Repository: linkerd/linkerd2
Pull request #7769 (2022-02-02 23:25:56)

Add gopls to devcontainer
Add gopls to the Linkerd devcontainer so that it is available immediately when the container starts and doesn't need to be installed separately after launching the devcontainer.

Signed-off-by: Alex Leong <alex@buoyant.io>

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->


olix0r: @adleong When I load linkerd2, I get prompted to install all of the following:
```text
Tools environment: GOPATH=/go
Installing 9 tools at /go/bin in module mode.
  gopkgs
  go-outline
  gotests
  gomodifytags
  impl
  goplay
  dlv
  golangci-lint
  gopls

Installing github.com/uudashr/gopkgs/v2/cmd/gopkgs@latest (/go/bin/gopkgs) SUCCEEDED
Installing github.com/ramya-rao-a/go-outline@latest (/go/bin/go-outline) SUCCEEDED
Installing github.com/cweill/gotests/gotests@latest (/go/bin/gotests) SUCCEEDED
Installing github.com/fatih/gomodifytags@latest (/go/bin/gomodifytags) SUCCEEDED
Installing github.com/josharian/impl@latest (/go/bin/impl) SUCCEEDED
Installing github.com/haya14busa/goplay/cmd/goplay@latest (/go/bin/goplay) SUCCEEDED
Installing github.com/go-delve/delve/cmd/dlv@latest (/go/bin/dlv) SUCCEEDED
Installing github.com/golangci/golangci-lint/cmd/golangci-lint@latest (/go/bin/golangci-lint) SUCCEEDED
Installing golang.org/x/tools/gopls@latest (/go/bin/gopls) SUCCEEDED

All tools successfully installed. You are ready to Go. :)
```

Should we install these additional tools?

Do we need to install them into `/go`?

Patch:
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index d0d24b456..d26e82b46 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,49 @@
-FROM docker.io/golang:1.17-bullseye
+ARG GO_VERSION=1.17
+ARG RUST_TOOLCHAIN=1.56.1
+
+FROM docker.io/golang:${GO_VERSION}-bullseye as go
+RUN for p in \
+    github.com/uudashr/gopkgs/v2/cmd/gopkgs@latest \
+    github.com/ramya-rao-a/go-outline@latest \
+    github.com/cweill/gotests/gotests@latest \
+    github.com/fatih/gomodifytags@latest \
+    github.com/josharian/impl@latest \
+    github.com/haya14busa/goplay/cmd/goplay@latest \
+    github.com/go-delve/delve/cmd/dlv@latest \
+    github.com/golangci/golangci-lint/cmd/golangci-lint@latest \
+    golang.org/x/tools/gopls@latest \
+    ; do go install "$p" ; done
+
+FROM docker.io/golang:${GO_VERSION}-bullseye as cargo-deny
+ARG CARGO_DENY_VERSION=0.11.1
+COPY bin/scurl /usr/local/bin/scurl
+RUN scurl "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+    | tar zvxf - --strip-components=1 -C /usr/local/bin "cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny"
+
+FROM docker.io/golang:${GO_VERSION}-bullseye as yq
+ARG YQ_VERSION=v4.2.0
+COPY bin/scurl /usr/local/bin/scurl
+RUN scurl -vo /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \
+    && chmod +x /usr/local/bin/yq
+
+FROM docker.io/golang:${GO_VERSION}-bullseye as kubectl
+COPY bin/scurl /usr/local/bin/scurl
+RUN scurl -vo /usr/local/bin/kubectl "https://dl.k8s.io/release/$(scurl https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+    && chmod 755 /usr/local/bin/kubectl
+
+FROM docker.io/golang:${GO_VERSION}-bullseye as k3d
+COPY bin/scurl /usr/local/bin/scurl
+RUN scurl -v https://raw.githubusercontent.com/rancher/k3d/main/install.sh \
+    | USE_SUDO=false K3D_INSTALL_DIR=/usr/local/bin bash
+
+FROM docker.io/rust:${RUST_TOOLCHAIN}-bullseye as rust
+RUN rustup component add rustfmt clippy rls
+
+##
+## Main container configuration
+##
+
+FROM docker.io/golang:${GO_VERSION}-bullseye
 
 # Note: we do *not* delete the apt cache so subsequent steps (like docker,
 # dotfiles) need not pull the cache again. This comes at the cost of a fatter
@@ -44,26 +89,20 @@ ENV HOME=/home/$USER
 RUN mkdir -p $HOME/bin
 ENV PATH=$HOME/bin:$PATH
 
-RUN scurl -vo $HOME/bin/kubectl "https://dl.k8s.io/release/$(scurl https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
-    && chmod 755 $HOME/bin/kubectl
-RUN scurl -v https://raw.githubusercontent.com/rancher/k3d/main/install.sh \
-    | USE_SUDO=false K3D_INSTALL_DIR=$HOME/bin bash
-
-ARG YQ_VERSION=v4.2.0
-RUN scurl -vo $HOME/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \
-    && chmod +x $HOME/bin/yq
-
-ARG RUST_TOOLCHAIN=1.56.1
-RUN scurl -v https://sh.rustup.rs \
-    | sh -s -- -y --default-toolchain "${RUST_TOOLCHAIN}" -c rustfmt -c clippy -c rls
-
-RUN mkdir /tmp/cargo-deny && cd /tmp/cargo-deny && \
-    scurl -v https://github.com/EmbarkStudios/cargo-deny/releases/download/0.11.0/cargo-deny-0.11.0-x86_64-unknown-linux-musl.tar.gz | tar zxf - && \
-    mv cargo-deny-0.11.0-x86_64-unknown-linux-musl/cargo-deny $HOME/bin && \
-    cd .. && rm -rf /tmp/cargo-deny
-
 RUN scurl -v https://run.linkerd.io/install-edge | sh \
     && ln -s $(readlink ~/.linkerd2/bin/linkerd) ~/bin/linkerd
 
+COPY --from=go /go /go
+COPY --from=cargo-deny /usr/local/bin/cargo-deny /user/local/bin/cargo-deny
+COPY --from=k3d /usr/local/bin/k3d /user/local/bin/k3d
+COPY --from=kubectl /usr/local/bin/kubectl /user/local/bin/kubectl
+COPY --from=yq /usr/local/bin/yq /user/local/bin/yq
+
+COPY --from=rust /usr/local/cargo /usr/local/cargo
+COPY --from=rust /usr/local/rustup /usr/local/rustup
+ENV CARGO_HOME=/usr/local/cargo
+ENV RUSTUP_HOME=/usr/local/rustup
+ENV PATH=/usr/local/cargo/bin:$PATH
+
 ENTRYPOINT ["/usr/local/share/docker-init.sh"]
 CMD ["sleep", "infinity"]
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
index a625e8bbd..092da1c9d 100644
--- a/.devcontainer/README.md
+++ b/.devcontainer/README.md
@@ -10,6 +10,12 @@ running a separate docker daemon within in the container). It creates
 devcontainers on the host network so it's easy to use k3d clusters hosted in the
 parent host's docker daemon.
 
+You can build the devcontainer by running:
+
+```sh
+docker build . -f .devcontainer/Dockerfile -t ghcr.io/linkerd/dev
+```
+
 ## Customizing
 
 This configuration is supposed to provide a minimal setup without catering to
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 736a3e0cf..406653b9f 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
     "name": "linkerd2",
-    "image": "ghcr.io/linkerd/dev:v6",
+    "image": "ghcr.io/linkerd/dev:v7",
     // "dockerFile": "./Dockerfile",
     // "context": "..",
     "extensions": [
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5ad7a495..d746edbde 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -158,11 +158,9 @@ jobs:
         - cluster-domain
         - cni-calico-deep
         - deep
+        - viz
         - default-policy-deny
-        - external-issuer
-        - external-prometheus-deep
-        - external-resources
-        - helm-deep
+        - external
         # Skipping Helm upgrade test given chart in 2.11 is backwards-incompatible
         #- helm-upgrade
         - uninstall
@@ -361,7 +359,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
     - name: Log into GCP
-      uses: 'google-github-actions/auth@7a360a247cce1245c1d13bc63d8b2ac927d201c8'
+      uses: 'google-github-actions/auth@8d125895b958610ec414ca4dae010257eaa814d3'
       with:
         credentials_json: ${{ secrets.LINKERD_SITE_TOKEN }}
     - name: Edge Helm chart creation and upload
diff --git a/.github/workflows/rust_audit.yml b/.github/workflows/rust_audit.yml
index 8cbac2a7c..dc9cf8e46 100644
--- a/.github/workflows/rust_audit.yml
+++ b/.github/workflows/rust_audit.yml
@@ -1,8 +1,22 @@
 name: RUSTSEC audit
 
+# This audits *all* of our Rust repositories and opens issues for any new
+# security advisories.  This action depends on cargo-deny, so if advisories are
+# ignored in the repo's `deny.toml`, an issue may not be flagged.
+
 on:
+
+  # Run when the Cargo.lock changes or when this workflow changes.
+  push:
+    branches:
+      - main
+    paths:
+      - Cargo.lock
+      - deny.toml
+      - .github/workflows/rust_audit.yml
+
+  # Run at 00:00 UTC every day
   schedule:
-    # Run at 00:00 UTC every day
     - cron: '0 0 * * *'
 
 permissions:
@@ -10,23 +24,26 @@ permissions:
 
 jobs:
   audit:
+    runs-on: ubuntu-latest
+
     strategy:
       matrix:
-        repository:
-        - linkerd2
-        - linkerd2-proxy
-        - linkerd-await
-    runs-on: ubuntu-latest
-    name: RUSTSEC audit (${{ matrix.repository }})
+        include:
+
+          - repo: linkerd2
+            labels: area/controller,rust,security
+
+          - repo: linkerd2-proxy
+            labels: area/proxy,rust,security
+
+          - repo: linkerd-await
+            labels: area/await,rust,security
+
+    name: RUSTSEC audit (${{ matrix.repo }})
     steps:
       - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
         with:
-          repository: linkerd/${{ matrix.repository }}
-      - uses: actions-rs/toolchain@88dc2356392166efad76775c878094f4e83ff746
-        with:
-          toolchain: stable
-          profile: minimal
-          override: true
-      - uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3
+          repository: linkerd/${{ matrix.repo }}
+      - uses: olix0r/rustsecbot@560c817c7a019e1f0c2318721b55156409be7f8c
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          labels: ${{ matrix.labels }}
diff --git a/CHANGES.md b/CHANGES.md
index e1fcb32a4..214e7df7e 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,21 @@
 # Changes
 
+## edge-22.2.1
+
+This edge release removed the `disableIdentity` configuration now that the proxy
+no longer supports running without identity.
+
+* Added a `privileged` configuration to linkerd-cni which is required by some
+  environments
+* Fixed an issue where the TLS credentials used by the policy validator were not
+  updated when the credentials were rotated
+* Removed the `disableIdentity` configurations now that the proxy no longer
+  supports running without identity
+* Fixed an issue where `linkerd jaeger check` would needlessly fail for BYO
+  Jaeger or collector installations
+* Fixed a Helm HA installation race condition introduced by the stoppage of
+  namespace creation
+
 ## edge-22.1.5
 
 This edge release adds support for per-request Access Logging for HTTP inbound
diff --git a/Cargo.lock b/Cargo.lock
index d99bf735d..5752e5a9a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -796,9 +796,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.116"
+version = "0.2.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "565dbd88872dbe4cc8a46e527f26483c1d1f7afa6b884a3bd6cd893d4f98da74"
+checksum = "e74d72e0f9b65b5b4ca49a346af3976df0f9c61d550727f349ecd559f251a26c"
 
 [[package]]
 name = "linked-hash-map"
@@ -1886,9 +1886,9 @@ checksum = "360dfd1d6d30e05fda32ace2c8c70e9c0a9da713275777f5a4dbb8a1893930c6"
 
 [[package]]
 name = "tracing"
-version = "0.1.29"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "375a639232caf30edfc78e8d89b2d4c375515393e7af7e16f01cd96917fb2105"
+checksum = "2d8d93354fe2a8e50d5953f5ae2e47a3fc2ef03292e7ea46e3cc38f549525fb9"
 dependencies = [
  "cfg-if",
  "log",
@@ -1899,9 +1899,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4f480b8f81512e825f337ad51e94c1eb5d3bbdf2b363dcd01e2b19a9ffe3f8e"
+checksum = "8276d9a4a3a558d7b7ad5303ad50b53d58264641b82914b7ada36bd762e7a716"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1910,11 +1910,12 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.21"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f4ed65637b8390770814083d20756f87bfa2c21bf2f110babdc5438351746e4"
+checksum = "03cfcb51380632a72d3111cb8d3447a8d908e577d31beeac006f836383d29a23"
 dependencies = [
  "lazy_static",
+ "valuable",
 ]
 
 [[package]]
@@ -2001,6 +2002,12 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
diff --git a/Dockerfile-proxy b/Dockerfile-proxy
index 166b79e07..a962eb717 100644
--- a/Dockerfile-proxy
+++ b/Dockerfile-proxy
@@ -18,7 +18,7 @@ COPY .proxy-version proxy-version
 ARG TARGETARCH
 RUN (proxy=$(bin/fetch-proxy $(cat proxy-version) $TARGETARCH) && \
     mv "$proxy" linkerd2-proxy)
-ARG LINKERD_AWAIT_VERSION=v0.2.4
+ARG LINKERD_AWAIT_VERSION=v0.2.5
 RUN bin/scurl -o linkerd-await https://github.com/linkerd/linkerd-await/releases/download/release%2F${LINKERD_AWAIT_VERSION}/linkerd-await-${LINKERD_AWAIT_VERSION}-${TARGETARCH} && chmod +x linkerd-await
 
 ## compile proxy-identity agent
diff --git a/charts/linkerd-control-plane/Chart.yaml b/charts/linkerd-control-plane/Chart.yaml
index 35ec4bccf..2772e3a27 100644
--- a/charts/linkerd-control-plane/Chart.yaml
+++ b/charts/linkerd-control-plane/Chart.yaml
@@ -12,11 +12,11 @@ kubeVersion: ">=1.20.0-0"
 name: "linkerd-control-plane"
 sources:
 - https://github.com/linkerd/linkerd2/
-dependencies: 
+dependencies:
 - name: partials
   version: 0.1.0
   repository: file://../partials
-version: 1.1.3-edge
+version: 1.1.4-edge
 icon: https://linkerd.io/images/logo-only-200h.png
 maintainers:
   - name: Linkerd authors
diff --git a/charts/linkerd-control-plane/README.md b/charts/linkerd-control-plane/README.md
index 975b5f96b..f3a89308c 100644
--- a/charts/linkerd-control-plane/README.md
+++ b/charts/linkerd-control-plane/README.md
@@ -3,7 +3,7 @@
 Linkerd gives you observability, reliability, and security
 for your microservices — with no code change required.
 
-![Version: 1.1.3-edge](https://img.shields.io/badge/Version-1.1.3--edge-informational?style=flat-square)
+![Version: 1.1.4-edge](https://img.shields.io/badge/Version-1.1.4--edge-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 ![AppVersion: edge-XX.X.X](https://img.shields.io/badge/AppVersion-edge--XX.X.X-informational?style=flat-square)
 
diff --git a/charts/linkerd-crds/templates/policy/server.yaml b/charts/linkerd-crds/templates/policy/server.yaml
new file mode 100644
index 000000000..ba8530f74
--- /dev/null
+++ b/charts/linkerd-crds/templates/policy/server.yaml
@@ -0,0 +1,146 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: servers.policy.linkerd.io
+  annotations:
+    {{ include "partials.annotations.created-by" . }}
+  labels:
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    linkerd.io/control-plane-ns: {{.Release.Namespace}}
+spec:
+  group: policy.linkerd.io
+  names:
+    kind: Server
+    plural: servers
+    singular: server
+    shortNames: [srv]
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: false
+      deprecated: true
+      deprecationWarning: "policy.linkerd.io/v1alpha1 Server is deprecated; use policy.linkerd.io/v1beta1 Server"
+      schema:
+        openAPIV3Schema:
+          type: object
+          required: [spec]
+          properties:
+            spec:
+              type: object
+              required:
+                - podSelector
+                - port
+              properties:
+                podSelector:
+                  type: object
+                  description: >-
+                    Selects pods in the same namespace.
+                  oneOf:
+                    - required: [matchExpressions]
+                    - required: [matchLabels]
+                  properties:
+                    matchLabels:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    matchExpressions:
+                      type: array
+                      items:
+                        type: object
+                        required: [key, operator]
+                        properties:
+                          key:
+                            type: string
+                          operator:
+                            type: string
+                            enum: [In, NotIn, Exists, DoesNotExist]
+                          values:
+                            type: array
+                            items:
+                              type: string
+                port:
+                  description: >-
+                    A port name or number. Must exist in a pod spec.
+                  x-kubernetes-int-or-string: true
+                proxyProtocol:
+                  description: >-
+                    Configures protocol discovery for inbound connections.
+
+                    Supersedes the `config.linkerd.io/opaque-ports` annotation.
+                  type: string
+                  default: unknown
+                  enum:
+                    - unknown
+                    - HTTP/1
+                    - HTTP/2
+                    - gRPC
+                    - opaque
+                    - TLS
+    - name: v1beta1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          required: [spec]
+          properties:
+            spec:
+              type: object
+              required:
+                - podSelector
+                - port
+              properties:
+                podSelector:
+                  type: object
+                  description: >-
+                    Selects pods in the same namespace.
+                  oneOf:
+                    - required: [matchExpressions]
+                    - required: [matchLabels]
+                  properties:
+                    matchLabels:
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    matchExpressions:
+                      type: array
+                      items:
+                        type: object
+                        required: [key, operator]
+                        properties:
+                          key:
+                            type: string
+                          operator:
+                            type: string
+                            enum: [In, NotIn, Exists, DoesNotExist]
+                          values:
+                            type: array
+                            items:
+                              type: string
+                port:
+                  description: >-
+                    A port name or number. Must exist in a pod spec.
+                  x-kubernetes-int-or-string: true
+                proxyProtocol:
+                  description: >-
+                    Configures protocol discovery for inbound connections.
+
+                    Supersedes the `config.linkerd.io/opaque-ports` annotation.
+                  type: string
+                  default: unknown
+                  enum:
+                    - unknown
+                    - HTTP/1
+                    - HTTP/2
+                    - gRPC
+                    - opaque
+                    - TLS
+      additionalPrinterColumns:
+      - name: Port
+        type: string
+        description: The port the server is listening on
+        jsonPath: .spec.port
+      - name: Protocol
+        type: string
+        description: The protocol of the server
+        jsonPath: .spec.proxyProtocol
diff --git a/charts/linkerd-crds/templates/policy-crd.yaml b/charts/linkerd-crds/templates/policy/serverauthorization.yaml
similarity index 71%
rename from charts/linkerd-crds/templates/policy-crd.yaml
rename to charts/linkerd-crds/templates/policy/serverauthorization.yaml
index 56aa92651..3474f3999 100644
--- a/charts/linkerd-crds/templates/policy-crd.yaml
+++ b/charts/linkerd-crds/templates/policy/serverauthorization.yaml
@@ -1,152 +1,6 @@
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
-metadata:
-  name: servers.policy.linkerd.io
-  annotations:
-    {{ include "partials.annotations.created-by" . }}
-  labels:
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
-    linkerd.io/control-plane-ns: {{.Release.Namespace}}
-spec:
-  group: policy.linkerd.io
-  names:
-    kind: Server
-    plural: servers
-    singular: server
-    shortNames: [srv]
-  scope: Namespaced
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: false
-      deprecated: true
-      deprecationWarning: "policy.linkerd.io/v1alpha1 Server is deprecated; use policy.linkerd.io/v1beta1 Server"
-      schema:
-        openAPIV3Schema:
-          type: object
-          required: [spec]
-          properties:
-            spec:
-              type: object
-              required:
-                - podSelector
-                - port
-              properties:
-                podSelector:
-                  type: object
-                  description: >-
-                    Selects pods in the same namespace.
-                  oneOf:
-                    - required: [matchExpressions]
-                    - required: [matchLabels]
-                  properties:
-                    matchLabels:
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    matchExpressions:
-                      type: array
-                      items:
-                        type: object
-                        required: [key, operator]
-                        properties:
-                          key:
-                            type: string
-                          operator:
-                            type: string
-                            enum: [In, NotIn, Exists, DoesNotExist]
-                          values:
-                            type: array
-                            items:
-                              type: string
-                port:
-                  description: >-
-                    A port name or number. Must exist in a pod spec.
-                  x-kubernetes-int-or-string: true
-                proxyProtocol:
-                  description: >-
-                    Configures protocol discovery for inbound connections.
-
-                    Supersedes the `config.linkerd.io/opaque-ports` annotation.
-                  type: string
-                  default: unknown
-                  enum:
-                    - unknown
-                    - HTTP/1
-                    - HTTP/2
-                    - gRPC
-                    - opaque
-                    - TLS
-    - name: v1beta1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          required: [spec]
-          properties:
-            spec:
-              type: object
-              required:
-                - podSelector
-                - port
-              properties:
-                podSelector:
-                  type: object
-                  description: >-
-                    Selects pods in the same namespace.
-                  oneOf:
-                    - required: [matchExpressions]
-                    - required: [matchLabels]
-                  properties:
-                    matchLabels:
-                      type: object
-                      x-kubernetes-preserve-unknown-fields: true
-                    matchExpressions:
-                      type: array
-                      items:
-                        type: object
-                        required: [key, operator]
-                        properties:
-                          key:
-                            type: string
-                          operator:
-                            type: string
-                            enum: [In, NotIn, Exists, DoesNotExist]
-                          values:
-                            type: array
-                            items:
-                              type: string
-                port:
-                  description: >-
-                    A port name or number. Must exist in a pod spec.
-                  x-kubernetes-int-or-string: true
-                proxyProtocol:
-                  description: >-
-                    Configures protocol discovery for inbound connections.
-
-                    Supersedes the `config.linkerd.io/opaque-ports` annotation.
-                  type: string
-                  default: unknown
-                  enum:
-                    - unknown
-                    - HTTP/1
-                    - HTTP/2
-                    - gRPC
-                    - opaque
-                    - TLS
-      additionalPrinterColumns:
-      - name: Port
-        type: string
-        description: The port the server is listening on
-        jsonPath: .spec.port
-      - name: Protocol
-        type: string
-        description: The protocol of the server
-        jsonPath: .spec.proxyProtocol
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
 metadata:
   name: serverauthorizations.policy.linkerd.io
   annotations:
diff --git a/charts/linkerd-crds/templates/serviceprofile-crd.yaml b/charts/linkerd-crds/templates/serviceprofile.yaml
similarity index 100%
rename from charts/linkerd-crds/templates/serviceprofile-crd.yaml
rename to charts/linkerd-crds/templates/serviceprofile.yaml
diff --git a/charts/linkerd2-cni/Chart.yaml b/charts/linkerd2-cni/Chart.yaml
index 8522d8fcb..6be65789d 100644
--- a/charts/linkerd2-cni/Chart.yaml
+++ b/charts/linkerd2-cni/Chart.yaml
@@ -9,5 +9,5 @@ description: |
 kubeVersion: ">=1.20.0-0"
 icon: https://linkerd.io/images/logo-only-200h.png
 name: "linkerd2-cni"
-version: 30.0.3-edge
+version: 30.0.4-edge
 
diff --git a/charts/linkerd2-cni/README.md b/charts/linkerd2-cni/README.md
index 5c3c88054..7c6281cbc 100644
--- a/charts/linkerd2-cni/README.md
+++ b/charts/linkerd2-cni/README.md
@@ -6,7 +6,7 @@ Linkerd [CNI plugin](https://linkerd.io/2/features/cni/) takes care of setting
 up your pod's network so  incoming and outgoing traffic is proxied through the
 data plane.
 
-![Version: 30.0.3-edge](https://img.shields.io/badge/Version-30.0.3--edge-informational?style=flat-square)
+![Version: 30.0.4-edge](https://img.shields.io/badge/Version-30.0.4--edge-informational?style=flat-square)
 
 ![AppVersion: edge-XX.X.X](https://img.shields.io/badge/AppVersion-edge--XX.X.X-informational?style=flat-square)
 
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index b27187dca..619ab4aaa 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -163,7 +163,8 @@ lifecycle:
   postStart:
     exec:
       command:
-      - /usr/lib/linkerd/linkerd-await
+        - /usr/lib/linkerd/linkerd-await
+        - --timeout=2m
 {{- end }}
 {{- if .Values.proxy.waitBeforeExitSeconds }}
   preStop:
diff --git a/cli/cmd/install.go b/cli/cmd/install.go
index ba5c954dc..7fb02b0d9 100644
--- a/cli/cmd/install.go
+++ b/cli/cmd/install.go
@@ -61,8 +61,9 @@ Otherwise, you can use the --ignore-cluster flag to overwrite the existing globa
 
 var (
 	templatesCrdFiles = []string{
-		"templates/policy-crd.yaml",
-		"templates/serviceprofile-crd.yaml",
+		"templates/policy/server.yaml",
+		"templates/policy/serverauthorization.yaml",
+		"templates/serviceprofile.yaml",
 	}
 
 	templatesConfigStage = []string{
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index 7a8fb7f87..588198d57 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -290,7 +290,8 @@
         "postStart": {
           "exec": {
             "command": [
-              "/usr/lib/linkerd/linkerd-await"
+              "/usr/lib/linkerd/linkerd-await",
+              "--timeout=2m"
             ]
           }
         }
diff --git a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
index 407eab8de..228e5bdf0 100644
--- a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
@@ -290,7 +290,8 @@
         "postStart": {
           "exec": {
             "command": [
-              "/usr/lib/linkerd/linkerd-await"
+              "/usr/lib/linkerd/linkerd-await",
+              "--timeout=2m"
             ]
           }
         },
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index 6d0d3ed7d..22331780a 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -280,7 +280,8 @@
         "postStart": {
           "exec": {
             "command": [
-              "/usr/lib/linkerd/linkerd-await"
+              "/usr/lib/linkerd/linkerd-await",
+              "--timeout=2m"
             ]
           }
         }
diff --git a/deny.toml b/deny.toml
index dc7f23f10..01dd828d3 100644
--- a/deny.toml
+++ b/deny.toml
@@ -12,8 +12,6 @@ unmaintained = "warn"
 yanked = "deny"
 notice = "warn"
 ignore = [
-    # https://github.com/kube-rs/kube-rs/issues/656
-    "RUSTSEC-2020-0071",
     # https://github.com/kube-rs/kube-rs/issues/650
     # https://github.com/kube-rs/kube-rs/issues/660
     "RUSTSEC-2020-0159",
diff --git a/policy-controller/arm.dockerfile b/policy-controller/arm.dockerfile
index 512860235..730639cd5 100644
--- a/policy-controller/arm.dockerfile
+++ b/policy-controller/arm.dockerfile
@@ -13,7 +13,7 @@ COPY Cargo.toml Cargo.lock policy-controller/ /build/
 RUN --mount=type=cache,target=target \
     --mount=type=cache,from=rust:1.56.1,source=/usr/local/cargo,target=/usr/local/cargo \
     cargo build --locked --release --target=armv7-unknown-linux-gnueabihf \
-        --package=linkerd-policy-controller --no-default-features --features="rustls" && \
+        --package=linkerd-policy-controller --no-default-features --features="rustls-tls" && \
     mv target/armv7-unknown-linux-gnueabihf/release/linkerd-policy-controller /tmp/
 
 FROM --platform=linux/arm $RUNTIME_IMAGE


Test patch:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index cce8296ee..04037c2db 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -115,6 +115,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 24d1992b6..219f27ddd 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -115,6 +115,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
@@ -312,6 +313,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index 53c68a141..5ada70fd6 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -115,6 +115,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 1db208bdd..d0bf299d1 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -123,6 +123,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index 685aeeb90..cc9e67387 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
@@ -325,6 +326,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
@@ -533,6 +535,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
@@ -741,6 +744,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index fa65c87be..df9dd2594 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
index 6f12e9897..e31bf302b 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
@@ -120,6 +120,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
index be306c3f0..4cb46bab9 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
@@ -118,6 +118,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index 56afa29de..0c83a9c04 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index 6e327f06b..c4895709a 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -127,6 +127,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index 1aea4d11e..3ac93b9ec 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
@@ -325,6 +326,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index 1c5b7c050..d6cb3b528 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -118,6 +118,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index 9eb847c60..20851c5f9 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index 8ee283515..16e3ddba3 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
index 023100832..63b560355 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
index 4b2b97b2a..f65a333e5 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
@@ -118,6 +118,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index 006bea51b..6b1210397 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -118,6 +118,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index 7a8acdb7a..e26d6af3c 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -119,6 +119,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index a1de3f7fa..5fd28f4e7 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -117,6 +117,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index 30e86c7c7..74d457c16 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -119,6 +119,7 @@ items:
               exec:
                 command:
                 - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
           livenessProbe:
             httpGet:
               path: /live
@@ -326,6 +327,7 @@ items:
               exec:
                 command:
                 - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
           livenessProbe:
             httpGet:
               path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index b73cd6bda..ac18eddeb 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -119,6 +119,7 @@ items:
               exec:
                 command:
                 - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
           livenessProbe:
             httpGet:
               path: /live
@@ -326,6 +327,7 @@ items:
               exec:
                 command:
                 - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
           livenessProbe:
             httpGet:
               path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index 0e6e1fa1e..4a2163ad4 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -107,6 +107,7 @@ spec:
         exec:
           command:
           - /usr/lib/linkerd/linkerd-await
+          - --timeout=2m
     livenessProbe:
       httpGet:
         path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
index 4d69779c5..5ae047dd9 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
@@ -110,6 +110,7 @@ spec:
         exec:
           command:
           - /usr/lib/linkerd/linkerd-await
+          - --timeout=2m
     livenessProbe:
       httpGet:
         path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index 4572d06a2..f94ab82e1 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -109,6 +109,7 @@ spec:
         exec:
           command:
           - /usr/lib/linkerd/linkerd-await
+          - --timeout=2m
     livenessProbe:
       httpGet:
         path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index 576ee94b2..31569eb6a 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -111,6 +111,7 @@ spec:
         exec:
           command:
           - /usr/lib/linkerd/linkerd-await
+          - --timeout=2m
     livenessProbe:
       httpGet:
         path: /live
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index 89bafd76f..e9fab015c 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -118,6 +118,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index afbaa81e0..b5819664a 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -113,6 +113,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
@@ -323,6 +324,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index 225e51b3c..eba1ba78c 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -134,6 +134,7 @@ spec:
             exec:
               command:
               - /usr/lib/linkerd/linkerd-await
+              - --timeout=2m
         livenessProbe:
           httpGet:
             path: /live
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 62b8f90cc..b788f6d9c 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1865,7 +1865,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2224,7 +2225,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 3b8571fd0..b9b03d656 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1864,7 +1864,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2222,7 +2223,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 724dd4433..74bd807f2 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1864,7 +1864,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2222,7 +2223,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 3b8571fd0..b9b03d656 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1864,7 +1864,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2222,7 +2223,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 1d10f56aa..0a5ec9713 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1864,7 +1864,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2222,7 +2223,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index 7998695d2..eb3b0ae32 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1855,7 +1855,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2204,7 +2205,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index f47aa254d..030bc71f0 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1994,7 +1994,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2392,7 +2393,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index ee8bed99a..a87502285 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1994,7 +1994,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2392,7 +2393,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 6575e4ef2..37bb6e2a8 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1795,7 +1795,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2103,7 +2104,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index 84efc055f..422abc9bc 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -1127,7 +1127,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -1490,7 +1491,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index 92cd8a66f..67a1395be 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -1257,7 +1257,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -1660,7 +1661,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_helm_crds_output.golden b/cli/cmd/testdata/install_helm_crds_output.golden
index 4f5983ed7..aea4795f0 100644
--- a/cli/cmd/testdata/install_helm_crds_output.golden
+++ b/cli/cmd/testdata/install_helm_crds_output.golden
@@ -1,5 +1,5 @@
 ---
-# Source: linkerd-crds/templates/policy-crd.yaml
+# Source: linkerd-crds/templates/policy/server.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -147,6 +147,8 @@ spec:
         description: The protocol of the server
         jsonPath: .spec.proxyProtocol
 ---
+# Source: linkerd-crds/templates/policy/serverauthorization.yaml
+---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -433,7 +435,7 @@ spec:
         description: The server that this grants access to
         jsonPath: .spec.server.name
 ---
-# Source: linkerd-crds/templates/serviceprofile-crd.yaml
+# Source: linkerd-crds/templates/serviceprofile.yaml
 ---
 ###
 ### Service Profile CRD
diff --git a/cli/cmd/testdata/install_helm_crds_output_ha.golden b/cli/cmd/testdata/install_helm_crds_output_ha.golden
index 4f5983ed7..aea4795f0 100644
--- a/cli/cmd/testdata/install_helm_crds_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_crds_output_ha.golden
@@ -1,5 +1,5 @@
 ---
-# Source: linkerd-crds/templates/policy-crd.yaml
+# Source: linkerd-crds/templates/policy/server.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -147,6 +147,8 @@ spec:
         description: The protocol of the server
         jsonPath: .spec.proxyProtocol
 ---
+# Source: linkerd-crds/templates/policy/serverauthorization.yaml
+---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -433,7 +435,7 @@ spec:
         description: The server that this grants access to
         jsonPath: .spec.server.name
 ---
-# Source: linkerd-crds/templates/serviceprofile-crd.yaml
+# Source: linkerd-crds/templates/serviceprofile.yaml
 ---
 ###
 ### Service Profile CRD
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 074e09f1e..36e90f7a9 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -1269,7 +1269,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -1680,7 +1681,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index aa791747e..7e9609a89 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -1247,7 +1247,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -1650,7 +1651,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index fd6daeea0..0f0d04dcc 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1827,7 +1827,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2148,7 +2149,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 3ac30a276..56f7c2847 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: CliVersion
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: CliVersion
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: CliVersion
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1866,7 +1866,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2234,7 +2235,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 2c35c0a81..279eb89a2 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1864,7 +1864,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2222,7 +2223,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 064e0859d..02efe0621 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -6,7 +6,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -152,7 +152,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: policy.linkerd.io
@@ -441,7 +441,7 @@ metadata:
   annotations:
     linkerd.io/created-by: linkerd/cli dev-undefined
   labels:
-    helm.sh/chart: linkerd-control-plane-1.1.3-edge
+    helm.sh/chart: linkerd-control-plane-1.1.4-edge
     linkerd.io/control-plane-ns: linkerd
 spec:
   group: linkerd.io
@@ -1864,7 +1864,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity
@@ -2222,7 +2223,8 @@ spec:
           postStart:
             exec:
               command:
-              - /usr/lib/linkerd/linkerd-await
+                - /usr/lib/linkerd/linkerd-await
+                - --timeout=2m
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/end-entity
           name: linkerd-identity-end-entity