Repository: linkerd/linkerd2
Pull request #5093 (2020-10-15 20:34:23)

Add a default set of ports to bypass the proxy
The proxy has a default, hardcoded set of ports on which it doesn't do
protocol detection (25, 587, 3306 -- all of which are server-first
protocols). In a recent change, this default set was removed from
the outbound proxy, since there was no way to configure it to anything
other than the default set. I had thought that there was a default set
applied to proxy-init, but this appears to not be the case.

This change adds these ports to the default Helm values to restore the
prior behavior.

I have also elected to include 443 in this set, as it is generally our
recommendation to avoid proxying HTTPS traffic, since the proxy provides
very little value on these connections today. This may change in the
future, but it seems like a good default for the 2.9 release.

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->



Patch:
diff --git a/charts/add-ons/prometheus/values.yaml b/charts/add-ons/prometheus/values.yaml
index f068a8da0..822596321 100644
--- a/charts/add-ons/prometheus/values.yaml
+++ b/charts/add-ons/prometheus/values.yaml
@@ -2,7 +2,7 @@
 # If installing/upgrading with Helm, you can override them through the usual `--set` or `-f` flags
 # when installing with the parent linkerd2 chart
 # Do not override them in this file!
-# If installing/upgrading with linkerd's CLI, use the `--addon-config` flag.
+# If installing/upgrading with linkerd's CLI, use the `--config` flag.
 image: prom/prometheus:v2.19.3
 args:
   storage.tsdb.path: /data
diff --git a/charts/linkerd2-cni/values.yaml b/charts/linkerd2-cni/values.yaml
index 189856b41..7cbc5ddd4 100644
--- a/charts/linkerd2-cni/values.yaml
+++ b/charts/linkerd2-cni/values.yaml
@@ -3,17 +3,24 @@ installNamespace: true
 cniResourceLabel: linkerd.io/cni-resource
 inboundProxyPort: 4143
 outboundProxyPort: 4140
-ignoreInboundPorts: ""
-ignoreOutboundPorts: ""
+
+# Default set of ports to skip via itpables:
+# - SMTP (25,587) server-first
+# - HTTPS (443) opaque TLS
+# - MYSQL (3306) server-first
+# - Memcached (11211) clients do not issue any preamble, which breaks detection
+ignoreInboundPorts: "25,443,587,3306,11211"
+ignoreOutboundPorts: "25,443,587,3306,11211"
+
 createdByAnnotation: linkerd.io/created-by
-cniPluginImage:   "ghcr.io/linkerd/cni-plugin"
+cniPluginImage: "ghcr.io/linkerd/cni-plugin"
 cniPluginVersion: linkerdVersionValue
-logLevel:         info
-portsToRedirect:  ""
-proxyUID:         2102
-destCNINetDir:    "/etc/cni/net.d"
-destCNIBinDir:    "/opt/cni/bin"
-useWaitFlag:      false
+logLevel: info
+portsToRedirect: ""
+proxyUID: 2102
+destCNINetDir: "/etc/cni/net.d"
+destCNIBinDir: "/opt/cni/bin"
+useWaitFlag: false
 priorityClassName: ""
 
 # namespace annotation and labels - do not edit
diff --git a/charts/linkerd2/templates/linkerd-config-addons.yaml b/charts/linkerd2/templates/linkerd-config-addons.yaml
deleted file mode 100644
index 6f86c9371..000000000
--- a/charts/linkerd2/templates/linkerd-config-addons.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-{{- /*
-  This config-map is used to store the configuration of add-ons, which is useful during upgrades.
-  This is required, as some add-ons can be enabled by default.
-  Whenever an add-on is disabled, we just store the enabled flag for it and remove any extra configuration
-  passed for the add-on.
-*/ -}}
----
-###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: {{.Values.global.namespace}}
-  labels:
-    {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-  annotations:
-    {{.Values.global.createdByAnnotation}}: {{default (printf "linkerd/helm %s" .Values.global.linkerdVersion) .Values.global.cliVersion}}
-data:
-  values: |-
-    global:
-      prometheusUrl: "{{.Values.global.prometheusUrl}}"
-      grafanaUrl: "{{.Values.global.grafanaUrl}}"
-    grafana:
-      {{- include "linkerd.addons.sanitize-config" .Values.grafana}}
-    prometheus:
-      {{- include "linkerd.addons.sanitize-config" .Values.prometheus}}
-    tracing:
-      {{- include "linkerd.addons.sanitize-config" .Values.tracing}}
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index 6bb97c913..6d67ca1ea 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -78,8 +78,13 @@ global:
 
   # proxy-init configuration
   proxyInit:
-    ignoreInboundPorts: ""
-    ignoreOutboundPorts: ""
+    # Default set of ports to skip via itpables:
+    # - SMTP (25,587) server-first
+    # - HTTPS (443) opaque TLS
+    # - MYSQL (3306) server-first
+    # - Memcached (11211) clients do not issue any preamble, which breaks detection
+    ignoreInboundPorts: "25,443,587,3306,11211"
+    ignoreOutboundPorts: "25,443,587,3306,11211"
     image:
       name: ghcr.io/linkerd/proxy-init
       pullPolicy: *image_pull_policy
diff --git a/cli/cmd/install.go b/cli/cmd/install.go
index cd8ab9aa3..3d3e69590 100644
--- a/cli/cmd/install.go
+++ b/cli/cmd/install.go
@@ -82,7 +82,6 @@ var (
 		"templates/proxy-injector.yaml",
 		"templates/sp-validator.yaml",
 		"templates/tap.yaml",
-		"templates/linkerd-config-addons.yaml",
 	}
 
 	ignoreCluster bool
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index 9712e83e6..d7e83524b 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -54,7 +54,9 @@
         "--proxy-uid",
         "2102",
         "--inbound-ports-to-ignore",
-        "4190,4191"
+        "4190,4191,25,443,587,3306,11211",
+        "--outbound-ports-to-ignore",
+        "25,443,587,3306,11211"
       ],
       "image": "ghcr.io/linkerd/proxy-init:v1.3.6",
       "imagePullPolicy": "IfNotPresent",
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index ff25eda98..8bf17c303 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -54,7 +54,9 @@
         "--proxy-uid",
         "2102",
         "--inbound-ports-to-ignore",
-        "4190,4191"
+        "4190,4191,25,443,587,3306,11211",
+        "--outbound-ports-to-ignore",
+        "25,443,587,3306,11211"
       ],
       "image": "ghcr.io/linkerd/proxy-init:v1.3.6",
       "imagePullPolicy": "IfNotPresent",
diff --git a/pkg/healthcheck/healthcheck.go b/pkg/healthcheck/healthcheck.go
index adaef35a6..32de70493 100644
--- a/pkg/healthcheck/healthcheck.go
+++ b/pkg/healthcheck/healthcheck.go
@@ -378,7 +378,6 @@ type HealthChecker struct {
 	trustAnchors     []*x509.Certificate
 	cniDaemonSet     *appsv1.DaemonSet
 	links            []multicluster.Link
-	addOns           map[string]interface{}
 }
 
 // NewHealthChecker returns an initialized HealthChecker
diff --git a/pkg/healthcheck/healthcheck_addons.go b/pkg/healthcheck/healthcheck_addons.go
index 1fe027ef3..b51d0761a 100644
--- a/pkg/healthcheck/healthcheck_addons.go
+++ b/pkg/healthcheck/healthcheck_addons.go
@@ -5,16 +5,11 @@ import (
 	"errors"
 	"fmt"
 
-	l5dcharts "github.com/linkerd/linkerd2/pkg/charts/linkerd2"
-	"github.com/linkerd/linkerd2/pkg/k8s"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/yaml"
 )
 
 const (
-	// LinkerdAddOnChecks adds checks to validate the add-on components
-	LinkerdAddOnChecks CategoryID = "linkerd-addons"
-
 	// LinkerdGrafanaAddOnChecks adds checks related to grafana add-on components
 	LinkerdGrafanaAddOnChecks CategoryID = "linkerd-grafana"
 
@@ -30,7 +25,7 @@ var (
 	errorKeyNotFound error = errors.New("key not found")
 
 	// AddOnCategories is the list of add-on category checks
-	AddOnCategories = []CategoryID{LinkerdAddOnChecks, LinkerdPrometheusAddOnChecks, LinkerdGrafanaAddOnChecks, LinkerdTracingAddOnChecks}
+	AddOnCategories = []CategoryID{LinkerdPrometheusAddOnChecks, LinkerdGrafanaAddOnChecks, LinkerdTracingAddOnChecks}
 )
 
 // addOnCategories contain all the checks w.r.t add-ons. It is strongly advised to
@@ -38,18 +33,6 @@ var (
 // not hard requirements unless otherwise.
 func (hc *HealthChecker) addOnCategories() []category {
 	return []category{
-		{
-			id: LinkerdAddOnChecks,
-			checkers: []checker{
-				{
-					description: fmt.Sprintf("'%s' config map exists", k8s.AddOnsConfigMapName),
-					warning:     true,
-					check: func(ctx context.Context) error {
-						return hc.checkIfAddOnsConfigMapExists(ctx)
-					},
-				},
-			},
-		},
 		{
 			id: LinkerdPrometheusAddOnChecks,
 			checkers: []checker{
@@ -57,7 +40,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "prometheus add-on service account exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if _, ok := hc.addOns[l5dcharts.PrometheusAddOn]; ok {
+						prometheusValues := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Prometheus.Values(), &prometheusValues)
+						if err != nil {
+							return err
+						}
+						if GetBool(prometheusValues, "enabled") {
 							return hc.checkServiceAccounts(ctx, []string{"linkerd-prometheus"}, hc.ControlPlaneNamespace, "")
 						}
 						return &SkipError{Reason: "prometheus add-on not enabled"}
@@ -67,7 +55,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "prometheus add-on config map exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if _, ok := hc.addOns[l5dcharts.PrometheusAddOn]; ok {
+						prometheusValues := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Prometheus.Values(), &prometheusValues)
+						if err != nil {
+							return err
+						}
+						if GetBool(prometheusValues, "enabled") {
 							_, err := hc.kubeAPI.CoreV1().ConfigMaps(hc.ControlPlaneNamespace).Get(ctx, "linkerd-prometheus-config", metav1.GetOptions{})
 							return err
 						}
@@ -80,7 +73,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					retryDeadline:       hc.RetryDeadline,
 					surfaceErrorOnRetry: true,
 					check: func(ctx context.Context) error {
-						if _, ok := hc.addOns[l5dcharts.PrometheusAddOn]; ok {
+						prometheusValues := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Prometheus.Values(), &prometheusValues)
+						if err != nil {
+							return err
+						}
+						if GetBool(prometheusValues, "enabled") {
 							// populate controlPlanePods to get the latest status, during retries
 							var err error
 							hc.controlPlanePods, err = hc.kubeAPI.GetPodsByNamespace(ctx, hc.ControlPlaneNamespace)
@@ -102,7 +100,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "grafana add-on service account exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if grafana, ok := hc.addOns[l5dcharts.GrafanaAddOn]; ok {
+						grafana := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Grafana.Values(), &grafana)
+						if err != nil {
+							return err
+						}
+						if GetBool(grafana, "enabled") {
 							name, err := GetString(grafana, "name")
 							if err != nil && !errors.Is(err, errorKeyNotFound) {
 								return err
@@ -122,7 +125,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "grafana add-on config map exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if grafana, ok := hc.addOns[l5dcharts.GrafanaAddOn]; ok {
+						grafana := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Grafana.Values(), &grafana)
+						if err != nil {
+							return err
+						}
+						if GetBool(grafana, "enabled") {
 							name, err := GetString(grafana, "name")
 							if err != nil && !errors.Is(err, errorKeyNotFound) {
 								return err
@@ -148,7 +156,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					retryDeadline:       hc.RetryDeadline,
 					surfaceErrorOnRetry: true,
 					check: func(ctx context.Context) error {
-						if _, ok := hc.addOns[l5dcharts.GrafanaAddOn]; ok {
+						grafana := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Grafana.Values(), &grafana)
+						if err != nil {
+							return err
+						}
+						if GetBool(grafana, "enabled") {
 							// populate controlPlanePods to get the latest status, during retries
 							var err error
 							hc.controlPlanePods, err = hc.kubeAPI.GetPodsByNamespace(ctx, hc.ControlPlaneNamespace)
@@ -170,7 +183,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "collector service account exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if tracing, ok := hc.addOns[l5dcharts.TracingAddOn]; ok {
+						tracing := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Tracing.Values(), &tracing)
+						if err != nil {
+							return err
+						}
+						if GetBool(tracing, "enabled") {
 
 							collector, mapError := GetMap(tracing, "collector")
 
@@ -197,7 +215,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "jaeger service account exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if tracing, ok := hc.addOns[l5dcharts.TracingAddOn]; ok {
+						tracing := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Tracing.Values(), &tracing)
+						if err != nil {
+							return err
+						}
+						if GetBool(tracing, "enabled") {
 							jaeger, mapError := GetMap(tracing, "jaeger")
 
 							jaegerName, keyError := GetString(jaeger, "name")
@@ -223,7 +246,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					description: "collector config map exists",
 					warning:     true,
 					check: func(ctx context.Context) error {
-						if tracing, ok := hc.addOns[l5dcharts.TracingAddOn]; ok {
+						tracing := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Tracing.Values(), &tracing)
+						if err != nil {
+							return err
+						}
+						if GetBool(tracing, "enabled") {
 							collector, mapError := GetMap(tracing, "collector")
 
 							collectorName, keyError := GetString(collector, "name")
@@ -255,7 +283,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					retryDeadline:       hc.RetryDeadline,
 					surfaceErrorOnRetry: true,
 					check: func(ctx context.Context) error {
-						if _, ok := hc.addOns[l5dcharts.TracingAddOn]; ok {
+						tracing := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Tracing.Values(), &tracing)
+						if err != nil {
+							return err
+						}
+						if GetBool(tracing, "enabled") {
 							// populate controlPlanePods to get the latest status, during retries
 							var err error
 							hc.controlPlanePods, err = hc.kubeAPI.GetPodsByNamespace(ctx, hc.ControlPlaneNamespace)
@@ -274,7 +307,12 @@ func (hc *HealthChecker) addOnCategories() []category {
 					retryDeadline:       hc.RetryDeadline,
 					surfaceErrorOnRetry: true,
 					check: func(ctx context.Context) error {
-						if _, ok := hc.addOns[l5dcharts.TracingAddOn]; ok {
+						tracing := make(map[string]interface{})
+						err := yaml.Unmarshal(hc.linkerdConfig.Tracing.Values(), &tracing)
+						if err != nil {
+							return err
+						}
+						if GetBool(tracing, "enabled") {
 							// populate controlPlanePods to get the latest status, during retries
 							var err error
 							hc.controlPlanePods, err = hc.kubeAPI.GetPodsByNamespace(ctx, hc.ControlPlaneNamespace)
@@ -292,74 +330,45 @@ func (hc *HealthChecker) addOnCategories() []category {
 	}
 }
 
-func (hc *HealthChecker) checkIfAddOnsConfigMapExists(ctx context.Context) error {
-
-	// Check if linkerd-config-addons ConfigMap present, If not skip the next checks
-	cm, err := hc.checkForAddOnCM(ctx)
-	if err != nil {
-		return err
-	}
-
-	// linkerd-config-addons cm is present,now update hc to include those add-ons
-	// so that further add-on specific checks can be ran
-	var values l5dcharts.Values
-	err = yaml.Unmarshal([]byte(cm), &values)
-	if err != nil {
-		return fmt.Errorf("could not unmarshal %s config-map: %s", k8s.AddOnsConfigMapName, err)
-	}
-
-	addOns, err := l5dcharts.ParseAddOnValues(&values)
-	if err != nil {
-		return fmt.Errorf("could not read %s config-map: %s", k8s.AddOnsConfigMapName, err)
-	}
-
-	hc.addOns = make(map[string]interface{})
-
-	for _, addOn := range addOns {
-		values := map[string]interface{}{}
-		err = yaml.Unmarshal(addOn.Values(), &values)
-		if err != nil {
-			return err
-		}
-
-		hc.addOns[addOn.Name()] = values
+// GetString returns a String with the given key if present
+func GetString(i interface{}, k string) (string, error) {
+	m, ok := i.(map[string]interface{})
+	if !ok {
+		return "", errors.New("config value is not a map")
 	}
 
-	return nil
-}
-
-func (hc *HealthChecker) checkForAddOnCM(ctx context.Context) (string, error) {
-	cm, err := k8s.GetAddOnsConfigMap(ctx, hc.kubeAPI, hc.ControlPlaneNamespace)
-	if err != nil {
-		return "", err
+	v, ok := m[k]
+	if !ok {
+		return "", errorKeyNotFound
 	}
 
-	values, ok := cm["values"]
+	res, ok := v.(string)
 	if !ok {
-		return "", fmt.Errorf("values subpath not found in %s configmap", k8s.AddOnsConfigMapName)
+		return "", fmt.Errorf("config value '%v' for key '%s' is not a string", v, k)
 	}
 
-	return values, nil
+	return res, nil
 }
 
-// GetString returns a String with the given key if present
-func GetString(i interface{}, k string) (string, error) {
+// GetBool returns a bool with the given key if present.  Defaults to false if
+// the key is not present or is a different type.
+func GetBool(i interface{}, k string) bool {
 	m, ok := i.(map[string]interface{})
 	if !ok {
-		return "", errors.New("config value is not a map")
+		return false
 	}
 
 	v, ok := m[k]
 	if !ok {
-		return "", errorKeyNotFound
+		return false
 	}
 
-	res, ok := v.(string)
+	res, ok := v.(bool)
 	if !ok {
-		return "", fmt.Errorf("config value '%v' for key '%s' is not a string", v, k)
+		return false
 	}
 
-	return res, nil
+	return res
 }
 
 // GetMap returns a Map with the given Key if Present


Test patch:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index 4644ed24a..f352f5e22 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -137,7 +137,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 627d7ab24..3e52d4e1b 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -137,7 +137,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -308,7 +310,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index 1d981a3b5..5b088b6e7 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -137,7 +137,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 8d9847e3f..967fdb506 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -177,7 +177,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index 8147c7deb..4fd7f12f5 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -148,7 +148,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -330,7 +332,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -512,7 +516,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -694,7 +700,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index 4bb4fd179..dbb23e632 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -148,7 +148,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index b2f708212..0ee11497f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -161,7 +161,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index 35f1d8977..76bb3cb52 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -148,7 +148,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -330,7 +332,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index e261cab89..fc398adb5 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -153,7 +153,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index 2a4d82c6b..d72ebaa31 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -148,7 +148,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index 330aa9a2a..97216d73e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -149,7 +149,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index 446d7d9b6..94dd7c85d 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -149,7 +149,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,1234
+        - 4190,1234,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml
index f79479c9a..ee16a4565 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_trace.golden.yml
@@ -158,7 +158,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index ac48eabc5..6acb3fe97 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -150,7 +150,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index 8a730075b..a7f806040 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -150,7 +150,9 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191
+          - 4190,4191,25,443,587,3306,11211
+          - --outbound-ports-to-ignore
+          - 25,443,587,3306,11211
           image: ghcr.io/linkerd/proxy-init:v1.3.6
           imagePullPolicy: IfNotPresent
           name: linkerd-init
@@ -326,7 +328,9 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191
+          - 4190,4191,25,443,587,3306,11211
+          - --outbound-ports-to-ignore
+          - 25,443,587,3306,11211
           image: ghcr.io/linkerd/proxy-init:v1.3.6
           imagePullPolicy: IfNotPresent
           name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index 23db20696..ce40a61c1 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -150,7 +150,9 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191
+          - 4190,4191,25,443,587,3306,11211
+          - --outbound-ports-to-ignore
+          - 25,443,587,3306,11211
           image: ghcr.io/linkerd/proxy-init:v1.3.6
           imagePullPolicy: IfNotPresent
           name: linkerd-init
@@ -326,7 +328,9 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191
+          - 4190,4191,25,443,587,3306,11211
+          - --outbound-ports-to-ignore
+          - 25,443,587,3306,11211
           image: ghcr.io/linkerd/proxy-init:v1.3.6
           imagePullPolicy: IfNotPresent
           name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index 4e3fde831..c789d603a 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -133,7 +133,9 @@ spec:
     - --proxy-uid
     - "2102"
     - --inbound-ports-to-ignore
-    - 4190,4191
+    - 4190,4191,25,443,587,3306,11211
+    - --outbound-ports-to-ignore
+    - 25,443,587,3306,11211
     image: ghcr.io/linkerd/proxy-init:v1.3.6
     imagePullPolicy: IfNotPresent
     name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index 42f004e3a..dcb311cb5 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -144,7 +144,9 @@ spec:
     - --proxy-uid
     - "2102"
     - --inbound-ports-to-ignore
-    - 4190,4191
+    - 4190,4191,25,443,587,3306,11211
+    - --outbound-ports-to-ignore
+    - 25,443,587,3306,11211
     image: ghcr.io/linkerd/proxy-init:v1.3.6
     imagePullPolicy: IfNotPresent
     name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index b2e34d67a..8e7ba843c 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -149,7 +149,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index 637b633be..5fda69df8 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -150,7 +150,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -334,7 +336,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
+        - --outbound-ports-to-ignore
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index fe9ed8e09..00b2706c1 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -202,9 +202,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install-cni-plugin_default.golden b/cli/cmd/testdata/install-cni-plugin_default.golden
index 56faef31c..66ce80b3b 100644
--- a/cli/cmd/testdata/install-cni-plugin_default.golden
+++ b/cli/cmd/testdata/install-cni-plugin_default.golden
@@ -123,8 +123,8 @@ data:
         "outgoing-proxy-port": 4140,
         "proxy-uid": 2102,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": ["4190","4191"],
-        "outbound-ports-to-ignore": [],
+        "inbound-ports-to-ignore": ["4190","4191","25","443","587","3306","11211"],
+        "outbound-ports-to-ignore": ["25","443","587","3306","11211"],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install-cni-plugin_skip_ports.golden b/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
index 61a4b38ac..f5d83da1f 100644
--- a/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
+++ b/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
@@ -123,8 +123,8 @@ data:
         "outgoing-proxy-port": 4140,
         "proxy-uid": 2102,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": ["4190","4191","80","8080"],
-        "outbound-ports-to-ignore": ["443","1000"],
+        "inbound-ports-to-ignore": ["4190","4191","25","443","587","3306","11211","80","8080"],
+        "outbound-ports-to-ignore": ["25","443","587","3306","11211","443","1000"],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install_addon.golden b/cli/cmd/testdata/install_addon.golden
index 98284edae..794207232 100644
--- a/cli/cmd/testdata/install_addon.golden
+++ b/cli/cmd/testdata/install_addon.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1224,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1461,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1716,9 +1716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2000,9 +2000,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2215,9 +2215,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2472,9 +2472,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2716,9 +2716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2756,31 +2756,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: true
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3055,9 +3030,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3496,9 +3471,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3799,9 +3774,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4024,9 +3999,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_cni_helm_default_output.golden b/cli/cmd/testdata/install_cni_helm_default_output.golden
index e8924f8aa..dfcbdf73b 100644
--- a/cli/cmd/testdata/install_cni_helm_default_output.golden
+++ b/cli/cmd/testdata/install_cni_helm_default_output.golden
@@ -125,8 +125,8 @@ data:
         "outgoing-proxy-port": 4140,
         "proxy-uid": 2102,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": [],
-        "outbound-ports-to-ignore": [],
+        "inbound-ports-to-ignore": ["25","443","587","3306","11211"],
+        "outbound-ports-to-ignore": ["25","443","587","3306","11211"],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install_cni_helm_override_output.golden b/cli/cmd/testdata/install_cni_helm_override_output.golden
index b5dae20c7..17bf55af9 100644
--- a/cli/cmd/testdata/install_cni_helm_override_output.golden
+++ b/cli/cmd/testdata/install_cni_helm_override_output.golden
@@ -125,8 +125,8 @@ data:
         "outgoing-proxy-port": 5678,
         "proxy-uid": 1111,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": [],
-        "outbound-ports-to-ignore": [],
+        "inbound-ports-to-ignore": ["25","443","587","3306","11211"],
+        "outbound-ports-to-ignore": ["25","443","587","3306","11211"],
         "simulate": false,
         "use-wait-flag": true
       }
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 18f66d4d1..efafdf957 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1233,9 +1233,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1485,9 +1485,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1755,9 +1755,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2053,9 +2053,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2282,9 +2282,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2553,9 +2553,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2812,9 +2812,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2858,31 +2858,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3165,9 +3140,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3620,9 +3595,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index a1272e44f..6951bd7f2 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: my.custom.registry/linkerd-io/proxy-init
           pullPolicy: IfNotPresent
@@ -1224,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1461,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1716,9 +1716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1999,9 +1999,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2214,9 +2214,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2471,9 +2471,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2715,9 +2715,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2755,31 +2755,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3054,9 +3029,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3495,9 +3470,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 603677614..2a7d7b140 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1224,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1461,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1716,9 +1716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1999,9 +1999,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2214,9 +2214,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2471,9 +2471,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2715,9 +2715,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2755,31 +2755,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3054,9 +3029,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3495,9 +3470,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index e8ef3cb12..8a4f09a42 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1224,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1461,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1716,9 +1716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1999,9 +1999,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2214,9 +2214,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2471,9 +2471,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2715,9 +2715,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2755,31 +2755,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3054,9 +3029,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3495,9 +3470,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_grafana_existing.golden b/cli/cmd/testdata/install_grafana_existing.golden
index 01cbbcd54..535b15b3f 100644
--- a/cli/cmd/testdata/install_grafana_existing.golden
+++ b/cli/cmd/testdata/install_grafana_existing.golden
@@ -888,8 +888,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1221,9 +1221,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1458,9 +1458,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1713,9 +1713,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1996,9 +1996,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2211,9 +2211,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2468,9 +2468,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2712,9 +2712,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2752,31 +2752,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: "somegrafana.xyz"
-    grafana:
-      enabled: false
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Prometheus RBAC
 ###
 ---
@@ -3170,9 +3145,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 98180bd31..ca6d1a678 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -897,8 +897,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1322,9 +1322,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1595,9 +1595,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1886,9 +1886,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2189,9 +2189,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2440,9 +2440,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2733,9 +2733,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3013,9 +3013,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3053,45 +3053,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      resources:
-        cpu:
-          limit: "1"
-          request: 100m
-        memory:
-          limit: 1024Mi
-          request: 50Mi
-    prometheus:
-      enabled: true
-      resources:
-        cpu:
-          limit: "4"
-          request: 300m
-        memory:
-          limit: 8192Mi
-          request: 300Mi
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3379,9 +3340,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3833,9 +3794,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index f4a8fcf09..35d5c8b5a 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -897,8 +897,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1322,9 +1322,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1595,9 +1595,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1886,9 +1886,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2189,9 +2189,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2440,9 +2440,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2733,9 +2733,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3013,9 +3013,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3053,45 +3053,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      resources:
-        cpu:
-          limit: "1"
-          request: 100m
-        memory:
-          limit: 1024Mi
-          request: 50Mi
-    prometheus:
-      enabled: true
-      resources:
-        cpu:
-          limit: "4"
-          request: 300m
-        memory:
-          limit: 8192Mi
-          request: 300Mi
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3379,9 +3340,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3833,9 +3794,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 96c565cfe..23c21eb4b 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -847,8 +847,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1180,9 +1180,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1417,9 +1417,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1672,9 +1672,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1910,9 +1910,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2125,9 +2125,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2382,9 +2382,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2626,9 +2626,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2666,31 +2666,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -2965,9 +2940,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3406,9 +3381,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index 1f6536acb..8ee76d586 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -3052,45 +3052,6 @@ spec:
           secretName: linkerd-tap-k8s-tls
 
 ---
-# Source: linkerd2/templates/linkerd-config-addons.yaml
----
-###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/helm linkerd-version
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      image:
-        name: ghcr.io/linkerd/grafana
-    prometheus:
-      args:
-        config.file: /etc/prometheus/prometheus.yml
-        log.level: info
-        storage.tsdb.path: /data
-        storage.tsdb.retention.time: 6h
-      enabled: true
-      globalConfig:
-        evaluation_interval: 10s
-        scrape_interval: 10s
-        scrape_timeout: 10s
-      image: prom/prometheus:v2.19.3
-    tracing:
-      enabled: false
----
 # Source: linkerd2/charts/grafana/templates/grafana-rbac.yaml
 ---
 ###
diff --git a/cli/cmd/testdata/install_helm_output_addons.golden b/cli/cmd/testdata/install_helm_output_addons.golden
index ba2c572ac..398551857 100644
--- a/cli/cmd/testdata/install_helm_output_addons.golden
+++ b/cli/cmd/testdata/install_helm_output_addons.golden
@@ -3228,49 +3228,6 @@ spec:
           secretName: linkerd-tap-k8s-tls
 
 ---
-# Source: linkerd2/templates/linkerd-config-addons.yaml
----
-###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/helm linkerd-version
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      image:
-        name: ghcr.io/linkerd/grafana
-    prometheus:
-      args:
-        config.file: /etc/prometheus/prometheus.yml
-        log.level: info
-        storage.tsdb.path: /data
-        storage.tsdb.retention.time: 6h
-      enabled: true
-      globalConfig:
-        evaluation_interval: 10s
-        scrape_interval: 10s
-        scrape_timeout: 10s
-      image: prom/prometheus:v2.19.3
-    tracing:
-      collector:
-        image: omnition/opencensus-collector:0.1.11
-      enabled: true
-      jaeger:
-        image: jaegertracing/all-in-one:1.19.2
----
 # Source: linkerd2/charts/grafana/templates/grafana-rbac.yaml
 ---
 ###
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index 8c5aa463b..4ac55e17b 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -3346,59 +3346,6 @@ spec:
           secretName: linkerd-tap-k8s-tls
 
 ---
-# Source: linkerd2/templates/linkerd-config-addons.yaml
----
-###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/helm linkerd-version
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      image:
-        name: ghcr.io/linkerd/grafana
-      resources:
-        cpu:
-          limit: "1"
-          request: 100m
-        memory:
-          limit: 1024Mi
-          request: 50Mi
-    prometheus:
-      args:
-        config.file: /etc/prometheus/prometheus.yml
-        log.level: info
-        storage.tsdb.path: /data
-        storage.tsdb.retention.time: 6h
-      enabled: true
-      globalConfig:
-        evaluation_interval: 10s
-        scrape_interval: 10s
-        scrape_timeout: 10s
-      image: prom/prometheus:v2.19.3
-      resources:
-        cpu:
-          limit: "4"
-          request: 300m
-        memory:
-          limit: 8192Mi
-          request: 300Mi
-    tracing:
-      enabled: false
----
 # Source: linkerd2/charts/grafana/templates/grafana-rbac.yaml
 ---
 ###
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 547ad5b65..b2596f538 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -3398,59 +3398,6 @@ spec:
           secretName: linkerd-tap-k8s-tls
 
 ---
-# Source: linkerd2/templates/linkerd-config-addons.yaml
----
-###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/helm linkerd-version
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      image:
-        name: ghcr.io/linkerd/grafana
-      resources:
-        cpu:
-          limit: "1"
-          request: 100m
-        memory:
-          limit: 1024Mi
-          request: 50Mi
-    prometheus:
-      args:
-        config.file: /etc/prometheus/prometheus.yml
-        log.level: info
-        storage.tsdb.path: /data
-        storage.tsdb.retention.time: 6h
-      enabled: true
-      globalConfig:
-        evaluation_interval: 10s
-        scrape_interval: 10s
-        scrape_timeout: 10s
-      image: prom/prometheus:v2.19.3
-      resources:
-        cpu:
-          limit: "4"
-          request: 300m
-        memory:
-          limit: 8192Mi
-          request: 300Mi
-    tracing:
-      enabled: false
----
 # Source: linkerd2/charts/grafana/templates/grafana-rbac.yaml
 ---
 ###
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index ec67750ec..bce59af9d 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -3346,59 +3346,6 @@ spec:
           secretName: linkerd-tap-k8s-tls
 
 ---
-# Source: linkerd2/templates/linkerd-config-addons.yaml
----
-###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/helm linkerd-version
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-      image:
-        name: ghcr.io/linkerd/grafana
-      resources:
-        cpu:
-          limit: "1"
-          request: 100m
-        memory:
-          limit: 1024Mi
-          request: 50Mi
-    prometheus:
-      args:
-        config.file: /etc/prometheus/prometheus.yml
-        log.level: info
-        storage.tsdb.path: /data
-        storage.tsdb.retention.time: 6h
-      enabled: true
-      globalConfig:
-        evaluation_interval: 10s
-        scrape_interval: 10s
-        scrape_timeout: 10s
-      image: prom/prometheus:v2.19.3
-      resources:
-        cpu:
-          limit: "4"
-          request: 300m
-        memory:
-          limit: 8192Mi
-          request: 300Mi
-    tracing:
-      enabled: false
----
 # Source: linkerd2/charts/grafana/templates/grafana-rbac.yaml
 ---
 ###
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index f94883101..c49482491 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -888,8 +888,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -2486,31 +2486,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index f5affcf10..4453b258e 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -2770,32 +2770,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: Namespace
-  labels:
-    ControllerNamespaceLabel: Namespace
-  annotations:
-    CreatedByAnnotation: CliVersion
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-      image: PrometheusImage
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3557,7 +3531,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckltYWdlVmVyc2lvbjogQ29udHJvbGxlckltYWdlVmVyc2lvbgpkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmdsb2JhbDoKICBjbGlWZXJzaW9uOiBDbGlWZXJzaW9uCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgZGVzdGluYXRpb25HZXROZXR3b3JrczogRGVzdGluYXRpb25HZXROZXR3b3JrcwogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpbWFnZToKICAgICAgbmFtZTogUHJveHlJbml0SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eUluaXRWZXJzaW9uCiAgcHJveHlJbmplY3RBbm5vdGF0aW9uOiBQcm94eUluamVjdEFubm90YXRpb24KICBwcm94eUluamVjdERpc2FibGVkOiBQcm94eUluamVjdERpc2FibGVkCiAgd29ya2xvYWROYW1lc3BhY2VMYWJlbDogV29ya2xvYWROYW1lc3BhY2VMYWJlbApoZWFydGJlYXRTY2hlZHVsZTogIiIKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb21ldGhldXM6CiAgaW1hZ2U6IFByb21ldGhldXNJbWFnZQpwcm94eUluamVjdG9yOgogIGNhQnVuZGxlOiBwcm94eSBpbmplY3RvciBDQSBidW5kbGUKICBjcnRQRU06IHByb3h5IGluamVjdG9yIGNydAogIGtleVBFTTogcHJveHkgaW5qZWN0b3Iga2V5CnRhcDoKICBjYUJ1bmRsZTogdGFwIENBIGJ1bmRsZQogIGNydFBFTTogdGFwIGNydAogIGtleVBFTTogdGFwIGtleQp3ZWJJbWFnZTogV2ViSW1hZ2UKd2ViaG9va0ZhaWx1cmVQb2xpY3k6IFdlYmhvb2tGYWlsdXJlUG9saWN5Cg==
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckltYWdlVmVyc2lvbjogQ29udHJvbGxlckltYWdlVmVyc2lvbgpkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmdsb2JhbDoKICBjbGlWZXJzaW9uOiBDbGlWZXJzaW9uCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgZGVzdGluYXRpb25HZXROZXR3b3JrczogRGVzdGluYXRpb25HZXROZXR3b3JrcwogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_prometheus_overwrite.golden b/cli/cmd/testdata/install_prometheus_overwrite.golden
index e18f1ce10..b05adf373 100644
--- a/cli/cmd/testdata/install_prometheus_overwrite.golden
+++ b/cli/cmd/testdata/install_prometheus_overwrite.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1281,9 +1281,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1518,9 +1518,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1773,9 +1773,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2056,9 +2056,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2271,9 +2271,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2528,9 +2528,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2772,9 +2772,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2812,88 +2812,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      alertManagers:
-      - scheme: http
-        static_configs:
-        - targets:
-          - alertmanager.linkerd.svc:9093
-      alertRelabelConfigs:
-      - action: labeldrop
-        regex: prometheus_replica
-      args:
-        log.format: json
-      enabled: true
-      globalConfig:
-        evaluation_interval: 2m
-        external_labels:
-          cluster: cluster-1
-      image: linkedin.io/prom
-      remoteWrite:
-      - url: http://cortex-service.default:9009/api/prom/push
-      ruleConfigMapMounts:
-      - configMap: linkerd-prometheus-rules
-        name: alerting-rules
-        subPath: alerting_rules.yml
-      - configMap: linkerd-prometheus-rules
-        name: recording-rules
-        subPath: recording_rules.yml
-      scrapeConfigs:
-      - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-        job_name: kubernetes-nodes
-        kubernetes_sd_configs:
-        - role: node
-        relabel_configs:
-        - action: labelmap
-          regex: __meta_kubernetes_node_label_(.+)
-        scheme: https
-        tls_config:
-          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      sidecarContainers:
-      - command:
-        - /bin/sh
-        - -c
-        - |
-          exec /bin/stackdriver-prometheus-sidecar \
-            --stackdriver.project-id=myproject \
-            --stackdriver.kubernetes.location=us-central1 \
-            --stackdriver.kubernetes.cluster-name=mycluster \
-            --prometheus.wal-directory=/data/wal \
-            --log.level=info
-          volumeMounts:
-          - mountPath: /data
-            name: data
-        imagePullPolicy: always
-        lifecycle:
-          type: Sidecar
-        name: sidecar
-        ports:
-        - containerPort: 9091
-          name: foo
-          protocol: TCP
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3168,9 +3086,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3662,9 +3580,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 55727deea..7c79b4c62 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -2755,31 +2755,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
diff --git a/cli/cmd/testdata/install_restricted_dashboard.golden b/cli/cmd/testdata/install_restricted_dashboard.golden
index 515a2a66f..defc66dd5 100644
--- a/cli/cmd/testdata/install_restricted_dashboard.golden
+++ b/cli/cmd/testdata/install_restricted_dashboard.golden
@@ -823,8 +823,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1156,9 +1156,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1393,9 +1393,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1648,9 +1648,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1931,9 +1931,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2146,9 +2146,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2403,9 +2403,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2647,9 +2647,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,31 +2687,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: false
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -2986,9 +2961,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3427,9 +3402,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_tracing.golden b/cli/cmd/testdata/install_tracing.golden
index 98284edae..794207232 100644
--- a/cli/cmd/testdata/install_tracing.golden
+++ b/cli/cmd/testdata/install_tracing.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1224,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1461,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1716,9 +1716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2000,9 +2000,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2215,9 +2215,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2472,9 +2472,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2716,9 +2716,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2756,31 +2756,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      enabled: true
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3055,9 +3030,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3496,9 +3471,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3799,9 +3774,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4024,9 +3999,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_tracing_overwrite.golden b/cli/cmd/testdata/install_tracing_overwrite.golden
index c7f11bf0a..f8a89ce8a 100644
--- a/cli/cmd/testdata/install_tracing_overwrite.golden
+++ b/cli/cmd/testdata/install_tracing_overwrite.golden
@@ -891,8 +891,8 @@ data:
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
-        ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreInboundPorts: 25,443,587,3306,11211
+        ignoreOutboundPorts: 25,443,587,3306,11211
         image:
           name: ghcr.io/linkerd/proxy-init
           pullPolicy: IfNotPresent
@@ -1226,9 +1226,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1463,9 +1463,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1718,9 +1718,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2002,9 +2002,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2217,9 +2217,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2474,9 +2474,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2718,9 +2718,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2758,33 +2758,6 @@ spec:
 
 ---
 ###
-### linkerd add-ons configuration
-###
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: linkerd-config-addons
-  namespace: linkerd
-  labels:
-    linkerd.io/control-plane-ns: linkerd
-  annotations:
-    linkerd.io/created-by: linkerd/cli dev-undefined
-data:
-  values: |-
-    global:
-      prometheusUrl: ""
-      grafanaUrl: ""
-    grafana:
-      enabled: true
-    prometheus:
-      enabled: true
-    tracing:
-      collector:
-        image: overwrite-collector-image
-      enabled: true
----
-###
 ### Grafana RBAC
 ###
 ---
@@ -3059,9 +3032,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3500,9 +3473,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3803,9 +3776,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4028,9 +4001,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - "443"
+        - 443,25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/upgrade_test.go b/cli/cmd/upgrade_test.go
index e5c60ae0f..a91bc2fb7 100644
--- a/cli/cmd/upgrade_test.go
+++ b/cli/cmd/upgrade_test.go
@@ -293,7 +293,7 @@ func TestUpgradeTracingAddon(t *testing.T) {
 	upgradeManifests := parseManifestList(upgrade.String())
 	diffMap := diffManifestLists(expectedManifests, upgradeManifests)
 	tracingManifests := []string{
-		"Service/linkerd-jaeger", "Deployment/linkerd-jaeger", "ConfigMap/linkerd-config-addons",
+		"Service/linkerd-jaeger", "Deployment/linkerd-jaeger",
 		"ServiceAccount/linkerd-jaeger", "Service/linkerd-collector", "ConfigMap/linkerd-collector-config",
 		"ServiceAccount/linkerd-collector", "Deployment/linkerd-collector",
 	}
@@ -343,9 +343,7 @@ func TestUpgradeOverwriteTracingAddon(t *testing.T) {
 	expectedManifests := parseManifestList(expected)
 	upgradeManifests := parseManifestList(upgrade.String())
 	diffMap := diffManifestLists(expectedManifests, upgradeManifests)
-	tracingManifests := []string{
-		"ConfigMap/linkerd-config-addons", "Deployment/linkerd-collector",
-	}
+	tracingManifests := []string{"Deployment/linkerd-collector"}
 	for _, id := range tracingManifests {
 		if _, ok := diffMap[id]; ok {
 			delete(diffMap, id)
@@ -523,7 +521,7 @@ func TestUpgradeEnableAddon(t *testing.T) {
 	diffMap := diffManifestLists(expectedManifests, upgradeManifests)
 	addonManifests := []string{
 		"ServiceAccount/linkerd-grafana", "Deployment/linkerd-grafana", "Service/linkerd-grafana",
-		"ConfigMap/linkerd-grafana-config", "ConfigMap/linkerd-config-addons",
+		"ConfigMap/linkerd-grafana-config",
 	}
 	for _, id := range addonManifests {
 		if _, ok := diffMap[id]; ok {
@@ -608,11 +606,6 @@ func TestUpgradeOverwriteRemoveAddonKeys(t *testing.T) {
 	expectedManifests := parseManifestList(expected)
 	upgradeManifests := parseManifestList(upgrade.String())
 	diffMap := diffManifestLists(expectedManifests, upgradeManifests)
-	if _, ok := diffMap["ConfigMap/linkerd-config-addons"]; ok {
-		delete(diffMap, "ConfigMap/linkerd-config-addons")
-	} else {
-		t.Error("Expected ConfigMap/linkerd-config-addons in upgrade output diff but was absent")
-	}
 
 	resourceDiffFound := false
 	for id, diffs := range diffMap {
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index bb2dd0ffa..43a6d0d3a 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -102,6 +102,8 @@ func TestNewValues(t *testing.T) {
 				InboundConnectTimeout:  "100ms",
 			},
 			ProxyInit: &ProxyInit{
+				IgnoreInboundPorts:  "25,443,587,3306,11211",
+				IgnoreOutboundPorts: "25,443,587,3306,11211",
 				Image: &Image{
 					Name:       "ghcr.io/linkerd/proxy-init",
 					PullPolicy: "IfNotPresent",
diff --git a/test/cli/cli_install_static_test.go b/test/cli/cli_install_static_test.go
index 942ab4fbb..ed4c123a3 100644
--- a/test/cli/cli_install_static_test.go
+++ b/test/cli/cli_install_static_test.go
@@ -39,19 +39,8 @@ func TestMain(m *testing.M) {
 }
 
 func TestCliInstall(t *testing.T) {
-
-	var (
-		cmd  = "install"
-		args = []string{
-			"--ignore-cluster",
-		}
-	)
-
-	exec := append([]string{cmd}, args...)
-	out, stderr, err := TestHelper.LinkerdRun(exec...)
+	_, err := TestHelper.LinkerdRun("install", "--ignore-cluster")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd install' command failed",
-			"'linkerd install' command failed: \n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd install' command failed", err)
 	}
-
 }
diff --git a/test/integration/edges/edges_test.go b/test/integration/edges/edges_test.go
index f969e8bc1..bbcd60752 100644
--- a/test/integration/edges/edges_test.go
+++ b/test/integration/edges/edges_test.go
@@ -38,9 +38,9 @@ func TestEdges(t *testing.T) {
 		"deploy",
 		"-ojson",
 	}
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		t.Fatalf("Unexpected error: %v\nError output: %s", err, stderr)
+		t.Fatal(err)
 	}
 
 	tpl := template.Must(template.ParseFiles("testdata/linkerd_edges.golden"))
@@ -67,9 +67,9 @@ func TestDirectEdges(t *testing.T) {
 
 		// inject terminus
 
-		out, stderr, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/terminus.yaml")
+		out, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/terminus.yaml")
 		if err != nil {
-			testutil.AnnotatedFatalf(t, "'linkerd inject' command failed", "'linkerd inject' command failed with %s: %s\n", err, stderr)
+			testutil.AnnotatedFatalf(t, "'linkerd inject' command failed", "'linkerd inject' command failed: %s", err)
 		}
 
 		// deploy terminus
@@ -109,7 +109,7 @@ func TestDirectEdges(t *testing.T) {
 
 		// inject slow cooker
 
-		out, stderr, err = TestHelper.PipeToLinkerdRun(slowcooker, "inject", "--manual", "-")
+		out, stderr, err := TestHelper.PipeToLinkerdRun(slowcooker, "inject", "--manual", "-")
 		if err != nil {
 			testutil.AnnotatedFatalf(t, "'linkerd 'inject' command failed", "'linkerd %s' command failed with %s: %s\n", "inject", err.Error(), stderr)
 		}
@@ -136,9 +136,9 @@ func TestDirectEdges(t *testing.T) {
 		// check edges
 		timeout := 50 * time.Second
 		err = TestHelper.RetryFor(timeout, func() error {
-			out, stderr, err = TestHelper.LinkerdRun("-n", testNamespace, "-o", "json", "edges", "deploy")
+			out, err = TestHelper.LinkerdRun("-n", testNamespace, "-o", "json", "edges", "deploy")
 			if err != nil {
-				return fmt.Errorf("linkerd %s command failed with %s: %s", "edges", err, stderr)
+				return err
 			}
 
 			tpl := template.Must(template.ParseFiles("testdata/direct_edges.golden"))
diff --git a/test/integration/egress/egress_test.go b/test/integration/egress/egress_test.go
index 567b218fa..fbc8daf09 100644
--- a/test/integration/egress/egress_test.go
+++ b/test/integration/egress/egress_test.go
@@ -26,9 +26,9 @@ func TestMain(m *testing.M) {
 
 func TestEgressHttp(t *testing.T) {
 	ctx := context.Background()
-	out, stderr, err := TestHelper.LinkerdRun("inject", "testdata/proxy.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "testdata/proxy.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\n%s", err, stderr)
+		testutil.AnnotatedFatal(t, "unexpected error", err)
 	}
 
 	TestHelper.WithDataPlaneNamespace(ctx, "egress-test", map[string]string{}, t, func(t *testing.T, ns string) {
diff --git a/test/integration/endpoints/endpoints_test.go b/test/integration/endpoints/endpoints_test.go
index 884ef13ae..05609d0ce 100644
--- a/test/integration/endpoints/endpoints_test.go
+++ b/test/integration/endpoints/endpoints_test.go
@@ -34,9 +34,9 @@ func TestGoodEndpoints(t *testing.T) {
 		fmt.Sprintf("linkerd-web.%s.svc.cluster.local:8084", ns),
 		"-ojson",
 	}
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\nError output: %s", err, stderr)
+		testutil.AnnotatedFatal(t, "unexpected error", err)
 	}
 
 	tpl := template.Must(template.ParseFiles("testdata/linkerd_endpoints.golden"))
@@ -54,7 +54,7 @@ func TestGoodEndpoints(t *testing.T) {
 
 // TODO: when #3004 gets fixed, add a negative test for mismatched ports
 func TestBadEndpoints(t *testing.T) {
-	_, stderr, err := TestHelper.LinkerdRun("endpoints", "foo")
+	_, stderr, err := TestHelper.PipeToLinkerdRun("", "endpoints", "foo")
 	if err == nil {
 		testutil.AnnotatedFatalf(t, "was expecting an error", "was expecting an error: %v", err)
 	}
diff --git a/test/integration/externalissuer/external_issuer_test.go b/test/integration/externalissuer/external_issuer_test.go
index 37289ff90..08d17a27c 100644
--- a/test/integration/externalissuer/external_issuer_test.go
+++ b/test/integration/externalissuer/external_issuer_test.go
@@ -41,9 +41,9 @@ func TestExternalIssuer(t *testing.T) {
 }
 
 func verifyInstallApp(ctx context.Context, t *testing.T) {
-	out, stderr, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/external_issuer_application.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/external_issuer_application.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd inject' command failed", "'linkerd inject' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd inject' command failed", err)
 	}
 
 	prefixedNs := TestHelper.GetTestNamespace(TestAppNamespaceSuffix)
@@ -72,13 +72,13 @@ func verifyInstallApp(ctx context.Context, t *testing.T) {
 func checkAppWoks(t *testing.T, timeout time.Duration) error {
 	return TestHelper.RetryFor(timeout, func() error {
 		args := []string{"stat", "deploy", "-n", TestHelper.GetTestNamespace(TestAppNamespaceSuffix), "--from", "deploy/slow-cooker", "-t", "1m"}
-		out, stderr, err := TestHelper.LinkerdRun(args...)
+		out, err := TestHelper.LinkerdRun(args...)
 		if err != nil {
-			return fmt.Errorf("Unexpected stat error: %s\n%s\n%s", err, out, stderr)
+			return err
 		}
 		rowStats, err := testutil.ParseRows(out, 1, 8)
 		if err != nil {
-			return fmt.Errorf("%s\n%s", err, stderr)
+			return err
 		}
 
 		stat := rowStats[TestAppBackendDeploymentName]
diff --git a/test/integration/get/get_test.go b/test/integration/get/get_test.go
index f5340f055..aa2a04f88 100644
--- a/test/integration/get/get_test.go
+++ b/test/integration/get/get_test.go
@@ -51,9 +51,9 @@ var (
 //////////////////////
 
 func TestCliGet(t *testing.T) {
-	out, stderr, err := TestHelper.LinkerdRun("inject", "testdata/to_be_injected_application.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "testdata/to_be_injected_application.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v\n%s", err, stderr)
+		testutil.AnnotatedFatal(t, "unexpected error", err)
 	}
 
 	ctx := context.Background()
@@ -86,9 +86,9 @@ func TestCliGet(t *testing.T) {
 		}
 
 		t.Run("get pods from --all-namespaces", func(t *testing.T) {
-			out, stderr, err = TestHelper.LinkerdRun("get", "pods", "--all-namespaces")
+			out, err = TestHelper.LinkerdRun("get", "pods", "--all-namespaces")
 			if err != nil {
-				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v output:\n%s\n%s", err, out, stderr)
+				testutil.AnnotatedFatal(t, "unexpected error", err)
 			}
 
 			err := checkPodOutput(out, deployReplicas, "", prefixedNs)
@@ -98,9 +98,9 @@ func TestCliGet(t *testing.T) {
 		})
 
 		t.Run("get pods from the linkerd namespace", func(t *testing.T) {
-			out, stderr, err = TestHelper.LinkerdRun("get", "pods", "-n", TestHelper.GetLinkerdNamespace())
+			out, err = TestHelper.LinkerdRun("get", "pods", "-n", TestHelper.GetLinkerdNamespace())
 			if err != nil {
-				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v output:\n%s\n%s", err, out, stderr)
+				testutil.AnnotatedFatal(t, "unexpected error", err)
 			}
 
 			err := checkPodOutput(out, linkerdPods, "linkerd-heartbeat", TestHelper.GetLinkerdNamespace())
@@ -115,9 +115,9 @@ func TestCliGet(t *testing.T) {
 				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v output:\n%s", err, out)
 			}
 
-			out, stderr, err = TestHelper.LinkerdRun("get", "pods")
+			out, err = TestHelper.LinkerdRun("get", "pods")
 			if err != nil {
-				testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v output:\n%s\n%s", err, out, stderr)
+				testutil.AnnotatedFatal(t, "unexpected error", err)
 			}
 
 			err = checkPodOutput(out, linkerdPods, "linkerd-heartbeat", TestHelper.GetLinkerdNamespace())
diff --git a/test/integration/inject/inject_test.go b/test/integration/inject/inject_test.go
index c06bd68e6..ef24f4ffc 100644
--- a/test/integration/inject/inject_test.go
+++ b/test/integration/inject/inject_test.go
@@ -80,10 +80,9 @@ func TestInjectManualParams(t *testing.T) {
 
 	cmd = append(cmd, "testdata/inject_test.yaml")
 
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
-
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "unexpected error", "unexpected error: %v: %s", stderr, err)
+		testutil.AnnotatedFatal(t, "unexpected error", err)
 	}
 
 	deploy, err := parseDeployment(out)
@@ -388,6 +387,7 @@ func TestInjectAutoPod(t *testing.T) {
 			"--proxy-uid", "2102",
 			// 1234,5678 were added at install time in `install_test.go`'s helmOverridesEdge()
 			"--inbound-ports-to-ignore", "4190,4191,1234,5678",
+			"--outbound-ports-to-ignore", "25,443,587,3306,11211",
 		},
 		Resources: v1.ResourceRequirements{
 			Limits: v1.ResourceList{
diff --git a/test/integration/install_test.go b/test/integration/install_test.go
index dd0c20cf5..cbc8bbf4c 100644
--- a/test/integration/install_test.go
+++ b/test/integration/install_test.go
@@ -115,9 +115,9 @@ func TestCheckPreInstall(t *testing.T) {
 
 	cmd := []string{"check", "--pre", "--expected-version", TestHelper.GetVersion()}
 	golden := "check.pre.golden"
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd check' command failed", "'linkerd check' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd check' command failed", err)
 	}
 
 	err = TestHelper.ValidateOutput(out, golden)
@@ -219,10 +219,9 @@ func TestInstallCNIPlugin(t *testing.T) {
 	)
 
 	exec := append([]string{cmd}, args...)
-	out, stderr, err := TestHelper.LinkerdRun(exec...)
+	out, err := TestHelper.LinkerdRun(exec...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd install-cni' command failed",
-			"'linkerd install-cni' command failed: \n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd install-cni' command failed", err)
 	}
 
 	out, err = TestHelper.KubectlApply(out, "")
@@ -234,9 +233,9 @@ func TestInstallCNIPlugin(t *testing.T) {
 	// perform a linkerd check with --linkerd-cni-enabled
 	timeout := time.Minute
 	err = TestHelper.RetryFor(timeout, func() error {
-		out, stderr, err = TestHelper.LinkerdRun("check", "--pre", "--linkerd-cni-enabled", "--wait=0")
+		out, err = TestHelper.LinkerdRun("check", "--pre", "--linkerd-cni-enabled", "--wait=0")
 		if err != nil {
-			return fmt.Errorf("'linkerd check' command failed\n%s\n%s\n%v", out, stderr, err)
+			return err
 		}
 		return nil
 	})
@@ -326,10 +325,9 @@ func TestInstallOrUpgradeCli(t *testing.T) {
 
 		cmd = "upgrade"
 		// test 2-stage install during upgrade
-		out, stderr, err := TestHelper.LinkerdRun(cmd, "config")
+		out, err := TestHelper.LinkerdRun(cmd, "config")
 		if err != nil {
-			testutil.AnnotatedFatalf(t, "'linkerd upgrade config' command failed",
-				"'linkerd upgrade config' command failed\n%s\n%s", out, stderr)
+			testutil.AnnotatedFatal(t, "'linkerd upgrade config' command failed", err)
 		}
 
 		// apply stage 1
@@ -344,10 +342,9 @@ func TestInstallOrUpgradeCli(t *testing.T) {
 	}
 
 	exec := append([]string{cmd}, args...)
-	out, stderr, err := TestHelper.LinkerdRun(exec...)
+	out, err := TestHelper.LinkerdRun(exec...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd install' command failed",
-			"'linkerd install' command failed: \n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd install' command failed", err)
 	}
 
 	// test `linkerd upgrade --from-manifests`
@@ -378,7 +375,7 @@ func TestInstallOrUpgradeCli(t *testing.T) {
 		if out != upgradeFromManifests {
 			// retry in case it's just a discrepancy in the heartbeat cron schedule
 			exec := append([]string{cmd}, args...)
-			out, stderr, err := TestHelper.LinkerdRun(exec...)
+			out, err := TestHelper.LinkerdRun(exec...)
 			if err != nil {
 				testutil.AnnotatedFatalf(t, fmt.Sprintf("command failed: %v", exec),
 					"command failed: %v\n%s\n%s", exec, out, stderr)
@@ -484,10 +481,9 @@ func TestInstallMulticluster(t *testing.T) {
 			"install",
 			"--namespace", TestHelper.GetMulticlusterNamespace(),
 		}...)
-		out, stderr, err := TestHelper.LinkerdRun(exec...)
+		out, err := TestHelper.LinkerdRun(exec...)
 		if err != nil {
-			testutil.AnnotatedFatalf(t, "'linkerd multicluster install' command failed",
-				"'linkerd multicluster' command failed: \n%s\n%s", out, stderr)
+			testutil.AnnotatedFatal(t, "'linkerd multicluster install' command failed", err)
 		}
 
 		out, err = TestHelper.KubectlApply(out, "")
@@ -719,10 +715,10 @@ func testCheckCommand(t *testing.T, stage string, expectedVersion string, namesp
 			cliVOverride := []string{"--cli-version-override", cliVersionOverride}
 			cmd = append(cmd, cliVOverride...)
 		}
-		out, stderr, err := TestHelper.LinkerdRun(cmd...)
+		out, err := TestHelper.LinkerdRun(cmd...)
 
 		if err != nil {
-			return fmt.Errorf("'linkerd check' command failed\n%s\n%s", stderr, out)
+			return fmt.Errorf("'linkerd check' command failed\n%s", err)
 		}
 
 		if !compareOutput {
@@ -765,10 +761,9 @@ func TestUpgradeTestAppWorksAfterUpgrade(t *testing.T) {
 func TestInstallSP(t *testing.T) {
 	cmd := []string{"install-sp"}
 
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd install-sp' command failed",
-			"'linkerd install-sp' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd install-sp' command failed", err)
 	}
 
 	out, err = TestHelper.KubectlApply(out, TestHelper.GetLinkerdNamespace())
@@ -842,7 +837,7 @@ func TestInject(t *testing.T) {
 				cmd = append(cmd, "testdata/smoke_test.yaml")
 
 				var injectReport string
-				out, injectReport, err = TestHelper.LinkerdRun(cmd...)
+				out, injectReport, err = TestHelper.PipeToLinkerdRun("", cmd...)
 				if err != nil {
 					testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
 						"'linkerd inject' command failed: %s\n%s", err, out)
diff --git a/test/integration/multicluster/source/source_test.go b/test/integration/multicluster/source/source_test.go
index 21992a799..6e1a14db6 100644
--- a/test/integration/multicluster/source/source_test.go
+++ b/test/integration/multicluster/source/source_test.go
@@ -26,9 +26,9 @@ func TestMain(m *testing.M) {
 func TestGateways(t *testing.T) {
 	timeout := time.Minute
 	err := TestHelper.RetryFor(timeout, func() error {
-		out, stderr, err := TestHelper.LinkerdRun("multicluster", "gateways")
+		out, err := TestHelper.LinkerdRun("multicluster", "gateways")
 		if err != nil {
-			return fmt.Errorf("%s\n%s", err, stderr)
+			return err
 		}
 		rows := strings.Split(out, "\n")
 		if len(rows) < 2 {
diff --git a/test/integration/routes/routes_test.go b/test/integration/routes/routes_test.go
index 182aceb51..7f7632a1d 100644
--- a/test/integration/routes/routes_test.go
+++ b/test/integration/routes/routes_test.go
@@ -30,9 +30,9 @@ func TestMain(m *testing.M) {
 func TestRoutes(t *testing.T) {
 	// control-plane routes
 	cmd := []string{"routes", "--namespace", TestHelper.GetLinkerdNamespace(), "deploy"}
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd routes' command failed", "'linkerd routes' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd routes' command failed", err)
 	}
 
 	routeStrings := []struct {
@@ -71,9 +71,9 @@ func TestRoutes(t *testing.T) {
 	cmd = []string{"routes", "--namespace", prefixedNs, "deploy"}
 	golden := "routes.smoke.golden"
 
-	out, stderr, err = TestHelper.LinkerdRun(cmd...)
+	out, err = TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd routes' command failed", "'linkerd routes' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd routes' command failed", err)
 	}
 
 	err = TestHelper.ValidateOutput(out, golden)
diff --git a/test/integration/serviceprofiles/serviceprofiles_test.go b/test/integration/serviceprofiles/serviceprofiles_test.go
index 39bc21282..dc6e8a9e9 100644
--- a/test/integration/serviceprofiles/serviceprofiles_test.go
+++ b/test/integration/serviceprofiles/serviceprofiles_test.go
@@ -42,10 +42,9 @@ func TestServiceProfiles(t *testing.T) {
 func testProfiles(t *testing.T) {
 	ctx := context.Background()
 	testNamespace := TestHelper.GetTestNamespace("serviceprofile-test")
-	out, stderr, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/tap_application.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/tap_application.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
-			"'linkerd inject' command failed with %s: %s\n", err, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd inject' command failed", err)
 	}
 
 	out, err = TestHelper.KubectlApply(out, testNamespace)
@@ -118,10 +117,9 @@ func testProfiles(t *testing.T) {
 			}
 
 			cmd = append(cmd, tc.args...)
-			out, stderr, err := TestHelper.LinkerdRun(cmd...)
+			out, err := TestHelper.LinkerdRun(cmd...)
 			if err != nil {
-				testutil.AnnotatedFatalf(t, fmt.Sprintf("'linkerd %s' command failed", cmd),
-					"'linkerd %s' command failed with %s: %s\n", cmd, err, stderr)
+				testutil.AnnotatedFatal(t, fmt.Sprintf("'linkerd %s' command failed", cmd), err)
 			}
 
 			_, err = TestHelper.KubectlApply(out, tc.namespace)
@@ -150,10 +148,9 @@ func testMetrics(t *testing.T) {
 		testYAML             = "testdata/hello_world.yaml"
 	)
 
-	out, stderr, err := TestHelper.LinkerdRun("inject", "--manual", testYAML)
+	out, err := TestHelper.LinkerdRun("inject", "--manual", testYAML)
 	if err != nil {
-		testutil.AnnotatedErrorf(t, "'linkerd inject' command failed",
-			"'linkerd inject' command failed with %s: %s\n", err, stderr)
+		testutil.AnnotatedError(t, "'linkerd inject' command failed", err)
 	}
 
 	out, err = TestHelper.KubectlApply(out, testNamespace)
@@ -171,10 +168,9 @@ func testMetrics(t *testing.T) {
 		testSP,
 	}
 
-	out, stderr, err = TestHelper.LinkerdRun(cmd...)
+	out, err = TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedErrorf(t, fmt.Sprintf("'linkerd %s' command failed", cmd),
-			"'linkerd %s' command failed with %s: %s\n", cmd, err, stderr)
+		testutil.AnnotatedError(t, fmt.Sprintf("'linkerd %s' command failed", cmd), err)
 	}
 
 	_, err = TestHelper.KubectlApply(out, testNamespace)
@@ -289,24 +285,30 @@ func getRoutes(deployName, namespace string, additionalArgs []string) ([]*cmd2.J
 	}
 
 	cmd = append(cmd, "--output", "json")
-	var out, stderr string
+	var results map[string][]*cmd2.JSONRouteStats
 	err := TestHelper.RetryFor(2*time.Minute, func() error {
-		var err error
-		out, stderr, err = TestHelper.LinkerdRun(cmd...)
-		return err
+		out, err := TestHelper.LinkerdRun(cmd...)
+		if err != nil {
+			return err
+		}
+
+		if err := yaml.Unmarshal([]byte(out), &results); err != nil {
+			return err
+		}
+
+		if _, ok := results[deployName]; ok {
+			return nil
+		}
+
+		keys := []string{}
+		for k := range results {
+			keys = append(keys, k)
+		}
+		return fmt.Errorf("could not retrieve route info for %s; found [%s]", deployName, strings.Join(keys, ", "))
 	})
 	if err != nil {
 		return nil, err
 	}
+	return results[deployName], nil
 
-	var list map[string][]*cmd2.JSONRouteStats
-	err = yaml.Unmarshal([]byte(out), &list)
-	if err != nil {
-		return nil, fmt.Errorf(fmt.Sprintf("Error: %s stderr: %s", err, stderr))
-	}
-
-	if deployment, ok := list[deployName]; ok {
-		return deployment, nil
-	}
-	return nil, fmt.Errorf("could not retrieve route info for %s", deployName)
 }
diff --git a/test/integration/stat/stat_test.go b/test/integration/stat/stat_test.go
index 093c45ec5..c5a30ca1f 100644
--- a/test/integration/stat/stat_test.go
+++ b/test/integration/stat/stat_test.go
@@ -129,12 +129,11 @@ func TestCliStatForLinkerdNamespace(t *testing.T) {
 				// Use a short time window so that transient errors at startup
 				// fall out of the window.
 				tt.args = append(tt.args, "-t", "30s")
-				out, stderr, err := TestHelper.LinkerdRun(tt.args...)
+				out, err := TestHelper.LinkerdRun(tt.args...)
 				if err != nil {
 					testutil.AnnotatedFatalf(t, "unexpected stat error",
 						"unexpected stat error: %s\n%s", err, out)
 				}
-				fmt.Println(stderr)
 
 				expectedColumnCount := 8
 				if tt.status != "" {
diff --git a/test/integration/tap/tap_test.go b/test/integration/tap/tap_test.go
index 22b876503..49a589720 100644
--- a/test/integration/tap/tap_test.go
+++ b/test/integration/tap/tap_test.go
@@ -67,10 +67,9 @@ var (
 //////////////////////
 
 func TestCliTap(t *testing.T) {
-	out, stderr, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/tap_application.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/tap_application.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
-			"'linkerd inject' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd inject' command failed", err)
 	}
 
 	ctx := context.Background()
@@ -134,7 +133,7 @@ func TestCliTap(t *testing.T) {
 		})
 
 		t.Run("tap a disabled deployment", func(t *testing.T) {
-			out, stderr, err := TestHelper.LinkerdRun("tap", "deploy/t4", "--namespace", prefixedNs)
+			out, stderr, err := TestHelper.PipeToLinkerdRun("", "tap", "deploy/t4", "--namespace", prefixedNs)
 			if out != "" {
 				testutil.AnnotatedFatalf(t, "unexpected output",
 					"unexpected output: %s", out)
diff --git a/test/integration/testdata/check.cni.golden b/test/integration/testdata/check.cni.golden
index b8527fa57..2144cdcd8 100644
--- a/test/integration/testdata/check.cni.golden
+++ b/test/integration/testdata/check.cni.golden
@@ -76,10 +76,6 @@ control-plane-version
 √ control plane is up-to-date
 √ control plane and cli versions match
 
-linkerd-addons
---------------
-√ 'linkerd-config-addons' config map exists
-
 linkerd-prometheus
 ------------------
 √ prometheus add-on service account exists
diff --git a/test/integration/testdata/check.cni.proxy.golden b/test/integration/testdata/check.cni.proxy.golden
index f87440190..0a08a8121 100644
--- a/test/integration/testdata/check.cni.proxy.golden
+++ b/test/integration/testdata/check.cni.proxy.golden
@@ -83,10 +83,6 @@ linkerd-data-plane
 √ data plane is up-to-date
 √ data plane and cli versions match
 
-linkerd-addons
---------------
-√ 'linkerd-config-addons' config map exists
-
 linkerd-prometheus
 ------------------
 √ prometheus add-on service account exists
diff --git a/test/integration/testdata/check.golden b/test/integration/testdata/check.golden
index 1de523497..7f3dd2bf4 100644
--- a/test/integration/testdata/check.golden
+++ b/test/integration/testdata/check.golden
@@ -64,10 +64,6 @@ control-plane-version
 √ control plane is up-to-date
 √ control plane and cli versions match
 
-linkerd-addons
---------------
-√ 'linkerd-config-addons' config map exists
-
 linkerd-prometheus
 ------------------
 √ prometheus add-on service account exists
diff --git a/test/integration/testdata/check.multicluster.golden b/test/integration/testdata/check.multicluster.golden
index 52929609c..150d673d7 100644
--- a/test/integration/testdata/check.multicluster.golden
+++ b/test/integration/testdata/check.multicluster.golden
@@ -64,10 +64,6 @@ control-plane-version
 √ control plane is up-to-date
 √ control plane and cli versions match
 
-linkerd-addons
---------------
-√ 'linkerd-config-addons' config map exists
-
 linkerd-prometheus
 ------------------
 √ prometheus add-on service account exists
diff --git a/test/integration/testdata/check.multicluster.proxy.golden b/test/integration/testdata/check.multicluster.proxy.golden
index 25c4c1c0d..ce1fc992c 100644
--- a/test/integration/testdata/check.multicluster.proxy.golden
+++ b/test/integration/testdata/check.multicluster.proxy.golden
@@ -71,10 +71,6 @@ linkerd-data-plane
 √ data plane is up-to-date
 √ data plane and cli versions match
 
-linkerd-addons
---------------
-√ 'linkerd-config-addons' config map exists
-
 linkerd-prometheus
 ------------------
 √ prometheus add-on service account exists
diff --git a/test/integration/testdata/check.proxy.golden b/test/integration/testdata/check.proxy.golden
index 43c83cb0a..bb4af1e81 100644
--- a/test/integration/testdata/check.proxy.golden
+++ b/test/integration/testdata/check.proxy.golden
@@ -71,10 +71,6 @@ linkerd-data-plane
 √ data plane is up-to-date
 √ data plane and cli versions match
 
-linkerd-addons
---------------
-√ 'linkerd-config-addons' config map exists
-
 linkerd-prometheus
 ------------------
 √ prometheus add-on service account exists
diff --git a/test/integration/tracing/tracing_test.go b/test/integration/tracing/tracing_test.go
index 52246cc7d..f9219d1b7 100644
--- a/test/integration/tracing/tracing_test.go
+++ b/test/integration/tracing/tracing_test.go
@@ -49,10 +49,9 @@ func TestTracing(t *testing.T) {
 	}
 
 	// Tracing Components
-	out, stderr, err := TestHelper.LinkerdRun("inject", "testdata/tracing.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "testdata/tracing.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
-			"'linkerd inject' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd inject' command failed", err)
 	}
 
 	tracingNs := TestHelper.GetTestNamespace("tracing")
@@ -81,7 +80,7 @@ func TestTracing(t *testing.T) {
 			"failed to read emojivoto yaml\n%s\n", err)
 	}
 	emojivotoYaml = strings.ReplaceAll(emojivotoYaml, "___TRACING_NS___", tracingNs)
-	out, stderr, err = TestHelper.PipeToLinkerdRun(emojivotoYaml, "inject", "-")
+	out, stderr, err := TestHelper.PipeToLinkerdRun(emojivotoYaml, "inject", "-")
 	if err != nil {
 		testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
 			"'linkerd inject' command failed\n%s\n%s", out, stderr)
diff --git a/test/integration/trafficsplit/trafficsplit_test.go b/test/integration/trafficsplit/trafficsplit_test.go
index ac8b79fe5..25f33dbf0 100644
--- a/test/integration/trafficsplit/trafficsplit_test.go
+++ b/test/integration/trafficsplit/trafficsplit_test.go
@@ -69,11 +69,11 @@ func parseStatTsRow(out string, expectedRowCount, expectedColumnCount int) (map[
 
 func statTrafficSplit(from string, ns string) (map[string]*statTsRow, error) {
 	cmd := []string{"stat", "ts", "--from", from, "--namespace", ns, "-t", "30s", "--unmeshed"}
-	stdOut, _, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
 		return nil, err
 	}
-	return parseStatTsRow(stdOut, 2, 9)
+	return parseStatTsRow(out, 2, 9)
 }
 
 func validateTrafficSplit(actual *statTsRow, expected *statTsRow) error {
@@ -148,10 +148,9 @@ func validateExpectedTsOutput(rows map[string]*statTsRow, expectedBackendSvc, ex
 }
 
 func TestTrafficSplitCli(t *testing.T) {
-	out, stderr, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/traffic_split_application.yaml")
+	out, err := TestHelper.LinkerdRun("inject", "--manual", "testdata/traffic_split_application.yaml")
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd inject' command failed",
-			"'linkerd inject' command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd inject' command failed", err)
 	}
 
 	ctx := context.Background()
diff --git a/test/integration/uninstall/uninstall_test.go b/test/integration/uninstall/uninstall_test.go
index b355a83df..86301f6c2 100644
--- a/test/integration/uninstall/uninstall_test.go
+++ b/test/integration/uninstall/uninstall_test.go
@@ -28,10 +28,9 @@ func TestInstall(t *testing.T) {
 		"--proxy-version", TestHelper.GetVersion(),
 	}
 
-	out, stderr, err := TestHelper.LinkerdRun(args...)
+	out, err := TestHelper.LinkerdRun(args...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd install' command failed",
-			"'linkerd install' command failed: \n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd install' command failed", err)
 	}
 
 	out, err = TestHelper.KubectlApply(out, "")
@@ -67,10 +66,9 @@ func TestResourcesPostInstall(t *testing.T) {
 
 func TestUninstall(t *testing.T) {
 	args := []string{"uninstall"}
-	out, stderr, err := TestHelper.LinkerdRun(args...)
+	out, err := TestHelper.LinkerdRun(args...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "'linkerd install' command failed",
-			"'linkerd install' command failed: \n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "'linkerd install' command failed", err)
 	}
 
 	args = []string{"delete", "-f", "-"}
@@ -84,10 +82,9 @@ func TestUninstall(t *testing.T) {
 func TestCheckPostUninstall(t *testing.T) {
 	cmd := []string{"check", "--pre", "--expected-version", TestHelper.GetVersion()}
 	golden := "check.pre.golden"
-	out, stderr, err := TestHelper.LinkerdRun(cmd...)
+	out, err := TestHelper.LinkerdRun(cmd...)
 	if err != nil {
-		testutil.AnnotatedFatalf(t, "check command failed",
-			"check command failed\n%s\n%s", out, stderr)
+		testutil.AnnotatedFatal(t, "check command failed", err)
 	}
 
 	err = TestHelper.ValidateOutput(out, golden)
diff --git a/testutil/test_helper.go b/testutil/test_helper.go
index 31ed2d390..181d3999b 100644
--- a/testutil/test_helper.go
+++ b/testutil/test_helper.go
@@ -199,15 +199,15 @@ func NewTestHelper() *TestHelper {
 		certsPath:      *certsPath,
 	}
 
-	version, stderr, err := testHelper.LinkerdRun("version", "--client", "--short")
+	version, err := testHelper.LinkerdRun("version", "--client", "--short")
 	if err != nil {
-		exit(1, fmt.Sprintf("error getting linkerd version: %s\n%s", err.Error(), stderr))
+		exit(1, fmt.Sprintf("error getting linkerd version: %s", err.Error()))
 	}
 	testHelper.version = strings.TrimSpace(version)
 
 	kubernetesHelper, err := NewKubernetesHelper(*k8sContext, testHelper.RetryFor)
 	if err != nil {
-		exit(1, fmt.Sprintf("error creating kubernetes helper: %s\n%s", err.Error(), stderr))
+		exit(1, fmt.Sprintf("error creating kubernetes helper: %s", err.Error()))
 	}
 	testHelper.KubernetesHelper = *kubernetesHelper
 
@@ -331,10 +331,13 @@ type: kubernetes.io/tls`, base64.StdEncoding.EncodeToString([]byte(root)), base6
 	return err
 }
 
-// LinkerdRun executes a linkerd command appended with the --linkerd-namespace
-// flag.
-func (h *TestHelper) LinkerdRun(arg ...string) (string, string, error) {
-	return h.PipeToLinkerdRun("", arg...)
+// LinkerdRun executes a linkerd command returning its stdout.
+func (h *TestHelper) LinkerdRun(arg ...string) (string, error) {
+	out, stderr, err := h.PipeToLinkerdRun("", arg...)
+	if err != nil {
+		return out, fmt.Errorf("command failed: linkerd %s\n%s\n%s", strings.Join(arg, " "), err, stderr)
+	}
+	return out, nil
 }
 
 // PipeToLinkerdRun executes a linkerd command appended with the
@@ -447,9 +450,9 @@ func (h *TestHelper) ValidateOutput(out, fixtureFile string) error {
 
 // CheckVersion validates the output of the "linkerd version" command.
 func (h *TestHelper) CheckVersion(serverVersion string) error {
-	out, _, err := h.LinkerdRun("version")
+	out, err := h.LinkerdRun("version")
 	if err != nil {
-		return fmt.Errorf("Unexpected error: %s\n%s", err.Error(), out)
+		return err
 	}
 	if !strings.Contains(out, fmt.Sprintf("Client version: %s", h.version)) {
 		return fmt.Errorf("Expected client version [%s], got:\n%s", h.version, out)