Repository: linkerd/linkerd2
Pull request #5110 (2020-10-20 19:26:47)

Replace global.proxy.destinationGetNetworks with global.clusterNetworks
There is no longer a proxy config `DESTINATION_GET_NETWORKS`. Instead of
reflecting this implementation in our values.yaml, this changes this
variable to the more general `clusterNetworks` to emphasize its
similarity to `clusterDomain` for the purposes of discovery.

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->



Patch:
diff --git a/charts/linkerd2/README.md b/charts/linkerd2/README.md
index ea4967076..9cc8c5594 100644
--- a/charts/linkerd2/README.md
+++ b/charts/linkerd2/README.md
@@ -100,6 +100,7 @@ their default values.
 | `disableHeartBeat`                          | Set to true to not start the heartbeat cronjob                                                                                                                                        | `false`                              |
 | `enableH2Upgrade`                           | Allow proxies to perform transparent HTTP/2 upgrading                                                                                                                                 | `true`                               |
 | `global.clusterDomain`                      | Kubernetes DNS Domain name to use                                                                                                                                                     | `cluster.local`                      |
+| `global.clusterNetworks`                    | The networks that may include pods & services in this cluscter                                                                                                                         | `10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16` |
 | `global.cniEnabled`                         | Omit the NET_ADMIN capability in the PSP and the proxy-init container when injecting the proxy; requires the linkerd-cni plugin to already be installed                               | `false`                              |
 | `global.controllerComponentLabel`           | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-component` |
 | `global.controllerNamespaceLabel`           | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-component` |
@@ -112,7 +113,6 @@ their default values.
 | `global.linkerdNamespaceLabel`              | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-component` |
 | `global.linkerdVersion`                     | Control plane version                                                                                                                                                                 | latest version                       |
 | `global.namespace`                          | Control plane namespace                                                                                                                                                               | `linkerd`                            |
-| `global.proxy.destinationGetNetworks`       | Network ranges for which the Linkerd proxy does destination lookups by IP address                                                                                                     | `10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16` |
 | `global.proxy.enableExternalProfiles`       | Enable service profiles for non-Kubernetes services                                                                                                                                   | `false`                              |
 | `global.proxy.image.name`                   | Docker image for the proxy                                                                                                                                                            | `ghcr.io/linkerd/proxy`            |
 | `global.proxy.image.pullPolicy`             | Pull policy for the proxy container Docker image                                                                                                                                      | `IfNotPresent`                       |
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index afacde744..65fe05a77 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -4,7 +4,16 @@
 
 # Values that are passed along to sub-charts
 global:
+  # The kubernetes cluster domain.
   clusterDomain: &cluster_domain cluster.local
+
+  # The cluster networks for which service discovery is performed. This should
+  # include the pod network but need not include the node network.
+  #
+  # By default, all private networks are specified so that resolution works in
+  # typical Kubernetes environments.
+  clusterNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
+
   imagePullPolicy: &image_pull_policy IfNotPresent
   controllerLogLevel: &controller_log_level info
 
@@ -74,7 +83,6 @@ global:
     # for more info on container lifecycle hooks.
     waitBeforeExitSeconds: 0
     requireIdentityOnInboundPorts: ""
-    destinationGetNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
 
   # proxy-init configuration
   proxyInit:
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index 0221c0662..15ce991d7 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -10,10 +10,8 @@ env:
   value: {{.Values.global.proxy.logFormat | quote}}
 - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
   value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s:8086" .Values.global.namespace .Values.global.clusterDomain) (eq .Values.global.proxy.component "linkerd-destination")}}
-{{ if .Values.global.proxy.destinationGetNetworks -}}
 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-  value: {{.Values.global.proxy.destinationGetNetworks | quote}}
-{{ end -}}
+  value: {{.Values.global.clusterNetworks | quote}}
 {{ if .Values.global.proxy.inboundConnectTimeout -}}
 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT
   value: {{.Values.global.proxy.inboundConnectTimeout | quote}}
diff --git a/cli/cmd/options.go b/cli/cmd/options.go
index 25fea92d5..3a28cc2a9 100644
--- a/cli/cmd/options.go
+++ b/cli/cmd/options.go
@@ -576,7 +576,7 @@ func validateValues(ctx context.Context, k *k8s.KubernetesAPI, values *l5dcharts
 }
 
 func validateProxyValues(values *l5dcharts.Values) error {
-	networks := strings.Split(values.Global.Proxy.DestinationGetNetworks, ",")
+	networks := strings.Split(values.Global.ClusterNetworks, ",")
 	for _, network := range networks {
 		if _, _, err := net.ParseCIDR(network); err != nil {
 			return fmt.Errorf("cannot parse destination get networks: %s", err)
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index 69b31c360..d232ff005 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -73,6 +73,7 @@ type (
 	Global struct {
 		Namespace                string              `json:"namespace"`
 		ClusterDomain            string              `json:"clusterDomain"`
+		ClusterNetworks          string              `json:"clusterNetworks"`
 		ImagePullPolicy          string              `json:"imagePullPolicy"`
 		CliVersion               string              `json:"cliVersion"`
 		ControllerComponentLabel string              `json:"controllerComponentLabel"`
@@ -117,7 +118,6 @@ type (
 		DisableIdentity               bool             `json:"disableIdentity"`
 		DisableTap                    bool             `json:"disableTap"`
 		EnableExternalProfiles        bool             `json:"enableExternalProfiles"`
-		DestinationGetNetworks        string           `json:"destinationGetNetworks"`
 		Image                         *Image           `json:"image"`
 		LogLevel                      string           `json:"logLevel"`
 		LogFormat                     string           `json:"logFormat"`
diff --git a/pkg/config/config.go b/pkg/config/config.go
index e074bbfe5..459f63981 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -126,6 +126,7 @@ func ToValues(configs *pb.All) *l5dcharts.Values {
 			IdentityTrustAnchorsPEM: configs.GetGlobal().GetIdentityContext().GetTrustAnchorsPem(),
 			IdentityTrustDomain:     configs.GetGlobal().GetIdentityContext().GetTrustDomain(),
 			ClusterDomain:           configs.GetGlobal().GetClusterDomain(),
+			ClusterNetworks:         configs.GetProxy().GetDestinationGetNetworks(),
 			LinkerdVersion:          configs.GetGlobal().GetVersion(),
 			Proxy: &l5dcharts.Proxy{
 				Image: &l5dcharts.Image{
@@ -150,7 +151,6 @@ func ToValues(configs *pb.All) *l5dcharts.Values {
 					},
 				},
 				EnableExternalProfiles: !configs.Proxy.GetDisableExternalProfiles(),
-				DestinationGetNetworks: configs.GetProxy().GetDestinationGetNetworks(),
 				LogFormat:              configs.GetProxy().GetLogFormat(),
 				OutboundConnectTimeout: configs.GetProxy().GetOutboundConnectTimeout(),
 				InboundConnectTimeout:  configs.GetProxy().GetInboundConnectTimeout(),
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index 54edbd249..b43a31748 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -243,8 +243,8 @@ func (conf *ResourceConfig) GetPatch(injectProxy bool) ([]byte, error) {
 		return nil, fmt.Errorf("%s cannot be set when identity is disabled", k8s.ProxyRequireIdentityOnInboundPortsAnnotation)
 	}
 
-	if values.Global.Proxy.DestinationGetNetworks != "" {
-		for _, network := range strings.Split(strings.Trim(values.Global.Proxy.DestinationGetNetworks, ","), ",") {
+	if values.Global.ClusterNetworks != "" {
+		for _, network := range strings.Split(strings.Trim(values.Global.ClusterNetworks, ","), ",") {
 			if _, _, err := net.ParseCIDR(network); err != nil {
 				return nil, fmt.Errorf("cannot parse destination get networks: %s", err)
 			}
@@ -748,7 +748,7 @@ func (conf *ResourceConfig) applyAnnotationOverrides(values *l5dcharts.Values) {
 	}
 
 	if override, ok := annotations[k8s.ProxyDestinationGetNetworks]; ok {
-		values.Global.Proxy.DestinationGetNetworks = override
+		values.Global.ClusterNetworks = override
 	}
 
 	if override, ok := annotations[k8s.ProxyOutboundConnectTimeout]; ok {


Test patch:
diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
index c7b7c2dde..d224ca341 100644
--- a/cli/cmd/install_test.go
+++ b/cli/cmd/install_test.go
@@ -45,6 +45,7 @@ func TestRender(t *testing.T) {
 		Global: &charts.Global{
 			Namespace:                "Namespace",
 			ClusterDomain:            "cluster.local",
+			ClusterNetworks:          "ClusterNetworks",
 			ImagePullPolicy:          "ImagePullPolicy",
 			CliVersion:               "CliVersion",
 			ControllerComponentLabel: "ControllerComponentLabel",
@@ -63,7 +64,6 @@ func TestRender(t *testing.T) {
 			PodAnnotations:           map[string]string{},
 			PodLabels:                map[string]string{},
 			Proxy: &charts.Proxy{
-				DestinationGetNetworks: "DestinationGetNetworks",
 				Image: &charts.Image{
 					Name:       "ProxyImageName",
 					PullPolicy: "ImagePullPolicy",
@@ -222,7 +222,7 @@ func TestRender(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Unexpected error: %v\n", err)
 	}
-	withCustomDestinationGetNetsValues.Global.Proxy.DestinationGetNetworks = "10.0.0.0/8,100.64.0.0/10,172.0.0.0/8"
+	withCustomDestinationGetNetsValues.Global.ClusterNetworks = "10.0.0.0/8,100.64.0.0/10,172.0.0.0/8"
 	addFakeTLSSecrets(withCustomDestinationGetNetsValues)
 
 	testCases := []struct {
@@ -382,7 +382,7 @@ func TestValidate(t *testing.T) {
 			t.Fatalf("Unexpected error: %v\n", err)
 		}
 
-		values.Global.Proxy.DestinationGetNetworks = "wrong"
+		values.Global.ClusterNetworks = "wrong"
 		expected := "cannot parse destination get networks: invalid CIDR address: wrong"
 
 		err = validateValues(context.Background(), nil, values)
diff --git a/cli/cmd/testdata/install_addon.golden b/cli/cmd/testdata/install_addon.golden
index f12cda178..d42975d45 100644
--- a/cli/cmd/testdata/install_addon.golden
+++ b/cli/cmd/testdata/install_addon.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_control-plane.golden b/cli/cmd/testdata/install_control-plane.golden
index c973748e4..1db92b0bd 100644
--- a/cli/cmd/testdata/install_control-plane.golden
+++ b/cli/cmd/testdata/install_control-plane.golden
@@ -36,6 +36,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -71,7 +72,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 51c41b6d9..127ece261 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: true
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 7be440320..67809778f 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 7300be918..711bb319a 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 56da49cd0..0c2277175 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.0.0.0/8
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.0.0.0/8
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -3474,7 +3474,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlVmVyc2lvbjogaW5zdGFsbC1jb250cm9sLXBsYW5lLXZlcnNpb24KZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICB2ZXJzaW9uOiBpbnN0YWxsLWRlYnVnLXZlcnNpb24KZ2xvYmFsOgogIGNvbnRyb2xsZXJJbWFnZVZlcnNpb246IGluc3RhbGwtY29udHJvbC1wbGFuZS12ZXJzaW9uCiAgaWRlbnRpdHlUcnVzdEFuY2hvcnNQRU06IHwKICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgTUlJQndUQ0NBV2FnQXdJQkFnSVFlRFpwNWxEYUl5Z1E1VWZNS1pyRkFUQUtCZ2dxaGtqT1BRUURBakFwTVNjdwogICAgSlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1clpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d0hoY05NakF3T0RJNAogICAgTURjeE1qUTNXaGNOTXpBd09ESTJNRGN4TWpRM1dqQXBNU2N3SlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1cgogICAgWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3V1RBVEJnY3Foa2pPUFFJQkJnZ3Foa2pPUFFNQkJ3TkNBQVJxYzcwWgogICAgbDF2Z3c3OXJqQjV1U0lUSUNVQTZHeWZ2U0ZmY3VJaXM3Qi9YRlNra3dBSFU1Uy9zMUFBUCtSMFRYN0hCV1VDNAogICAgdWFHNFdXc2l3SktObjdtZ28zQXdiakFPQmdOVkhROEJBZjhFQkFNQ0FRWXdFZ1lEVlIwVEFRSC9CQWd3QmdFQgogICAgL3dJQkFUQWRCZ05WSFE0RUZnUVU1WXRqVlZQZmQ3STdOTEhzbjJDMjZFQnlHVjB3S1FZRFZSMFJCQ0l3SUlJZQogICAgYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Bb0dDQ3FHU000OUJBTUNBMGtBTUVZQwogICAgSVFDTjdsQkZMRER2ang2VjArWGtqcEtFUlJzSllmNWFkTXZubG9GbDQ4aWxKZ0loQU50eGhuZGNyK1FKUHVDOAogICAgdmdVQzBkMi85Rk11ZUlWTWIrNDZXVENPanNxcgogICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogIHByb3h5OgogICAgZGVzdGluYXRpb25HZXROZXR3b3JrczogMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4wLjAuMC84CiAgICBpbWFnZToKICAgICAgdmVyc2lvbjogaW5zdGFsbC1wcm94eS12ZXJzaW9uCmhlYXJ0YmVhdFNjaGVkdWxlOiAxIDIgMyA0IDUKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb3h5SW5qZWN0b3I6CiAgY2FCdW5kbGU6IHByb3h5IGluamVjdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJveHkgaW5qZWN0b3IgY3J0CiAga2V5UEVNOiBwcm94eSBpbmplY3RvciBrZXkKdGFwOgogIGNhQnVuZGxlOiB0YXAgQ0EgYnVuZGxlCiAgY3J0UEVNOiB0YXAgY3J0CiAga2V5UEVNOiB0YXAga2V5Cg==
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlVmVyc2lvbjogaW5zdGFsbC1jb250cm9sLXBsYW5lLXZlcnNpb24KZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICB2ZXJzaW9uOiBpbnN0YWxsLWRlYnVnLXZlcnNpb24KZ2xvYmFsOgogIGNsdXN0ZXJOZXR3b3JrczogMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4wLjAuMC84CiAgY29udHJvbGxlckltYWdlVmVyc2lvbjogaW5zdGFsbC1jb250cm9sLXBsYW5lLXZlcnNpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgcHJveHk6CiAgICBpbWFnZToKICAgICAgdmVyc2lvbjogaW5zdGFsbC1wcm94eS12ZXJzaW9uCmhlYXJ0YmVhdFNjaGVkdWxlOiAxIDIgMyA0IDUKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb3h5SW5qZWN0b3I6CiAgY2FCdW5kbGU6IHByb3h5IGluamVjdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJveHkgaW5qZWN0b3IgY3J0CiAga2V5UEVNOiBwcm94eSBpbmplY3RvciBrZXkKdGFwOgogIGNhQnVuZGxlOiB0YXAgQ0EgYnVuZGxlCiAgY3J0UEVNOiB0YXAgY3J0CiAga2V5UEVNOiB0YXAga2V5Cg==
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_grafana_existing.golden b/cli/cmd/testdata/install_grafana_existing.golden
index 8b0d97b19..e31167485 100644
--- a/cli/cmd/testdata/install_grafana_existing.golden
+++ b/cli/cmd/testdata/install_grafana_existing.golden
@@ -815,6 +815,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -850,7 +851,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index cc1497858..9836c12a2 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 420a4f2ae..80461dc54 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index dd8dc4928..319f23138 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -774,6 +774,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -809,7 +810,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index b2f44c51c..42f303b2f 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -844,6 +844,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -867,7 +868,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -931,6 +931,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -954,7 +955,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1019,6 +1019,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1042,7 +1043,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1138,6 +1138,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1161,7 +1162,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1229,6 +1229,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1252,7 +1253,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_addons.golden b/cli/cmd/testdata/install_helm_output_addons.golden
index 0c8509e6a..e0efd7a50 100644
--- a/cli/cmd/testdata/install_helm_output_addons.golden
+++ b/cli/cmd/testdata/install_helm_output_addons.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -873,7 +874,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -937,6 +937,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -960,7 +961,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1025,6 +1025,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1048,7 +1049,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1144,6 +1144,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1167,7 +1168,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1235,6 +1235,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1258,7 +1259,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1348,6 +1348,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1371,7 +1372,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1436,6 +1436,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1459,7 +1460,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index 3fc86a885..9aca54bc8 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -873,7 +874,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -937,6 +937,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -959,7 +960,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1024,6 +1024,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1046,7 +1047,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1161,6 +1161,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1183,7 +1184,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1251,6 +1251,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1273,7 +1274,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 822545de8..48da8dd2b 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -877,7 +878,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -941,6 +941,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -967,7 +968,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1032,6 +1032,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1058,7 +1059,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1173,6 +1173,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1199,7 +1200,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1267,6 +1267,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1293,7 +1294,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 4a930193c..299c0d675 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -873,7 +874,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -937,6 +937,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -959,7 +960,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1024,6 +1024,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1046,7 +1047,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1161,6 +1161,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1183,7 +1184,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1251,6 +1251,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1273,7 +1274,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index feb81a90d..acdcd2ed3 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -815,6 +815,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: true
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -850,7 +851,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index f992bb9b7..7f5a2d6bc 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: CliVersion
       clusterDomain: cluster.local
+      clusterNetworks: ClusterNetworks
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: ControllerComponentLabel
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: DestinationGetNetworks
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -1119,7 +1119,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -1354,7 +1354,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -1607,7 +1607,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: localhost.:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -1888,7 +1888,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2101,7 +2101,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2356,7 +2356,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2598,7 +2598,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2910,7 +2910,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -3347,7 +3347,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -3493,7 +3493,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckltYWdlVmVyc2lvbjogQ29udHJvbGxlckltYWdlVmVyc2lvbgpkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmdsb2JhbDoKICBjbGlWZXJzaW9uOiBDbGlWZXJzaW9uCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgZGVzdGluYXRpb25HZXROZXR3b3JrczogRGVzdGluYXRpb25HZXROZXR3b3JrcwogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckltYWdlVmVyc2lvbjogQ29udHJvbGxlckltYWdlVmVyc2lvbgpkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmdsb2JhbDoKICBjbGlWZXJzaW9uOiBDbGlWZXJzaW9uCiAgY2x1c3Rlck5ldHdvcmtzOiBDbHVzdGVyTmV0d29ya3MKICBjb250cm9sbGVyQ29tcG9uZW50TGFiZWw6IENvbnRyb2xsZXJDb21wb25lbnRMYWJlbAogIGNvbnRyb2xsZXJJbWFnZVZlcnNpb246IENvbnRyb2xsZXJJbWFnZVZlcnNpb24KICBjb250cm9sbGVyTG9nTGV2ZWw6IENvbnRyb2xsZXJMb2dMZXZlbAogIGNvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbDogQ29udHJvbGxlck5hbWVzcGFjZUxhYmVsCiAgY3JlYXRlZEJ5QW5ub3RhdGlvbjogQ3JlYXRlZEJ5QW5ub3RhdGlvbgogIGlkZW50aXR5VHJ1c3RBbmNob3JzUEVNOiB8CiAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgIE1JSUJ3VENDQVdhZ0F3SUJBZ0lRZURacDVsRGFJeWdRNVVmTUtackZBVEFLQmdncWhrak9QUVFEQWpBcE1TY3cKICAgIEpRWURWUVFERXg1cFpHVnVkR2wwZVM1c2FXNXJaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dIaGNOTWpBd09ESTQKICAgIE1EY3hNalEzV2hjTk16QXdPREkyTURjeE1qUTNXakFwTVNjd0pRWURWUVFERXg1cFpHVnVkR2wwZVM1c2FXNXIKICAgIFpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFScWM3MFoKICAgIGwxdmd3NzlyakI1dVNJVElDVUE2R3lmdlNGZmN1SWlzN0IvWEZTa2t3QUhVNVMvczFBQVArUjBUWDdIQldVQzQKICAgIHVhRzRXV3Npd0pLTm43bWdvM0F3YmpBT0JnTlZIUThCQWY4RUJBTUNBUVl3RWdZRFZSMFRBUUgvQkFnd0JnRUIKICAgIC93SUJBVEFkQmdOVkhRNEVGZ1FVNVl0alZWUGZkN0k3TkxIc24yQzI2RUJ5R1Ywd0tRWURWUjBSQkNJd0lJSWUKICAgIGFXUmxiblJwZEhrdWJHbHVhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUMKICAgIElRQ043bEJGTEREdmp4NlYwK1hranBLRVJSc0pZZjVhZE12bmxvRmw0OGlsSmdJaEFOdHhobmRjcitRSlB1QzgKICAgIHZnVUMwZDIvOUZNdWVJVk1iKzQ2V1RDT2pzcXIKICAgIC0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KICBpbWFnZVB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogIGltYWdlUHVsbFNlY3JldHM6IG51bGwKICBsaW5rZXJkTmFtZXNwYWNlTGFiZWw6IExpbmtlcmROYW1lc3BhY2VMYWJlbAogIGxpbmtlcmRWZXJzaW9uOiAiIgogIG5hbWVzcGFjZTogTmFtZXNwYWNlCiAgcHJveHk6CiAgICBpbWFnZToKICAgICAgbmFtZTogUHJveHlJbWFnZU5hbWUKICAgICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICAgIHZlcnNpb246IFByb3h5VmVyc2lvbgogICAgaW5ib3VuZENvbm5lY3RUaW1lb3V0OiAiIgogICAgb3V0Ym91bmRDb25uZWN0VGltZW91dDogIiIKICAgIHJlc291cmNlczoKICAgICAgY3B1OgogICAgICAgIGxpbWl0OiBjcHUtbGltaXQKICAgICAgICByZXF1ZXN0OiBjcHUtcmVxdWVzdAogICAgICBtZW1vcnk6CiAgICAgICAgbGltaXQ6IG1lbW9yeS1saW1pdAogICAgICAgIHJlcXVlc3Q6IG1lbW9yeS1yZXF1ZXN0CiAgICB0cmFjZToKICAgICAgY29sbGVjdG9yU3ZjQWNjb3VudDogIiIKICBwcm94eUNvbnRhaW5lck5hbWU6IFByb3h5Q29udGFpbmVyTmFtZQogIHByb3h5SW5pdDoKICAgIGlnbm9yZUluYm91bmRQb3J0czogIiIKICAgIGlnbm9yZU91dGJvdW5kUG9ydHM6ICIiCiAgICBpbWFnZToKICAgICAgbmFtZTogUHJveHlJbml0SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eUluaXRWZXJzaW9uCiAgcHJveHlJbmplY3RBbm5vdGF0aW9uOiBQcm94eUluamVjdEFubm90YXRpb24KICBwcm94eUluamVjdERpc2FibGVkOiBQcm94eUluamVjdERpc2FibGVkCiAgd29ya2xvYWROYW1lc3BhY2VMYWJlbDogV29ya2xvYWROYW1lc3BhY2VMYWJlbApoZWFydGJlYXRTY2hlZHVsZTogIiIKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb21ldGhldXM6CiAgaW1hZ2U6IFByb21ldGhldXNJbWFnZQpwcm94eUluamVjdG9yOgogIGNhQnVuZGxlOiBwcm94eSBpbmplY3RvciBDQSBidW5kbGUKICBjcnRQRU06IHByb3h5IGluamVjdG9yIGNydAogIGtleVBFTTogcHJveHkgaW5qZWN0b3Iga2V5CnRhcDoKICBjYUJ1bmRsZTogdGFwIENBIGJ1bmRsZQogIGNydFBFTTogdGFwIGNydAogIGtleVBFTTogdGFwIGtleQp3ZWJJbWFnZTogV2ViSW1hZ2UKd2ViaG9va0ZhaWx1cmVQb2xpY3k6IFdlYmhvb2tGYWlsdXJlUG9saWN5Cg==
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_prometheus_overwrite.golden b/cli/cmd/testdata/install_prometheus_overwrite.golden
index a77279648..e7e638b51 100644
--- a/cli/cmd/testdata/install_prometheus_overwrite.golden
+++ b/cli/cmd/testdata/install_prometheus_overwrite.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 039eaf67a..9a61eb7ad 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_restricted_dashboard.golden b/cli/cmd/testdata/install_restricted_dashboard.golden
index dfccac1af..372ab6fb7 100644
--- a/cli/cmd/testdata/install_restricted_dashboard.golden
+++ b/cli/cmd/testdata/install_restricted_dashboard.golden
@@ -750,6 +750,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -785,7 +786,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_tracing.golden b/cli/cmd/testdata/install_tracing.golden
index f12cda178..d42975d45 100644
--- a/cli/cmd/testdata/install_tracing.golden
+++ b/cli/cmd/testdata/install_tracing.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_tracing_overwrite.golden b/cli/cmd/testdata/install_tracing_overwrite.golden
index b544b52e0..4c73af3af 100644
--- a/cli/cmd/testdata/install_tracing_overwrite.golden
+++ b/cli/cmd/testdata/install_tracing_overwrite.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index a450fb257..fb97a1306 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -47,6 +47,7 @@ func TestNewValues(t *testing.T) {
 		Global: &Global{
 			Namespace:                "linkerd",
 			ClusterDomain:            "cluster.local",
+			ClusterNetworks:          "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16",
 			ImagePullPolicy:          "IfNotPresent",
 			CliVersion:               "linkerd/cli dev-undefined",
 			ControllerComponentLabel: "linkerd.io/control-plane-component",
@@ -97,7 +98,6 @@ func TestNewValues(t *testing.T) {
 				},
 				UID:                    2102,
 				WaitBeforeExitSeconds:  0,
-				DestinationGetNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16",
 				OutboundConnectTimeout: "1000ms",
 				InboundConnectTimeout:  "100ms",
 			},
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 85b6f4b35..58e713a6d 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2564,6 +2564,7 @@ data:
     global:
       cliVersion: CliVersion
       clusterDomain: cluster.local
+      clusterNetworks: ClusterNetworks
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: ControllerComponentLabel
@@ -2584,7 +2585,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: DestinationGetNetworks
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -2683,6 +2683,7 @@ data:
 				Global: &linkerd2.Global{
 					Namespace:                "Namespace",
 					ClusterDomain:            "cluster.local",
+					ClusterNetworks:          "ClusterNetworks",
 					ImagePullPolicy:          "ImagePullPolicy",
 					CliVersion:               "CliVersion",
 					ControllerComponentLabel: "ControllerComponentLabel",
@@ -2698,8 +2699,7 @@ data:
 					CNIEnabled:               false,
 					IdentityTrustDomain:      defaultValues.Global.IdentityTrustDomain,
 					Proxy: &linkerd2.Proxy{
-						Component:              "linkerd-controller",
-						DestinationGetNetworks: "DestinationGetNetworks",
+						Component: "linkerd-controller",
 						Image: &linkerd2.Image{
 							Name:       "ProxyImageName",
 							PullPolicy: "ImagePullPolicy",
diff --git a/pkg/inject/inject_test.go b/pkg/inject/inject_test.go
index d217ad4ba..c876563c9 100644
--- a/pkg/inject/inject_test.go
+++ b/pkg/inject/inject_test.go
@@ -75,7 +75,7 @@ func TestGetOverriddenValues(t *testing.T) {
 				values, _ := l5dcharts.NewValues(false)
 
 				values.Global.Proxy.DisableIdentity = true
-				values.Global.Proxy.DestinationGetNetworks = "10.0.0.0/8"
+				values.Global.ClusterNetworks = "10.0.0.0/8"
 				values.Global.Proxy.Image.Name = "ghcr.io/linkerd/proxy"
 				values.Global.Proxy.Image.PullPolicy = pullPolicy
 				values.Global.Proxy.Image.Version = proxyVersionOverride
@@ -211,7 +211,7 @@ func TestGetOverriddenValues(t *testing.T) {
 			},
 			expected: func() *l5dcharts.Values {
 				values, _ := l5dcharts.NewValues(false)
-				values.Global.Proxy.DestinationGetNetworks = ""
+				values.Global.ClusterNetworks = ""
 				return values
 			},
 		},