Repository: linkerd/linkerd2
Pull request #4614 (2020-06-16 22:09:59)

Update proxy-api dependencies
proxy-api v0.1.13  updates the `grcp-go` dependency.

While upgrading we encountered two issues (some via linters):

1. We're not supposed to use `DeepEqual` with `error` values
2. We can no longer copy gRPC data structures, since they now manage some internal state.


Patch:
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 9123b713e..a62313c7e 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -5,7 +5,7 @@ set the title and description of this PR to the git commit message subject and
 body, respectively. If so, you may delete these instructions and submit your PR.
 
 If this is your first time, please read our contributor guide:
-https://github.com/linkerd/linkerd2/blob/master/CONTRIBUTING.md
+https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md
 
 The title and description of your Pull Request should match the git commit
 subject and body, respectively. Git commit messages are structured as follows:
@@ -47,5 +47,5 @@ Note the git commit message subject becomes the pull request title.
 
 For more details around git commits, see the section on Committing in our
 contributor guide:
-https://github.com/linkerd/linkerd2/blob/master/CONTRIBUTING.md#committing
+https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
 -->
diff --git a/.github/workflows/cloud_integration.yml b/.github/workflows/cloud_integration.yml
index a9aae072d..4a30e7f41 100644
--- a/.github/workflows/cloud_integration.yml
+++ b/.github/workflows/cloud_integration.yml
@@ -5,7 +5,7 @@ on:
     - '*.md'
     - '**/*.md'
     branches:
-    - master
+    - main
 env:
   GH_ANNOTATION: true
 jobs:
@@ -67,8 +67,8 @@ jobs:
         export PATH="`pwd`/bin:$PATH"
         bin/docker-push-deps
         bin/docker-push $TAG
-        bin/docker-retag-all $TAG master
-        bin/docker-push master
+        bin/docker-retag-all $TAG main
+        bin/docker-push main
   # todo: Keep in sync with `release.yml`
   cloud_integration_tests:
     name: Cloud integration tests
diff --git a/.github/workflows/kind_integration.yml b/.github/workflows/kind_integration.yml
index 81fbee952..eb288b0ff 100644
--- a/.github/workflows/kind_integration.yml
+++ b/.github/workflows/kind_integration.yml
@@ -6,7 +6,7 @@ on:
     - '*.md'
     - '**/*.md'
     branches:
-    - master
+    - main
 env:
   GH_ANNOTATION: true
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7bae7ea48..52947ecd5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,8 +72,8 @@ jobs:
         export PATH="`pwd`/bin:$PATH"
         bin/docker-push-deps
         bin/docker-push $TAG
-        bin/docker-retag-all $TAG master
-        bin/docker-push master
+        bin/docker-retag-all $TAG main
+        bin/docker-push main
   # todo: Keep in sync with `kind_integration.yml`
   kind_integration_tests:
     strategy:
diff --git a/.github/workflows/static_checks.yml b/.github/workflows/static_checks.yml
index 765d31018..853f19faf 100644
--- a/.github/workflows/static_checks.yml
+++ b/.github/workflows/static_checks.yml
@@ -6,7 +6,7 @@ on:
     - '*.md'
     - '**/*.md'
     branches:
-    - master
+    - main
 jobs:
   go_dependencies:
     name: Go dependencies
diff --git a/BUILD.md b/BUILD.md
index 8ea8c3f25..887150b8c 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -56,7 +56,7 @@ written in Go. The dashboard UI is a React application.
 
 ## Components
 
-![Linkerd2 Components](https://g.gravizo.com/source/svg/linkerd2_components?https%3A%2F%2Fraw.githubusercontent.com%2Flinkerd%2Flinkerd2%2Fmaster%2FBUILD.md)
+![Linkerd2 Components](https://g.gravizo.com/source/svg/linkerd2_components?https%3A%2F%2Fraw.githubusercontent.com%2Flinkerd%2Flinkerd2%2Fmain%2FBUILD.md)
 
 <!-- markdownlint-disable no-inline-html -->
 <details>
@@ -432,7 +432,7 @@ the templates.
 
 ## Build Architecture
 
-![Build Architecture](https://g.gravizo.com/source/svg/build_architecture?https%3A%2F%2Fraw.githubusercontent.com%2Flinkerd%2Flinkerd2%2Fmaster%2FBUILD.md)
+![Build Architecture](https://g.gravizo.com/source/svg/build_architecture?https%3A%2F%2Fraw.githubusercontent.com%2Flinkerd%2Flinkerd2%2Fmain%2FBUILD.md)
 
 <!-- markdownlint-disable no-inline-html -->
 <details>
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b1300346f..959e5f803 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -35,7 +35,7 @@ Do you have an improvement?
 2. We will try to respond to your issue promptly.
 3. Fork this repo, develop and test your code changes. See the project's
    [README](README.md) for further information about working in this repository.
-4. Submit a pull request against this repo's `master` branch.
+4. Submit a pull request against this repo's `main` branch.
     - Include instructions on how to test your changes.
     - If you are making a change to the user interface (UI), include a
       screenshot of the UI before and after your changes.
@@ -47,7 +47,7 @@ Do you have an improvement?
 ## Committing ##
 
 We prefer squash or rebase commits so that all changes from a branch are
-committed to master as a single commit. All pull requests are squashed when
+committed to main as a single commit. All pull requests are squashed when
 merged, but rebasing prior to merge gives you better control over the commit
 message.
 
diff --git a/Dockerfile-proxy b/Dockerfile-proxy
index b4c15afd3..fa91b5c26 100644
--- a/Dockerfile-proxy
+++ b/Dockerfile-proxy
@@ -9,7 +9,7 @@ RUN (proxy=$(bin/fetch-proxy $(cat proxy-version)) && \
     mv "$proxy" linkerd2-proxy)
 
 ## compile proxy-identity agent
-FROM gcr.io/linkerd-io/go-deps:1a8bf322 as golang
+FROM gcr.io/linkerd-io/go-deps:30d997a8 as golang
 WORKDIR /linkerd-build
 COPY pkg/flags pkg/flags
 COPY pkg/tls pkg/tls
diff --git a/bin/win/linkerd.nuspec b/bin/win/linkerd.nuspec
index 788d0a331..0bb9b1b15 100644
--- a/bin/win/linkerd.nuspec
+++ b/bin/win/linkerd.nuspec
@@ -17,7 +17,7 @@
     </description>
 
     <projectUrl>https://github.com/linkerd/linkerd2</projectUrl>
-    <licenseUrl>https://github.com/linkerd/linkerd2/blob/master/LICENSE</licenseUrl>
+    <licenseUrl>https://github.com/linkerd/linkerd2/blob/main/LICENSE</licenseUrl>
     <releaseNotes>https://github.com/linkerd/linkerd2/releases</releaseNotes>
     <docsUrl>https://linkerd.io/docs</docsUrl>
 
diff --git a/cli/Dockerfile-bin b/cli/Dockerfile-bin
index b455df1bc..c2e2c05a1 100644
--- a/cli/Dockerfile-bin
+++ b/cli/Dockerfile-bin
@@ -1,5 +1,5 @@
 ## compile binaries
-FROM gcr.io/linkerd-io/go-deps:1a8bf322 as golang
+FROM gcr.io/linkerd-io/go-deps:30d997a8 as golang
 WORKDIR /linkerd-build
 COPY cli cli
 COPY charts charts
diff --git a/cli/cmd/inject.go b/cli/cmd/inject.go
index 7d8704b26..4d5899975 100644
--- a/cli/cmd/inject.go
+++ b/cli/cmd/inject.go
@@ -29,8 +29,8 @@ const (
 	injectDisabledDesc               = "pods are not annotated to disable injection"
 	unsupportedDesc                  = "at least one resource injected"
 	udpDesc                          = "pod specs do not include UDP ports"
+	automountServiceAccountTokenDesc = "pods do not have automountServiceAccountToken set to \"false\""
 	slash                            = "/"
-	automountServiceAccountTokenDesc = "cannot enable mTLS when automountServiceAccountToken set to \"false\""
 )
 
 type resourceTransformerInject struct {
@@ -182,8 +182,8 @@ func (rt resourceTransformerInject) transform(bytes []byte) ([]byte, []inject.Re
 		return b, reports, err
 	}
 	if b, _ := report.Injectable(); !b {
-		if !report.AutomountServiceAccountToken {
-			return bytes, reports, errors.New(automountServiceAccountTokenDesc)
+		if errs := report.ThrowInjectError(); len(errs) > 0 {
+			return bytes, reports, fmt.Errorf("failed to inject %s%s%s: %v", report.Kind, slash, report.Name, concatErrors(errs, ", "))
 		}
 		return bytes, reports, nil
 	}
@@ -233,6 +233,7 @@ func (resourceTransformerInject) generateReport(reports []inject.Report, output
 	sidecar := []string{}
 	udp := []string{}
 	injectDisabled := []string{}
+	automountServiceAccountTokenFalse := []string{}
 	warningsPrinted := verbose
 
 	for _, r := range reports {
@@ -259,6 +260,11 @@ func (resourceTransformerInject) generateReport(reports []inject.Report, output
 			injectDisabled = append(injectDisabled, r.ResName())
 			warningsPrinted = true
 		}
+
+		if !r.AutomountServiceAccountToken {
+			automountServiceAccountTokenFalse = append(automountServiceAccountTokenFalse, r.ResName())
+			warningsPrinted = true
+		}
 	}
 
 	//
@@ -304,6 +310,9 @@ func (resourceTransformerInject) generateReport(reports []inject.Report, output
 		output.Write([]byte(fmt.Sprintf("%s %s\n", okStatus, udpDesc)))
 	}
 
+	if len(automountServiceAccountTokenFalse) == 0 && verbose {
+		output.Write([]byte(fmt.Sprintf("%s %s\n", okStatus, automountServiceAccountTokenDesc)))
+	}
 	//
 	// Summary
 	//
diff --git a/cli/cmd/inject_util.go b/cli/cmd/inject_util.go
index 5e5db4789..63ca98eb6 100644
--- a/cli/cmd/inject_util.go
+++ b/cli/cmd/inject_util.go
@@ -3,6 +3,7 @@ package cmd
 import (
 	"bufio"
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -29,12 +30,13 @@ func transformInput(inputs []io.Reader, errWriter, outWriter io.Writer, rt resou
 	reportBuf := &bytes.Buffer{}
 
 	for _, input := range inputs {
-		err := processYAML(input, postInjectBuf, reportBuf, rt)
-		if err != nil {
-			fmt.Fprintf(errWriter, "Error transforming resources: %v\n", err)
+		errs := processYAML(input, postInjectBuf, reportBuf, rt)
+		if len(errs) > 0 {
+			fmt.Fprintf(errWriter, "Error transforming resources:\n%v", concatErrors(errs, "\n"))
 			return 1
 		}
-		_, err = io.Copy(outWriter, postInjectBuf)
+
+		_, err := io.Copy(outWriter, postInjectBuf)
 
 		// print error report after yaml output, for better visibility
 		io.Copy(errWriter, reportBuf)
@@ -48,11 +50,13 @@ func transformInput(inputs []io.Reader, errWriter, outWriter io.Writer, rt resou
 }
 
 // processYAML takes an input stream of YAML, outputting injected/uninjected YAML to out.
-func processYAML(in io.Reader, out io.Writer, report io.Writer, rt resourceTransformer) error {
+func processYAML(in io.Reader, out io.Writer, report io.Writer, rt resourceTransformer) []error {
 	reader := yamlDecoder.NewYAMLReader(bufio.NewReaderSize(in, 4096))
 
 	reports := []inject.Report{}
 
+	errs := []error{}
+
 	// Iterate over all YAML objects in the input
 	for {
 		// Read a single YAML object
@@ -61,7 +65,7 @@ func processYAML(in io.Reader, out io.Writer, report io.Writer, rt resourceTrans
 			break
 		}
 		if err != nil {
-			return err
+			return []error{err}
 		}
 
 		var result []byte
@@ -69,7 +73,7 @@ func processYAML(in io.Reader, out io.Writer, report io.Writer, rt resourceTrans
 
 		isList, err := kindIsList(bytes)
 		if err != nil {
-			return err
+			return []error{err}
 		}
 		if isList {
 			result, irs, err = processList(bytes, rt)
@@ -77,16 +81,19 @@ func processYAML(in io.Reader, out io.Writer, report io.Writer, rt resourceTrans
 			result, irs, err = rt.transform(bytes)
 		}
 		if err != nil {
-			return err
+			errs = append(errs, err)
 		}
 		reports = append(reports, irs...)
-		out.Write(result)
-		out.Write([]byte("---\n"))
+
+		if len(errs) == 0 {
+			out.Write(result)
+			out.Write([]byte("---\n"))
+		}
 	}
 
 	rt.generateReport(reports, report)
 
-	return nil
+	return errs
 }
 
 func kindIsList(bytes []byte) (bool, error) {
@@ -221,3 +228,15 @@ func walk(path string) ([]io.Reader, error) {
 
 	return in, nil
 }
+
+// a helper function to concatenate the items in a []error
+// into a single error
+func concatErrors(errs []error, delimiter string) error {
+	message, errs := errs[0].Error(), errs[1:] // pop the first element of the errs
+	// this is done so that the first error message is not prefixed by the delimiter
+
+	for _, err := range errs {
+		message = fmt.Sprintf("%s%s%s", message, delimiter, err.Error())
+	}
+	return errors.New(message)
+}
diff --git a/cni-plugin/Dockerfile b/cni-plugin/Dockerfile
index 5ea6fd86f..47d05466e 100644
--- a/cni-plugin/Dockerfile
+++ b/cni-plugin/Dockerfile
@@ -1,5 +1,5 @@
 ## compile cni-plugin utility
-FROM gcr.io/linkerd-io/go-deps:1a8bf322 as golang
+FROM gcr.io/linkerd-io/go-deps:30d997a8 as golang
 WORKDIR /linkerd-build
 COPY pkg pkg
 COPY controller controller
diff --git a/controller/Dockerfile b/controller/Dockerfile
index f80638ab7..561cfb782 100644
--- a/controller/Dockerfile
+++ b/controller/Dockerfile
@@ -1,5 +1,5 @@
 ## compile controller service
-FROM gcr.io/linkerd-io/go-deps:1a8bf322 as golang
+FROM gcr.io/linkerd-io/go-deps:30d997a8 as golang
 WORKDIR /linkerd-build
 COPY controller/gen controller/gen
 COPY pkg pkg
diff --git a/controller/api/destination/profile_translator.go b/controller/api/destination/profile_translator.go
index 09ece6469..23fb4feee 100644
--- a/controller/api/destination/profile_translator.go
+++ b/controller/api/destination/profile_translator.go
@@ -15,19 +15,6 @@ import (
 const millisPerDecimilli = 10
 
 var (
-	defaultRetryBudget = pb.RetryBudget{
-		MinRetriesPerSecond: 10,
-		RetryRatio:          0.2,
-		Ttl: &duration.Duration{
-			Seconds: 10,
-		},
-	}
-
-	defaultServiceProfile = pb.DestinationProfile{
-		Routes:      []*pb.Route{},
-		RetryBudget: &defaultRetryBudget,
-	}
-
 	defaultRouteTimeout = 10 * time.Second
 )
 
@@ -46,7 +33,7 @@ func newProfileTranslator(stream pb.Destination_GetProfileServer, log *logging.E
 
 func (pt *profileTranslator) Update(profile *sp.ServiceProfile) {
 	if profile == nil {
-		pt.stream.Send(&defaultServiceProfile)
+		pt.stream.Send(defaultServiceProfile())
 		return
 	}
 	destinationProfile, err := toServiceProfile(profile)
@@ -58,6 +45,23 @@ func (pt *profileTranslator) Update(profile *sp.ServiceProfile) {
 	pt.stream.Send(destinationProfile)
 }
 
+func defaultServiceProfile() *pb.DestinationProfile {
+	return &pb.DestinationProfile{
+		Routes:      []*pb.Route{},
+		RetryBudget: defaultRetryBudget(),
+	}
+}
+
+func defaultRetryBudget() *pb.RetryBudget {
+	return &pb.RetryBudget{
+		MinRetriesPerSecond: 10,
+		RetryRatio:          0.2,
+		Ttl: &duration.Duration{
+			Seconds: 10,
+		},
+	}
+}
+
 func toDuration(d time.Duration) *duration.Duration {
 	return &duration.Duration{
 		Seconds: int64(d / time.Second),
@@ -76,7 +80,7 @@ func toServiceProfile(profile *sp.ServiceProfile) (*pb.DestinationProfile, error
 		}
 		routes = append(routes, pbRoute)
 	}
-	budget := defaultRetryBudget
+	budget := defaultRetryBudget()
 	if profile.Spec.RetryBudget != nil {
 		budget.MinRetriesPerSecond = profile.Spec.RetryBudget.MinRetriesPerSecond
 		budget.RetryRatio = profile.Spec.RetryBudget.RetryRatio
@@ -88,7 +92,7 @@ func toServiceProfile(profile *sp.ServiceProfile) (*pb.DestinationProfile, error
 	}
 	return &pb.DestinationProfile{
 		Routes:       routes,
-		RetryBudget:  &budget,
+		RetryBudget:  budget,
 		DstOverrides: toDstOverrides(profile.Spec.DstOverrides),
 	}, nil
 }
diff --git a/go.mod b/go.mod
index 038db2aaa..3ef3cab6e 100644
--- a/go.mod
+++ b/go.mod
@@ -20,14 +20,14 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-openapi/spec v0.19.3
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/golang/protobuf v1.3.2
+	github.com/golang/protobuf v1.4.2
 	github.com/gorilla/websocket v1.4.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
 	github.com/huandu/xstrings v1.2.0 // indirect
 	github.com/imdario/mergo v0.3.7
 	github.com/julienschmidt/httprouter v1.2.0
 	github.com/kr/pretty v0.2.0 // indirect
-	github.com/linkerd/linkerd2-proxy-api v0.1.12
+	github.com/linkerd/linkerd2-proxy-api v0.1.13
 	github.com/linkerd/linkerd2-proxy-init v1.3.3
 	github.com/mattn/go-isatty v0.0.12
 	github.com/mattn/go-runewidth v0.0.2
@@ -53,7 +53,7 @@ require (
 	golang.org/x/net v0.0.0-20200202094626-16171245cfb2
 	golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9 // indirect
 	golang.org/x/tools v0.0.0-20191009213438-b090f1f24028
-	google.golang.org/grpc v1.26.0
+	google.golang.org/grpc v1.29.1
 	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
 	k8s.io/api v0.17.4
 	k8s.io/apiextensions-apiserver v0.17.4
diff --git a/go.sum b/go.sum
index fc21e32a2..d2ddeb493 100644
--- a/go.sum
+++ b/go.sum
@@ -64,6 +64,7 @@ github.com/cespare/xxhash/v2 v2.1.0/go.mod h1:dgIUBU3pDso/gPgZ1osOZ0iQf77oPR28Tj
 github.com/clarketm/json v1.13.4 h1:0JketcMdLC16WGnRGJiNmTXuQznDEQaiknxSPRBxg+k=
 github.com/clarketm/json v1.13.4/go.mod h1:ynr2LRfb0fQU34l07csRNBTcivjySLLiY1YzQqKVfdo=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/containernetworking/cni v0.6.1-0.20180218032124-142cde0c766c h1:X6Gxg2GV1i0UhDodKZYrp//lg8h3KANe8l3gtFHoi9M=
 github.com/containernetworking/cni v0.6.1-0.20180218032124-142cde0c766c/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
@@ -108,7 +109,9 @@ github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/proto v1.6.8 h1:TgJKjY0I1cec7Xtj0dJGnxXHP0TJRGaqGW44waWqaLA=
 github.com/emicklei/proto v1.6.8/go.mod h1:Dqn751twH9SasYqvA59Lb9Hz+itoJgmMoivX6k7OPZc=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch v4.2.0+incompatible h1:fUDGZCv/7iAN7u0puUVhvKCcsR6vRfwrJatElLBEf0I=
 github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
@@ -202,6 +205,15 @@ github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -209,6 +221,9 @@ github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
 github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -277,8 +292,11 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/linkerd/linkerd2-proxy-api v0.1.12 h1:mP0UYjmemLI6Ru7m1HW3d9up5Bt9VRB9FsxRA8jy2IM=
 github.com/linkerd/linkerd2-proxy-api v0.1.12/go.mod h1:2WJHEYXoww5ALM6c1QspRFiROGZg08tGxCO1js0tTVA=
+github.com/linkerd/linkerd2-proxy-api v0.1.13-0.20200616212153-2ac143ef3cac h1:XWRzBkZrclWrTAoLVtUdvPjw/fpZeqUCgQPRhIOuCug=
+github.com/linkerd/linkerd2-proxy-api v0.1.13-0.20200616212153-2ac143ef3cac/go.mod h1:Fpew8Tsm1D70GtuYg7km/PYeZRMUqlxIxwCrId/G+oQ=
+github.com/linkerd/linkerd2-proxy-api v0.1.13 h1:wk0EZBk1zD1cvnRK7myv+exKUQQbykGWZqVhly6Ws8I=
+github.com/linkerd/linkerd2-proxy-api v0.1.13/go.mod h1:Fpew8Tsm1D70GtuYg7km/PYeZRMUqlxIxwCrId/G+oQ=
 github.com/linkerd/linkerd2-proxy-init v1.3.3 h1:x561EUgmk5aJNDjE7UEEL0r9U4vtM2IK0thuDcSf81g=
 github.com/linkerd/linkerd2-proxy-init v1.3.3/go.mod h1:M6iaaLLi06ofuIV6x74SDknSFi7VS/MFqa5m+CwHgLY=
 github.com/linkerd/stern v0.0.0-20200331220320-37779ceb2c32 h1:BIdntxDGoVcFzrihrNcWjdjA92S28cl+/mOC7bsgb3c=
@@ -567,6 +585,8 @@ golang.org/x/tools v0.0.0-20191009213438-b090f1f24028 h1:uYpiJNFQR6EGzWevFLoFS3m
 golang.org/x/tools v0.0.0-20191009213438-b090f1f24028/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485 h1:OB/uP/Puiu5vS5QMRPrXCDWUPb+kt8f1KW8oQzFejQw=
 gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485/go.mod h1:2ltnJ7xHfj0zHS40VVPYEAAMTa3ZGguvHGBSJeRWqE0=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
@@ -589,14 +609,29 @@ google.golang.org/genproto v0.0.0-20190716160619-c506a9f90610 h1:Ygq9/SRJX9+dU0W
 google.golang.org/genproto v0.0.0-20190716160619-c506a9f90610/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 h1:+kGHl1aib/qcwaRi1CbqBZ1rk19r85MNUf8HaBghugY=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.22.0 h1:J0UbZOIrCAl+fpTOf8YLs4dJo8L/owV4LYVtAXQoPkw=
 google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.26.0 h1:2dTRdpdFEEhJYQD8EMLB61nnrzSCTbG38PhqdhvOltg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.29.1 h1:EC2SB8S04d2r73uptxphDSUG+kTKVgjRPF+N3xpxRB4=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0 h1:UhZDfRO8JRQru4/+LlLE0BRKGF8L+PICnvYZmx/fEGA=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/pkg/inject/report.go b/pkg/inject/report.go
index f8d2994b0..d800c8586 100644
--- a/pkg/inject/report.go
+++ b/pkg/inject/report.go
@@ -1,6 +1,7 @@
 package inject
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 
@@ -20,6 +21,7 @@ const (
 	invalidInjectAnnotationWorkload      = "invalid_inject_annotation_at_workload"
 	invalidInjectAnnotationNamespace     = "invalid_inject_annotation_at_ns"
 	disabledAutomountServiceAccountToken = "disabled_automount_service_account_token_account"
+	udpPortsEnabled                      = "udp_ports_enabled"
 )
 
 var (
@@ -33,6 +35,7 @@ var (
 		invalidInjectAnnotationWorkload:      fmt.Sprintf("invalid value for annotation \"%s\" at workload", k8s.ProxyInjectAnnotation),
 		invalidInjectAnnotationNamespace:     fmt.Sprintf("invalid value for annotation \"%s\" at namespace", k8s.ProxyInjectAnnotation),
 		disabledAutomountServiceAccountToken: fmt.Sprintf("automountServiceAccountToken set to \"false\""),
+		udpPortsEnabled:                      "UDP port(s) configured on pod spec",
 	}
 )
 
@@ -197,3 +200,30 @@ func isInjectAnnotationValid(annotation string) bool {
 	}
 	return true
 }
+
+// ThrowInjectError errors out `inject` when the report contains errors
+// related to automountServiceAccountToken, hostNetwork, existing sidecar,
+// or udp ports
+// See - https://github.com/linkerd/linkerd2/issues/4214
+func (r *Report) ThrowInjectError() []error {
+
+	errs := []error{}
+
+	if !r.AutomountServiceAccountToken {
+		errs = append(errs, errors.New(Reasons[disabledAutomountServiceAccountToken]))
+	}
+
+	if r.HostNetwork {
+		errs = append(errs, errors.New(Reasons[hostNetworkEnabled]))
+	}
+
+	if r.Sidecar {
+		errs = append(errs, errors.New(Reasons[sidecarExists]))
+	}
+
+	if r.UDP {
+		errs = append(errs, errors.New(Reasons[udpPortsEnabled]))
+	}
+
+	return errs
+}
diff --git a/web/Dockerfile b/web/Dockerfile
index dce59ec48..316d66295 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -21,7 +21,7 @@ COPY web/app ./web/app
 RUN ./bin/web build
 
 ## compile go server
-FROM gcr.io/linkerd-io/go-deps:1a8bf322 as golang
+FROM gcr.io/linkerd-io/go-deps:30d997a8 as golang
 WORKDIR /linkerd-build
 RUN mkdir -p web
 COPY web/main.go web


Test patch:
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 66fc2752c..f8049d22d 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -6,7 +6,7 @@ on:
     - '*.md'
     - '**/*.md'
     branches:
-    - master
+    - main
 jobs:
   go_unit_tests:
     name: Go unit tests
diff --git a/bin/test-scale b/bin/test-scale
index 44545b243..8746b2b8b 100755
--- a/bin/test-scale
+++ b/bin/test-scale
@@ -76,7 +76,7 @@ linkerd_namespace=${2:-l5d-scale}
 # Deploy Books
 #
 
-BOOKS_BACKEND=$(curl -s https://raw.githubusercontent.com/BuoyantIO/booksapp/master/k8s/mysql-backend.yml)
+BOOKS_BACKEND=$(curl -s https://raw.githubusercontent.com/BuoyantIO/booksapp/main/k8s/mysql-backend.yml)
 
 AUTHORS_SP=$(curl -s https://run.linkerd.io/booksapp/authors.swagger)
 BOOKS_SP=$(curl -s https://run.linkerd.io/booksapp/books.swagger)
@@ -93,7 +93,7 @@ for ((i=1; i <= NAMESPACES; i++)); do
     echo "$WEBAPP_SP"  | bin/linkerd profile -n "$booksns" webapp  --open-api - | kubectl apply -f -
 done
 
-BOOKS_APP=$(curl -s https://raw.githubusercontent.com/BuoyantIO/booksapp/master/k8s/mysql-app.yml)
+BOOKS_APP=$(curl -s https://raw.githubusercontent.com/BuoyantIO/booksapp/main/k8s/mysql-app.yml)
 
 # add "-sleep=10ms" param to the traffic app (~100rps)
 traffic_param="        - \"webapp:7000\""
diff --git a/cli/cmd/inject_test.go b/cli/cmd/inject_test.go
index 6c7498b47..4d8da4a45 100644
--- a/cli/cmd/inject_test.go
+++ b/cli/cmd/inject_test.go
@@ -170,13 +170,6 @@ func TestUninjectAndInject(t *testing.T) {
 			injectProxy:      true,
 			testInjectConfig: defaultConfig,
 		},
-		{
-			inputFileName:    "inject_emojivoto_deployment_hostNetwork_true.input.yml",
-			goldenFileName:   "inject_emojivoto_deployment_hostNetwork_true.input.yml",
-			reportFileName:   "inject_emojivoto_deployment_hostNetwork_true.report",
-			injectProxy:      true,
-			testInjectConfig: defaultConfig,
-		},
 		{
 			inputFileName:    "inject_emojivoto_deployment_capabilities.input.yml",
 			goldenFileName:   "inject_emojivoto_deployment_capabilities.golden.yml",
@@ -247,13 +240,6 @@ func TestUninjectAndInject(t *testing.T) {
 			injectProxy:      true,
 			testInjectConfig: defaultConfig,
 		},
-		{
-			inputFileName:    "inject_emojivoto_istio.input.yml",
-			goldenFileName:   "inject_emojivoto_istio.input.yml",
-			reportFileName:   "inject_emojivoto_istio.report",
-			injectProxy:      true,
-			testInjectConfig: defaultConfig,
-		},
 		{
 			inputFileName:    "inject_contour.input.yml",
 			goldenFileName:   "inject_contour.golden.yml",
@@ -429,6 +415,20 @@ func TestRunInjectCmd(t *testing.T) {
 			exitCode:             1,
 			injectProxy:          false,
 		},
+		{
+			inputFileName:        "inject_emojivoto_istio.input.yml",
+			stdOutGoldenFileName: "inject_emojivoto_istio.golden.yml",
+			stdErrGoldenFileName: "inject_emojivoto_istio.golden.stderr",
+			exitCode:             1,
+			injectProxy:          true,
+		},
+		{
+			inputFileName:        "inject_emojivoto_deployment_hostNetwork_true.input.yml",
+			stdOutGoldenFileName: "inject_emojivoto_deployment_hostNetwork_true.golden.yml",
+			stdErrGoldenFileName: "inject_emojivoto_deployment_hostNetwork_true.golden.stderr",
+			exitCode:             1,
+			injectProxy:          true,
+		},
 	}
 
 	for i, tc := range testCases {
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.stderr.verbose b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.stderr.verbose
index 00cd103b2..bc955a1ad 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.stderr.verbose
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.stderr.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "nginx" injected
 
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.stderr.verbose b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.stderr.verbose
index 5f4ff8c9a..b4b193c79 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.stderr.verbose
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.stderr.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "redis" injected
 
@@ -13,6 +14,7 @@ deployment "redis" injected
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "nginx" injected
 
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.stderr.verbose b/cli/cmd/testdata/inject-filepath/expected/injected_redis.stderr.verbose
index fc9ee0d32..482e9f5a2 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.stderr.verbose
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.stderr.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "redis" injected
 
diff --git a/cli/cmd/testdata/inject_contour.report.verbose b/cli/cmd/testdata/inject_contour.report.verbose
index ec4700efc..9c2c0bec9 100644
--- a/cli/cmd/testdata/inject_contour.report.verbose
+++ b/cli/cmd/testdata/inject_contour.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "contour" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.report.verbose b/cli/cmd/testdata/inject_emojivoto_already_injected.report.verbose
index 6236525ab..37f97af50 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web1" injected
 deployment "web2" injected
diff --git a/cli/cmd/testdata/inject_emojivoto_cronjob.report.verbose b/cli/cmd/testdata/inject_emojivoto_cronjob.report.verbose
index de6f69c5e..35a934635 100644
--- a/cli/cmd/testdata/inject_emojivoto_cronjob.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_cronjob.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 cronjob "hello" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment.report.verbose
index 42ae028a0..59734f772 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr
index a1a3ee482..f4b0aedc3 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr
@@ -1,1 +1,2 @@
-Error transforming resources: cannot enable mTLS when automountServiceAccountToken set to "false"
+Error transforming resources:
+failed to inject deployment/nginx: automountServiceAccountToken set to "false"
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr.verbose
index a1a3ee482..f4b0aedc3 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.stderr.verbose
@@ -1,1 +1,2 @@
-Error transforming resources: cannot enable mTLS when automountServiceAccountToken set to "false"
+Error transforming resources:
+failed to inject deployment/nginx: automountServiceAccountToken set to "false"
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.report.verbose
index 424b76cf0..78f6874e6 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "controller" injected
 deployment "not-controller" injected
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.report.verbose
index c777b6f66..1e4c548ef 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 document missing "kind" field, skipped
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.report.verbose
index 42ae028a0..59734f772 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.stderr b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.stderr
new file mode 100644
index 000000000..379f5449a
--- /dev/null
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.stderr
@@ -0,0 +1,2 @@
+Error transforming resources:
+failed to inject deployment/web: hostNetwork is enabled
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.stderr.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.stderr.verbose
new file mode 100644
index 000000000..379f5449a
--- /dev/null
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.stderr.verbose
@@ -0,0 +1,2 @@
+Error transforming resources:
+failed to inject deployment/web: hostNetwork is enabled
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.golden.yml
new file mode 100644
index 000000000..e69de29bb
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.report b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.report
deleted file mode 100644
index d58849fb2..000000000
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.report
+++ /dev/null
@@ -1,6 +0,0 @@
-
-‼ "hostNetwork: true" detected in deployment/web
-‼ no supported objects found
-
-deployment "web" skipped
-
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.report.verbose
deleted file mode 100644
index 0916fea25..000000000
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_true.report.verbose
+++ /dev/null
@@ -1,9 +0,0 @@
-
-‼ "hostNetwork: true" detected in deployment/web
-√ pods do not have a 3rd party proxy or initContainer already injected
-√ pods are not annotated to disable injection
-‼ no supported objects found
-√ pod specs do not include UDP ports
-
-deployment "web" skipped
-
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_injectDisabled.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_injectDisabled.report.verbose
index 42d071b28..5a8a21c91 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_injectDisabled.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_injectDisabled.report.verbose
@@ -4,6 +4,7 @@
 ‼ "linkerd.io/inject: disabled" annotation set on deployment/web
 ‼ no supported objects found
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" skipped
 
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_trace.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_trace.report.verbose
index 42ae028a0..59734f772 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_trace.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_trace.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.report.verbose b/cli/cmd/testdata/inject_emojivoto_deployment_udp.report.verbose
index 60bdfff80..2c6752165 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 ‼ deployment/web uses "protocol: UDP"
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_istio.golden.stderr b/cli/cmd/testdata/inject_emojivoto_istio.golden.stderr
new file mode 100644
index 000000000..0e183c5a3
--- /dev/null
+++ b/cli/cmd/testdata/inject_emojivoto_istio.golden.stderr
@@ -0,0 +1,2 @@
+Error transforming resources:
+failed to inject deployment/web: pod has a sidecar injected already
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_emojivoto_istio.golden.stderr.verbose b/cli/cmd/testdata/inject_emojivoto_istio.golden.stderr.verbose
new file mode 100644
index 000000000..0e183c5a3
--- /dev/null
+++ b/cli/cmd/testdata/inject_emojivoto_istio.golden.stderr.verbose
@@ -0,0 +1,2 @@
+Error transforming resources:
+failed to inject deployment/web: pod has a sidecar injected already
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_emojivoto_istio.golden.yml b/cli/cmd/testdata/inject_emojivoto_istio.golden.yml
new file mode 100644
index 000000000..e69de29bb
diff --git a/cli/cmd/testdata/inject_emojivoto_istio.report b/cli/cmd/testdata/inject_emojivoto_istio.report
deleted file mode 100644
index e845cd2d7..000000000
--- a/cli/cmd/testdata/inject_emojivoto_istio.report
+++ /dev/null
@@ -1,6 +0,0 @@
-
-‼ known 3rd party sidecar detected in deployment/web
-‼ no supported objects found
-
-deployment "web" skipped
-
diff --git a/cli/cmd/testdata/inject_emojivoto_istio.report.verbose b/cli/cmd/testdata/inject_emojivoto_istio.report.verbose
deleted file mode 100644
index 27bc51865..000000000
--- a/cli/cmd/testdata/inject_emojivoto_istio.report.verbose
+++ /dev/null
@@ -1,9 +0,0 @@
-
-√ pods do not use host networking
-‼ known 3rd party sidecar detected in deployment/web
-√ pods are not annotated to disable injection
-‼ no supported objects found
-√ pod specs do not include UDP ports
-
-deployment "web" skipped
-
diff --git a/cli/cmd/testdata/inject_emojivoto_list.report.verbose b/cli/cmd/testdata/inject_emojivoto_list.report.verbose
index 3c23c6849..72c53bcb2 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_list.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 deployment "emoji" injected
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.report.verbose b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.report.verbose
index 3a0e28ab6..81ef51e38 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "web" injected
 deployment "emoji" injected
diff --git a/cli/cmd/testdata/inject_emojivoto_namespace_good.golden.report.verbose b/cli/cmd/testdata/inject_emojivoto_namespace_good.golden.report.verbose
index ef0ae2a0b..ff21aa017 100644
--- a/cli/cmd/testdata/inject_emojivoto_namespace_good.golden.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_namespace_good.golden.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 namespace "emojivoto" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.report.verbose b/cli/cmd/testdata/inject_emojivoto_pod.report.verbose
index 2e9f9e459..4127b938b 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_pod.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 pod "vote-bot" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.report.verbose b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.report.verbose
index 2e9f9e459..4127b938b 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 pod "vote-bot" injected
 
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.report.verbose b/cli/cmd/testdata/inject_emojivoto_statefulset.report.verbose
index 0eb304268..2de917a6c 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.report.verbose
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 statefulset "web" injected
 
diff --git a/cli/cmd/testdata/inject_gettest_deployment.bad.golden b/cli/cmd/testdata/inject_gettest_deployment.bad.golden
index 6316b8a62..e03964e89 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.bad.golden
+++ b/cli/cmd/testdata/inject_gettest_deployment.bad.golden
@@ -1,1 +1,2 @@
-Error transforming resources: error converting YAML to JSON: yaml: line 14: did not find expected key
+Error transforming resources:
+error converting YAML to JSON: yaml: line 14: did not find expected key
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_gettest_deployment.bad.golden.verbose b/cli/cmd/testdata/inject_gettest_deployment.bad.golden.verbose
index 6316b8a62..e03964e89 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.bad.golden.verbose
+++ b/cli/cmd/testdata/inject_gettest_deployment.bad.golden.verbose
@@ -1,1 +1,2 @@
-Error transforming resources: error converting YAML to JSON: yaml: line 14: did not find expected key
+Error transforming resources:
+error converting YAML to JSON: yaml: line 14: did not find expected key
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.stderr.verbose b/cli/cmd/testdata/inject_gettest_deployment.good.golden.stderr.verbose
index 7e70721a7..6f560f649 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.stderr.verbose
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.stderr.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "get-test-deploy-injected-1" injected
 deployment "get-test-deploy-injected-2" injected
diff --git a/cli/cmd/testdata/inject_tap_deployment.bad.golden b/cli/cmd/testdata/inject_tap_deployment.bad.golden
index 3aabaeafe..9b01057c3 100644
--- a/cli/cmd/testdata/inject_tap_deployment.bad.golden
+++ b/cli/cmd/testdata/inject_tap_deployment.bad.golden
@@ -1,1 +1,2 @@
-Error transforming resources: --manual must be set when injecting control plane components
+Error transforming resources:
+--manual must be set when injecting control plane components
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_tap_deployment.bad.golden.verbose b/cli/cmd/testdata/inject_tap_deployment.bad.golden.verbose
index 3aabaeafe..9b01057c3 100644
--- a/cli/cmd/testdata/inject_tap_deployment.bad.golden.verbose
+++ b/cli/cmd/testdata/inject_tap_deployment.bad.golden.verbose
@@ -1,1 +1,2 @@
-Error transforming resources: --manual must be set when injecting control plane components
+Error transforming resources:
+--manual must be set when injecting control plane components
\ No newline at end of file
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.report.verbose b/cli/cmd/testdata/inject_tap_deployment_debug.report.verbose
index 1d11978f7..482292cfd 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.report.verbose
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.report.verbose
@@ -4,6 +4,7 @@
 √ pods are not annotated to disable injection
 √ at least one resource injected
 √ pod specs do not include UDP ports
+√ pods do not have automountServiceAccountToken set to "false"
 
 deployment "linkerd-tap" injected
 
diff --git a/controller/api/destination/endpoint_translator_test.go b/controller/api/destination/endpoint_translator_test.go
index 9a07fe75c..aa42e1300 100644
--- a/controller/api/destination/endpoint_translator_test.go
+++ b/controller/api/destination/endpoint_translator_test.go
@@ -410,7 +410,13 @@ func checkAddress(t *testing.T, actual *net.TcpAddress, expected watcher.Address
 	if err != nil {
 		t.Fatalf("Failed to parse expected IP [%s]: %s", expected.IP, err)
 	}
-	if !reflect.DeepEqual(*actual, expectedTCP) {
-		t.Fatalf("Expected address [%+v] but got [%+v]", expectedTCP, *actual)
+	if actual.Ip.GetIpv4() != expectedTCP.Ip.GetIpv4() {
+		t.Fatalf("Expected IP [%+v] but got [%+v]", expectedTCP.Ip, actual.Ip)
+	}
+	if actual.Ip.GetIpv6() != expectedTCP.Ip.GetIpv6() {
+		t.Fatalf("Expected IP [%+v] but got [%+v]", expectedTCP.Ip, actual.Ip)
+	}
+	if actual.Port != expectedTCP.Port {
+		t.Fatalf("Expected port [%+v] but got [%+v]", expectedTCP.Port, actual.Port)
 	}
 }
diff --git a/controller/api/destination/profile_translator_test.go b/controller/api/destination/profile_translator_test.go
index 66be1985b..6ee951943 100644
--- a/controller/api/destination/profile_translator_test.go
+++ b/controller/api/destination/profile_translator_test.go
@@ -180,12 +180,12 @@ var (
 			pbRoute1,
 			pbRoute2,
 		},
-		RetryBudget: &defaultRetryBudget,
+		RetryBudget: defaultRetryBudget(),
 	}
 
 	defaultPbProfile = &pb.DestinationProfile{
 		Routes:      []*pb.Route{},
-		RetryBudget: &defaultRetryBudget,
+		RetryBudget: defaultRetryBudget(),
 	}
 
 	multipleRequestMatches = &sp.ServiceProfile{
@@ -238,7 +238,7 @@ var (
 				},
 			},
 		},
-		RetryBudget: &defaultRetryBudget,
+		RetryBudget: defaultRetryBudget(),
 	}
 
 	notEnoughRequestMatches = &sp.ServiceProfile{
@@ -330,7 +330,7 @@ var (
 				},
 			},
 		},
-		RetryBudget: &defaultRetryBudget,
+		RetryBudget: defaultRetryBudget(),
 	}
 
 	oneSidedStatusRange = &sp.ServiceProfile{
@@ -423,7 +423,7 @@ var (
 		Routes: []*pb.Route{
 			pbRouteWithTimeout,
 		},
-		RetryBudget: &defaultRetryBudget,
+		RetryBudget: defaultRetryBudget(),
 	}
 )
 
diff --git a/controller/api/public/test_helper.go b/controller/api/public/test_helper.go
index edffd2624..0c95746e2 100644
--- a/controller/api/public/test_helper.go
+++ b/controller/api/public/test_helper.go
@@ -117,19 +117,19 @@ type MockDestinationGetClient struct {
 func (a *MockDestinationGetClient) Recv() (*destinationPb.Update, error) {
 	a.Lock()
 	defer a.Unlock()
-	var updatePopped destinationPb.Update
+	var updatePopped *destinationPb.Update
 	var errorPopped error
 	if len(a.UpdatesToReturn) == 0 && len(a.ErrorsToReturn) == 0 {
 		return nil, io.EOF
 	}
 	if len(a.UpdatesToReturn) != 0 {
-		updatePopped, a.UpdatesToReturn = a.UpdatesToReturn[0], a.UpdatesToReturn[1:]
+		updatePopped, a.UpdatesToReturn = &a.UpdatesToReturn[0], a.UpdatesToReturn[1:]
 	}
 	if len(a.ErrorsToReturn) != 0 {
 		errorPopped, a.ErrorsToReturn = a.ErrorsToReturn[0], a.ErrorsToReturn[1:]
 	}
 
-	return &updatePopped, errorPopped
+	return updatePopped, errorPopped
 }
 
 // AuthorityEndpoints holds the details for the Endpoints associated to an authority
diff --git a/controller/tap/server_test.go b/controller/tap/server_test.go
index 24dbfc27c..75b1b1e66 100644
--- a/controller/tap/server_test.go
+++ b/controller/tap/server_test.go
@@ -382,8 +382,12 @@ status:
 			k8sAPI.Sync(nil)
 
 			err = fakeGrpcServer.TapByResource(&exp.req, &stream)
-			if !reflect.DeepEqual(err, exp.err) {
-				t.Fatalf("TapByResource returned unexpected: [%s], expected: [%s]", err, exp.err)
+			if err != nil || exp.err != nil {
+				code := status.Code(err)
+				expCode := status.Code(exp.err)
+				if code != expCode {
+					t.Fatalf("TapByResource returned unexpected: [%s], expected: [%s]", code, expCode)
+				}
 			}
 
 			if exp.requireID != "" {
diff --git a/pkg/identity/service_test.go b/pkg/identity/service_test.go
index bb349b256..5602bd1c3 100644
--- a/pkg/identity/service_test.go
+++ b/pkg/identity/service_test.go
@@ -53,27 +53,31 @@ func TestInvalidRequestArguments(t *testing.T) {
 	svc := NewService(&fakeValidator{"successful-result", nil}, nil, nil, nil, "", "", "")
 	svc.updateIssuer(&fakeIssuer{tls.Crt{}, nil})
 	fakeData := "fake-data"
-	invalidCsr := pb.CertifyRequest{
-		Identity:                  fakeData,
-		Token:                     []byte(fakeData),
-		CertificateSigningRequest: []byte(fakeData),
+	invalidCsr := func() *pb.CertifyRequest {
+		return &pb.CertifyRequest{
+			Identity:                  fakeData,
+			Token:                     []byte(fakeData),
+			CertificateSigningRequest: []byte(fakeData),
+		}
 	}
 
-	reqNoIdentitiy := invalidCsr
+	reqNoIdentitiy := invalidCsr()
 	reqNoIdentitiy.Identity = ""
-	reqNoToken := invalidCsr
+
+	reqNoToken := invalidCsr()
 	reqNoToken.Token = []byte{}
-	reqNoCsr := invalidCsr
+
+	reqNoCsr := invalidCsr()
 	reqNoCsr.CertificateSigningRequest = []byte{}
 
 	testCases := []struct {
 		input         *pb.CertifyRequest
 		expectedError string
 	}{
-		{&reqNoIdentitiy, "rpc error: code = InvalidArgument desc = missing identity"},
-		{&reqNoToken, "rpc error: code = InvalidArgument desc = missing token"},
-		{&reqNoCsr, "rpc error: code = InvalidArgument desc = missing certificate signing request"},
-		{&invalidCsr, "rpc error: code = InvalidArgument desc = asn1: structure error: tags don't match " +
+		{reqNoIdentitiy, "rpc error: code = InvalidArgument desc = missing identity"},
+		{reqNoToken, "rpc error: code = InvalidArgument desc = missing token"},
+		{reqNoCsr, "rpc error: code = InvalidArgument desc = missing certificate signing request"},
+		{invalidCsr(), "rpc error: code = InvalidArgument desc = asn1: structure error: tags don't match " +
 			"(16 vs {class:1 tag:6 length:97 isCompound:true}) " +
 			"{optional:false explicit:false application:false private:false defaultValue:<nil> " +
 			"tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} certificateRequest @2"},