Repository: linkerd/linkerd2
Pull request #5144 (2020-10-27 14:00:34)

charts: Do not store .component in linkerd-config
As `linkerd-config` is used with injections, It could be better to not
store the component value in `linkerd-config` which might cause any
unecessary configuration for application pods.

This is not the case currently, as there is no install specific logic in
patching anymore i.e that uses `.component`

Signed-off-by: Tarun Pothulapati <tarunpothulapati@outlook.com>


adleong: Even better than unsetting the component name when rendering the config would be to only set the component name on the copies used for rendering the proxy partials.  This way the component name never even gets set on the root Values in the first place.

Patch:
diff --git a/CHANGES.md b/CHANGES.md
index d4a0dfe91..72b59228b 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,9 +1,22 @@
 # Changes
 
+## edge-20.10.6
+
+This edge supersedes edge-20.10.5 as a release candidate for stable-2.9.0. It
+adds a new `linkerd.io/inject: ingress` annotation to support service profiles
+and enable per-route metrics and traffic splits for HTTP ingress controllers
+
+* Added a new `linkerd.io/inject: ingress` annotation to configure the
+  proxy to support service profiles and enable per-route metrics and traffic
+  splits for HTTP ingress controllers
+* Reduced performance impact of logging in the proxy, especially when the
+  `debug` or `trace` log levels are disabled
+* Fixed spurious warnings logged by the `linkerd profile` CLI command
+
 ## edge-20.10.5
 
 This edge supersedes edge-20.10.4 as a release candidate for stable-2.9.0. It
-adds a fix for updating the destination service when ther are no endpoints
+adds a fix for updating the destination service when there are no endpoints
 
 * Added a fix to clear the EndpointTranslator state when it gets a
   `NoEndpoints` message. This ensures that the clients get the correct set of
diff --git a/charts/add-ons/grafana/templates/grafana.yaml b/charts/add-ons/grafana/templates/grafana.yaml
index f7b7b773a..e36f4c8bd 100644
--- a/charts/add-ons/grafana/templates/grafana.yaml
+++ b/charts/add-ons/grafana/templates/grafana.yaml
@@ -86,8 +86,9 @@ spec:
     port: 3000
     targetPort: 3000
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-grafana" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-grafana" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -108,7 +109,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: grafana
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -119,7 +120,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: grafana
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8 }}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8 }}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -160,13 +161,13 @@ spec:
         - mountPath: /etc/grafana
           name: grafana-config
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.proxy) }}
       {{- if not (empty .Values.proxy.resources) }}
       {{- $r := merge .Values.proxy.resources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/add-ons/prometheus/templates/prometheus.yaml b/charts/add-ons/prometheus/templates/prometheus.yaml
index f3ea80245..e5b5296e5 100644
--- a/charts/add-ons/prometheus/templates/prometheus.yaml
+++ b/charts/add-ons/prometheus/templates/prometheus.yaml
@@ -186,8 +186,9 @@ spec:
     port: 9090
     targetPort: 9090
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-prometheus" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-prometheus" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -212,7 +213,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: prometheus
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -223,7 +224,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: prometheus
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -278,13 +279,13 @@ spec:
           name: prometheus-config
           subPath: prometheus.yml
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.proxy) }}
       {{- if not (empty .Values.proxy.resources) }}
       {{- $r := merge .Values.proxy.resources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/add-ons/tracing/templates/tracing.yaml b/charts/add-ons/tracing/templates/tracing.yaml
index b38fdaa21..a8b75c487 100644
--- a/charts/add-ons/tracing/templates/tracing.yaml
+++ b/charts/add-ons/tracing/templates/tracing.yaml
@@ -60,9 +60,10 @@ spec:
   selector:
     {{.Values.global.controllerComponentLabel}}: linkerd-collector
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-collector" -}}
-{{ include "linkerd.proxy.validation" .Values.global.proxy -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-collector" -}}
+{{ include "linkerd.proxy.validation" $tree.Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -82,7 +83,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: linkerd-collector
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   minReadySeconds: 5
   progressDeadlineSeconds: 120
   template:
@@ -98,7 +99,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: linkerd-collector
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       containers:
@@ -129,7 +130,7 @@ spec:
         volumeMounts:
         - mountPath: /conf
           name: linkerd-collector-config-val
-      - {{- include "partials.proxy" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
       - {{- include "partials.proxy-init" . | indent 8 | trimPrefix (repeat 7 " ") }}
@@ -174,9 +175,10 @@ spec:
     - name: ui
       port: 16686
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-jaeger" -}}
-{{ include "linkerd.proxy.validation" .Values.global.proxy -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-jaeger" -}}
+{{ include "linkerd.proxy.validation" $tree.Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -196,7 +198,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: linkerd-jaeger
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -210,7 +212,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: linkerd-jaeger
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       containers:
@@ -227,7 +229,7 @@ spec:
         {{- if .Values.jaeger.resources -}}
         {{- include "partials.resources" .Values.jaeger.resources | nindent 8 }}
         {{- end }}
-      - {{- include "partials.proxy" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
       - {{- include "partials.proxy-init" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/README.md b/charts/linkerd2/README.md
index 6044554c7..2e2e8f145 100644
--- a/charts/linkerd2/README.md
+++ b/charts/linkerd2/README.md
@@ -104,6 +104,7 @@ their default values.
 | `global.controllerImageVersion`             | Tag for the controller container docker image                                                                                                                                         | latest version                       |
 | `global.controllerLogLevel`                 | Log level for the control plane components                                                                                                                                            | `info`                               |
 | `global.controllerNamespaceLabel`           | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-ns`        |
+| `global.grafanaUrl`                          | URL of external grafana instance configured with reverse proxy, used by the dashboard                                                                                                                                      |                                 |
 | `global.podLabels`                          | Additional labels to add to all pods                                                                                                                                                  | `{}`                                 |
 | `global.podAnnotations`                     | Additional annotations to add to all pods                                                                                                                                             | `{}`                                 |
 | `global.createdByAnnotation`                | Annotation label for the proxy create. Do not edit.                                                                                                                                   | `linkerd.io/created-by`              |
@@ -113,6 +114,7 @@ their default values.
 | `global.linkerdNamespaceLabel`              | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/is-control-plane` |
 | `global.linkerdVersion`                     | Control plane version                                                                                                                                                                 | latest version                       |
 | `global.namespace`                          | Control plane namespace                                                                                                                                                               | `linkerd`                            |
+| `global.prometheusUrl`     | URL of external prometheus instance to perform queries, used by the `public-api`                                                                                                                    |                               |
 | `global.proxy.enableExternalProfiles`       | Enable service profiles for non-Kubernetes services                                                                                                                                   | `false`                              |
 | `global.proxy.image.name`                   | Docker image for the proxy                                                                                                                                                            | `ghcr.io/linkerd/proxy`            |
 | `global.proxy.image.pullPolicy`             | Pull policy for the proxy container Docker image                                                                                                                                      | `IfNotPresent`                       |
diff --git a/charts/linkerd2/templates/controller.yaml b/charts/linkerd2/templates/controller.yaml
index 83786b16d..072e165b1 100644
--- a/charts/linkerd2/templates/controller.yaml
+++ b/charts/linkerd2/templates/controller.yaml
@@ -22,8 +22,9 @@ spec:
     port: 8085
     targetPort: 8085
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-controller" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-controller" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -44,7 +45,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: controller
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -60,7 +61,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: controller
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -107,11 +108,11 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.publicAPIProxyResources) }}
       {{- $r := merge .Values.publicAPIProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/templates/destination.yaml b/charts/linkerd2/templates/destination.yaml
index c478b3bf5..fba76ce94 100644
--- a/charts/linkerd2/templates/destination.yaml
+++ b/charts/linkerd2/templates/destination.yaml
@@ -41,8 +41,9 @@ spec:
     port: 8086
     targetPort: 8086
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-destination" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-destination" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -63,7 +64,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: destination
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -79,7 +80,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: destination
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -124,11 +125,11 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.destinationProxyResources) }}
       {{- $r := merge .Values.destinationProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+            {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/templates/identity.yaml b/charts/linkerd2/templates/identity.yaml
index 99e325fc1..1fc7b2db9 100644
--- a/charts/linkerd2/templates/identity.yaml
+++ b/charts/linkerd2/templates/identity.yaml
@@ -61,8 +61,9 @@ spec:
     port: 8080
     targetPort: 8080
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-identity" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-identity" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -83,7 +84,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: identity
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -99,7 +100,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: identity
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -147,11 +148,11 @@ spec:
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/issuer
           name: identity-issuer
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.identityProxyResources) }}
       {{- $r := merge .Values.identityProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/templates/proxy-injector.yaml b/charts/linkerd2/templates/proxy-injector.yaml
index b17de25b1..d5b67e759 100644
--- a/charts/linkerd2/templates/proxy-injector.yaml
+++ b/charts/linkerd2/templates/proxy-injector.yaml
@@ -3,8 +3,9 @@
 ### Proxy Injector
 ###
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-proxy-injector" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-proxy-injector" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -42,7 +43,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: proxy-injector
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -86,11 +87,11 @@ spec:
         - mountPath: /var/run/linkerd/tls
           name: tls
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.proxyInjectorProxyResources) }}
       {{- $r := merge .Values.proxyInjectorProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/templates/sp-validator.yaml b/charts/linkerd2/templates/sp-validator.yaml
index 8e65393a1..e3943ce79 100644
--- a/charts/linkerd2/templates/sp-validator.yaml
+++ b/charts/linkerd2/templates/sp-validator.yaml
@@ -22,8 +22,9 @@ spec:
     port: 443
     targetPort: sp-validator
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-sp-validator" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-sp-validator" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -61,7 +62,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: sp-validator
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -103,11 +104,11 @@ spec:
         - mountPath: /var/run/linkerd/tls
           name: tls
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.spValidatorProxyResources) }}
       {{- $r := merge .Values.spValidatorProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/templates/tap.yaml b/charts/linkerd2/templates/tap.yaml
index 4f7fe8a69..7d8f6cc32 100644
--- a/charts/linkerd2/templates/tap.yaml
+++ b/charts/linkerd2/templates/tap.yaml
@@ -25,8 +25,9 @@ spec:
     port: 443
     targetPort: apiserver
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-tap" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-tap" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 kind: Deployment
 apiVersion: apps/v1
@@ -47,7 +48,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: tap
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -66,7 +67,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: tap
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -113,11 +114,11 @@ spec:
         - mountPath: /var/run/linkerd/tls
           name: tls
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.tapProxyResources) }}
       {{- $r := merge .Values.tapProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/templates/web.yaml b/charts/linkerd2/templates/web.yaml
index 6c4c87bba..f8272ef78 100644
--- a/charts/linkerd2/templates/web.yaml
+++ b/charts/linkerd2/templates/web.yaml
@@ -25,8 +25,9 @@ spec:
     port: 9994
     targetPort: 9994
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-web" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-web" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -47,7 +48,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: web
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -58,7 +59,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: web
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -110,11 +111,11 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.webProxyResources) }}
       {{- $r := merge .Values.webProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
       {{- end }}
+      {{- include "partials.setControlPlaneTracing.proxy" $tree }}
       - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index 65fe05a77..7eeb7bb7a 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -41,7 +41,7 @@ global:
 
   # url of existing prometheus
   prometheusUrl: ""
-  # url of external grafana instance.
+  # url of external grafana instance with reverse proxy configured
   grafanaUrl: ""
 
   # Additional annotations to add to all pods
diff --git a/charts/partials/templates/_proxy-init.tpl b/charts/partials/templates/_proxy-init.tpl
index 59508e7cc..c818e713a 100644
--- a/charts/partials/templates/_proxy-init.tpl
+++ b/charts/partials/templates/_proxy-init.tpl
@@ -7,11 +7,8 @@ args:
 - --proxy-uid
 - {{.Values.global.proxy.uid | quote}}
 - --inbound-ports-to-ignore
-- {{.Values.global.proxy.ports.control}},{{.Values.global.proxy.ports.admin}}{{ternary (printf ",%s" .Values.global.proxyInit.ignoreInboundPorts) "" (not (empty .Values.global.proxyInit.ignoreInboundPorts)) }}
-{{- if hasPrefix "linkerd-" .Values.global.proxy.component }}
-- --outbound-ports-to-ignore
-- {{ternary (printf "443,%s" .Values.global.proxyInit.ignoreOutboundPorts) (quote "443") (not (empty .Values.global.proxyInit.ignoreOutboundPorts)) }}
-{{- else if .Values.global.proxyInit.ignoreOutboundPorts }}
+- "{{.Values.global.proxy.ports.control}},{{.Values.global.proxy.ports.admin}}{{ternary (printf ",%s" .Values.global.proxyInit.ignoreInboundPorts) "" (not (empty .Values.global.proxyInit.ignoreInboundPorts)) }}"
+{{- if .Values.global.proxyInit.ignoreOutboundPorts }}
 - --outbound-ports-to-ignore
 - {{.Values.global.proxyInit.ignoreOutboundPorts | quote}}
 {{- end }}
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index 3300b4c64..36dc5c571 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -9,7 +9,7 @@ env:
 - name: LINKERD2_PROXY_LOG_FORMAT
   value: {{.Values.global.proxy.logFormat | quote}}
 - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
-  value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s:8086" .Values.global.namespace .Values.global.clusterDomain) (eq .Values.global.proxy.component "linkerd-destination")}}
+  value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s:8086" .Values.global.namespace .Values.global.clusterDomain) (eq (toString .Values.global.proxy.component) "linkerd-destination")}}
 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
   value: {{.Values.global.clusterNetworks | quote}}
 {{ if .Values.global.proxy.inboundConnectTimeout -}}
@@ -43,7 +43,7 @@ env:
   value: 10000ms
 - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
   value: 10000ms
-{{ if or (.Values.global.proxy.trace.collectorSvcAddr) (.Values.global.controlPlaneTracing) -}}
+{{ if .Values.global.proxy.trace.collectorSvcAddr -}}
 - name: LINKERD2_PROXY_TRACE_ATTRIBUTES_PATH
   value: /var/run/linkerd/podinfo/labels
 {{ end -}}
@@ -74,8 +74,7 @@ env:
 - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE
   value: /var/run/secrets/kubernetes.io/serviceaccount/token
 - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR
-  {{- $identitySvcAddr := printf "linkerd-identity-headless.%s.svc.%s:8080" .Values.global.namespace .Values.global.clusterDomain }}
-  value: {{ternary "localhost.:8080" $identitySvcAddr (eq .Values.global.proxy.component "linkerd-identity")}}
+  value: {{ternary "localhost.:8080" (printf "linkerd-identity-headless.%s.svc.%s:8080" .Values.global.namespace .Values.global.clusterDomain) (eq (toString .Values.global.proxy.component) "linkerd-identity")}}
 - name: _pod_sa
   valueFrom:
     fieldRef:
@@ -98,12 +97,7 @@ env:
 - name: LINKERD2_PROXY_TAP_SVC_NAME
   value: linkerd-tap.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
 {{ end -}}
-{{ if .Values.global.controlPlaneTracing -}}
-- name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_ADDR
-  value: linkerd-collector.{{.Values.global.namespace}}.svc.{{.Values.global.clusterDomain}}:55678
-- name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_NAME
-  value: linkerd-collector.{{.Values.global.namespace}}.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
-{{ else if .Values.global.proxy.trace.collectorSvcAddr -}}
+{{ if .Values.global.proxy.trace.collectorSvcAddr -}}
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_ADDR
   value: {{ .Values.global.proxy.trace.collectorSvcAddr }}
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_NAME
@@ -147,9 +141,9 @@ lifecycle:
         - -c
         - sleep {{.Values.global.proxy.waitBeforeExitSeconds}}
 {{- end }}
-{{- if or (.Values.global.proxy.trace.collectorSvcAddr) (.Values.global.controlPlaneTracing)  (not .Values.global.proxy.disableIdentity) (.Values.global.proxy.saMountPath) }}
+{{- if or (.Values.global.proxy.trace.collectorSvcAddr) (not .Values.global.proxy.disableIdentity) (.Values.global.proxy.saMountPath) }}
 volumeMounts:
-{{- if or (.Values.global.proxy.trace.collectorSvcAddr) (.Values.global.controlPlaneTracing) }}
+{{- if .Values.global.proxy.trace.collectorSvcAddr }}
 - mountPath: var/run/linkerd/podinfo
   name: podinfo
 {{- end -}}
diff --git a/charts/partials/templates/_trace.tpl b/charts/partials/templates/_trace.tpl
index 8e60ff886..8bf6295d7 100644
--- a/charts/partials/templates/_trace.tpl
+++ b/charts/partials/templates/_trace.tpl
@@ -3,3 +3,10 @@
 - -trace-collector=linkerd-collector.{{.Values.global.namespace}}.svc.{{.Values.global.clusterDomain}}:55678
 {{ end -}}
 {{- end }}
+
+{{ define "partials.setControlPlaneTracing.proxy" -}}
+{{ if .Values.global.controlPlaneTracing -}}
+{{ $_ := set .Values.global.proxy.trace "collectorSvcAddr" (printf "linkerd-collector.%s.svc.%s:55678" .Values.global.namespace .Values.global.clusterDomain) -}}
+{{ $_ := set .Values.global.proxy.trace "collectorSvcAccount" (printf "linkerd-collector.%s" .Values.global.namespace) -}}
+{{ end -}}
+{{- end }}
diff --git a/cli/cmd/inject.go b/cli/cmd/inject.go
index 444e96041..4333d990c 100644
--- a/cli/cmd/inject.go
+++ b/cli/cmd/inject.go
@@ -181,6 +181,9 @@ func (rt resourceTransformerInject) transform(bytes []byte) ([]byte, []inject.Re
 	}
 
 	if rt.injectProxy {
+		// delete the inject annotation if present as its not needed in the manual case
+		// prevents injector from taking a different code path in the ignress mode
+		delete(rt.overrideAnnotations, k8s.ProxyInjectAnnotation)
 		conf.AppendPodAnnotation(k8s.CreatedByAnnotation, k8s.CreatedByAnnotationValue())
 	} else {
 		// flag the auto-injector to inject the proxy, regardless of the namespace annotation
@@ -423,6 +426,10 @@ func getOverrideAnnotations(values *charts.Values, base *charts.Values) map[stri
 		overrideAnnotations[k8s.ProxyEnableExternalProfilesAnnotation] = strconv.FormatBool(proxy.EnableExternalProfiles)
 	}
 
+	if proxy.IsIngress != baseProxy.IsIngress {
+		overrideAnnotations[k8s.ProxyInjectAnnotation] = k8s.ProxyInjectIngress
+	}
+
 	if proxy.Resources.CPU.Request != baseProxy.Resources.CPU.Request {
 		overrideAnnotations[k8s.ProxyCPURequestAnnotation] = proxy.Resources.CPU.Request
 	}
diff --git a/cli/cmd/multicluster.go b/cli/cmd/multicluster.go
index d872271f0..6b0958077 100644
--- a/cli/cmd/multicluster.go
+++ b/cli/cmd/multicluster.go
@@ -617,7 +617,14 @@ func newLinkCommand() *cobra.Command {
 
 			gatewayAddresses := []string{}
 			for _, ingress := range gateway.Status.LoadBalancer.Ingress {
-				gatewayAddresses = append(gatewayAddresses, ingress.IP)
+				addr := ingress.IP
+				if addr == "" {
+					addr = ingress.Hostname
+				}
+				if addr == "" {
+					continue
+				}
+				gatewayAddresses = append(gatewayAddresses, addr)
 			}
 			if len(gatewayAddresses) == 0 {
 				return fmt.Errorf("Gateway %s.%s has no ingress addresses", gateway.Name, gateway.Namespace)
diff --git a/cli/cmd/options.go b/cli/cmd/options.go
index 2c545b259..1495c69c0 100644
--- a/cli/cmd/options.go
+++ b/cli/cmd/options.go
@@ -498,6 +498,12 @@ func makeInjectFlags(defaults *l5dcharts.Values) ([]flag.Flag, *pflag.FlagSet) {
 				values.Global.Proxy.RequireIdentityOnInboundPorts = strings.Join(value, ",")
 				return nil
 			}),
+
+		flag.NewBoolFlag(injectFlags, "ingress", defaults.Global.Proxy.IsIngress, "Enable ingress mode in the linkerd proxy",
+			func(values *l5dcharts.Values, value bool) error {
+				values.Global.Proxy.IsIngress = value
+				return nil
+			}),
 	}
 
 	return flags, injectFlags
diff --git a/cli/cmd/profile.go b/cli/cmd/profile.go
index 2e58db4c1..12e3241c8 100644
--- a/cli/cmd/profile.go
+++ b/cli/cmd/profile.go
@@ -120,7 +120,7 @@ func newCmdProfile() *cobra.Command {
 			} else if options.openAPI != "" {
 				return profiles.RenderOpenAPI(options.openAPI, options.namespace, options.name, clusterDomain, os.Stdout)
 			} else if options.tap != "" {
-				return profiles.RenderTapOutputProfile(k8sAPI, options.tap, options.namespace, options.name, clusterDomain, options.tapDuration, int(options.tapRouteLimit), os.Stdout)
+				return profiles.RenderTapOutputProfile(cmd.Context(), k8sAPI, options.tap, options.namespace, options.name, clusterDomain, options.tapDuration, int(options.tapRouteLimit), os.Stdout)
 			} else if options.proto != "" {
 				return profiles.RenderProto(options.proto, options.namespace, options.name, clusterDomain, os.Stdout)
 			}
diff --git a/cli/cmd/tap.go b/cli/cmd/tap.go
index fc28b8ea7..0195a03c1 100644
--- a/cli/cmd/tap.go
+++ b/cli/cmd/tap.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"bufio"
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -199,7 +200,7 @@ func newCmdTap() *cobra.Command {
 				return err
 			}
 
-			return requestTapByResourceFromAPI(os.Stdout, k8sAPI, req, options)
+			return requestTapByResourceFromAPI(cmd.Context(), os.Stdout, k8sAPI, req, options)
 		},
 	}
 
@@ -227,8 +228,8 @@ func newCmdTap() *cobra.Command {
 	return cmd
 }
 
-func requestTapByResourceFromAPI(w io.Writer, k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest, options *tapOptions) error {
-	reader, body, err := tap.Reader(k8sAPI, req, 0)
+func requestTapByResourceFromAPI(ctx context.Context, w io.Writer, k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest, options *tapOptions) error {
+	reader, body, err := tap.Reader(ctx, k8sAPI, req)
 	if err != nil {
 		return err
 	}
diff --git a/cli/cmd/top.go b/cli/cmd/top.go
index 2378caec5..d80e1d906 100644
--- a/cli/cmd/top.go
+++ b/cli/cmd/top.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"bufio"
+	"context"
 	"fmt"
 	"io"
 	"sort"
@@ -355,7 +356,7 @@ func newCmdTop() *cobra.Command {
 				return err
 			}
 
-			return getTrafficByResourceFromAPI(k8sAPI, req, table)
+			return getTrafficByResourceFromAPI(cmd.Context(), k8sAPI, req, table)
 		},
 	}
 
@@ -382,8 +383,8 @@ func newCmdTop() *cobra.Command {
 	return cmd
 }
 
-func getTrafficByResourceFromAPI(k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest, table *topTable) error {
-	reader, body, err := tap.Reader(k8sAPI, req, 0)
+func getTrafficByResourceFromAPI(ctx context.Context, k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest, table *topTable) error {
+	reader, body, err := tap.Reader(ctx, k8sAPI, req)
 	if err != nil {
 		return err
 	}
@@ -434,7 +435,7 @@ func recvEvents(tapByteStream *bufio.Reader, eventCh chan<- *pb.TapEvent, closin
 		if err != nil {
 			if err == io.EOF {
 				fmt.Println("Tap stream terminated")
-			} else if !strings.HasSuffix(err.Error(), "http2: response body closed") {
+			} else if !strings.HasSuffix(err.Error(), tap.ErrClosedResponseBody) {
 				fmt.Println(err.Error())
 			}
 
diff --git a/controller/api/public/grpc_server.go b/controller/api/public/grpc_server.go
index 8a810fad1..de1ae4ec9 100644
--- a/controller/api/public/grpc_server.go
+++ b/controller/api/public/grpc_server.go
@@ -117,9 +117,10 @@ func (s *grpcServer) ListPods(ctx context.Context, req *pb.ListPodsRequest) (*pb
 
 	// Query Prometheus for all pods present
 	vec, err := s.queryProm(ctx, processStartTimeQuery)
-	if err != nil {
+	if err != nil && !errors.Is(err, ErrNoPrometheusInstance) {
 		return nil, err
 	}
+
 	for _, sample := range vec {
 		pod := string(sample.Metric["pod"])
 		timestamp := sample.Timestamp
diff --git a/controller/api/public/prometheus.go b/controller/api/public/prometheus.go
index dffc55a9b..5133d2bcd 100644
--- a/controller/api/public/prometheus.go
+++ b/controller/api/public/prometheus.go
@@ -42,6 +42,11 @@ const (
 	remoteClusterNameLabel = model.LabelName("target_cluster_name")
 )
 
+var (
+	// ErrNoPrometheusInstance is returned when there is no prometheus instance configured
+	ErrNoPrometheusInstance = errors.New("No prometheus instance to connect")
+)
+
 func extractSampleValue(sample *model.Sample) uint64 {
 	value := uint64(0)
 	if !math.IsNaN(float64(sample.Value)) {
@@ -58,7 +63,7 @@ func (s *grpcServer) queryProm(ctx context.Context, query string) (model.Vector,
 	span.AddAttributes(trace.StringAttribute("queryString", query))
 
 	if s.prometheusAPI == nil {
-		return nil, errors.New("No prometheus instance to connect")
+		return nil, ErrNoPrometheusInstance
 	}
 
 	// single data point (aka summary) query
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index b8569f594..34e3992e9 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -113,7 +113,6 @@ type (
 	// Proxy contains the fields to set the proxy sidecar container
 	Proxy struct {
 		Capabilities                  *Capabilities    `json:"capabilities"`
-		Component                     string           `json:"component"`
 		DisableIdentity               bool             `json:"disableIdentity"`
 		DisableTap                    bool             `json:"disableTap"`
 		EnableExternalProfiles        bool             `json:"enableExternalProfiles"`
diff --git a/pkg/healthcheck/healthcheck.go b/pkg/healthcheck/healthcheck.go
index 32de70493..5267d38b9 100644
--- a/pkg/healthcheck/healthcheck.go
+++ b/pkg/healthcheck/healthcheck.go
@@ -1051,6 +1051,22 @@ func (hc *HealthChecker) allCategories() []category {
 						return hc.checkCertAndAnchors(cert, anchors, identityName)
 					},
 				},
+				{
+					description: "tap API server cert is valid for at least 60 days",
+					warning:     true,
+					hintAnchor:  "l5d-webhook-cert-not-expiring-soon",
+					check: func(ctx context.Context) error {
+						cert, err := hc.fetchCredsFromSecret(ctx, tapTLSSecretName)
+						if kerrors.IsNotFound(err) {
+							cert, err = hc.fetchCredsFromOldSecret(ctx, tapOldTLSSecretName)
+						}
+						if err != nil {
+							return err
+						}
+						return hc.checkCertAndAnchorsExpiringSoon(cert)
+
+					},
+				},
 				{
 					description: "proxy-injector webhook has valid cert",
 					hintAnchor:  "l5d-proxy-injector-webhook-cert-valid",
@@ -1072,6 +1088,22 @@ func (hc *HealthChecker) allCategories() []category {
 						return hc.checkCertAndAnchors(cert, anchors, identityName)
 					},
 				},
+				{
+					description: "proxy-injector cert is valid for at least 60 days",
+					warning:     true,
+					hintAnchor:  "l5d-webhook-cert-not-expiring-soon",
+					check: func(ctx context.Context) error {
+						cert, err := hc.fetchCredsFromSecret(ctx, proxyInjectorTLSSecretName)
+						if kerrors.IsNotFound(err) {
+							cert, err = hc.fetchCredsFromOldSecret(ctx, proxyInjectorOldTLSSecretName)
+						}
+						if err != nil {
+							return err
+						}
+						return hc.checkCertAndAnchorsExpiringSoon(cert)
+
+					},
+				},
 				{
 					description: "sp-validator webhook has valid cert",
 					hintAnchor:  "l5d-sp-validator-webhook-cert-valid",
@@ -1092,6 +1124,22 @@ func (hc *HealthChecker) allCategories() []category {
 						return hc.checkCertAndAnchors(cert, anchors, identityName)
 					},
 				},
+				{
+					description: "sp-validator cert is valid for at least 60 days",
+					warning:     true,
+					hintAnchor:  "l5d-webhook-cert-not-expiring-soon",
+					check: func(ctx context.Context) error {
+						cert, err := hc.fetchCredsFromSecret(ctx, spValidatorTLSSecretName)
+						if kerrors.IsNotFound(err) {
+							cert, err = hc.fetchCredsFromOldSecret(ctx, spValidatorOldTLSSecretName)
+						}
+						if err != nil {
+							return err
+						}
+						return hc.checkCertAndAnchorsExpiringSoon(cert)
+
+					},
+				},
 			},
 		},
 		{
@@ -1241,6 +1289,16 @@ func (hc *HealthChecker) allCategories() []category {
 							return err
 						}
 
+						// Check if prometheus configured
+						prometheusValues := make(map[string]interface{})
+						err = yaml.Unmarshal(hc.linkerdConfig.Prometheus.Values(), &prometheusValues)
+						if err != nil {
+							return err
+						}
+						if !GetBool(prometheusValues, "enabled") && hc.linkerdConfig.Global.PrometheusURL == "" {
+							return &SkipError{Reason: "no prometheus instance to connect"}
+						}
+
 						return validateDataPlanePodReporting(pods)
 					},
 				},
@@ -1336,9 +1394,22 @@ func (hc *HealthChecker) checkCertAndAnchors(cert *tls.Cred, trustAnchors []*x50
 		return fmt.Errorf("Anchors not within their validity period:\n\t%s", strings.Join(expiredAnchors, "\n\t"))
 	}
 
+	// check cert validity
+	if err := issuercerts.CheckCertValidityPeriod(cert.Certificate); err != nil {
+		return fmt.Errorf("certificate is %s", err)
+	}
+
+	if err := cert.Verify(tls.CertificatesToPool(trustAnchors), identityName, time.Time{}); err != nil {
+		return fmt.Errorf("cert is not issued by the trust anchor: %s", err)
+	}
+
+	return nil
+}
+
+func (hc *HealthChecker) checkCertAndAnchorsExpiringSoon(cert *tls.Cred) error {
 	// check anchors not expiring soon
 	var expiringAnchors []string
-	for _, anchor := range trustAnchors {
+	for _, anchor := range cert.TrustChain {
 		anchor := anchor
 		if err := issuercerts.CheckExpiringSoon(anchor); err != nil {
 			expiringAnchors = append(expiringAnchors, fmt.Sprintf("* %v %s %s", anchor.SerialNumber, anchor.Subject.CommonName, err))
@@ -1348,20 +1419,10 @@ func (hc *HealthChecker) checkCertAndAnchors(cert *tls.Cred, trustAnchors []*x50
 		return fmt.Errorf("Anchors expiring soon:\n\t%s", strings.Join(expiringAnchors, "\n\t"))
 	}
 
-	// check cert validity
-	if err := issuercerts.CheckCertValidityPeriod(cert.Certificate); err != nil {
-		return fmt.Errorf("certificate is %s", err)
-	}
-
 	// check cert not expiring soon
 	if err := issuercerts.CheckExpiringSoon(cert.Certificate); err != nil {
 		return fmt.Errorf("certificate %s", err)
 	}
-
-	if err := cert.Verify(tls.CertificatesToPool(trustAnchors), identityName, time.Time{}); err != nil {
-		return fmt.Errorf("cert is not issued by the trust anchor: %s", err)
-	}
-
 	return nil
 }
 
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index bca97051e..62357d6ea 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -516,7 +516,6 @@ func (conf *ResourceConfig) complete(template *corev1.PodTemplateSpec) {
 
 // injectPodSpec adds linkerd sidecars to the provided PodSpec.
 func (conf *ResourceConfig) injectPodSpec(values *patch) {
-	values.Global.Proxy.Component = conf.pod.labels[k8s.ProxyDeploymentLabel]
 	saVolumeMount := conf.serviceAccountVolumeMount()
 
 	// use the primary container's capabilities to ensure psp compliance, if
diff --git a/pkg/profiles/tap.go b/pkg/profiles/tap.go
index bddf60c6f..30526fc6f 100644
--- a/pkg/profiles/tap.go
+++ b/pkg/profiles/tap.go
@@ -2,8 +2,11 @@ package profiles
 
 import (
 	"bufio"
+	"context"
+	"errors"
 	"fmt"
 	"io"
+	"net"
 	"os"
 	"sort"
 	"strings"
@@ -23,7 +26,7 @@ import (
 // RenderTapOutputProfile performs a tap on the desired resource and generates
 // a service profile with routes pre-populated from the tap data
 // Only inbound tap traffic is considered.
-func RenderTapOutputProfile(k8sAPI *k8s.KubernetesAPI, tapResource, namespace, name, clusterDomain string, tapDuration time.Duration, routeLimit int, w io.Writer) error {
+func RenderTapOutputProfile(ctx context.Context, k8sAPI *k8s.KubernetesAPI, tapResource, namespace, name, clusterDomain string, tapDuration time.Duration, routeLimit int, w io.Writer) error {
 	requestParams := util.TapRequestParams{
 		Resource:  tapResource,
 		Namespace: namespace,
@@ -35,7 +38,7 @@ func RenderTapOutputProfile(k8sAPI *k8s.KubernetesAPI, tapResource, namespace, n
 		return err
 	}
 
-	profile, err := tapToServiceProfile(k8sAPI, req, namespace, name, clusterDomain, tapDuration, routeLimit)
+	profile, err := tapToServiceProfile(ctx, k8sAPI, req, namespace, name, clusterDomain, tapDuration, routeLimit)
 	if err != nil {
 		return err
 	}
@@ -48,7 +51,7 @@ func RenderTapOutputProfile(k8sAPI *k8s.KubernetesAPI, tapResource, namespace, n
 	return nil
 }
 
-func tapToServiceProfile(k8sAPI *k8s.KubernetesAPI, tapReq *pb.TapByResourceRequest, namespace, name, clusterDomain string, tapDuration time.Duration, routeLimit int) (sp.ServiceProfile, error) {
+func tapToServiceProfile(ctx context.Context, k8sAPI *k8s.KubernetesAPI, tapReq *pb.TapByResourceRequest, namespace, name, clusterDomain string, tapDuration time.Duration, routeLimit int) (sp.ServiceProfile, error) {
 	profile := sp.ServiceProfile{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      fmt.Sprintf("%s.%s.svc.%s", name, namespace, clusterDomain),
@@ -57,7 +60,9 @@ func tapToServiceProfile(k8sAPI *k8s.KubernetesAPI, tapReq *pb.TapByResourceRequ
 		TypeMeta: serviceProfileMeta,
 	}
 
-	reader, body, err := tap.Reader(k8sAPI, tapReq, tapDuration)
+	ctxWithTime, cancel := context.WithTimeout(ctx, tapDuration)
+	defer cancel()
+	reader, body, err := tap.Reader(ctxWithTime, k8sAPI, tapReq)
 	if err != nil {
 		return profile, err
 	}
@@ -80,9 +85,11 @@ func routeSpecFromTap(tapByteStream *bufio.Reader, routeLimit int) []*sp.RouteSp
 		err := protohttp.FromByteStreamToProtocolBuffers(tapByteStream, &event)
 		if err != nil {
 			// expected errors when hitting the tapDuration deadline
+			var e net.Error
 			if err != io.EOF &&
-				!strings.HasSuffix(err.Error(), "(Client.Timeout exceeded while reading body)") &&
-				!strings.HasSuffix(err.Error(), "http2: response body closed") {
+				!(errors.As(err, &e) && e.Timeout()) &&
+				!errors.Is(err, context.DeadlineExceeded) &&
+				!strings.HasSuffix(err.Error(), tap.ErrClosedResponseBody) {
 				fmt.Fprintln(os.Stderr, err)
 			}
 			break
diff --git a/pkg/protohttp/protohttp.go b/pkg/protohttp/protohttp.go
index 917e1455a..6ff0b6376 100644
--- a/pkg/protohttp/protohttp.go
+++ b/pkg/protohttp/protohttp.go
@@ -131,14 +131,14 @@ func deserializePayloadFromReader(reader *bufio.Reader) ([]byte, error) {
 	messageLengthAsBytes := make([]byte, numBytesForMessageLength)
 	_, err := io.ReadFull(reader, messageLengthAsBytes)
 	if err != nil {
-		return nil, fmt.Errorf("error while reading message length: %v", err)
+		return nil, fmt.Errorf("error while reading message length: %w", err)
 	}
 	messageLength := int(binary.LittleEndian.Uint32(messageLengthAsBytes))
 
 	messageContentsAsBytes := make([]byte, messageLength)
 	_, err = io.ReadFull(reader, messageContentsAsBytes)
 	if err != nil {
-		return nil, fmt.Errorf("error while reading bytes from message: %v", err)
+		return nil, fmt.Errorf("error while reading bytes from message: %w", err)
 	}
 
 	return messageContentsAsBytes, nil
@@ -190,12 +190,12 @@ func CheckIfResponseHasError(rsp *http.Response) error {
 func FromByteStreamToProtocolBuffers(byteStreamContainingMessage *bufio.Reader, out proto.Message) error {
 	messageAsBytes, err := deserializePayloadFromReader(byteStreamContainingMessage)
 	if err != nil {
-		return fmt.Errorf("error reading byte stream header: %v", err)
+		return fmt.Errorf("error reading byte stream header: %w", err)
 	}
 
 	err = proto.Unmarshal(messageAsBytes, out)
 	if err != nil {
-		return fmt.Errorf("error unmarshalling array of [%d] bytes error: %v", len(messageAsBytes), err)
+		return fmt.Errorf("error unmarshalling array of [%d] bytes error: %w", len(messageAsBytes), err)
 	}
 
 	return nil
diff --git a/pkg/tap/tap.go b/pkg/tap/tap.go
index 80d6b903b..5c8e57fb8 100644
--- a/pkg/tap/tap.go
+++ b/pkg/tap/tap.go
@@ -3,11 +3,11 @@ package tap
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
-	"time"
 
 	"github.com/golang/protobuf/proto"
 	pb "github.com/linkerd/linkerd2/controller/gen/public"
@@ -16,18 +16,22 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+const (
+	// ErrClosedResponseBody is returned when response body is closed in http2
+	ErrClosedResponseBody = "http2: response body closed"
+)
+
 // TapRbacURL is the link users should visit to remedy issues when attempting
 // to tap resources with missing authorizations
 const TapRbacURL = "https://linkerd.io/tap-rbac"
 
 // Reader initiates a TapByResourceRequest and returns a buffered Reader.
 // It is the caller's responsibility to call Close() on the io.ReadCloser.
-func Reader(k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest, timeout time.Duration) (*bufio.Reader, io.ReadCloser, error) {
+func Reader(ctx context.Context, k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest) (*bufio.Reader, io.ReadCloser, error) {
 	client, err := k8sAPI.NewClient()
 	if err != nil {
 		return nil, nil, err
 	}
-	client.Timeout = timeout
 
 	reqBytes, err := proto.Marshal(req)
 	if err != nil {
@@ -49,7 +53,7 @@ func Reader(k8sAPI *k8s.KubernetesAPI, req *pb.TapByResourceRequest, timeout tim
 		return nil, nil, err
 	}
 
-	httpRsp, err := client.Do(httpReq)
+	httpRsp, err := client.Do(httpReq.WithContext(ctx))
 	if err != nil {
 		log.Debugf("Error invoking [%s]: %v", url, err)
 		return nil, nil, err
diff --git a/web/srv/api_handlers.go b/web/srv/api_handlers.go
index 53d1d002d..13be10b44 100644
--- a/web/srv/api_handlers.go
+++ b/web/srv/api_handlers.go
@@ -269,7 +269,7 @@ func (h *handler) handleAPITap(w http.ResponseWriter, req *http.Request, p httpr
 	}
 
 	go func() {
-		reader, body, err := tap.Reader(h.k8sAPI, tapReq, 0)
+		reader, body, err := tap.Reader(req.Context(), h.k8sAPI, tapReq)
 		if err != nil {
 			// If there was a [403] error when initiating a tap, close the
 			// socket with `ClosePolicyViolation` status code so that the error


Test patch:
diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
index 81413585f..3ce799ea2 100644
--- a/cli/cmd/install_test.go
+++ b/cli/cmd/install_test.go
@@ -95,6 +95,7 @@ func TestRender(t *testing.T) {
 					PullPolicy: "ImagePullPolicy",
 					Version:    "ProxyInitVersion",
 				},
+				IgnoreOutboundPorts: "443",
 				Resources: &charts.Resources{
 					CPU: charts.Constraints{
 						Limit:   "100m",
diff --git a/cli/cmd/tap_test.go b/cli/cmd/tap_test.go
index fbc0fc6fe..ada59bb7b 100644
--- a/cli/cmd/tap_test.go
+++ b/cli/cmd/tap_test.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"bytes"
+	"context"
 	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
@@ -131,7 +132,7 @@ func busyTest(t *testing.T, output string) {
 	options.output = output
 
 	writer := bytes.NewBufferString("")
-	err = requestTapByResourceFromAPI(writer, kubeAPI, req, options)
+	err = requestTapByResourceFromAPI(context.Background(), writer, kubeAPI, req, options)
 	if err != nil {
 		t.Fatalf("Unexpected error: %v", err)
 	}
@@ -158,6 +159,8 @@ func busyTest(t *testing.T, output string) {
 }
 
 func TestRequestTapByResourceFromAPI(t *testing.T) {
+
+	ctx := context.Background()
 	t.Run("Should render busy response if everything went well", func(t *testing.T) {
 		busyTest(t, "")
 	})
@@ -197,7 +200,7 @@ func TestRequestTapByResourceFromAPI(t *testing.T) {
 
 		options := newTapOptions()
 		writer := bytes.NewBufferString("")
-		err = requestTapByResourceFromAPI(writer, kubeAPI, req, options)
+		err = requestTapByResourceFromAPI(ctx, writer, kubeAPI, req, options)
 		if err != nil {
 			t.Fatalf("Unexpected error: %v", err)
 		}
@@ -236,7 +239,7 @@ func TestRequestTapByResourceFromAPI(t *testing.T) {
 
 		options := newTapOptions()
 		writer := bytes.NewBufferString("")
-		err = requestTapByResourceFromAPI(writer, kubeAPI, req, options)
+		err = requestTapByResourceFromAPI(ctx, writer, kubeAPI, req, options)
 		if err == nil {
 			t.Fatalf("Expecting error, got nothing but output [%s]", writer.String())
 		}
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index ba5431a1b..b66a2cae6 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -200,7 +200,7 @@ spec:
         - --inbound-ports-to-ignore
         - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_addon.golden b/cli/cmd/testdata/install_addon.golden
index 6dfaa3a8c..f6d98698b 100644
--- a/cli/cmd/testdata/install_addon.golden
+++ b/cli/cmd/testdata/install_addon.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1226,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1459,9 +1457,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1710,9 +1708,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1990,9 +1988,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2201,9 +2199,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2454,9 +2452,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2694,9 +2692,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3004,9 +3002,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3439,9 +3437,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3738,9 +3736,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3959,9 +3957,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index bbe5e4c01..b6b479cc8 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1229,9 +1227,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1477,9 +1475,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1743,9 +1741,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2037,9 +2035,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2262,9 +2260,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2529,9 +2527,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2784,9 +2782,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3108,9 +3106,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3557,9 +3555,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index fc9fce581..397ae9c4f 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index c06dfe45a..af26c6236 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 9c7f5f43e..73954259b 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_grafana_existing.golden b/cli/cmd/testdata/install_grafana_existing.golden
index 2bdfeef9d..17dca2e71 100644
--- a/cli/cmd/testdata/install_grafana_existing.golden
+++ b/cli/cmd/testdata/install_grafana_existing.golden
@@ -849,7 +849,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -883,7 +882,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1217,9 +1215,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1450,9 +1448,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1701,9 +1699,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1980,9 +1978,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2191,9 +2189,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2444,9 +2442,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2684,9 +2682,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3111,9 +3109,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index cfce0ac49..a0db0183b 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1318,9 +1316,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1587,9 +1585,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1874,9 +1872,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2173,9 +2171,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2420,9 +2418,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2709,9 +2707,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2985,9 +2983,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3308,9 +3306,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3756,9 +3754,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 6b0f7f453..b4244dcdc 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1318,9 +1316,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1587,9 +1585,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1874,9 +1872,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2173,9 +2171,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2420,9 +2418,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2709,9 +2707,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2985,9 +2983,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3308,9 +3306,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3756,9 +3754,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 99a0a656f..60b8a7af1 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -808,7 +808,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -842,7 +841,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1176,9 +1174,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1409,9 +1407,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1660,9 +1658,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1894,9 +1892,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2105,9 +2103,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2358,9 +2356,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2598,9 +2596,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2908,9 +2906,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3343,9 +3341,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index 7a189d137..f8a90da26 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -866,7 +866,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -900,7 +899,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -954,7 +952,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -988,7 +985,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1043,7 +1039,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1077,7 +1072,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1163,7 +1157,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1197,7 +1190,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1255,7 +1247,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1289,7 +1280,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1571,9 +1561,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1795,9 +1785,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2037,9 +2027,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2309,9 +2299,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2512,9 +2502,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2757,9 +2747,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2989,9 +2979,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3292,9 +3282,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3720,9 +3710,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_addons.golden b/cli/cmd/testdata/install_helm_output_addons.golden
index 2969b8182..29cd41b19 100644
--- a/cli/cmd/testdata/install_helm_output_addons.golden
+++ b/cli/cmd/testdata/install_helm_output_addons.golden
@@ -872,7 +872,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -906,7 +905,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -960,7 +958,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -994,7 +991,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1049,7 +1045,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1083,7 +1078,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1169,7 +1163,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1203,7 +1196,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1261,7 +1253,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1295,7 +1286,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1375,7 +1365,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1409,7 +1398,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1464,7 +1452,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1498,7 +1485,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1754,9 +1740,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1978,9 +1964,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2220,9 +2206,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2493,9 +2479,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2696,9 +2682,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2941,9 +2927,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3173,9 +3159,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3476,9 +3462,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3904,9 +3890,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4196,9 +4182,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4406,9 +4392,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index cbf7d8dae..a2171df0a 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -872,7 +872,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -906,7 +905,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -959,7 +957,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -993,7 +990,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1047,7 +1043,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1081,7 +1076,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1185,7 +1179,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1219,7 +1212,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1276,7 +1268,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1310,7 +1301,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1665,9 +1655,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1925,9 +1915,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2203,9 +2193,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2495,9 +2485,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2734,9 +2724,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3015,9 +3005,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3283,9 +3273,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3599,9 +3589,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4040,9 +4030,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 2b4ffdc81..1d052a7a5 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -876,7 +876,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -910,7 +909,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -967,7 +965,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1001,7 +998,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1059,7 +1055,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1093,7 +1088,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1201,7 +1195,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1235,7 +1228,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1296,7 +1288,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1330,7 +1321,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1689,9 +1679,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1953,9 +1943,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2235,9 +2225,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2535,9 +2525,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2778,9 +2768,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3063,9 +3053,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3335,9 +3325,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3655,9 +3645,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4100,9 +4090,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 97ff6b828..de12859fd 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -872,7 +872,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -906,7 +905,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -959,7 +957,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -993,7 +990,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1047,7 +1043,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1081,7 +1076,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1185,7 +1179,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1219,7 +1212,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1276,7 +1268,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1310,7 +1301,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1665,9 +1655,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1925,9 +1915,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2203,9 +2193,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2495,9 +2485,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2734,9 +2724,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3015,9 +3005,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3283,9 +3273,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3599,9 +3589,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4040,9 +4030,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 2d9059d44..4a9eb230d 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -849,7 +849,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -883,7 +882,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 2fdb1b912..57b800e51 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,13 +885,12 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: ProxyContainerName
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
         ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreOutboundPorts: "443"
         image:
           name: ProxyInitImageName
           pullPolicy: ImagePullPolicy
@@ -1223,7 +1221,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -1458,7 +1456,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -1711,7 +1709,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -1992,7 +1990,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -2205,7 +2203,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -2460,7 +2458,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -2702,7 +2700,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -3014,7 +3012,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -3451,7 +3449,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -3493,7 +3491,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICBuYW1lOiBEZWJ1Z0ltYWdlTmFtZQogICAgcHVsbFBvbGljeTogRGVidWdJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IERlYnVnVmVyc2lvbgpnbG9iYWw6CiAgY2xpVmVyc2lvbjogQ2xpVmVyc2lvbgogIGNsdXN0ZXJOZXR3b3JrczogQ2x1c3Rlck5ldHdvcmtzCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICBuYW1lOiBEZWJ1Z0ltYWdlTmFtZQogICAgcHVsbFBvbGljeTogRGVidWdJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IERlYnVnVmVyc2lvbgpnbG9iYWw6CiAgY2xpVmVyc2lvbjogQ2xpVmVyc2lvbgogIGNsdXN0ZXJOZXR3b3JrczogQ2x1c3Rlck5ldHdvcmtzCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiNDQzIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_prometheus_overwrite.golden b/cli/cmd/testdata/install_prometheus_overwrite.golden
index 8db0e0740..6d64b22f5 100644
--- a/cli/cmd/testdata/install_prometheus_overwrite.golden
+++ b/cli/cmd/testdata/install_prometheus_overwrite.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1277,9 +1275,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1510,9 +1508,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1761,9 +1759,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2040,9 +2038,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2251,9 +2249,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2504,9 +2502,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2744,9 +2742,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3054,9 +3052,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3542,9 +3540,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index f63988141..0d8cd53d4 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_restricted_dashboard.golden b/cli/cmd/testdata/install_restricted_dashboard.golden
index 8a5ee9e91..075e58f7c 100644
--- a/cli/cmd/testdata/install_restricted_dashboard.golden
+++ b/cli/cmd/testdata/install_restricted_dashboard.golden
@@ -784,7 +784,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -818,7 +817,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1152,9 +1150,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1385,9 +1383,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1636,9 +1634,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1915,9 +1913,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2126,9 +2124,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2379,9 +2377,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2619,9 +2617,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2929,9 +2927,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3364,9 +3362,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_tracing.golden b/cli/cmd/testdata/install_tracing.golden
index 6dfaa3a8c..f6d98698b 100644
--- a/cli/cmd/testdata/install_tracing.golden
+++ b/cli/cmd/testdata/install_tracing.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1226,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1459,9 +1457,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1710,9 +1708,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1990,9 +1988,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2201,9 +2199,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2454,9 +2452,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2694,9 +2692,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3004,9 +3002,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3439,9 +3437,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3738,9 +3736,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3959,9 +3957,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_tracing_overwrite.golden b/cli/cmd/testdata/install_tracing_overwrite.golden
index e25aa5392..87e5f9778 100644
--- a/cli/cmd/testdata/install_tracing_overwrite.golden
+++ b/cli/cmd/testdata/install_tracing_overwrite.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1228,9 +1226,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1459,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1712,9 +1710,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1992,9 +1990,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2203,9 +2201,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2456,9 +2454,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2696,9 +2694,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3006,9 +3004,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3441,9 +3439,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3740,9 +3738,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3961,9 +3959,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 59e068c4e..e4d103ea7 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2698,7 +2698,6 @@ data:
 					CNIEnabled:               false,
 					IdentityTrustDomain:      defaultValues.Global.IdentityTrustDomain,
 					Proxy: &linkerd2.Proxy{
-						Component: "linkerd-controller",
 						Image: &linkerd2.Image{
 							Name:       "ProxyImageName",
 							PullPolicy: "ImagePullPolicy",
diff --git a/pkg/profiles/tap_test.go b/pkg/profiles/tap_test.go
index 742f91664..4bb286ff0 100644
--- a/pkg/profiles/tap_test.go
+++ b/pkg/profiles/tap_test.go
@@ -1,6 +1,7 @@
 package profiles
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -119,7 +120,7 @@ func TestTapToServiceProfile(t *testing.T) {
 		},
 	}
 
-	actualServiceProfile, err := tapToServiceProfile(kubeAPI, tapReq, namespace, name, clusterDomain, tapDuration, routeLimit)
+	actualServiceProfile, err := tapToServiceProfile(context.Background(), kubeAPI, tapReq, namespace, name, clusterDomain, tapDuration, routeLimit)
 	if err != nil {
 		t.Fatalf("Failed to create ServiceProfile: %v", err)
 	}
diff --git a/test/integration/testdata/check.cni.golden b/test/integration/testdata/check.cni.golden
index 2144cdcd8..9a2e25a09 100644
--- a/test/integration/testdata/check.cni.golden
+++ b/test/integration/testdata/check.cni.golden
@@ -55,8 +55,11 @@ linkerd-identity
 linkerd-webhooks-and-apisvc-tls
 -------------------------------
 √ tap API server has valid cert
+√ tap API server cert is valid for at least 60 days
 √ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
 √ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
 
 linkerd-api
 -----------
diff --git a/test/integration/testdata/check.cni.proxy.golden b/test/integration/testdata/check.cni.proxy.golden
index 0a08a8121..7edfbe683 100644
--- a/test/integration/testdata/check.cni.proxy.golden
+++ b/test/integration/testdata/check.cni.proxy.golden
@@ -55,8 +55,11 @@ linkerd-identity
 linkerd-webhooks-and-apisvc-tls
 -------------------------------
 √ tap API server has valid cert
+√ tap API server cert is valid for at least 60 days
 √ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
 √ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
 
 linkerd-identity-data-plane
 ---------------------------
diff --git a/test/integration/testdata/check.golden b/test/integration/testdata/check.golden
index 7f3dd2bf4..1615f007e 100644
--- a/test/integration/testdata/check.golden
+++ b/test/integration/testdata/check.golden
@@ -43,8 +43,11 @@ linkerd-identity
 linkerd-webhooks-and-apisvc-tls
 -------------------------------
 √ tap API server has valid cert
+√ tap API server cert is valid for at least 60 days
 √ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
 √ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
 
 linkerd-api
 -----------
diff --git a/test/integration/testdata/check.multicluster.golden b/test/integration/testdata/check.multicluster.golden
index 150d673d7..bfe56bb18 100644
--- a/test/integration/testdata/check.multicluster.golden
+++ b/test/integration/testdata/check.multicluster.golden
@@ -43,8 +43,11 @@ linkerd-identity
 linkerd-webhooks-and-apisvc-tls
 -------------------------------
 √ tap API server has valid cert
+√ tap API server cert is valid for at least 60 days
 √ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
 √ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
 
 linkerd-api
 -----------
diff --git a/test/integration/testdata/check.multicluster.proxy.golden b/test/integration/testdata/check.multicluster.proxy.golden
index ce1fc992c..2a9c529ed 100644
--- a/test/integration/testdata/check.multicluster.proxy.golden
+++ b/test/integration/testdata/check.multicluster.proxy.golden
@@ -43,8 +43,11 @@ linkerd-identity
 linkerd-webhooks-and-apisvc-tls
 -------------------------------
 √ tap API server has valid cert
+√ tap API server cert is valid for at least 60 days
 √ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
 √ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
 
 linkerd-identity-data-plane
 ---------------------------
diff --git a/test/integration/testdata/check.proxy.golden b/test/integration/testdata/check.proxy.golden
index bb4af1e81..62ca666df 100644
--- a/test/integration/testdata/check.proxy.golden
+++ b/test/integration/testdata/check.proxy.golden
@@ -43,8 +43,11 @@ linkerd-identity
 linkerd-webhooks-and-apisvc-tls
 -------------------------------
 √ tap API server has valid cert
+√ tap API server cert is valid for at least 60 days
 √ proxy-injector webhook has valid cert
+√ proxy-injector cert is valid for at least 60 days
 √ sp-validator webhook has valid cert
+√ sp-validator cert is valid for at least 60 days
 
 linkerd-identity-data-plane
 ---------------------------