Repository: linkerd/linkerd2
Pull request #14048 (2025-05-23 03:13:54)

build(deps): bump rustversion from 1.0.20 to 1.0.21
Bumps [rustversion](https://github.com/dtolnay/rustversion) from 1.0.20 to 1.0.21.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/dtolnay/rustversion/releases">rustversion's releases</a>.</em></p>
<blockquote>
<h2>1.0.21</h2>
<ul>
<li>Support <code>-Zfmt-debug=none</code> (<a href="https://redirect.github.com/dtolnay/rustversion/issues/61">#61</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dtolnay/rustversion/commit/1f833903f93e6dbabf9eebb5935fcafd2f6f0ce1"><code>1f83390</code></a> Release 1.0.21</li>
<li><a href="https://github.com/dtolnay/rustversion/commit/8be70573321aa3d616fcf46b7df7c98d0d3cdc1a"><code>8be7057</code></a> Merge pull request <a href="https://redirect.github.com/dtolnay/rustversion/issues/61">#61</a> from dtolnay/debugnone</li>
<li><a href="https://github.com/dtolnay/rustversion/commit/91dd8ef7b1e999d3a733d8136b60d6e9c0290d9d"><code>91dd8ef</code></a> Ignore elidable_lifetime_names pedantic clippy lint</li>
<li><a href="https://github.com/dtolnay/rustversion/commit/052138c8c8c6e13ee49dc94cbeb04962f5e54db3"><code>052138c</code></a> Support -Zfmt-debug=none</li>
<li><a href="https://github.com/dtolnay/rustversion/commit/17dc0fd54f1591305d55e784745193f5867d34ee"><code>17dc0fd</code></a> Pin nightly toolchain used for miri job</li>
<li>See full diff in <a href="https://github.com/dtolnay/rustversion/compare/1.0.20...1.0.21">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rustversion&package-manager=cargo&previous-version=1.0.20&new-version=1.0.21)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 0345d2d19..e8c1796e0 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: tj-actions/changed-files@403a8a6fd188648f8a5adab2047d8eab5c0a4b34
+      - uses: tj-actions/changed-files@3981e4f74104e7a4c67a835e1e5dd5d9eb0f0a57
         id: changed
         with:
           files: |
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index e1e4e77b6..44f97c070 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - id: tag
         run: echo "tag=$(CI_FORCE_CLEAN=1 bin/root-tag)" >> "$GITHUB_OUTPUT"
-      - uses: tj-actions/changed-files@403a8a6fd188648f8a5adab2047d8eab5c0a4b34
+      - uses: tj-actions/changed-files@3981e4f74104e7a4c67a835e1e5dd5d9eb0f0a57
         id: core
         with:
           files: |
diff --git a/Cargo.lock b/Cargo.lock
index a84faae37..ba2824fa8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -249,9 +249,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.23"
+version = "1.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f4ac86a9e5bc1e2b3449ab9d7d3a6a405e3d1bb28d7b9be8614f55846ae3766"
+checksum = "16595d3be041c03b09d08d0858631facccee9221e579704070e6e9e4915d3bc7"
 dependencies = [
  "shlex",
 ]
@@ -507,7 +507,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -924,11 +924,10 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.5"
+version = "0.27.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
+checksum = "03a01595e11bdcec50946522c32dde3fc6914743000a68b93000965f2f02406d"
 dependencies = [
- "futures-util",
  "http",
  "hyper",
  "hyper-util",
@@ -1586,13 +1585,13 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2153,9 +2152,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.20"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
+checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
 
 [[package]]
 name = "ryu"
@@ -2465,9 +2464,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
 dependencies = [
  "backtrace",
  "bytes",
diff --git a/cli/cmd/inject.go b/cli/cmd/inject.go
index c24c145a2..6cb84c55d 100644
--- a/cli/cmd/inject.go
+++ b/cli/cmd/inject.go
@@ -40,13 +40,14 @@ type resourceTransformerInject struct {
 	overrideAnnotations map[string]string
 	enableDebugSidecar  bool
 	closeWaitTimeout    time.Duration
+	overrider           inject.ValueOverrider
 }
 
 func runInjectCmd(inputs []io.Reader, errWriter, outWriter io.Writer, transformer *resourceTransformerInject, output string) int {
 	return transformInput(inputs, errWriter, outWriter, transformer, output)
 }
 
-func newCmdInject() *cobra.Command {
+func NewCmdInject(overrider inject.ValueOverrider) *cobra.Command {
 	defaults, err := linkerd2.NewValues()
 	if err != nil {
 		fmt.Fprint(os.Stderr, err.Error())
@@ -109,6 +110,7 @@ sub-folders, or coming from stdin.`,
 				overrideAnnotations: overrideAnnotations,
 				enableDebugSidecar:  enableDebugSidecar,
 				closeWaitTimeout:    closeWaitTimeout,
+				overrider:           overrider,
 			}
 			exitCode := uninjectAndInject(in, stderr, stdout, transformer, output)
 			os.Exit(exitCode)
@@ -205,7 +207,7 @@ func (rt resourceTransformerInject) transform(bytes []byte) ([]byte, []inject.Re
 		conf.AppendPodAnnotation(k8s.ProxyInjectAnnotation, k8s.ProxyInjectEnabled)
 	}
 
-	patchJSON, err := conf.GetPodPatch(rt.injectProxy)
+	patchJSON, err := conf.GetPodPatch(rt.injectProxy, rt.overrider)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/cli/cmd/root.go b/cli/cmd/root.go
index ffafe1cdc..d4077dc53 100644
--- a/cli/cmd/root.go
+++ b/cli/cmd/root.go
@@ -13,6 +13,7 @@ import (
 	pkgcmd "github.com/linkerd/linkerd2/pkg/cmd"
 	"github.com/linkerd/linkerd2/pkg/flags"
 	"github.com/linkerd/linkerd2/pkg/healthcheck"
+	"github.com/linkerd/linkerd2/pkg/inject"
 	viz "github.com/linkerd/linkerd2/viz/cmd"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -109,7 +110,7 @@ func init() {
 	RootCmd.AddCommand(newCmdDiagnostics())
 	RootCmd.AddCommand(newCmdDoc())
 	RootCmd.AddCommand(newCmdIdentity())
-	RootCmd.AddCommand(newCmdInject())
+	RootCmd.AddCommand(NewCmdInject(inject.GetOverriddenValues))
 	RootCmd.AddCommand(newCmdInstall())
 	RootCmd.AddCommand(newCmdInstallCNIPlugin())
 	RootCmd.AddCommand(newCmdProfile())
diff --git a/controller/cmd/proxy-injector/main.go b/controller/cmd/proxy-injector/main.go
index 6118d2057..f52b8991d 100644
--- a/controller/cmd/proxy-injector/main.go
+++ b/controller/cmd/proxy-injector/main.go
@@ -9,6 +9,7 @@ import (
 	injector "github.com/linkerd/linkerd2/controller/proxy-injector"
 	"github.com/linkerd/linkerd2/controller/webhook"
 	"github.com/linkerd/linkerd2/pkg/flags"
+	"github.com/linkerd/linkerd2/pkg/inject"
 )
 
 // Main executes the proxy-injector subcommand
@@ -24,7 +25,7 @@ func Main(args []string) {
 	webhook.Launch(
 		context.Background(),
 		[]k8s.APIResource{k8s.NS, k8s.Deploy, k8s.RC, k8s.RS, k8s.Job, k8s.DS, k8s.SS, k8s.Pod, k8s.CJ},
-		injector.Inject(*linkerdNamespace),
+		injector.Inject(*linkerdNamespace, inject.GetOverriddenValues),
 		"linkerd-proxy-injector",
 		*metricsAddr,
 		*addr,
diff --git a/controller/proxy-injector/webhook.go b/controller/proxy-injector/webhook.go
index 0572759c5..87caefebf 100644
--- a/controller/proxy-injector/webhook.go
+++ b/controller/proxy-injector/webhook.go
@@ -28,7 +28,7 @@ const (
 // Inject returns the function that produces an AdmissionResponse containing
 // the patch, if any, to apply to the pod (proxy sidecar and eventually the
 // init container to set it up)
-func Inject(linkerdNamespace string) webhook.Handler {
+func Inject(linkerdNamespace string, overrider inject.ValueOverrider) webhook.Handler {
 	return func(
 		ctx context.Context,
 		api *k8s.MetadataAPI,
@@ -116,7 +116,7 @@ func Inject(linkerdNamespace string) webhook.Handler {
 				}
 			}
 
-			patchJSON, err := resourceConfig.GetPodPatch(true)
+			patchJSON, err := resourceConfig.GetPodPatch(true, overrider)
 			if err != nil {
 				return nil, err
 			}
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index 618611bf4..687a87820 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -90,6 +90,8 @@ var (
 	}
 )
 
+type ValueOverrider func(values *l5dcharts.Values, overrides map[string]string, namedPorts map[string]int32) (*l5dcharts.Values, error)
+
 // Origin defines where the input YAML comes from. Refer the ResourceConfig's
 // 'origin' field
 type Origin int
@@ -661,13 +663,13 @@ func (conf *ResourceConfig) getAnnotationOverrides() map[string]string {
 
 // GetPodPatch returns the JSON patch containing the proxy and init containers specs, if any.
 // If injectProxy is false, only the config.linkerd.io annotations are set.
-func (conf *ResourceConfig) GetPodPatch(injectProxy bool) ([]byte, error) {
+func (conf *ResourceConfig) GetPodPatch(injectProxy bool, overrider ValueOverrider) ([]byte, error) {
 	namedPorts := make(map[string]int32)
 	if conf.HasPodTemplate() {
 		namedPorts = util.GetNamedPorts(conf.pod.spec.Containers)
 	}
 
-	values, err := GetOverriddenValues(conf.values, conf.getAnnotationOverrides(), namedPorts)
+	values, err := overrider(conf.values, conf.getAnnotationOverrides(), namedPorts)
 	values.Proxy.PodInboundPorts = getPodInboundPorts(conf.pod.spec)
 	if err != nil {
 		return nil, fmt.Errorf("could not generate Overridden Values: %w", err)
diff --git a/pkg/inject/inject_fuzzer.go b/pkg/inject/inject_fuzzer.go
index ede129e96..1310e9891 100644
--- a/pkg/inject/inject_fuzzer.go
+++ b/pkg/inject/inject_fuzzer.go
@@ -25,7 +25,7 @@ func FuzzInject(data []byte) int {
 	if err != nil {
 		return 0
 	}
-	_, _ = conf.GetPodPatch(injectProxy)
+	_, _ = conf.GetPodPatch(injectProxy, GetOverriddenValues)
 	_, _ = conf.CreateOpaquePortsPatch()
 
 	report := &Report{}
diff --git a/web/app/package.json b/web/app/package.json
index 0cec816d7..2ec30f703 100644
--- a/web/app/package.json
+++ b/web/app/package.json
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@babel/core": "^7.27.1",
-    "@babel/eslint-parser": "^7.27.0",
+    "@babel/eslint-parser": "^7.27.1",
     "@babel/plugin-proposal-class-properties": "^7.17.12",
     "@babel/preset-env": "^7.26.8",
     "@babel/preset-react": "^7.27.1",
diff --git a/web/app/yarn.lock b/web/app/yarn.lock
index 97d72d79c..6d4e4cbae 100644
--- a/web/app/yarn.lock
+++ b/web/app/yarn.lock
@@ -55,10 +55,10 @@
     json5 "^2.2.3"
     semver "^6.3.1"
 
-"@babel/eslint-parser@^7.27.0":
-  version "7.27.0"
-  resolved "https://registry.yarnpkg.com/@babel/eslint-parser/-/eslint-parser-7.27.0.tgz#d55e52a5ef3b164139a799dc522c338faba3507c"
-  integrity sha512-dtnzmSjXfgL/HDgMcmsLSzyGbEosi4DrGWoCNfuI+W4IkVJw6izpTe7LtOdwAXnkDqw5yweboYCTkM2rQizCng==
+"@babel/eslint-parser@^7.27.1":
+  version "7.27.1"
+  resolved "https://registry.yarnpkg.com/@babel/eslint-parser/-/eslint-parser-7.27.1.tgz#e146fb2facef62c6c5d1a6fd07cfd79ee9f7b0f1"
+  integrity sha512-q8rjOuadH0V6Zo4XLMkJ3RMQ9MSBqwaDByyYB0izsYdaIWGNLmEblbCOf1vyFHICcg16CD7Fsi51vcQnYxmt6Q==
   dependencies:
     "@nicolo-ribaudo/eslint-scope-5-internals" "5.1.1-v1"
     eslint-visitor-keys "^2.1.0"


Test patch:
diff --git a/cli/cmd/inject_test.go b/cli/cmd/inject_test.go
index 0bd477707..f31871d8b 100644
--- a/cli/cmd/inject_test.go
+++ b/cli/cmd/inject_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/linkerd/linkerd2/pkg/charts/linkerd2"
 	"github.com/linkerd/linkerd2/pkg/cmd"
+	"github.com/linkerd/linkerd2/pkg/inject"
 	"github.com/linkerd/linkerd2/pkg/k8s"
 	"github.com/linkerd/linkerd2/testutil"
 )
@@ -50,6 +51,7 @@ func testUninjectAndInject(t *testing.T, tc testCase) {
 		overrideAnnotations: getOverrideAnnotations(tc.testInjectConfig, defaultConfig()),
 		enableDebugSidecar:  tc.enableDebugSidecarFlag,
 		allowNsInject:       true,
+		overrider:           inject.GetOverriddenValues,
 	}
 
 	if exitCode := uninjectAndInject([]io.Reader{read}, report, output, transformer, "yaml"); exitCode != 0 {
@@ -431,6 +433,7 @@ func testInjectCmd(t *testing.T, tc injectCmd) {
 	transformer := &resourceTransformerInject{
 		injectProxy: tc.injectProxy,
 		values:      testConfig,
+		overrider:   inject.GetOverriddenValues,
 	}
 	exitCode := runInjectCmd([]io.Reader{in}, errBuffer, outBuffer, transformer, "yaml")
 	if exitCode != tc.exitCode {
@@ -537,6 +540,7 @@ func testInjectFilePath(t *testing.T, tc injectFilePath) {
 	transformer := &resourceTransformerInject{
 		injectProxy: true,
 		values:      values,
+		overrider:   inject.GetOverriddenValues,
 	}
 	if exitCode := runInjectCmd(in, errBuf, actual, transformer, "yaml"); exitCode != 0 {
 		t.Fatal("Unexpected error. Exit code from runInjectCmd: ", exitCode)
@@ -564,6 +568,7 @@ func testReadFromFolder(t *testing.T, resourceFolder string, expectedFolder stri
 	transformer := &resourceTransformerInject{
 		injectProxy: true,
 		values:      values,
+		overrider:   inject.GetOverriddenValues,
 	}
 	if exitCode := runInjectCmd(in, errBuf, actual, transformer, "yaml"); exitCode != 0 {
 		t.Fatal("Unexpected error. Exit code from runInjectCmd: ", exitCode)
diff --git a/controller/proxy-injector/webhook_test.go b/controller/proxy-injector/webhook_test.go
index 8711cab13..48dcbc43c 100644
--- a/controller/proxy-injector/webhook_test.go
+++ b/controller/proxy-injector/webhook_test.go
@@ -119,7 +119,7 @@ func TestGetPodPatch(t *testing.T) {
 					t.Fatal(err)
 				}
 
-				patchJSON, err := fullConf.GetPodPatch(true)
+				patchJSON, err := fullConf.GetPodPatch(true, inject.GetOverriddenValues)
 				if err != nil {
 					t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 				}
@@ -142,7 +142,7 @@ func TestGetPodPatch(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		patchJSON, err := conf.GetPodPatch(true)
+		patchJSON, err := conf.GetPodPatch(true, inject.GetOverriddenValues)
 		if err != nil {
 			t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 		}
@@ -163,7 +163,7 @@ func TestGetPodPatch(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		patchJSON, err := conf.GetPodPatch(true)
+		patchJSON, err := conf.GetPodPatch(true, inject.GetOverriddenValues)
 		if err != nil {
 			t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 		}
@@ -186,7 +186,7 @@ func TestGetPodPatch(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		patchJSON, err := conf.GetPodPatch(true)
+		patchJSON, err := conf.GetPodPatch(true, inject.GetOverriddenValues)
 		if err != nil {
 			t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 		}
@@ -210,7 +210,7 @@ func TestGetPodPatch(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		patchJSON, err := conf.GetPodPatch(true)
+		patchJSON, err := conf.GetPodPatch(true, inject.GetOverriddenValues)
 		if err != nil {
 			t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 		}
@@ -240,7 +240,7 @@ func TestGetPodPatch(t *testing.T) {
 		// The namespace has two config annotations: one valid and one invalid
 		// the pod patch should only contain the valid annotation.
 		inject.AppendNamespaceAnnotations(conf.GetOverrideAnnotations(), conf.GetNsAnnotations(), conf.GetWorkloadAnnotations())
-		patchJSON, err := conf.GetPodPatch(true)
+		patchJSON, err := conf.GetPodPatch(true, inject.GetOverriddenValues)
 		if err != nil {
 			t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 		}
@@ -254,7 +254,7 @@ func TestGetPodPatch(t *testing.T) {
 		deployment := fileContents(factory, t, "deployment-with-injected-proxy.yaml")
 		fakeReq := getFakePodReq(deployment)
 		conf := confNsDisabled().WithKind(fakeReq.Kind.Kind)
-		patchJSON, err := conf.GetPodPatch(true)
+		patchJSON, err := conf.GetPodPatch(true, inject.GetOverriddenValues)
 		if err != nil {
 			t.Fatalf("Unexpected PatchForAdmissionRequest error: %s", err)
 		}