Repository: linkerd/linkerd2
Pull request #13002 (2024-08-29 06:35:19)

Add support to modify liveness and readiness probe timeouts on control plane containers in helm chart
This PR adds support for custom liveness and readiness probe timeouts on control plane containers in helm chart.

It was discussed on https://github.com/linkerd/linkerd2/issues/12895 with @alpeb 

kristjankullerkann-wearemp: > Thanks @kristjankullerkann-wearemp ! 👍 Just couple of comments below. Also, please don't forget to run `bin/helm-docs` to re-generate the README chart files with the new values.yaml entries.

I did run helm-docs but there wasn't any updates except helm-docs footer itself so I decided not to commit this.
kristjankullerkann-wearemp: > Looking good 👍 Given that those new settings will always be set, at least to their defaults, the tests golden files need to be updated. You can do that with `go test ./... -update`.

Files updated.
alpeb: Can you please address the [DCO](https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#developer-certificate-of-origin)?
kristjankullerkann-wearemp: > Can you please address the [DCO](https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#developer-certificate-of-origin)?

Sorry, missed signoff for second commit. Should be there now.
kristjankullerkann-wearemp: > There still are missing changes to tests; please apply the following:
> 
> ```diff
> diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
> index 7d06da27f..2f1e1bd02 100644
> --- a/cli/cmd/install_test.go
> +++ b/cli/cmd/install_test.go
> @@ -60,6 +60,7 @@ func TestRender(t *testing.T) {
>                 CNIEnabled:              false,
>                 IdentityTrustDomain:     defaultValues.IdentityTrustDomain,
>                 IdentityTrustAnchorsPEM: defaultValues.IdentityTrustAnchorsPEM,
> +               DestinationController:   map[string]any{},
>                 PodAnnotations:          map[string]string{},
>                 PodLabels:               map[string]string{},
>                 PriorityClassName:       "PriorityClassName",
> diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
> index ac239ea37..4ac0e8506 100644
> --- a/pkg/charts/linkerd2/values_test.go
> +++ b/pkg/charts/linkerd2/values_test.go
> @@ -98,6 +98,12 @@ func TestNewValues(t *testing.T) {
>                                         "while_idle": true,
>                                 },
>                         },
> +                       "livenessProbe":  map[string]interface{}{"timeoutSeconds": 1.0},
> +                       "readinessProbe": map[string]interface{}{"timeoutSeconds": 1.0},
> +               },
> +               SPValidator: map[string]interface{}{
> +                       "livenessProbe":  map[string]interface{}{"timeoutSeconds": 1.0},
> +                       "readinessProbe": map[string]interface{}{"timeoutSeconds": 1.0},
>                 },
>                 PolicyController: &PolicyController{
>                         Image: &Image{
> ```
> 
> and then run `go test ./... -update` one more time.

Done and thanks.

Patch:
diff --git a/.proxy-version b/.proxy-version
index 7eacb3575..bcf52eae9 100644
--- a/.proxy-version
+++ b/.proxy-version
@@ -1,1 +1,1 @@
-v2.250.0
+v2.251.0
diff --git a/Cargo.lock b/Cargo.lock
index 3fe906704..999c88e87 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1480,9 +1480,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-src"
-version = "300.3.1+3.3.1"
+version = "300.3.2+3.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7259953d42a81bf137fbbd73bd30a8e1914d6dce43c2b90ed575783a22608b91"
+checksum = "a211a18d945ef7e648cc6e0058f4c548ee46aab922ea203e0d30e966ea23647b"
 dependencies = [
  "cc",
 ]
diff --git a/charts/linkerd-control-plane/templates/destination.yaml b/charts/linkerd-control-plane/templates/destination.yaml
index b214c3c64..4be0d21ab 100644
--- a/charts/linkerd-control-plane/templates/destination.yaml
+++ b/charts/linkerd-control-plane/templates/destination.yaml
@@ -235,6 +235,9 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          {{- with (.Values.destinationController.livenessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         name: destination
         ports:
         - containerPort: 8086
@@ -246,6 +249,9 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          {{- with (.Values.destinationController.readinessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         {{- if .Values.destinationResources -}}
         {{- include "partials.resources" .Values.destinationResources | nindent 8 }}
         {{- end }}
@@ -283,6 +289,9 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          {{- with ((.Values.spValidator).livenessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -294,6 +303,9 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          {{- with ((.Values.spValidator).readinessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         {{- if .Values.spValidatorResources -}}
         {{- include "partials.resources" .Values.spValidatorResources | nindent 8 }}
         {{- end }}
@@ -343,6 +355,9 @@ spec:
           httpGet:
             path: /live
             port: admin-http
+          {{- with (.Values.policyController.livenessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         name: policy
         ports:
         - containerPort: 8090
@@ -357,6 +372,9 @@ spec:
             path: /ready
             port: admin-http
           initialDelaySeconds: 10
+          {{- with (.Values.policyController.readinessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         {{- if .Values.policyController.resources }}
         {{- include "partials.resources" .Values.policyController.resources | nindent 8 }}
         {{- end }}
diff --git a/charts/linkerd-control-plane/templates/identity.yaml b/charts/linkerd-control-plane/templates/identity.yaml
index bd3bcbe31..8ed15e630 100644
--- a/charts/linkerd-control-plane/templates/identity.yaml
+++ b/charts/linkerd-control-plane/templates/identity.yaml
@@ -185,6 +185,9 @@ spec:
             path: /ping
             port: 9990
           initialDelaySeconds: 10
+          {{- with (.Values.identity.livenessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         name: identity
         ports:
         - containerPort: 8080
@@ -196,6 +199,9 @@ spec:
           httpGet:
             path: /ready
             port: 9990
+          {{- with (.Values.identity.readinessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         {{- if .Values.identityResources -}}
         {{- include "partials.resources" .Values.identityResources | nindent 8 }}
         {{- end }}
diff --git a/charts/linkerd-control-plane/templates/proxy-injector.yaml b/charts/linkerd-control-plane/templates/proxy-injector.yaml
index 0f6b3bb87..34b1d3ba4 100644
--- a/charts/linkerd-control-plane/templates/proxy-injector.yaml
+++ b/charts/linkerd-control-plane/templates/proxy-injector.yaml
@@ -98,6 +98,9 @@ spec:
             path: /ping
             port: 9995
           initialDelaySeconds: 10
+          {{- with (.Values.proxyInjector.livenessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         name: proxy-injector
         ports:
         - containerPort: 8443
@@ -109,6 +112,9 @@ spec:
           httpGet:
             path: /ready
             port: 9995
+          {{- with (.Values.proxyInjector.readinessProbe).timeoutSeconds }}
+          timeoutSeconds: {{ . }}
+          {{- end }}
         {{- if .Values.proxyInjectorResources -}}
         {{- include "partials.resources" .Values.proxyInjectorResources | nindent 8 }}
         {{- end }}
diff --git a/charts/linkerd-control-plane/values.yaml b/charts/linkerd-control-plane/values.yaml
index 7889c0405..c51a4eb5a 100644
--- a/charts/linkerd-control-plane/values.yaml
+++ b/charts/linkerd-control-plane/values.yaml
@@ -118,6 +118,11 @@ policyController:
       # -- Amount of ephemeral storage that the policy controller requests
       request: ""
 
+  livenessProbe:
+    timeoutSeconds: 1
+  readinessProbe:
+    timeoutSeconds: 1
+
 # proxy configuration
 proxy:
   # -- Enable service profiles for non-Kubernetes services
@@ -379,6 +384,10 @@ destinationController:
       timeout:
         seconds: 3
       while_idle: true
+  livenessProbe:
+    timeoutSeconds: 1
+  readinessProbe:
+    timeoutSeconds: 1
 
 # debug configuration
 debugContainer:
@@ -419,6 +428,11 @@ identity:
 
   kubeAPI: *kubeapi
 
+  livenessProbe:
+    timeoutSeconds: 1
+  readinessProbe:
+    timeoutSeconds: 1
+
 # -|- CPU, Memory and Ephemeral Storage resources required by the identity controller (see `proxy.resources` for sub-fields)
 #identityResources:
 # -|- CPU, Memory and Ephemeral Storage resources required by proxy injected into identity pod (see `proxy.resources` for sub-fields)
@@ -491,6 +505,11 @@ proxyInjector:
   # for more information.
   injectCaFromSecret: ""
 
+  livenessProbe:
+    timeoutSeconds: 1
+  readinessProbe:
+    timeoutSeconds: 1
+
 # -|- CPU, Memory and Ephemeral Storage resources required by the proxy injector (see
 #`proxy.resources` for sub-fields)
 #proxyInjectorResources:
@@ -594,6 +613,13 @@ policyValidator:
 nodeSelector:
   kubernetes.io/os: linux
 
+# -- SP validator configuration
+spValidator:
+  livenessProbe:
+    timeoutSeconds: 1
+  readinessProbe:
+    timeoutSeconds: 1
+
 # -|- CPU, Memory and Ephemeral Storage resources required by the SP validator (see
 #`proxy.resources` for sub-fields)
 #spValidatorResources:
diff --git a/controller/api/destination/external-workload/endpoints_controller.go b/controller/api/destination/external-workload/endpoints_controller.go
index 8896c3384..bf75bd4ed 100644
--- a/controller/api/destination/external-workload/endpoints_controller.go
+++ b/controller/api/destination/external-workload/endpoints_controller.go
@@ -56,7 +56,7 @@ const (
 type EndpointsController struct {
 	k8sAPI     *k8s.API
 	log        *logging.Entry
-	queue      workqueue.RateLimitingInterface
+	queue      workqueue.TypedRateLimitingInterface[string]
 	reconciler *endpointsReconciler
 	stop       chan struct{}
 
@@ -95,7 +95,7 @@ type informerHandlers struct {
 // started with its `Start()` method.
 func NewEndpointsController(k8sAPI *k8s.API, hostname, controllerNs string, stopCh chan struct{}, exportQueueMetrics bool) (*EndpointsController, error) {
 	queueName := "endpoints_controller_workqueue"
-	workQueueConfig := workqueue.RateLimitingQueueConfig{
+	workQueueConfig := workqueue.TypedRateLimitingQueueConfig[string]{
 		Name: queueName,
 	}
 
@@ -109,7 +109,7 @@ func NewEndpointsController(k8sAPI *k8s.API, hostname, controllerNs string, stop
 	ec := &EndpointsController{
 		k8sAPI:     k8sAPI,
 		reconciler: newEndpointsReconciler(k8sAPI, managedBy, maxEndpointsQuota),
-		queue:      workqueue.NewRateLimitingQueueWithConfig(workqueue.DefaultControllerRateLimiter(), workQueueConfig),
+		queue:      workqueue.NewTypedRateLimitingQueueWithConfig[string](workqueue.DefaultTypedControllerRateLimiter[string](), workQueueConfig),
 		stop:       stopCh,
 		log: logging.WithFields(logging.Fields{
 			"component": "external-endpoints-controller",
@@ -297,17 +297,12 @@ func (ec *EndpointsController) Start() {
 // at the same time.
 func (ec *EndpointsController) processQueue() {
 	for {
-		item, quit := ec.queue.Get()
+		key, quit := ec.queue.Get()
 		if quit {
 			ec.log.Trace("queue received shutdown signal")
 			return
 		}
 
-		key, ok := item.(string)
-		if !ok {
-			ec.log.Errorf("Found queue element of type %T, was expecting a string", item)
-			continue
-		}
 		err := ec.syncService(key)
 		ec.handleError(err, key)
 
diff --git a/go.mod b/go.mod
index 4d438bd0d..a6dd3039b 100644
--- a/go.mod
+++ b/go.mod
@@ -42,14 +42,14 @@ require (
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v2 v2.4.0
 	helm.sh/helm/v3 v3.15.4
-	k8s.io/api v0.30.3
-	k8s.io/apiextensions-apiserver v0.30.3
+	k8s.io/api v0.31.0
+	k8s.io/apiextensions-apiserver v0.31.0
 	k8s.io/apimachinery v0.31.0
-	k8s.io/client-go v0.30.3
-	k8s.io/code-generator v0.30.3
-	k8s.io/endpointslice v0.30.3
+	k8s.io/client-go v0.31.0
+	k8s.io/code-generator v0.31.0
+	k8s.io/endpointslice v0.31.0
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kube-aggregator v0.30.3
+	k8s.io/kube-aggregator v0.31.0
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	sigs.k8s.io/gateway-api v0.8.1
 	sigs.k8s.io/yaml v1.4.0
@@ -79,7 +79,7 @@ require (
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.2 // indirect
-	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
@@ -98,7 +98,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -133,10 +133,10 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 // indirect
-	go.opentelemetry.io/otel v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.19.0 // indirect
-	go.opentelemetry.io/otel/trace v1.19.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/otel v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	golang.org/x/crypto v0.26.0 // indirect
 	golang.org/x/mod v0.20.0 // indirect
@@ -148,11 +148,12 @@ require (
 	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/api v0.143.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/cli-runtime v0.30.3 // indirect
-	k8s.io/component-base v0.30.3 // indirect
+	k8s.io/component-base v0.31.0 // indirect
 	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
 	oras.land/oras-go v1.2.5 // indirect
diff --git a/go.sum b/go.sum
index 12b517c82..e7cbb5148 100644
--- a/go.sum
+++ b/go.sum
@@ -129,8 +129,8 @@ github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lSh
 github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
 github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
-github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
-github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
 github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
 github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
@@ -172,8 +172,6 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.2.1 h1:OptwRhECazUx5ix5TTWC3EZhsZEHWcYWY4FQHTIubm4=
-github.com/golang/glog v1.2.1/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -250,8 +248,8 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.14.6/go.mod h1:zdiPV4Yse/1gnckTHtghG4GkDEdKCRJduHpTxT3/jcw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
@@ -344,8 +342,8 @@ github.com/nsf/termbox-go v1.1.1 h1:nksUPLCb73Q++DwbYUBEglYBRPZyoXJdrj5L+TkjyZY=
 github.com/nsf/termbox-go v1.1.1/go.mod h1:T0cTdVuOwf7pHQNtfhnEbzHbcNyCEcVU4YPpouCbVxo=
 github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
 github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.19.0 h1:4ieX6qQjPP/BfC3mpsAtIGGlxTWPeA3Inl/7DtXw1tw=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
+github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
+github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0-rc6 h1:XDqvyKsJEbRtATzkgItUqBA7QHk58yxX1Ov9HERHNqU=
@@ -455,16 +453,18 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZx8cOF0+Kkazoc7lwUNMGy0LrzEMxTm4BbTxg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
-go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
-go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
-go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
-go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
-go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
-go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
+go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
+go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca/go.mod h1:jxU+3+j+71eXOW14274+SmmuW82qJzl6iZSeqEtTGds=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -689,8 +689,8 @@ google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEY
 google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 h1:7whR9kGa5LUwFtpLm2ArCEejtnxlGeLbAyjFY8sGNFw=
 google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157/go.mod h1:99sLkeliLXfdj2J75X3Ho+rrVCaJze0uwN7zDDkjPVU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 h1:1GBuWVLM/KMVUv1t1En5Gs+gFZCNd360GGb4sSxtrhU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -725,6 +725,8 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -747,28 +749,28 @@ honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.30.3 h1:ImHwK9DCsPA9uoU3rVh4QHAHHK5dTSv1nxJUapx8hoQ=
-k8s.io/api v0.30.3/go.mod h1:GPc8jlzoe5JG3pb0KJCSLX5oAFIW3/qNJITlDj8BH04=
-k8s.io/apiextensions-apiserver v0.30.3 h1:oChu5li2vsZHx2IvnGP3ah8Nj3KyqG3kRSaKmijhB9U=
-k8s.io/apiextensions-apiserver v0.30.3/go.mod h1:uhXxYDkMAvl6CJw4lrDN4CPbONkF3+XL9cacCT44kV4=
+k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo=
+k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
+k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
+k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
 k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
 k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
 k8s.io/cli-runtime v0.30.3 h1:aG69oRzJuP2Q4o8dm+f5WJIX4ZBEwrvdID0+MXyUY6k=
 k8s.io/cli-runtime v0.30.3/go.mod h1:hwrrRdd9P84CXSKzhHxrOivAR9BRnkMt0OeP5mj7X30=
-k8s.io/client-go v0.30.3 h1:bHrJu3xQZNXIi8/MoxYtZBBWQQXwy16zqJwloXXfD3k=
-k8s.io/client-go v0.30.3/go.mod h1:8d4pf8vYu665/kUbsxWAQ/JDBNWqfFeZnvFiVdmx89U=
-k8s.io/code-generator v0.30.3 h1:bmtnLJKagDS5f5uOEpLyJiDfIMKXGMKgOLBdde+w0Mc=
-k8s.io/code-generator v0.30.3/go.mod h1:PFgBiv+miFV7TZYp+RXgROkhA+sWYZ+mtpbMLofMke8=
-k8s.io/component-base v0.30.3 h1:Ci0UqKWf4oiwy8hr1+E3dsnliKnkMLZMVbWzeorlk7s=
-k8s.io/component-base v0.30.3/go.mod h1:C1SshT3rGPCuNtBs14RmVD2xW0EhRSeLvBh7AGk1quA=
-k8s.io/endpointslice v0.30.3 h1:icsri41tm4maJLY8mpbvSgLeR2dFR5KhsbITyAYUw9s=
-k8s.io/endpointslice v0.30.3/go.mod h1:z5KEeOmhGH/McCFn8JliVmDf9p/8frv1Heabk4yMPYU=
+k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
+k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
+k8s.io/code-generator v0.31.0 h1:w607nrMi1KeDKB3/F/J4lIoOgAwc+gV9ZKew4XRfMp8=
+k8s.io/code-generator v0.31.0/go.mod h1:84y4w3es8rOJOUUP1rLsIiGlO1JuEaPFXQPA9e/K6U0=
+k8s.io/component-base v0.31.0 h1:/KIzGM5EvPNQcYgwq5NwoQBaOlVFrghoVGr8lG6vNRs=
+k8s.io/component-base v0.31.0/go.mod h1:TYVuzI1QmN4L5ItVdMSXKvH7/DtvIuas5/mm8YT3rTo=
+k8s.io/endpointslice v0.31.0 h1:iNADqy4yTsRcszDza6QCHCvZZviAVU36DUE+LZSmBzM=
+k8s.io/endpointslice v0.31.0/go.mod h1:1yyB5w4UNm4b+IX6BtnvZ5XLtWbvFUfg90yWf+O1PVk=
 k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 h1:NGrVE502P0s0/1hudf8zjgwki1X/TByhmAoILTarmzo=
 k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-aggregator v0.30.3 h1:hy5zfQ7p6BuJgc/XtGp3GBh2MPfOj6b1n3raKKMHOQE=
-k8s.io/kube-aggregator v0.30.3/go.mod h1:2SP0IckvQoOwwZN8lmtWUnTZTgIpwOWvidWtxyqLwuk=
+k8s.io/kube-aggregator v0.31.0 h1:3DqSpmqHF8rey7fY+qYXLJms0tYPhxrgWvjpnKVnS0Y=
+k8s.io/kube-aggregator v0.31.0/go.mod h1:Fa+OVSpMQC7zbTTz7/QG7FXe9jZ8usuJQej5sMdCrkM=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
diff --git a/multicluster/service-mirror/cluster_watcher.go b/multicluster/service-mirror/cluster_watcher.go
index 0598b9f36..2a40d8023 100644
--- a/multicluster/service-mirror/cluster_watcher.go
+++ b/multicluster/service-mirror/cluster_watcher.go
@@ -47,7 +47,7 @@ type (
 		eventBroadcaster        record.EventBroadcaster
 		recorder                record.EventRecorder
 		log                     *logging.Entry
-		eventsQueue             workqueue.RateLimitingInterface
+		eventsQueue             workqueue.TypedRateLimitingInterface[any]
 		requeueLimit            int
 		repairPeriod            time.Duration
 		gatewayAlive            bool
@@ -201,7 +201,7 @@ func NewRemoteClusterServiceWatcher(
 			"cluster":    clusterName,
 			"apiAddress": cfg.Host,
 		}),
-		eventsQueue:             workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()),
+		eventsQueue:             workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[any]()),
 		requeueLimit:            requeueLimit,
 		repairPeriod:            repairPeriod,
 		liveness:                liveness,


Test patch:
diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
index 7d06da27f..2f1e1bd02 100644
--- a/cli/cmd/install_test.go
+++ b/cli/cmd/install_test.go
@@ -60,6 +60,7 @@ func TestRender(t *testing.T) {
 		CNIEnabled:              false,
 		IdentityTrustDomain:     defaultValues.IdentityTrustDomain,
 		IdentityTrustAnchorsPEM: defaultValues.IdentityTrustAnchorsPEM,
+		DestinationController:   map[string]any{},
 		PodAnnotations:          map[string]string{},
 		PodLabels:               map[string]string{},
 		PriorityClassName:       "PriorityClassName",
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index ab1bdd086..25bd1c2d5 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1490,6 +1498,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1501,6 +1510,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1523,6 +1533,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1534,6 +1545,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index a6155034c..698083d90 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1488,6 +1496,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1499,6 +1508,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1521,6 +1531,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1532,6 +1543,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 0283388a3..7b4b6981c 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1488,6 +1496,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1499,6 +1508,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1521,6 +1531,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1532,6 +1543,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index a6155034c..698083d90 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1488,6 +1496,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1499,6 +1508,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1521,6 +1531,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1532,6 +1543,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index dec936b3c..2693d941f 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1488,6 +1496,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1499,6 +1508,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1521,6 +1531,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1532,6 +1543,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index dc9aad80e..57e48992f 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1477,6 +1485,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1488,6 +1497,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1510,6 +1520,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1521,6 +1532,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_gid_output.golden b/cli/cmd/testdata/install_gid_output.golden
index dcc89dd49..15f086149 100755
--- a/cli/cmd/testdata/install_gid_output.golden
+++ b/cli/cmd/testdata/install_gid_output.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1493,6 +1501,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1504,6 +1513,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1527,6 +1537,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1538,6 +1549,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 1c064fe8b..5fdbc4c1f 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 1
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources:
       cpu:
@@ -811,7 +815,11 @@ data:
         limit: 250Mi
         request: 50Mi
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Fail
 ---
@@ -1615,6 +1623,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1626,6 +1635,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         resources:
           limits:
             memory: "250Mi"
@@ -1654,6 +1664,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1665,6 +1676,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 3c13ef9c2..109f3213a 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 1
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources:
       cpu:
@@ -811,7 +815,11 @@ data:
         limit: 250Mi
         request: 50Mi
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Fail
 ---
@@ -1615,6 +1623,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1626,6 +1635,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         resources:
           limits:
             memory: "250Mi"
@@ -1654,6 +1664,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1665,6 +1676,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 67a311838..2240ac0c1 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -450,6 +450,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -457,6 +459,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: true
@@ -706,7 +710,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1419,6 +1427,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1430,6 +1439,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1452,6 +1462,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1463,6 +1474,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index 7025eedaa..182a93e34 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -520,6 +520,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -527,6 +529,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -752,7 +756,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tap:
       caBundle: test-tap-ca-bundle
       externalSecret: true
@@ -1463,6 +1471,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1474,6 +1483,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1496,6 +1506,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1507,6 +1518,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index 0ebd92695..2615b4401 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -520,6 +520,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 1
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -527,6 +529,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources:
       cpu:
@@ -788,7 +792,11 @@ data:
         limit: 250Mi
         request: 50Mi
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tap:
       caBundle: test-tap-ca-bundle
       externalSecret: true
@@ -1590,6 +1598,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1601,6 +1610,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         resources:
           limits:
             memory: "250Mi"
@@ -1629,6 +1639,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1640,6 +1651,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
index 40e261f23..ea6e80ece 100755
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
@@ -520,6 +520,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 1
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -527,6 +529,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources:
       cpu:
@@ -788,7 +792,11 @@ data:
         limit: 250Mi
         request: 50Mi
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tap:
       caBundle: test-tap-ca-bundle
       externalSecret: true
@@ -1595,6 +1603,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1606,6 +1615,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         resources:
           limits:
             memory: "250Mi"
@@ -1635,6 +1645,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1646,6 +1657,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 0652e150c..40a36dc46 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -520,6 +520,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 1
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -527,6 +529,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources:
       cpu:
@@ -792,7 +796,11 @@ data:
         limit: 250Mi
         request: 50Mi
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tap:
       caBundle: test-tap-ca-bundle
       externalSecret: true
@@ -1602,6 +1610,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1613,6 +1622,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         resources:
           limits:
             memory: "250Mi"
@@ -1641,6 +1651,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1652,6 +1663,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 27cfe2cea..50d1299b8 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -515,6 +515,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 1
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -522,6 +524,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources:
       cpu:
@@ -778,7 +782,11 @@ data:
         limit: 250Mi
         request: 50Mi
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tap:
       caBundle: test-tap-ca-bundle
       externalSecret: true
@@ -1580,6 +1588,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1591,6 +1600,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         resources:
           limits:
             memory: "250Mi"
@@ -1619,6 +1629,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1630,6 +1641,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index acfbce974..2906515f1 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1481,6 +1489,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1492,6 +1501,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1514,6 +1524,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1525,6 +1536,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 2abbe3ada..65e20c577 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -509,7 +509,7 @@ data:
         name: DebugImageName
         pullPolicy: DebugImagePullPolicy
         version: DebugVersion
-    destinationController: null
+    destinationController: {}
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -1995,7 +1995,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y2xpVmVyc2lvbjogQ2xpVmVyc2lvbgpjbHVzdGVyTmV0d29ya3M6IENsdXN0ZXJOZXR3b3Jrcwpjb250cm9sUGxhbmVUcmFjaW5nTmFtZXNwYWNlOiAiIgpjb250cm9sbGVyOiBudWxsCmNvbnRyb2xsZXJHSUQ6IDIxMDMKY29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckxvZ0Zvcm1hdDogQ29udHJvbGxlckxvZ0Zvcm1hdApjb250cm9sbGVyTG9nTGV2ZWw6IENvbnRyb2xsZXJMb2dMZXZlbApkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmRlc3RpbmF0aW9uQ29udHJvbGxlcjogbnVsbApkaXNhYmxlSVB2NjogZmFsc2UKZW5hYmxlRW5kcG9pbnRTbGljZXM6IGZhbHNlCmhlYXJ0YmVhdFNjaGVkdWxlOiAxIDIgMyA0IDUKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KaWRlbnRpdHlUcnVzdEFuY2hvcnNQRU06IHwKICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgSlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1clpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d0hoY05NakF3T0RJNAogIE1EY3hNalEzV2hjTk16QXdPREkyTURjeE1qUTNXakFwTVNjd0pRWURWUVFERXg1cFpHVnVkR2wwZVM1c2FXNXIKICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgbDF2Z3c3OXJqQjV1U0lUSUNVQTZHeWZ2U0ZmY3VJaXM3Qi9YRlNra3dBSFU1Uy9zMUFBUCtSMFRYN0hCV1VDNAogIHVhRzRXV3Npd0pLTm43bWdvM0F3YmpBT0JnTlZIUThCQWY4RUJBTUNBUVl3RWdZRFZSMFRBUUgvQkFnd0JnRUIKICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Bb0dDQ3FHU000OUJBTUNBMGtBTUVZQwogIElRQ043bEJGTEREdmp4NlYwK1hranBLRVJSc0pZZjVhZE12bmxvRmw0OGlsSmdJaEFOdHhobmRjcitRSlB1QzgKICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQppbWFnZVB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQppbWFnZVB1bGxTZWNyZXRzOiBudWxsCmxpbmtlcmRWZXJzaW9uOiBMaW5rZXJkVmVyc2lvbgpuZXR3b3JrVmFsaWRhdG9yOgogIGNvbm5lY3RBZGRyOiAxLjEuMS4xOjIwMDAxCiAgZW5hYmxlU2VjdXJpdHlDb250ZXh0OiBmYWxzZQogIGxpc3RlbkFkZHI6ICdbOjpdOjQxNDAnCnBvZE1vbml0b3I6IG51bGwKcG9saWN5Q29udHJvbGxlcjoKICBpbWFnZToKICAgIG5hbWU6IFBvbGljeUNvbnRyb2xsZXJJbWFnZU5hbWUKICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogUG9saWN5Q29udHJvbGxlclZlcnNpb24KICBsb2dMZXZlbDogbG9nLWxldmVsCiAgcmVzb3VyY2VzOgogICAgY3B1OgogICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgIHJlcXVlc3Q6IGNwdS1yZXF1ZXN0CiAgICBtZW1vcnk6CiAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgcmVxdWVzdDogbWVtb3J5LXJlcXVlc3QKcG9saWN5VmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwb2xpY3kgdmFsaWRhdG9yIENBIGJ1bmRsZQogIGV4dGVybmFsU2VjcmV0OiB0cnVlCnByaW9yaXR5Q2xhc3NOYW1lOiBQcmlvcml0eUNsYXNzTmFtZQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBleHRlcm5hbFNlY3JldDogdHJ1ZQpwcm94eToKICBjb250cm9sOiBudWxsCiAgZGVmYXVsdEluYm91bmRQb2xpY3k6IGRlZmF1bHQtYWxsb3ctcG9saWN5CiAgZ2lkOiAyMTAyCiAgaW1hZ2U6CiAgICBuYW1lOiBQcm94eUltYWdlTmFtZQogICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICBpbmJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgaW5ib3VuZERpc2NvdmVyeUNhY2hlVW51c2VkVGltZW91dDogIiIKICBsb2dMZXZlbDogd2FybixsaW5rZXJkPWluZm8KICBvcGFxdWVQb3J0czogMjUsNDQzLDU4NywzMzA2LDU0MzIsMTEyMTEKICBvdXRib3VuZENvbm5lY3RUaW1lb3V0OiAiIgogIG91dGJvdW5kRGlzY292ZXJ5Q2FjaGVVbnVzZWRUaW1lb3V0OiAiIgogIHJlc291cmNlczoKICAgIGNwdToKICAgICAgbGltaXQ6IGNwdS1saW1pdAogICAgICByZXF1ZXN0OiBjcHUtcmVxdWVzdAogICAgbWVtb3J5OgogICAgICBsaW1pdDogbWVtb3J5LWxpbWl0CiAgICAgIHJlcXVlc3Q6IG1lbW9yeS1yZXF1ZXN0CiAgc3RhcnR1cFByb2JlOiBudWxsCnByb3h5Q29udGFpbmVyTmFtZTogUHJveHlDb250YWluZXJOYW1lCnByb3h5SW5pdDoKICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgaWdub3JlT3V0Ym91bmRQb3J0czogIjQ0MyIKICBpbWFnZToKICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICB2ZXJzaW9uOiBQcm94eUluaXRWZXJzaW9uCiAga3ViZUFQSVNlcnZlclBvcnRzOiAiIgpwcm94eUluamVjdG9yOgogIGNhQnVuZGxlOiBwcm94eSBpbmplY3RvciBDQSBidW5kbGUKICBleHRlcm5hbFNlY3JldDogdHJ1ZQp3ZWJob29rRmFpbHVyZVBvbGljeTogV2ViaG9va0ZhaWx1cmVQb2xpY3kK
+  linkerd-config-overrides: Y2xpVmVyc2lvbjogQ2xpVmVyc2lvbgpjbHVzdGVyTmV0d29ya3M6IENsdXN0ZXJOZXR3b3Jrcwpjb250cm9sUGxhbmVUcmFjaW5nTmFtZXNwYWNlOiAiIgpjb250cm9sbGVyOiBudWxsCmNvbnRyb2xsZXJHSUQ6IDIxMDMKY29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckxvZ0Zvcm1hdDogQ29udHJvbGxlckxvZ0Zvcm1hdApjb250cm9sbGVyTG9nTGV2ZWw6IENvbnRyb2xsZXJMb2dMZXZlbApkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmRpc2FibGVJUHY2OiBmYWxzZQplbmFibGVFbmRwb2ludFNsaWNlczogZmFsc2UKaGVhcnRiZWF0U2NoZWR1bGU6IDEgMiAzIDQgNQppZGVudGl0eToKICBpc3N1ZXI6CiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQppZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogIE1JSUJ3VENDQVdhZ0F3SUJBZ0lRZURacDVsRGFJeWdRNVVmTUtackZBVEFLQmdncWhrak9QUVFEQWpBcE1TY3cKICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgTURjeE1qUTNXaGNOTXpBd09ESTJNRGN4TWpRM1dqQXBNU2N3SlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1cgogIFpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFScWM3MFoKICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgdWFHNFdXc2l3SktObjdtZ28zQXdiakFPQmdOVkhROEJBZjhFQkFNQ0FRWXdFZ1lEVlIwVEFRSC9CQWd3QmdFQgogIC93SUJBVEFkQmdOVkhRNEVGZ1FVNVl0alZWUGZkN0k3TkxIc24yQzI2RUJ5R1Ywd0tRWURWUjBSQkNJd0lJSWUKICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgSVFDTjdsQkZMRER2ang2VjArWGtqcEtFUlJzSllmNWFkTXZubG9GbDQ4aWxKZ0loQU50eGhuZGNyK1FKUHVDOAogIHZnVUMwZDIvOUZNdWVJVk1iKzQ2V1RDT2pzcXIKICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCmltYWdlUHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CmltYWdlUHVsbFNlY3JldHM6IG51bGwKbGlua2VyZFZlcnNpb246IExpbmtlcmRWZXJzaW9uCm5ldHdvcmtWYWxpZGF0b3I6CiAgY29ubmVjdEFkZHI6IDEuMS4xLjE6MjAwMDEKICBlbmFibGVTZWN1cml0eUNvbnRleHQ6IGZhbHNlCiAgbGlzdGVuQWRkcjogJ1s6Ol06NDE0MCcKcG9kTW9uaXRvcjogbnVsbApwb2xpY3lDb250cm9sbGVyOgogIGltYWdlOgogICAgbmFtZTogUG9saWN5Q29udHJvbGxlckltYWdlTmFtZQogICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICB2ZXJzaW9uOiBQb2xpY3lDb250cm9sbGVyVmVyc2lvbgogIGxvZ0xldmVsOiBsb2ctbGV2ZWwKICByZXNvdXJjZXM6CiAgICBjcHU6CiAgICAgIGxpbWl0OiBjcHUtbGltaXQKICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgIG1lbW9yeToKICAgICAgbGltaXQ6IG1lbW9yeS1saW1pdAogICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdApwb2xpY3lWYWxpZGF0b3I6CiAgY2FCdW5kbGU6IHBvbGljeSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgZXh0ZXJuYWxTZWNyZXQ6IHRydWUKcHJpb3JpdHlDbGFzc05hbWU6IFByaW9yaXR5Q2xhc3NOYW1lCnByb2ZpbGVWYWxpZGF0b3I6CiAgY2FCdW5kbGU6IHByb2ZpbGUgdmFsaWRhdG9yIENBIGJ1bmRsZQogIGV4dGVybmFsU2VjcmV0OiB0cnVlCnByb3h5OgogIGNvbnRyb2w6IG51bGwKICBkZWZhdWx0SW5ib3VuZFBvbGljeTogZGVmYXVsdC1hbGxvdy1wb2xpY3kKICBnaWQ6IDIxMDIKICBpbWFnZToKICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IFByb3h5VmVyc2lvbgogIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICBpbmJvdW5kRGlzY292ZXJ5Q2FjaGVVbnVzZWRUaW1lb3V0OiAiIgogIGxvZ0xldmVsOiB3YXJuLGxpbmtlcmQ9aW5mbwogIG9wYXF1ZVBvcnRzOiAyNSw0NDMsNTg3LDMzMDYsNTQzMiwxMTIxMQogIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgb3V0Ym91bmREaXNjb3ZlcnlDYWNoZVVudXNlZFRpbWVvdXQ6ICIiCiAgcmVzb3VyY2VzOgogICAgY3B1OgogICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgIHJlcXVlc3Q6IGNwdS1yZXF1ZXN0CiAgICBtZW1vcnk6CiAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgcmVxdWVzdDogbWVtb3J5LXJlcXVlc3QKICBzdGFydHVwUHJvYmU6IG51bGwKcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKcHJveHlJbml0OgogIGlnbm9yZUluYm91bmRQb3J0czogIiIKICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiNDQzIgogIGltYWdlOgogICAgbmFtZTogUHJveHlJbml0SW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IFByb3h5SW5pdFZlcnNpb24KICBrdWJlQVBJU2VydmVyUG9ydHM6ICIiCnByb3h5SW5qZWN0b3I6CiAgY2FCdW5kbGU6IHByb3h5IGluamVjdG9yIENBIGJ1bmRsZQogIGV4dGVybmFsU2VjcmV0OiB0cnVlCnNwVmFsaWRhdG9yOiBudWxsCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 74e1ebc27..da8e80960 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1488,6 +1496,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1499,6 +1508,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1521,6 +1531,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1532,6 +1543,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 146789a87..80cc0a233 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -519,6 +519,8 @@ data:
         maxSurge: 25%
         maxUnavailable: 25%
     destinationController:
+      livenessProbe:
+        timeoutSeconds: 1
       meshedHttp2ClientProtobuf:
         keep_alive:
           interval:
@@ -526,6 +528,8 @@ data:
           timeout:
             seconds: 3
           while_idle: true
+      readinessProbe:
+        timeoutSeconds: 1
     destinationProxyResources: null
     destinationResources: null
     disableHeartBeat: false
@@ -775,7 +779,11 @@ data:
     proxyInjectorProxyResources: null
     proxyInjectorResources: null
     revisionHistoryLimit: 10
-    spValidator: null
+    spValidator:
+      livenessProbe:
+        timeoutSeconds: 1
+      readinessProbe:
+        timeoutSeconds: 1
     tolerations: null
     webhookFailurePolicy: Ignore
 ---
@@ -1488,6 +1496,7 @@ spec:
             path: /ping
             port: 9996
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: destination
         ports:
         - containerPort: 8086
@@ -1499,6 +1508,7 @@ spec:
           httpGet:
             path: /ready
             port: 9996
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
@@ -1521,6 +1531,7 @@ spec:
             path: /ping
             port: 9997
           initialDelaySeconds: 10
+          timeoutSeconds: 1
         name: sp-validator
         ports:
         - containerPort: 8443
@@ -1532,6 +1543,7 @@ spec:
           httpGet:
             path: /ready
             port: 9997
+          timeoutSeconds: 1
         securityContext:
           capabilities:
             drop:
diff --git a/multicluster/service-mirror/cluster_watcher_mirroring_test.go b/multicluster/service-mirror/cluster_watcher_mirroring_test.go
index 378e50778..792481ca7 100644
--- a/multicluster/service-mirror/cluster_watcher_mirroring_test.go
+++ b/multicluster/service-mirror/cluster_watcher_mirroring_test.go
@@ -28,7 +28,7 @@ type mirroringTestCase struct {
 func (tc *mirroringTestCase) run(t *testing.T) {
 	t.Run(tc.description, func(t *testing.T) {
 
-		q := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter())
+		q := workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[any]())
 		localAPI, err := tc.environment.runEnvironment(q)
 		if err != nil {
 			t.Fatal(err)
@@ -267,7 +267,7 @@ func TestLocalNamespaceCreatedAfterServiceExport(t *testing.T) {
 	remoteAPI.Sync(nil)
 	localAPI.Sync(nil)
 
-	q := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter())
+	q := workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[any]())
 	eventRecorder := record.NewFakeRecorder(100)
 
 	watcher := RemoteClusterServiceWatcher{
@@ -358,7 +358,7 @@ func TestServiceCreatedGatewayAlive(t *testing.T) {
 	remoteAPI.Sync(nil)
 	localAPI.Sync(nil)
 
-	events := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter())
+	events := workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[any]())
 	watcher := RemoteClusterServiceWatcher{
 		link: &multicluster.Link{
 			TargetClusterName:       clusterName,
@@ -506,7 +506,7 @@ func TestServiceCreatedGatewayDown(t *testing.T) {
 	remoteAPI.Sync(nil)
 	localAPI.Sync(nil)
 
-	events := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter())
+	events := workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[any]())
 	watcher := RemoteClusterServiceWatcher{
 		link: &multicluster.Link{
 			TargetClusterName:       clusterName,
diff --git a/multicluster/service-mirror/cluster_watcher_test_util.go b/multicluster/service-mirror/cluster_watcher_test_util.go
index f96cdce6e..b0e083ea1 100644
--- a/multicluster/service-mirror/cluster_watcher_test_util.go
+++ b/multicluster/service-mirror/cluster_watcher_test_util.go
@@ -43,7 +43,7 @@ type testEnvironment struct {
 	link            multicluster.Link
 }
 
-func (te *testEnvironment) runEnvironment(watcherQueue workqueue.RateLimitingInterface) (*k8s.API, error) {
+func (te *testEnvironment) runEnvironment(watcherQueue workqueue.TypedRateLimitingInterface[any]) (*k8s.API, error) {
 	remoteAPI, err := k8s.NewFakeAPI(te.remoteResources...)
 	if err != nil {
 		return nil, err
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index ac239ea37..4ac0e8506 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -98,6 +98,12 @@ func TestNewValues(t *testing.T) {
 					"while_idle": true,
 				},
 			},
+			"livenessProbe":  map[string]interface{}{"timeoutSeconds": 1.0},
+			"readinessProbe": map[string]interface{}{"timeoutSeconds": 1.0},
+		},
+		SPValidator: map[string]interface{}{
+			"livenessProbe":  map[string]interface{}{"timeoutSeconds": 1.0},
+			"readinessProbe": map[string]interface{}{"timeoutSeconds": 1.0},
 		},
 		PolicyController: &PolicyController{
 			Image: &Image{