if opts.output == "json" {
+				credsOut, err = json.Marshal(creds)
+				if err != nil {
+					return err
+				}
+			} else {
+				return fmt.Errorf("output format %s not supported", opts.output)
 			}
 
 			destinationCreds := corev1.Secret{
@@ -204,9 +216,20 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 					k8s.ConfigKeyName: kubeconfig,
 				},
 			}
-			destinationCredsOut, err := yaml.Marshal(destinationCreds)
-			if err != nil {
-				return err
+
+			var destinationCredsOut []byte
+			if opts.output == "yaml" {
+				destinationCredsOut, err = yaml.Marshal(destinationCreds)
+				if err != nil {
+					return err
+				}
+			} else if opts.output == "json" {
+				destinationCredsOut, err = json.Marshal(destinationCreds)
+				if err != nil {
+					return err
+				}
+			} else {
+				return fmt.Errorf("output format %s not supported", opts.output)
 			}
 
 			remoteDiscoverySelector, err := metav1.ParseToLabelSelector(opts.remoteDiscoverySelector)
@@ -287,9 +310,20 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 			if err != nil {
 				return err
 			}
-			linkOut, err := yaml.Marshal(obj.Object)
-			if err != nil {
-				return err
+
+			var linkOut []byte
+			if opts.output == "yaml" {
+				linkOut, err = yaml.Marshal(obj.Object)
+				if err != nil {
+					return err
+				}
+			} else if opts.output == "json" {
+				linkOut, err = json.Marshal(obj.Object)
+				if err != nil {
+					return err
+				}
+			} else {
+				return fmt.Errorf("output format %s not supported", opts.output)
 			}
 
 			values, err := buildServiceMirrorValues(opts)
@@ -313,19 +347,23 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 					return err
 				}
 			}
-			serviceMirrorOut, err := renderServiceMirror(values, valuesOverrides, opts.namespace)
+			serviceMirrorOut, err := renderServiceMirror(values, valuesOverrides, opts.namespace, opts.output)
 			if err != nil {
 				return err
 			}
 
+			separator := []byte("---\n")
+			if opts.output == "json" {
+				separator = []byte("\n")
+			}
 			stdout.Write(credsOut)
-			stdout.Write([]byte("---\n"))
+			stdout.Write(separator)
 			stdout.Write(destinationCredsOut)
-			stdout.Write([]byte("---\n"))
+			stdout.Write(separator)
 			stdout.Write(linkOut)
-			stdout.Write([]byte("---\n"))
+			stdout.Write(separator)
 			stdout.Write(serviceMirrorOut)
-			stdout.Write([]byte("---\n"))
+			stdout.Write(separator)
 
 			return nil
 		},
@@ -350,6 +388,7 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 	cmd.Flags().Uint32Var(&opts.gatewayPort, "gateway-port", opts.gatewayPort, "If specified, overwrites gateway port when gateway service is not type LoadBalancer")
 	cmd.Flags().BoolVar(&opts.ha, "ha", opts.ha, "Enable HA configuration for the service-mirror deployment (default false)")
 	cmd.Flags().BoolVar(&opts.enableGateway, "gateway", opts.enableGateway, "If false, allows a link to be created against a cluster that does not have a gateway service")
+	cmd.Flags().StringVarP(&opts.output, "output", "o", "yaml", "Output format. One of: json|yaml")
 
 	pkgcmd.ConfigureNamespaceFlagCompletion(
 		cmd, []string{"namespace", "gateway-namespace"},
@@ -357,7 +396,7 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 	return cmd
 }
 
-func renderServiceMirror(values *multicluster.Values, valuesOverrides map[string]interface{}, namespace string) ([]byte, error) {
+func renderServiceMirror(values *multicluster.Values, valuesOverrides map[string]interface{}, namespace string, format string) ([]byte, error) {
 	files := []*chartloader.BufferedFile{
 		{Name: chartutil.ChartfileName},
 		{Name: "templates/service-mirror.yaml"},
@@ -420,14 +459,19 @@ func renderServiceMirror(values *multicluster.Values, valuesOverrides map[string
 	}
 
 	// Merge templates and inject
-	var out bytes.Buffer
+	var yamlBytes bytes.Buffer
 	for _, tmpl := range chart.Templates {
 		t := path.Join(chart.Metadata.Name, tmpl.Name)
-		if _, err := out.WriteString(renderedTemplates[t]); err != nil {
+		if _, err := yamlBytes.WriteString(renderedTemplates[t]); err != nil {
 			return nil, err
 		}
 	}
 
+	var out bytes.Buffer
+	err = pkgcmd.RenderYAMLAs(&yamlBytes, &out, format)
+	if err != nil {
+		return nil, err
+	}
 	return out.Bytes(), nil
 }
 
@@ -450,6 +494,7 @@ func newLinkOptionsWithDefault() (*linkOptions, error) {
 		gatewayPort:             0,
 		ha:                      false,
 		enableGateway:           true,
+		output:                  "yaml",
 	}, nil
 }
 
diff --git a/multicluster/cmd/unlink.go b/multicluster/cmd/unlink.go
index a3bcad343..c1f1ee8d8 100644
--- a/multicluster/cmd/unlink.go
+++ b/multicluster/cmd/unlink.go
@@ -105,8 +105,16 @@ func newUnlinkCommand() *cobra.Command {
 			}
 
 			for _, r := range resources {
-				if err := r.RenderResource(stdout); err != nil {
-					log.Errorf("failed to render resource %s: %s", r.Name, err)
+				if opts.output == "yaml" {
+					if err := r.RenderResource(stdout); err != nil {
+						log.Errorf("failed to render resource %s: %s", r.Name, err)
+					}
+				} else if opts.output == "json" {
+					if err := r.RenderResourceJSON(stdout); err != nil {
+						log.Errorf("failed to render resource %s: %s", r.Name, err)
+					}
+				} else {
+					return fmt.Errorf("unsupported format: %s", opts.output)
 				}
 			}
 
@@ -116,6 +124,7 @@ func newUnlinkCommand() *cobra.Command {
 
 	cmd.Flags().StringVar(&opts.namespace, "namespace", defaultMulticlusterNamespace, "The namespace for the service account")
 	cmd.Flags().StringVar(&opts.clusterName, "cluster-name", "", "Cluster name")
+	cmd.Flags().StringVarP(&opts.output, "output", "o", "yaml", "Output format. One of: json|yaml")
 
 	pkgcmd.ConfigureNamespaceFlagCompletion(
 		cmd, []string{"namespace"},
diff --git a/pkg/version/version.go b/pkg/version/version.go
index 0c091fc8d..bb6dad72d 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -15,8 +15,8 @@ var Version = undefinedVersion
 // ProxyInitVersion is the pinned version of the proxy-init, from
 // https://github.com/linkerd/linkerd2-proxy-init This has to be kept in sync
 // with the default version in the control plane's values.yaml.
-var ProxyInitVersion = "v2.4.0"
-var LinkerdCNIVersion = "v1.5.0"
+var ProxyInitVersion = "v2.4.1"
+var LinkerdCNIVersion = "v1.5.1"
 
 const (
 	// undefinedVersion should take the form `channel-version` to conform to
diff --git a/viz/cmd/allow-scrapes.go b/viz/cmd/allow-scrapes.go
index 2ddd9b0c8..0e114536c 100644
--- a/viz/cmd/allow-scrapes.go
+++ b/viz/cmd/allow-scrapes.go
@@ -1,7 +1,7 @@
 package cmd
 
 import (
-	"os"
+	"bytes"
 	"text/template"
 
 	pkgcmd "github.com/linkerd/linkerd2/pkg/cmd"
@@ -118,6 +118,7 @@ type templateOptions struct {
 
 // newCmdAllowScrapes creates a new cobra command `allow-scrapes`
 func newCmdAllowScrapes() *cobra.Command {
+	output := "yaml"
 	options := templateOptions{
 		ExtensionName: ExtensionName,
 		ChartName:     vizChartName,
@@ -136,10 +137,17 @@ linkerd viz allow-scrapes --namespace emojivoto | kubectl apply -f -`,
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			t := template.Must(template.New("allow-scrapes").Parse(allowScrapePolicy))
-			return t.Execute(os.Stdout, options)
+			var buf bytes.Buffer
+			err := t.Execute(&buf, options)
+			if err != nil {
+				return err
+			}
+
+			return pkgcmd.RenderYAMLAs(&buf, stdout, output)
 		},
 	}
 	cmd.Flags().StringVarP(&options.TargetNs, "namespace", "n", options.TargetNs, "The namespace in which to authorize Prometheus scrapes.")
+	cmd.Flags().StringVarP(&output, "output", "o", output, "Output format. One of: json|yaml")
 
 	pkgcmd.ConfigureNamespaceFlagCompletion(
 		cmd, []string{"n", "namespace"},


Test patch:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index ac0b0f7e6..43048d681 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -33,7 +33,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -192,7 +192,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 48680257a..24151e38a 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -33,7 +33,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -192,7 +192,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -268,7 +268,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -427,7 +427,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index fb9e52c34..a16217902 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -33,7 +33,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -192,7 +192,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 4b1eeb642..5e6d74f59 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -41,7 +41,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -232,7 +232,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index 2ceaa76a3..f5457a0d2 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -281,7 +281,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -449,7 +449,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -527,7 +527,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -695,7 +695,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -773,7 +773,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -941,7 +941,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index c4af2eda3..4ece96572 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
index b2438be7f..69423717f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
@@ -36,7 +36,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -206,7 +206,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
index 138c86dbb..57a244c8d 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
@@ -36,7 +36,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -195,7 +195,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index 8537d3b4f..492b96f78 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -217,7 +217,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index b8d14a608..3edb05d76 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -45,7 +45,7 @@ spec:
         - name: LINKERD2_PROXY_CORES
           value: "1"
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -220,7 +220,7 @@ spec:
         - 4190,9998,7777,8888
         - --outbound-ports-to-ignore
         - "9999"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index 784424cff..d06fcb2ec 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -281,7 +281,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -449,7 +449,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index 02fb4f559..283d71818 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -36,7 +36,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -216,7 +216,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index b23359d2e..09080b512 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index 5733deb32..f9814cbb7 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -204,7 +204,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
index 37f3174c8..af8dd8e8b 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
@@ -49,7 +49,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -90,7 +90,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
index 861327887..d01ee515f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
index dc0463478..5c93fb956 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
@@ -36,7 +36,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -204,7 +204,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index c764d2129..9a22b219f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -36,7 +36,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -204,7 +204,7 @@ spec:
         - 4190,1234,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
index 36943e3ec..bb77c23fc 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index ac2445f9b..f66265f70 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -37,7 +37,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -205,7 +205,7 @@ spec:
         - 4190,4191,22,8100-8102
         - --outbound-ports-to-ignore
         - "5432"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index 9b91c1bc4..16ace78c3 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -35,7 +35,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -205,7 +205,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index 8a7bdb8c5..1ec11eb39 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -37,7 +37,7 @@ items:
               fieldRef:
                 fieldPath: spec.nodeName
           - name: LINKERD2_PROXY_LOG
-            value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+            value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -205,7 +205,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+          image: cr.l5d.io/linkerd/proxy-init:v2.4.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -282,7 +282,7 @@ items:
               fieldRef:
                 fieldPath: spec.nodeName
           - name: LINKERD2_PROXY_LOG
-            value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+            value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -445,7 +445,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+          image: cr.l5d.io/linkerd/proxy-init:v2.4.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index e90a6e353..4b57bf5cf 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -37,7 +37,7 @@ items:
               fieldRef:
                 fieldPath: spec.nodeName
           - name: LINKERD2_PROXY_LOG
-            value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+            value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -205,7 +205,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+          image: cr.l5d.io/linkerd/proxy-init:v2.4.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -282,7 +282,7 @@ items:
               fieldRef:
                 fieldPath: spec.nodeName
           - name: LINKERD2_PROXY_LOG
-            value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+            value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -445,7 +445,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+          image: cr.l5d.io/linkerd/proxy-init:v2.4.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index 6b17d585e..3dcd4c88d 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -27,7 +27,7 @@ spec:
         fieldRef:
           fieldPath: spec.nodeName
     - name: LINKERD2_PROXY_LOG
-      value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+      value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -187,7 +187,7 @@ spec:
     - 4190,4191,4567,4568
     - --outbound-ports-to-ignore
     - 4567,4568
-    image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+    image: cr.l5d.io/linkerd/proxy-init:v2.4.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
index 34e352756..f2b67aa2b 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
@@ -28,7 +28,7 @@ spec:
         fieldRef:
           fieldPath: spec.nodeName
     - name: LINKERD2_PROXY_LOG
-      value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+      value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -190,7 +190,7 @@ spec:
     - 4190,4191,4567,4568
     - --outbound-ports-to-ignore
     - 4567,4568
-    image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+    image: cr.l5d.io/linkerd/proxy-init:v2.4.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index debbd2212..6dbb101c2 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -29,7 +29,7 @@ spec:
         fieldRef:
           fieldPath: spec.nodeName
     - name: LINKERD2_PROXY_LOG
-      value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+      value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -189,7 +189,7 @@ spec:
     - 4190,4191,22,8100-8102
     - --outbound-ports-to-ignore
     - "5432"
-    image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+    image: cr.l5d.io/linkerd/proxy-init:v2.4.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index 6adba3dd6..34f67b1a4 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -31,7 +31,7 @@ spec:
         fieldRef:
           fieldPath: spec.nodeName
     - name: LINKERD2_PROXY_LOG
-      value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+      value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -198,7 +198,7 @@ spec:
     - 4190,4191,4567,4568
     - --outbound-ports-to-ignore
     - 4567,4568
-    image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+    image: cr.l5d.io/linkerd/proxy-init:v2.4.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index 9db5eb416..a768c3ef6 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -36,7 +36,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -204,7 +204,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index 7aa59b35c..306df44de 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -31,7 +31,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -205,7 +205,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -279,7 +279,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -453,7 +453,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index b02b45a67..b3212e6b7 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -52,7 +52,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off
+          value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -266,7 +266,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install-cni-plugin_default.golden b/cli/cmd/testdata/install-cni-plugin_default.golden
index 5f25ddada..63b2a5c27 100644
--- a/cli/cmd/testdata/install-cni-plugin_default.golden
+++ b/cli/cmd/testdata/install-cni-plugin_default.golden
@@ -122,7 +122,7 @@ spec:
       # script copies the files into place and then sleeps so
       # that Kubernetes doesn't keep trying to restart it.
       - name: install-cni
-        image: cr.l5d.io/linkerd/cni-plugin:v1.5.0
+        image: cr.l5d.io/linkerd/cni-plugin:v1.5.1
         imagePullPolicy: 
         env:
         - name: DEST_CNI_NET_DIR
diff --git a/cli/cmd/testdata/install-cni-plugin_skip_ports.golden b/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
index 5ccb6d3dd..b08654c52 100644
--- a/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
+++ b/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
@@ -123,7 +123,7 @@ spec:
       # script copies the files into place and then sleeps so
       # that Kubernetes doesn't keep trying to restart it.
       - name: install-cni
-        image: cr.l5d.io/linkerd/cni-plugin:v1.5.0
+        image: cr.l5d.io/linkerd/cni-plugin:v1.5.1
         imagePullPolicy: 
         env:
         - name: DEST_CNI_NET_DIR
diff --git a/cli/cmd/testdata/install_cni_helm_default_output.golden b/cli/cmd/testdata/install_cni_helm_default_output.golden
index 42f0eadf8..0048f1f60 100644
--- a/cli/cmd/testdata/install_cni_helm_default_output.golden
+++ b/cli/cmd/testdata/install_cni_helm_default_output.golden
@@ -115,7 +115,7 @@ spec:
       # script copies the files into place and then sleeps so
       # that Kubernetes doesn't keep trying to restart it.
       - name: install-cni
-        image: cr.l5d.io/linkerd/cni-plugin:v1.5.0
+        image: cr.l5d.io/linkerd/cni-plugin:v1.5.1
         imagePullPolicy: IfNotPresent
         env:
         - name: DEST_CNI_NET_DIR
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index e31a661fe..1af9f12e4 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -986,7 +986,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1128,7 +1128,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1335,7 +1335,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1614,7 +1614,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1786,7 +1786,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1977,7 +1977,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 15cefc2d9..c96790e79 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1127,7 +1127,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1334,7 +1334,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1612,7 +1612,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1784,7 +1784,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1975,7 +1975,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 22a2a653c..9a577a260 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: my.custom.registry/linkerd-io/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1127,7 +1127,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: my.custom.registry/linkerd-io/proxy-init:v2.4.0
+        image: my.custom.registry/linkerd-io/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1334,7 +1334,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1612,7 +1612,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: my.custom.registry/linkerd-io/proxy-init:v2.4.0
+        image: my.custom.registry/linkerd-io/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1784,7 +1784,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1975,7 +1975,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: my.custom.registry/linkerd-io/proxy-init:v2.4.0
+        image: my.custom.registry/linkerd-io/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 15cefc2d9..c96790e79 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1127,7 +1127,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1334,7 +1334,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1612,7 +1612,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1784,7 +1784,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1975,7 +1975,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 1c8883ec7..b5aa60f1f 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1127,7 +1127,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1334,7 +1334,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1612,7 +1612,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1784,7 +1784,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1975,7 +1975,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index c2e0e51cc..c3c226241 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1125,7 +1125,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1325,7 +1325,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1601,7 +1601,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1766,7 +1766,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1955,7 +1955,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_gid_output.golden b/cli/cmd/testdata/install_gid_output.golden
index a379dae71..38398fae5 100755
--- a/cli/cmd/testdata/install_gid_output.golden
+++ b/cli/cmd/testdata/install_gid_output.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -986,7 +986,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1131,7 +1131,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1338,7 +1338,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1622,7 +1622,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1795,7 +1795,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1990,7 +1990,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 7001d4030..705f152ad 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -713,7 +713,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -760,7 +760,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -1062,7 +1062,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1209,7 +1209,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1451,7 +1451,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1740,7 +1740,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1937,7 +1937,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -2139,7 +2139,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index c9f44af36..104f85403 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -713,7 +713,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -760,7 +760,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -1062,7 +1062,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1209,7 +1209,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1451,7 +1451,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1740,7 +1740,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1937,7 +1937,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -2139,7 +2139,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index ad8ce2661..fae26e94a 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -617,7 +617,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -664,7 +664,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -916,7 +916,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1058,7 +1058,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1265,7 +1265,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1543,7 +1543,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1655,7 +1655,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1846,7 +1846,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index f5a2ff4db..daa6266f2 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -663,7 +663,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -958,7 +958,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1309,7 +1309,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1763,7 +1763,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index 307e7b93c..cd07e0102 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -690,7 +690,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -1035,7 +1035,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1426,7 +1426,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1916,7 +1916,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
index 4d768cb74..a217d5a5b 100755
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
@@ -690,7 +690,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -1036,7 +1036,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1430,7 +1430,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1927,7 +1927,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index ee303d764..31980bd89 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -694,7 +694,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -1043,7 +1043,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1438,7 +1438,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1936,7 +1936,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index c9fda21be..cbdf31faa 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -685,7 +685,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -1025,7 +1025,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1416,7 +1416,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1906,7 +1906,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 064f083e5..e2b182045 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1327,7 +1327,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1770,7 +1770,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 399856019..333402cd7 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1127,7 +1127,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1334,7 +1334,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1612,7 +1612,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1784,7 +1784,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1975,7 +1975,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 64d150f83..7aaf06c21 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -686,7 +686,7 @@ data:
         timeoutSeconds: 1
       logFormat: plain
       logHTTPHeaders: "off"
-      logLevel: warn,linkerd=info,trust_dns=error
+      logLevel: warn,linkerd=info,hickory=error
       nativeSidecar: false
       opaquePorts: 25,587,3306,4444,5432,6379,9300,11211
       outbound:
@@ -733,7 +733,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v2.4.0
+        version: v2.4.1
       iptablesMode: legacy
       kubeAPIServerPorts: 443,6443
       logFormat: ""
@@ -985,7 +985,7 @@ spec:
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1127,7 +1127,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1334,7 +1334,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1612,7 +1612,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1784,7 +1784,7 @@ spec:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_LOG
-          value: "warn,linkerd=info,trust_dns=error,linkerd_proxy_http::client[{headers}]=off"
+          value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1975,7 +1975,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443,6443"
-        image: cr.l5d.io/linkerd/proxy-init:v2.4.0
+        image: cr.l5d.io/linkerd/proxy-init:v2.4.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
diff --git a/multicluster/cmd/link_test.go b/multicluster/cmd/link_test.go
index 97e3790a5..e48cdef67 100644
--- a/multicluster/cmd/link_test.go
+++ b/multicluster/cmd/link_test.go
@@ -34,7 +34,7 @@ func TestServiceMirrorRender(t *testing.T) {
 	for i, tc := range testCases {
 		tc := tc
 		t.Run(fmt.Sprintf("%d: %s", i, tc.goldenFileName), func(t *testing.T) {
-			out, err := renderServiceMirror(tc.serviceMirrorValues, charts.MergeMaps(defaultValues, tc.overrides), "test")
+			out, err := renderServiceMirror(tc.serviceMirrorValues, charts.MergeMaps(defaultValues, tc.overrides), "test", "yaml")
 			if err != nil {
 				t.Fatalf("Failed to render templates: %v", err)
 			}
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index 01c6889fa..22c1893e7 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -122,7 +122,7 @@ func TestNewValues(t *testing.T) {
 				Name:    "cr.l5d.io/linkerd/proxy",
 				Version: "",
 			},
-			LogLevel:       "warn,linkerd=info,trust_dns=error",
+			LogLevel:       "warn,linkerd=info,hickory=error",
 			LogFormat:      "plain",
 			LogHTTPHeaders: "off",
 			Ports: &Ports{
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 0c54487d4..f93916205 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2404,7 +2404,7 @@ spec:
       serviceAccountName: linkerd-cni
       containers:
       - name: install-cni
-        image: cr.l5d.io/linkerd/cni-plugin:v1.5.0
+        image: cr.l5d.io/linkerd/cni-plugin:v1.5.1
         env:
         - name: DEST_CNI_NET_DIR
           valueFrom:
diff --git a/test/integration/multicluster/testdata/allow.golden b/test/integration/multicluster/testdata/allow.golden
index 24360e59c..4b4a31118 100644
--- a/test/integration/multicluster/testdata/allow.golden
+++ b/test/integration/multicluster/testdata/allow.golden
@@ -76,4 +76,3 @@ subjects:
   - kind: ServiceAccount
     name: {{ .AccountName }}
     namespace: linkerd-multicluster
----