Repository: linkerd/linkerd2
Pull request #5762 (2021-02-17 01:24:49)

Add support for CLI extensions
As described in https://github.com/linkerd/linkerd2/pull/5692, this PR adds support for CLI extensions.

Calling `linkerd foo` (if `foo` is not an existing Linkerd command) will now search the current PATH for an executable named `linkerd-foo` and invoke it with the current arguments.

* All arguments and flags will be passed to the extension command
* The Linkerd command itself will not process any flags
* To simplify parsing, flags are not allowed before the extension name

e.g. with an executable called `linkerd-foo` on my PATH:

```console
> linkerd foo install
Welcome to Linkerd foo!
Got: install
> linkerd foo --context=prod install
Welcome to Linkerd foo!
Got: --context=prod install
> linkerd --context=prod foo install
Cannot accept flags before Linkerd extension name
> linkerd bar install
Error: unknown command "bar" for "linkerd"
Run 'linkerd --help' for usage.
```

We also update `linkerd check` to invoke `linkerd <extension> check` for each extension found installed on the current cluster.  A check warning is emitted if the extension command is not found on the path.

e.g. with both `linkerd.io/extension=foo` and `linkerd.io/extension=bar` extensions installed on the cluster:

```console
> linkerd check
[...]
Linkerd extensions checks
=========================

Welcome to Linkerd foo!
Got: check --as-group=[] --cni-namespace=linkerd-cni --help=false --linkerd-cni-enabled=false --linkerd-namespace=linkerd --output=table --pre=false --proxy=false --verbose=false --wait=5m0s

linkerd-bar
-----------
‼ Linkerd extension command linkerd-bar exists

Status check results are ‼
```

olix0r: OK.. testing this:

1. Install linkerd
2. `k create ns linkerd-boop ; k label ns/linkerd-boop linkerd.io/extension: linkerd-boop`
3. `linkerd check`
```
...

linkerd-linkerd-boop
--------------------
‼ Linkerd extension command linkerd-linkerd-boop exists
```

This isn't at all clear what's going on... I assume this means that there's a warning that the `linkerd-linkerd-boop` command doesn't exist? But it should actually say that... The output there isn't helpful.

The other thing that's weird is `linkerd-linkerd-boop`... Should the extension label value just be `boop` instead of `linkerd-boop`? (I cribbed from the viz namespace, where the label value is `linkerd-viz`).

Running `echo "#!/bin/sh" > ~/bin/linkerd-linkerd-boop` (creating an extension file that isn't executable) -- i get the same warning message:

    ‼ Linkerd extension command linkerd-linkerd-boop exists 

It would be helpful to be more descriptive that the file exists and isn't executable...

Making it executable... `linkerd check` passes but doesn't list the extension at all? I would expect us to at least print something about the extension instead of silently ignoring it?

```
...

Linkerd extensions checks
=========================

linkerd-viz
-----------
√ linkerd-viz Namespace exists
√ linkerd-viz ClusterRoles exist
√ linkerd-viz ClusterRoleBindings exist
√ tap API server has valid cert
√ tap API server cert is valid for at least 60 days
√ tap API service is running
√ linkerd-viz pods are injected
√ viz extension pods are running
√ prometheus is installed and configured correctly
√ can initialize the client
√ viz extension self-check

Status check results are √
```

Without the viz extension, the output is even weirder:

```
...
Status check results are √

Linkerd extensions checks
=========================

```

(and nothing below the extension checks message)

Similarly, if the extension command fails with error (simply doing `exit 1`) no output is emitted... I'd expect the extension check to show some contextual error in this case.

With an extension script like:

```
#!/bin/sh

echo "some error message" >&2
exit 1
```

We get

```
...

Linkerd extensions checks
=========================

some error message
```

without any indication of which extension failed.

--

In general, i'm a bit skeptical of relying on the extension to only output plaintext without any handling by the wrapper process... it seems prone to very confusing/misleading output. I think, ideally, the main `linkerd` binary should handle formatting and the extension should only operate by outputing some structured output.
adleong: This PR has been updated to always call extension checks with `--output=json` and parsing the resulting output.  For example an extension command like this:

```console
> cat linkerd-foo
#!/bin/sh

echo '{
  "success": true,
  "categories": [
    {
      "categoryName": "linkerd-foo",
      "checks": [
        {
          "description": "everything looks ship shape, captain!",
          "result": "success"
        },
        {
          "description": "actually, hold on...",
          "result": "warning",
          "error": "something is fishy here..."
        },
        {
          "description": "oh no!",
          "result": "error",
          "error": "abandon ship!"
        }
      ]
    }
  ]
}'

```

results in check output like:

```console
Linkerd extensions checks
=========================

linkerd-foo
-----------
√ Linkerd extension command linkerd-foo exists
√ everything looks ship shape, captain!
‼ actually, hold on...
    something is fishy here...
× oh no!
    abandon ship!

Status check results are ×
```
adleong: @alpeb great catch!  I've changed it so that even the built-in extensions get invoked by shelling out.  This makes the behavior more consistent and now if the extension check exits, we can still continue.

Patch:
diff --git a/charts/linkerd2-cni/README.md b/charts/linkerd2-cni/README.md
index 2fc484194..d31d7e906 100644
--- a/charts/linkerd2-cni/README.md
+++ b/charts/linkerd2-cni/README.md
@@ -25,16 +25,14 @@ Kubernetes: `>=1.16.0-0`
 | cniPluginImage | string | `"cr.l5d.io/linkerd/cni-plugin"` | Docker image for the CNI plugin |
 | cniPluginVersion | string | `"linkerdVersionValue"` | Tag for the CNI container Docker image |
 | destCNIBinDir | string | `"/opt/cni/bin"` | Directory on the host where the CNI configuration will be placed |
-| destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside  |
-| ignoreInboundPorts | string | `"25,443,587,3306,11211"` | Inbound ports the proxy should ignore - SMTP (25,587) server-first - HTTPS (443) opaque TLS - MYSQL (3306) server-first - Memcached (11211) clients do not issue any preamble, which breaks detection |
-| ignoreOutboundPorts | string | `"25,443,587,3306,11211"` | Outbound ports the proxy should ignore |
+| destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside |
 | imagePullSecrets | string | `nil` |  |
 | inboundProxyPort | int | `4143` | Inbound port for the proxy container |
-| installNamespace | bool | `true` | Whether to create the CNI plugin plane namespace or not  |
+| installNamespace | bool | `true` | Whether to create the CNI plugin plane namespace or not |
 | logLevel | string | `"info"` | Log level for the CNI plugin |
 | namespace | string | `"linkerd-cni"` | CNI plugin plane namespace |
 | outboundProxyPort | int | `4140` | Outbound port for the proxy container |
-| portsToRedirect | string | `""` | Ports to redirect to proxy  |
+| portsToRedirect | string | `""` | Ports to redirect to proxy |
 | priorityClassName | string | `""` | Kubernetes priorityClassName for the CNI plugin's Pods |
 | proxyUID | int | `2102` | User id under which the proxy shall be ran |
 | useWaitFlag | bool | `false` | Configures the CNI plugin to use the -w flag for the iptables command |
diff --git a/charts/linkerd2-cni/templates/cni-plugin.yaml b/charts/linkerd2-cni/templates/cni-plugin.yaml
index 3290367bd..59778a36d 100644
--- a/charts/linkerd2-cni/templates/cni-plugin.yaml
+++ b/charts/linkerd2-cni/templates/cni-plugin.yaml
@@ -148,12 +148,16 @@ data:
         "outgoing-proxy-port": {{.Values.outboundProxyPort}},
         "proxy-uid": {{.Values.proxyUID}},
         "ports-to-redirect": [{{.Values.portsToRedirect}}],
+        {{- if .Values.ignoreInboundPorts }}
         "inbound-ports-to-ignore": [
           {{- include "partials.splitStringList" .Values.ignoreInboundPorts -}}
         ],
+        {{- end }}
+        {{- if .Values.ignoreOutboundPorts }}
         "outbound-ports-to-ignore": [
           {{- include "partials.splitStringList" .Values.ignoreOutboundPorts -}}
         ],
+        {{- end }}
         "simulate": false,
         "use-wait-flag": {{.Values.useWaitFlag}}
       }
diff --git a/charts/linkerd2-cni/values.yaml b/charts/linkerd2-cni/values.yaml
index 8ac239af5..5040be8d1 100644
--- a/charts/linkerd2-cni/values.yaml
+++ b/charts/linkerd2-cni/values.yaml
@@ -1,30 +1,22 @@
 # -- CNI plugin plane namespace
 namespace: linkerd-cni
-# -- Whether to create the CNI plugin plane namespace or not 
+# -- Whether to create the CNI plugin plane namespace or not
 installNamespace: true
 # -- Inbound port for the proxy container
 inboundProxyPort: 4143
 # -- Outbound port for the proxy container
 outboundProxyPort: 4140
-# -- Inbound ports the proxy should ignore
-# - SMTP (25,587) server-first
-# - HTTPS (443) opaque TLS
-# - MYSQL (3306) server-first
-# - Memcached (11211) clients do not issue any preamble, which breaks detection
-ignoreInboundPorts: "25,443,587,3306,11211"
-# -- Outbound ports the proxy should ignore
-ignoreOutboundPorts: "25,443,587,3306,11211"
 # -- Docker image for the CNI plugin
 cniPluginImage:   "cr.l5d.io/linkerd/cni-plugin"
 # -- Tag for the CNI container Docker image
 cniPluginVersion: linkerdVersionValue
 # -- Log level for the CNI plugin
 logLevel:         info
-# -- Ports to redirect to proxy 
+# -- Ports to redirect to proxy
 portsToRedirect:  ""
 # -- User id under which the proxy shall be ran
 proxyUID:         2102
-# -- Directory on the host where the CNI plugin binaries reside 
+# -- Directory on the host where the CNI plugin binaries reside
 destCNINetDir:    "/etc/cni/net.d"
 # -- Directory on the host where the CNI configuration will be placed
 destCNIBinDir:    "/opt/cni/bin"
@@ -33,7 +25,7 @@ useWaitFlag:      false
 # -- Kubernetes priorityClassName for the CNI plugin's Pods
 priorityClassName: ""
 
-# -|- Tolerations section, See the 
+# -|- Tolerations section, See the
 # [K8S documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
 # for more information
 #tolerations:
diff --git a/charts/linkerd2/README.md b/charts/linkerd2/README.md
index a5e50e2be..9afab7101 100644
--- a/charts/linkerd2/README.md
+++ b/charts/linkerd2/README.md
@@ -174,6 +174,7 @@ Kubernetes: `>=1.16.0-0`
 | proxy.inboundConnectTimeout | string | `"100ms"` | Maximum time allowed for the proxy to establish an inbound TCP connection |
 | proxy.logFormat | string | `"plain"` | Log format (`plain` or `json`) for the proxy |
 | proxy.logLevel | string | `"warn,linkerd=info"` | Log level for the proxy |
+| proxy.opaquePorts | string | `"25,443,587,3306,5432,11211"` | Default set of opaque ports - SMTP (25,587) server-first - HTTPS (443) opaque TLS - MYSQL (3306) server-first - PostgreSQL (5432) server-first - Memcached (11211) clients do not issue any preamble, which breaks detection |
 | proxy.outboundConnectTimeout | string | `"1000ms"` | Maximum time allowed for the proxy to establish an outbound TCP connection |
 | proxy.ports.admin | int | `4191` | Admin port for the proxy container |
 | proxy.ports.control | int | `4190` | Control port for the proxy container |
@@ -187,8 +188,6 @@ Kubernetes: `>=1.16.0-0`
 | proxy.uid | int | `2102` | User id under which the proxy runs |
 | proxy.waitBeforeExitSeconds | int | `0` | If set the proxy sidecar will stay alive for at least the given period before receiving SIGTERM signal from Kubernetes but no longer than pod's `terminationGracePeriodSeconds`. See [Lifecycle hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks) for more info on container lifecycle hooks. |
 | proxyInit.closeWaitTimeoutSecs | int | `0` |  |
-| proxyInit.ignoreInboundPorts | string | `"25,443,587,3306,11211"` | Default set of ports to skip via itpables: - SMTP (25,587) server-first - HTTPS (443) opaque TLS - MYSQL (3306) server-first - Memcached (11211) clients do not issue any preamble, which breaks detection |
-| proxyInit.ignoreOutboundPorts | string | `"25,443,587,3306,11211"` | Default set of ports to skip via itpables, same defaults as InboudPorts |
 | proxyInit.image.name | string | `"cr.l5d.io/linkerd/proxy-init"` | Docker image for the proxy-init container |
 | proxyInit.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy-init container Docker image |
 | proxyInit.image.version | string | `"v1.3.9"` | Tag for the proxy-init container Docker image |
diff --git a/charts/linkerd2/templates/controller.yaml b/charts/linkerd2/templates/controller.yaml
index 1f080c93e..791989503 100644
--- a/charts/linkerd2/templates/controller.yaml
+++ b/charts/linkerd2/templates/controller.yaml
@@ -129,7 +129,7 @@ spec:
       {{ if not .Values.cniEnabled -}}
       initContainers:
       {{- if not (contains "443" ( .Values.proxyInit.ignoreOutboundPorts | toString ))}}
-      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" (printf "%s,443" ( .Values.proxyInit.ignoreOutboundPorts | toString )) -}}
+      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" ( ternary "443" (printf "%s,443" (.Values.proxyInit.ignoreOutboundPorts | toString )) (empty .Values.proxyInit.ignoreOutboundPorts)) -}}
       {{- end}}
       - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ end -}}
diff --git a/charts/linkerd2/templates/destination.yaml b/charts/linkerd2/templates/destination.yaml
index 7d7f1344d..21bec1dcc 100644
--- a/charts/linkerd2/templates/destination.yaml
+++ b/charts/linkerd2/templates/destination.yaml
@@ -151,7 +151,7 @@ spec:
       {{ if not .Values.cniEnabled -}}
       initContainers:
       {{- if not (contains "443" ( .Values.proxyInit.ignoreOutboundPorts | toString ))}}
-      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" (printf "%s,443" ( .Values.proxyInit.ignoreOutboundPorts | toString )) -}}
+      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" ( ternary "443" (printf "%s,443" (.Values.proxyInit.ignoreOutboundPorts | toString )) (empty .Values.proxyInit.ignoreOutboundPorts)) -}}
       {{- end}}
       - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ end -}}
diff --git a/charts/linkerd2/templates/identity.yaml b/charts/linkerd2/templates/identity.yaml
index d82a395fd..244b52d75 100644
--- a/charts/linkerd2/templates/identity.yaml
+++ b/charts/linkerd2/templates/identity.yaml
@@ -175,7 +175,7 @@ spec:
       {{ if not .Values.cniEnabled -}}
       initContainers:
       {{- if not (contains "443" ( .Values.proxyInit.ignoreOutboundPorts | toString ))}}
-      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" (printf "%s,443" ( .Values.proxyInit.ignoreOutboundPorts | toString )) -}}
+      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" ( ternary "443" (printf "%s,443" (.Values.proxyInit.ignoreOutboundPorts | toString )) (empty .Values.proxyInit.ignoreOutboundPorts)) -}}
       {{- end}}
       - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ end -}}
diff --git a/charts/linkerd2/templates/proxy-injector.yaml b/charts/linkerd2/templates/proxy-injector.yaml
index e59393f19..0ec351109 100644
--- a/charts/linkerd2/templates/proxy-injector.yaml
+++ b/charts/linkerd2/templates/proxy-injector.yaml
@@ -95,7 +95,7 @@ spec:
       {{ if not .Values.cniEnabled -}}
       initContainers:
       {{- if not (contains "443" ( .Values.proxyInit.ignoreOutboundPorts | toString ))}}
-      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" (printf "%s,443" ( .Values.proxyInit.ignoreOutboundPorts | toString )) -}}
+      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" ( ternary "443" (printf "%s,443" (.Values.proxyInit.ignoreOutboundPorts | toString )) (empty .Values.proxyInit.ignoreOutboundPorts)) -}}
       {{- end}}
       - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ end -}}
diff --git a/charts/linkerd2/templates/sp-validator.yaml b/charts/linkerd2/templates/sp-validator.yaml
index 840cbeb02..bff04477a 100644
--- a/charts/linkerd2/templates/sp-validator.yaml
+++ b/charts/linkerd2/templates/sp-validator.yaml
@@ -130,7 +130,7 @@ spec:
       {{ if not .Values.cniEnabled -}}
       initContainers:
       {{- if not (contains "443" ( .Values.proxyInit.ignoreOutboundPorts | toString ))}}
-      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" (printf "%s,443" ( .Values.proxyInit.ignoreOutboundPorts | toString )) -}}
+      {{- $_ := set $tree.Values.proxyInit "ignoreOutboundPorts" ( ternary "443" (printf "%s,443" (.Values.proxyInit.ignoreOutboundPorts | toString )) (empty .Values.proxyInit.ignoreOutboundPorts)) -}}
       {{- end}}
       - {{- include "partials.proxy-init" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ end -}}
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index df9c2e422..5b513513d 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -98,16 +98,16 @@ proxy:
   # for more info on container lifecycle hooks.
   waitBeforeExitSeconds: 0
   requireIdentityOnInboundPorts: ""
-# proxy-init configuration
-proxyInit:
-  # -- Default set of ports to skip via itpables:
+  # -- Default set of opaque ports
   # - SMTP (25,587) server-first
   # - HTTPS (443) opaque TLS
   # - MYSQL (3306) server-first
+  # - PostgreSQL (5432) server-first
   # - Memcached (11211) clients do not issue any preamble, which breaks detection
-  ignoreInboundPorts: "25,443,587,3306,11211"
-  # -- Default set of ports to skip via itpables, same defaults as InboudPorts
-  ignoreOutboundPorts: "25,443,587,3306,11211"
+  opaquePorts: "25,443,587,3306,5432,11211"
+
+# proxy-init configuration
+proxyInit:
   image:
     # -- Docker image for the proxy-init container
     name: cr.l5d.io/linkerd/proxy-init
diff --git a/cli/cmd/check.go b/cli/cmd/check.go
index 19872b6a0..dc2ad2f29 100644
--- a/cli/cmd/check.go
+++ b/cli/cmd/check.go
@@ -1,11 +1,13 @@
 package cmd
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"strings"
 	"time"
 
@@ -16,7 +18,6 @@ import (
 	"github.com/linkerd/linkerd2/pkg/healthcheck"
 	"github.com/linkerd/linkerd2/pkg/k8s"
 	"github.com/linkerd/linkerd2/pkg/version"
-	vizCmd "github.com/linkerd/linkerd2/viz/cmd"
 	vizHealthCheck "github.com/linkerd/linkerd2/viz/pkg/healthcheck"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -212,34 +213,35 @@ func configureAndRunChecks(cmd *cobra.Command, wout io.Writer, werr io.Writer, s
 
 	success := healthcheck.RunChecks(wout, werr, hc, options.output)
 
-	if !success {
-		os.Exit(1)
-	}
-
-	err = runExtensionChecks(cmd, wout, werr, options)
+	extensionSuccess, err := runExtensionChecks(cmd, wout, werr, options)
 	if err != nil {
 		err = fmt.Errorf("failed to run extensions checks: %s", err)
 		fmt.Fprintln(werr, err)
 		os.Exit(1)
 	}
 
+	if !success || !extensionSuccess {
+		os.Exit(1)
+	}
+
 	return nil
 }
 
-func runExtensionChecks(cmd *cobra.Command, wout io.Writer, werr io.Writer, opts *checkOptions) error {
+func runExtensionChecks(cmd *cobra.Command, wout io.Writer, werr io.Writer, opts *checkOptions) (bool, error) {
 	kubeAPI, err := k8s.NewAPI(kubeconfigPath, kubeContext, impersonate, impersonateGroup, 0)
 	if err != nil {
-		return err
+		return false, err
 	}
 
 	namespaces, err := kubeAPI.GetAllNamespacesWithExtensionLabel(cmd.Context())
 	if err != nil {
-		return err
+		return false, err
 	}
 
+	success := true
 	// no extensions to check
 	if len(namespaces) == 0 {
-		return nil
+		return success, nil
 	}
 
 	if opts.output != healthcheck.JSONOutput {
@@ -254,103 +256,90 @@ func runExtensionChecks(cmd *cobra.Command, wout io.Writer, werr io.Writer, opts
 			// add a new line to space out each check output
 			fmt.Fprintln(wout)
 		}
+		extension := ns.Labels[k8s.LinkerdExtensionLabel]
+
+		var path string
+		args := append([]string{"check"}, getExtensionCheckFlags(cmd.Flags())...)
+		var err error
+		results := healthcheck.CheckResults{
+			Results: []healthcheck.CheckResult{},
+		}
+		extensionCmd := fmt.Sprintf("linkerd-%s", extension)
 
-		switch ns.Labels[k8s.LinkerdExtensionLabel] {
+		switch extension {
 		case jaegerCmd.JaegerExtensionName:
-			jaegerCheckCmd := jaegerCmd.NewCmdCheck()
-			err = executeExtensionCheck(cmd, "jaeger", jaegerCheckCmd.Flags())
+			path = os.Args[0]
+			args = append([]string{"jaeger"}, args...)
 		case vizHealthCheck.VizExtensionName:
-			vizCmd := vizCmd.NewCmdCheck()
-			err = executeExtensionCheck(cmd, "viz", vizCmd.Flags())
+			path = os.Args[0]
+			args = append([]string{"viz"}, args...)
 		case mcCmd.MulticlusterExtensionName:
-			mcCheckCmd := mcCmd.NewCmdCheck()
-			err = executeExtensionCheck(cmd, "multicluster", mcCheckCmd.Flags())
+			path = os.Args[0]
+			args = append([]string{"multicluster"}, args...)
 		default:
-			// Since we don't have checks for extensions we don't support
-			// create a healthchecker that checks if the namespace exists
-			categoryID := healthcheck.CategoryID(ns.Labels[k8s.LinkerdExtensionLabel])
-			checkers := []healthcheck.Checker{}
-			checkers = append(checkers,
-				*healthcheck.NewChecker(fmt.Sprintf("%s extension Namespace exists", categoryID)).
-					WithHintAnchor(fmt.Sprintf("%s-ns-exists", categoryID)).
-					Fatal().
-					WithCheck(func(ctx context.Context) error {
-						_, err := kubeAPI.GetNamespaceWithExtensionLabel(ctx, string(categoryID))
-						if err != nil {
-							return err
-						}
-						return nil
-					}))
-			hc := healthcheck.NewHealthChecker([]healthcheck.CategoryID{categoryID},
-				&healthcheck.Options{
-					ControlPlaneNamespace: controlPlaneNamespace,
-					CNINamespace:          cniNamespace,
-					DataPlaneNamespace:    opts.namespace,
-					KubeConfig:            kubeconfigPath,
-					KubeContext:           kubeContext,
-					Impersonate:           impersonate,
-					ImpersonateGroup:      impersonateGroup,
-					APIAddr:               apiAddr,
-					VersionOverride:       opts.versionOverride,
-					RetryDeadline:         time.Now().Add(opts.wait),
-					CNIEnabled:            opts.cniEnabled,
+			path, err = exec.LookPath(extensionCmd)
+			results.Results = []healthcheck.CheckResult{
+				{
+					Category:    healthcheck.CategoryID(extensionCmd),
+					Description: fmt.Sprintf("Linkerd extension command %s exists", extensionCmd),
+					Err:         err,
+					HintAnchor:  "extensions",
+					Warning:     true,
+				},
+			}
+		}
+		if err == nil {
+			plugin := exec.Command(path, args...)
+			var stdout, stderr bytes.Buffer
+			plugin.Stdout = &stdout
+			plugin.Stderr = &stderr
+			plugin.Run()
+			extensionResults, err := healthcheck.ParseJSONCheckOutput(stdout.Bytes())
+			if err != nil {
+				command := fmt.Sprintf("%s %s", path, strings.Join(args, " "))
+				if len(stderr.String()) > 0 {
+					err = errors.New(stderr.String())
+				} else {
+					err = fmt.Errorf("invalid extension check output from \"%s\" (JSON object expected):\n%s\n[%s]", command, stdout.String(), err)
+				}
+				results.Results = append(results.Results, healthcheck.CheckResult{
+					Category:    healthcheck.CategoryID(extensionCmd),
+					Description: fmt.Sprintf("Running: %s", command),
+					Err:         err,
+					HintAnchor:  "extensions",
 				})
-			hc.AppendCategories(*healthcheck.NewCategory(categoryID, checkers, true))
-			success := healthcheck.RunChecks(wout, werr, hc, opts.output)
-			if !success {
-				os.Exit(1)
+				success = false
+			} else {
+				results.Results = append(results.Results, extensionResults.Results...)
 			}
 		}
-		if err != nil {
-			return err
+		extensionSuccess := healthcheck.RunChecks(wout, werr, results, opts.output)
+		if !extensionSuccess {
+			success = false
 		}
 	}
-	return nil
-}
-
-func getGlobalFlags(lf *pflag.FlagSet) []string {
-	cmdLineFlags := []string{}
-	lf.VisitAll(func(f *pflag.Flag) {
-		val := f.Value.String()
-		if val != "" {
-			cmdLineFlags = append(cmdLineFlags, fmt.Sprintf("--%s=%s", f.Name, val))
-		}
-	})
-
-	return cmdLineFlags
+	return success, nil
 }
 
-func getSharedFlags(lf *pflag.FlagSet, lf2 *pflag.FlagSet) []string {
+func getExtensionCheckFlags(lf *pflag.FlagSet) []string {
+	extensionFlags := []string{
+		"api-addr", "context", "as", "as-group", "kubeconfig", "linkerd-namespace", "verbose",
+		"namespace", "proxy", "wait",
+	}
 	cmdLineFlags := []string{}
-	lf.VisitAll(func(f *pflag.Flag) {
-		val := f.Value.String()
-
-		if val == "" {
-			// skip processing empty flags
-			return
-		}
-
-		if lf2.Lookup(f.Name) != nil {
-			cmdLineFlags = append(cmdLineFlags, fmt.Sprintf("--%s=%s", f.Name, val))
+	for _, flag := range extensionFlags {
+		f := lf.Lookup(flag)
+		if f != nil {
+			val := f.Value.String()
+			if val != "" {
+				cmdLineFlags = append(cmdLineFlags, fmt.Sprintf("--%s=%s", f.Name, val))
+			}
 		}
-	})
-
+	}
+	cmdLineFlags = append(cmdLineFlags, "--output=json")
 	return cmdLineFlags
 }
 
-func executeExtensionCheck(currentCmd *cobra.Command, extension string, lf *pflag.FlagSet) error {
-	rootCmd := currentCmd.Root()
-	globalFlags := getGlobalFlags(rootCmd.PersistentFlags())
-	localFlags := getSharedFlags(currentCmd.Flags(), lf)
-
-	args := []string{extension, "check"}
-	args = append(args, globalFlags...)
-	args = append(args, localFlags...)
-
-	rootCmd.SetArgs(args)
-	return rootCmd.Execute()
-}
-
 func renderInstallManifest(ctx context.Context) (string, error) {
 	values, err := charts.NewValues()
 	if err != nil {
diff --git a/cli/main.go b/cli/main.go
index b3bdb1032..372cc26b2 100644
--- a/cli/main.go
+++ b/cli/main.go
@@ -1,13 +1,37 @@
 package main
 
 import (
+	"fmt"
 	"os"
+	"os/exec"
+	"strings"
 
 	"github.com/linkerd/linkerd2/cli/cmd"
 )
 
 func main() {
-	if err := cmd.RootCmd.Execute(); err != nil {
+	root := cmd.RootCmd
+	args := os.Args[1:]
+	if _, _, err := root.Find(args); err != nil {
+		if strings.HasPrefix(args[0], "-") {
+			fmt.Fprintln(os.Stderr, "Cannot accept flags before Linkerd extension name")
+			os.Exit(1)
+		}
+		path, err := exec.LookPath(fmt.Sprintf("linkerd-%s", args[0]))
+		if err == nil {
+			plugin := exec.Command(path, args[1:]...)
+			plugin.Stdin = os.Stdin
+			plugin.Stdout = os.Stdout
+			plugin.Stderr = os.Stderr
+			err = plugin.Run()
+			if err != nil {
+				fmt.Fprintln(os.Stderr, err)
+				os.Exit(1)
+			}
+			return
+		}
+	}
+	if err := root.Execute(); err != nil {
 		os.Exit(1)
 	}
 }
diff --git a/cni-plugin/main.go b/cni-plugin/main.go
index c4ee6c591..6741abaa7 100644
--- a/cni-plugin/main.go
+++ b/cni-plugin/main.go
@@ -237,7 +237,12 @@ func cmdAdd(args *skel.CmdArgs) error {
 				logEntry.Errorf("linkerd-cni: could not create a Firewall Configuration from the options: %v", options)
 				return err
 			}
-			iptables.ConfigureFirewall(*firewallConfiguration)
+
+			err = iptables.ConfigureFirewall(*firewallConfiguration)
+			if err != nil {
+				logEntry.Errorf("linkerd-cni: could not configure firewall: %v", err)
+				return err
+			}
 		} else {
 			if containsInitContainer {
 				logEntry.Debug("linkerd-cni: linkerd-init initContainer is present, skipping.")
diff --git a/controller/api/destination/endpoint_translator.go b/controller/api/destination/endpoint_translator.go
index 449f8eca3..3a849da1d 100644
--- a/controller/api/destination/endpoint_translator.go
+++ b/controller/api/destination/endpoint_translator.go
@@ -10,6 +10,7 @@ import (
 	"github.com/linkerd/linkerd2/controller/api/destination/watcher"
 	"github.com/linkerd/linkerd2/pkg/addr"
 	"github.com/linkerd/linkerd2/pkg/k8s"
+	"github.com/linkerd/linkerd2/pkg/opaqueports"
 	logging "github.com/sirupsen/logrus"
 	corev1 "k8s.io/api/core/v1"
 	coreinformers "k8s.io/client-go/informers/core/v1"
@@ -213,10 +214,15 @@ func (et *endpointTranslator) sendClientAdd(set watcher.AddressSet) {
 			err error
 		)
 		if address.Pod != nil {
-			opaquePorts, getErr := getPodOpaquePortsAnnotations(address.Pod)
+			opaquePorts, ok, getErr := getPodOpaquePortsAnnotations(address.Pod)
 			if getErr != nil {
 				et.log.Errorf("failed getting opaque ports annotation for pod: %s", getErr)
 			}
+			// If the opaque ports annotation was not set, then set the
+			// endpoint's opaque ports to the default value.
+			if !ok {
+				opaquePorts = opaqueports.DefaultOpaquePorts
+			}
 			wa, err = toWeightedAddr(address, opaquePorts, et.enableH2Upgrade, et.identityTrustDomain, et.controllerNS, et.log)
 		} else {
 			var authOverride *pb.AuthorityOverride
diff --git a/controller/api/destination/opaque_ports_adaptor.go b/controller/api/destination/opaque_ports_adaptor.go
index 60bc422bd..8acd94244 100644
--- a/controller/api/destination/opaque_ports_adaptor.go
+++ b/controller/api/destination/opaque_ports_adaptor.go
@@ -36,8 +36,6 @@ func (opa *opaquePortsAdaptor) publish() {
 	if opa.profile != nil {
 		merged = *opa.profile
 	}
-	if len(opa.opaquePorts) != 0 {
-		merged.Spec.OpaquePorts = opa.opaquePorts
-	}
+	merged.Spec.OpaquePorts = opa.opaquePorts
 	opa.listener.Update(&merged)
 }
diff --git a/controller/api/destination/server.go b/controller/api/destination/server.go
index de8b90b7f..34ab39d77 100644
--- a/controller/api/destination/server.go
+++ b/controller/api/destination/server.go
@@ -12,6 +12,7 @@ import (
 	sp "github.com/linkerd/linkerd2/controller/gen/apis/serviceprofile/v1alpha2"
 	"github.com/linkerd/linkerd2/controller/k8s"
 	labels "github.com/linkerd/linkerd2/pkg/k8s"
+	"github.com/linkerd/linkerd2/pkg/opaqueports"
 	"github.com/linkerd/linkerd2/pkg/prometheus"
 	"github.com/linkerd/linkerd2/pkg/util"
 	logging "github.com/sirupsen/logrus"
@@ -203,7 +204,6 @@ func (s *server) GetProfile(dest *pb.GetDestination, stream pb.Destination_GetPr
 			if err != nil {
 				return err
 			}
-
 			var endpoint *pb.WeightedAddr
 			opaquePorts := make(map[uint32]struct{})
 			if pod != nil {
@@ -217,10 +217,16 @@ func (s *server) GetProfile(dest *pb.GetDestination, stream pb.Destination_GetPr
 				if err != nil {
 					log.Errorf("failed to set opaque port annotation on pod: %s", err)
 				}
-				opaquePorts, err = getPodOpaquePortsAnnotations(pod)
+				var ok bool
+				opaquePorts, ok, err = getPodOpaquePortsAnnotations(pod)
 				if err != nil {
 					log.Errorf("failed to get opaque ports annotation for pod: %s", err)
 				}
+				// If the opaque ports annotation was not set, then set the
+				// endpoint's opaque ports to the default value.
+				if !ok {
+					opaquePorts = opaqueports.DefaultOpaquePorts
+				}
 				endpoint, err = toWeightedAddr(podSet.Addresses[podID], opaquePorts, s.enableH2Upgrade, s.identityTrustDomain, s.controllerNS, log)
 				if err != nil {
 					return err
@@ -455,17 +461,20 @@ func hasSuffix(slice []string, suffix []string) bool {
 	return true
 }
 
-func getPodOpaquePortsAnnotations(pod *corev1.Pod) (map[uint32]struct{}, error) {
+func getPodOpaquePortsAnnotations(pod *corev1.Pod) (map[uint32]struct{}, bool, error) {
+	annotation, ok := pod.Annotations[labels.ProxyOpaquePortsAnnotation]
+	if !ok {
+		return nil, false, nil
+	}
 	opaquePorts := make(map[uint32]struct{})
-	annotation := pod.Annotations[labels.ProxyOpaquePortsAnnotation]
 	if annotation != "" {
 		for _, portStr := range util.ParseContainerOpaquePorts(annotation, pod.Spec.Containers) {
 			port, err := strconv.ParseUint(portStr, 10, 32)
 			if err != nil {
-				return nil, err
+				return nil, true, err
 			}
 			opaquePorts[uint32(port)] = struct{}{}
 		}
 	}
-	return opaquePorts, nil
+	return opaquePorts, true, nil
 }
diff --git a/controller/api/destination/watcher/opaque_ports_watcher.go b/controller/api/destination/watcher/opaque_ports_watcher.go
index 238d626b8..33a45304a 100644
--- a/controller/api/destination/watcher/opaque_ports_watcher.go
+++ b/controller/api/destination/watcher/opaque_ports_watcher.go
@@ -7,6 +7,7 @@ import (
 	"github.com/linkerd/linkerd2-proxy-init/ports"
 	"github.com/linkerd/linkerd2/controller/k8s"
 	labels "github.com/linkerd/linkerd2/pkg/k8s"
+	"github.com/linkerd/linkerd2/pkg/opaqueports"
 	"github.com/linkerd/linkerd2/pkg/util"
 	log "github.com/sirupsen/logrus"
 	logging "github.com/sirupsen/logrus"
@@ -68,7 +69,7 @@ func (opw *OpaquePortsWatcher) Subscribe(id ServiceID, listener OpaquePortsUpdat
 	// and no opaque ports
 	if !ok {
 		opw.subscriptions[id] = &svcSubscriptions{
-			opaquePorts: make(map[uint32]struct{}),
+			opaquePorts: opaqueports.DefaultOpaquePorts,
 			listeners:   []OpaquePortsUpdateListener{listener},
 		}
 		return nil
@@ -77,9 +78,7 @@ func (opw *OpaquePortsWatcher) Subscribe(id ServiceID, listener OpaquePortsUpdat
 	// service listeners. If there are opaque ports for the service, update
 	// the listener with that value.
 	ss.listeners = append(ss.listeners, listener)
-	if len(ss.opaquePorts) != 0 {
-		listener.UpdateService(ss.opaquePorts)
-	}
+	listener.UpdateService(ss.opaquePorts)
 	return nil
 }
 
@@ -114,11 +113,16 @@ func (opw *OpaquePortsWatcher) addService(obj interface{}) {
 		Namespace: svc.Namespace,
 		Name:      svc.Name,
 	}
-	opaquePorts, err := getServiceOpaquePortsAnnotation(svc)
+	opaquePorts, ok, err := getServiceOpaquePortsAnnotation(svc)
 	if err != nil {
 		opw.log.Errorf("failed to get %s service opaque ports annotation: %s", id, err)
 		return
 	}
+	// If the opaque ports annotation was not set, then set the service's
+	// opaque ports to the default value.
+	if !ok {
+		opaquePorts = opaqueports.DefaultOpaquePorts
+	}
 	ss, ok := opw.subscriptions[id]
 	// If there are no subscriptions for this service, create one with the
 	// opaque ports.
@@ -168,9 +172,9 @@ func (opw *OpaquePortsWatcher) deleteService(obj interface{}) {
 		return
 	}
 	old := ss.opaquePorts
-	ss.opaquePorts = make(map[uint32]struct{})
-	// Do not send an update if the service already had no opaque ports
-	if len(old) == 0 {
+	ss.opaquePorts = opaqueports.DefaultOpaquePorts
+	// Do not send an update if the service already had the default opaque ports
+	if portsEqual(old, ss.opaquePorts) {
 		return
 	}
 	for _, listener := range ss.listeners {
@@ -178,19 +182,22 @@ func (opw *OpaquePortsWatcher) deleteService(obj interface{}) {
 	}
 }
 
-func getServiceOpaquePortsAnnotation(svc *corev1.Service) (map[uint32]struct{}, error) {
+func getServiceOpaquePortsAnnotation(svc *corev1.Service) (map[uint32]struct{}, bool, error) {
+	annotation, ok := svc.Annotations[labels.ProxyOpaquePortsAnnotation]
+	if !ok {
+		return nil, false, nil
+	}
 	opaquePorts := make(map[uint32]struct{})
-	annotation := svc.Annotations[labels.ProxyOpaquePortsAnnotation]
 	if annotation != "" {
 		for _, portStr := range parseServiceOpaquePorts(annotation, svc.Spec.Ports) {
 			port, err := strconv.ParseUint(portStr, 10, 32)
 			if err != nil {
-				return nil, err
+				return nil, true, err
 			}
 			opaquePorts[uint32(port)] = struct{}{}
 		}
 	}
-	return opaquePorts, nil
+	return opaquePorts, true, nil
 }
 
 func parseServiceOpaquePorts(annotation string, sps []corev1.ServicePort) []string {
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index c3072359e..85f203497 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -54,9 +54,7 @@
         "--proxy-uid",
         "2102",
         "--inbound-ports-to-ignore",
-        "4190,4191,25,443,587,3306,11211",
-        "--outbound-ports-to-ignore",
-        "25,443,587,3306,11211"
+        "4190,4191"
       ],
       "image": "cr.l5d.io/linkerd/proxy-init:v1.3.9",
       "imagePullPolicy": "IfNotPresent",
@@ -160,6 +158,10 @@
           "name": "LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE",
           "value": "10000ms"
         },
+        {
+          "name": "LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION",
+          "value": "25,443,587,3306,5432,11211"
+        },
         {
           "name": "_pod_ns",
           "valueFrom": {
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index 0a0248832..8c3ca0cff 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -54,9 +54,7 @@
         "--proxy-uid",
         "2102",
         "--inbound-ports-to-ignore",
-        "4190,4191,25,443,587,3306,11211",
-        "--outbound-ports-to-ignore",
-        "25,443,587,3306,11211"
+        "4190,4191"
       ],
       "image": "cr.l5d.io/linkerd/proxy-init:v1.3.9",
       "imagePullPolicy": "IfNotPresent",
@@ -150,6 +148,10 @@
           "name": "LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE",
           "value": "10000ms"
         },
+        {
+          "name": "LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION",
+          "value": "25,443,587,3306,5432,11211"
+        },
         {
           "name": "_pod_ns",
           "valueFrom": {
diff --git a/multicluster/charts/linkerd-multicluster-link/templates/gateway-mirror.yaml b/multicluster/charts/linkerd-multicluster-link/templates/gateway-mirror.yaml
index a1cd3280b..7806d3e47 100644
--- a/multicluster/charts/linkerd-multicluster-link/templates/gateway-mirror.yaml
+++ b/multicluster/charts/linkerd-multicluster-link/templates/gateway-mirror.yaml
@@ -5,8 +5,8 @@ metadata:
   name: probe-gateway-{{.Values.targetClusterName}}
   namespace: {{.Values.namespace}}
   labels:
-    multicluster.linkerd.io/mirrored-gateway: "true"
-    multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+    mirror.linkerd.io/mirrored-gateway: "true"
+    mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
 spec:
   ports:
   - name: mc-probe
diff --git a/multicluster/charts/linkerd-multicluster-link/templates/service-mirror.yaml b/multicluster/charts/linkerd-multicluster-link/templates/service-mirror.yaml
index 9dbdc10ec..32420020f 100644
--- a/multicluster/charts/linkerd-multicluster-link/templates/service-mirror.yaml
+++ b/multicluster/charts/linkerd-multicluster-link/templates/service-mirror.yaml
@@ -5,7 +5,7 @@ metadata:
   name: linkerd-service-mirror-access-local-resources-{{.Values.targetClusterName}}
   labels:
     linkerd.io/control-plane-component: service-mirror
-    multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+    mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
 rules:
 - apiGroups: [""]
   resources: ["endpoints", "services"]
@@ -20,7 +20,7 @@ metadata:
   name: linkerd-service-mirror-access-local-resources-{{.Values.targetClusterName}}
   labels:
     linkerd.io/control-plane-component: service-mirror
-    multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+    mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -37,7 +37,7 @@ metadata:
   namespace: {{.Values.namespace}}
   labels:
       linkerd.io/control-plane-component: service-mirror
-      multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+      mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
@@ -54,7 +54,7 @@ metadata:
   namespace: {{.Values.namespace}}
   labels:
       linkerd.io/control-plane-component: service-mirror
-      multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+      mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -71,14 +71,14 @@ metadata:
   namespace: {{.Values.namespace}}
   labels:
     linkerd.io/control-plane-component: service-mirror
-    multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+    mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
     linkerd.io/control-plane-component: service-mirror
-    multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+    mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
   name: linkerd-service-mirror-{{.Values.targetClusterName}}
   namespace: {{.Values.namespace}}
 spec:
@@ -86,14 +86,14 @@ spec:
   selector:
     matchLabels:
       linkerd.io/control-plane-component: linkerd-service-mirror
-      multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+      mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
   template:
     metadata:
       annotations:
         linkerd.io/inject: enabled
       labels:
         linkerd.io/control-plane-component: linkerd-service-mirror
-        multicluster.linkerd.io/cluster-name: {{.Values.targetClusterName}}
+        mirror.linkerd.io/cluster-name: {{.Values.targetClusterName}}
     spec:
       containers:
       - args:
diff --git a/multicluster/charts/linkerd-multicluster/templates/gateway.yaml b/multicluster/charts/linkerd-multicluster/templates/gateway.yaml
index e8274d6f2..476a23dde 100644
--- a/multicluster/charts/linkerd-multicluster/templates/gateway.yaml
+++ b/multicluster/charts/linkerd-multicluster/templates/gateway.yaml
@@ -120,10 +120,10 @@ metadata:
   labels:
     linkerd.io/extension: linkerd-multicluster
   annotations:
-    multicluster.linkerd.io/gateway-identity: {{.Values.gatewayName}}.{{.Values.namespace}}.serviceaccount.identity.{{.Values.linkerdNamespace}}.{{.Values.identityTrustDomain}}
-    multicluster.linkerd.io/probe-period: "{{.Values.gatewayProbeSeconds}}"
-    multicluster.linkerd.io/probe-path: {{.Values.gatewayProbePath}}
-    multicluster.linkerd.io/multicluster-gateway: "true"
+    mirror.linkerd.io/gateway-identity: {{.Values.gatewayName}}.{{.Values.namespace}}.serviceaccount.identity.{{.Values.linkerdNamespace}}.{{.Values.identityTrustDomain}}
+    mirror.linkerd.io/probe-period: "{{.Values.gatewayProbeSeconds}}"
+    mirror.linkerd.io/probe-path: {{.Values.gatewayProbePath}}
+    mirror.linkerd.io/multicluster-gateway: "true"
     linkerd.io/control-plane-component: gateway
     {{ include "partials.annotations.created-by" . }}
     {{- with .Values.gatewayServiceAnnotations }}{{ toYaml . | trim | nindent 4 }}{{- end }}
diff --git a/multicluster/cmd/check.go b/multicluster/cmd/check.go
index 2265bd2f3..58f787ee8 100644
--- a/multicluster/cmd/check.go
+++ b/multicluster/cmd/check.go
@@ -96,6 +96,10 @@ non-zero exit code.`,
 	}
 	cmd.Flags().StringVarP(&options.output, "output", "o", options.output, "Output format. One of: basic, json")
 	cmd.Flags().DurationVar(&options.wait, "wait", options.wait, "Maximum allowed time for all tests to pass")
+	cmd.Flags().Bool("proxy", false, "")
+	cmd.Flags().MarkHidden("proxy")
+	cmd.Flags().StringP("namespace", "n", "", "")
+	cmd.Flags().MarkHidden("namespace")
 	return cmd
 }
 
diff --git a/multicluster/cmd/gateways.go b/multicluster/cmd/gateways.go
index 4c99bcb1e..4002bb687 100644
--- a/multicluster/cmd/gateways.go
+++ b/multicluster/cmd/gateways.go
@@ -7,7 +7,6 @@ import (
 	"os"
 
 	"github.com/linkerd/linkerd2/cli/table"
-	labels "github.com/linkerd/linkerd2/multicluster/pkg"
 	"github.com/linkerd/linkerd2/pkg/k8s"
 	vizCmd "github.com/linkerd/linkerd2/viz/cmd"
 	"github.com/linkerd/linkerd2/viz/metrics-api/client"
@@ -166,9 +165,9 @@ func gatewaysRowToTableRow(row *pb.GatewaysTable_Row) []string {
 
 func extractGatewayPort(gateway *corev1.Service) (uint32, error) {
 	for _, port := range gateway.Spec.Ports {
-		if port.Name == labels.GatewayPortName {
+		if port.Name == k8s.GatewayPortName {
 			return uint32(port.Port), nil
 		}
 	}
-	return 0, fmt.Errorf("gateway service %s has no gateway port named %s", gateway.Name, labels.GatewayPortName)
+	return 0, fmt.Errorf("gateway service %s has no gateway port named %s", gateway.Name, k8s.GatewayPortName)
 }
diff --git a/multicluster/pkg/labels.go b/multicluster/pkg/labels.go
deleted file mode 100644
index f0391a5b6..000000000
--- a/multicluster/pkg/labels.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package pkg
-
-const (
-	// MulticlusterAnnotationsPrefix is the prefix of all multicluster-related annotations
-	MulticlusterAnnotationsPrefix = "multicluster.linkerd.io"
-
-	// RemoteResourceVersionAnnotation is the last observed remote resource
-	// version of a mirrored resource. Useful when doing updates
-	RemoteResourceVersionAnnotation = MulticlusterAnnotationsPrefix + "/remote-resource-version"
-
-	// RemoteGatewayResourceVersionAnnotation is the last observed remote resource
-	// version of the gateway for a particular mirrored service. It is used
-	// in cases we detect a change in a remote gateway
-	RemoteGatewayResourceVersionAnnotation = MulticlusterAnnotationsPrefix + "/remote-gateway-resource-version"
-
-	// GatewayPortName is the name of the incoming port of the gateway
-	GatewayPortName = "mc-gateway"
-
-	// ServiceMirrorLabel is the value used in the controller component label
-	ServiceMirrorLabel = "servicemirror"
-)
diff --git a/multicluster/service-mirror/cluster_watcher.go b/multicluster/service-mirror/cluster_watcher.go
index 9606b81cd..ae6a5bba9 100644
--- a/multicluster/service-mirror/cluster_watcher.go
+++ b/multicluster/service-mirror/cluster_watcher.go
@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"github.com/linkerd/linkerd2/controller/k8s"
-	labels "github.com/linkerd/linkerd2/multicluster/pkg"
 	consts "github.com/linkerd/linkerd2/pkg/k8s"
 	"github.com/linkerd/linkerd2/pkg/multicluster"
 	"github.com/prometheus/client_golang/prometheus"
@@ -16,7 +15,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8sLabels "k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/util/workqueue"
@@ -172,7 +171,7 @@ func (rcsw *RemoteClusterServiceWatcher) getMirroredServiceLabels() map[string]s
 
 func (rcsw *RemoteClusterServiceWatcher) getMirroredServiceAnnotations(remoteService *corev1.Service) map[string]string {
 	annotations := map[string]string{
-		labels.RemoteResourceVersionAnnotation: remoteService.ResourceVersion, // needed to detect real changes
+		consts.RemoteResourceVersionAnnotation: remoteService.ResourceVersion, // needed to detect real changes
 		consts.RemoteServiceFqName:             fmt.Sprintf("%s.%s.svc.%s", remoteService.Name, remoteService.Namespace, rcsw.link.TargetClusterDomain),
 	}
 	value, ok := remoteService.GetAnnotations()[consts.ProxyOpaquePortsAnnotation]
@@ -233,7 +232,7 @@ func (rcsw *RemoteClusterServiceWatcher) cleanupOrphanedServices(ctx context.Con
 		consts.RemoteClusterNameLabel: rcsw.link.TargetClusterName,
 	}
 
-	servicesOnLocalCluster, err := rcsw.localAPIClient.Svc().Lister().List(k8sLabels.Set(matchLabels).AsSelector())
+	servicesOnLocalCluster, err := rcsw.localAPIClient.Svc().Lister().List(labels.Set(matchLabels).AsSelector())
 	if err != nil {
 		innerErr := fmt.Errorf("failed to list services while cleaning up mirror services: %s", err)
 		if kerrors.IsNotFound(err) {
@@ -274,7 +273,7 @@ func (rcsw *RemoteClusterServiceWatcher) cleanupOrphanedServices(ctx context.Con
 func (rcsw *RemoteClusterServiceWatcher) cleanupMirroredResources(ctx context.Context) error {
 	matchLabels := rcsw.getMirroredServiceLabels()
 
-	services, err := rcsw.localAPIClient.Svc().Lister().List(k8sLabels.Set(matchLabels).AsSelector())
+	services, err := rcsw.localAPIClient.Svc().Lister().List(labels.Set(matchLabels).AsSelector())
 	if err != nil {
 		innerErr := fmt.Errorf("could not retrieve mirrored services that need cleaning up: %s", err)
 		if kerrors.IsNotFound(err) {
@@ -296,7 +295,7 @@ func (rcsw *RemoteClusterServiceWatcher) cleanupMirroredResources(ctx context.Co
 		}
 	}
 
-	endpoints, err := rcsw.localAPIClient.Endpoint().Lister().List(k8sLabels.Set(matchLabels).AsSelector())
+	endpoints, err := rcsw.localAPIClient.Endpoint().Lister().List(labels.Set(matchLabels).AsSelector())
 	if err != nil {
 		innerErr := fmt.Errorf("could not retrieve Endpoints that need cleaning up: %s", err)
 		if kerrors.IsNotFound(err) {
@@ -473,7 +472,7 @@ func (rcsw *RemoteClusterServiceWatcher) isExportedService(service *corev1.Servi
 		rcsw.log.Errorf("Invalid service selector: %s", err)
 		return false
 	}
-	return selector.Matches(k8sLabels.Set(service.Labels))
+	return selector.Matches(labels.Set(service.Labels))
 }
 
 // this method is common to both CREATE and UPDATE because if we have been
@@ -494,7 +493,7 @@ func (rcsw *RemoteClusterServiceWatcher) createOrUpdateService(service *corev1.S
 			return RetryableError{[]error{err}}
 		}
 		// if we have the local service present, we need to issue an update
-		lastMirroredRemoteVersion, ok := localService.Annotations[labels.RemoteResourceVersionAnnotation]
+		lastMirroredRemoteVersion, ok := localService.Annotations[consts.RemoteResourceVersionAnnotation]
 		if ok && lastMirroredRemoteVersion != service.ResourceVersion {
 			endpoints, err := rcsw.localAPIClient.Endpoint().Lister().Endpoints(service.Namespace).Get(localName)
 			if err == nil {
@@ -531,7 +530,7 @@ func (rcsw *RemoteClusterServiceWatcher) getMirrorServices() ([]*corev1.Service,
 		consts.RemoteClusterNameLabel: rcsw.link.TargetClusterName,
 	}
 
-	services, err := rcsw.localAPIClient.Svc().Lister().List(k8sLabels.Set(matchLabels).AsSelector())
+	services, err := rcsw.localAPIClient.Svc().Lister().List(labels.Set(matchLabels).AsSelector())
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/healthcheck/healthcheck_output.go b/pkg/healthcheck/healthcheck_output.go
index 7e560ea98..0311eec6a 100644
--- a/pkg/healthcheck/healthcheck_output.go
+++ b/pkg/healthcheck/healthcheck_output.go
@@ -2,6 +2,7 @@ package healthcheck
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -28,6 +29,25 @@ var (
 	failStatus = color.New(color.FgRed, color.Bold).SprintFunc()("\u00D7")    // ×
 )
 
+// CheckResults contains a slice of CheckResult structs.
+type CheckResults struct {
+	Results []CheckResult
+}
+
+// RunChecks submits each of the individual CheckResult structs to the given
+// observer.
+func (cr CheckResults) RunChecks(observer CheckObserver) bool {
+	success := true
+	for _, result := range cr.Results {
+		result := result // Copy loop variable to make lint happy.
+		if result.Err != nil && !result.Warning {
+			success = false
+		}
+		observer(&result)
+	}
+	return success
+}
+
 // RunChecks runs the checks that are part of hc
 func RunChecks(wout io.Writer, werr io.Writer, hc Runner, output string) bool {
 	if output == JSONOutput {
@@ -173,3 +193,32 @@ func runChecksJSON(wout io.Writer, werr io.Writer, hc Runner) bool {
 	}
 	return result
 }
+
+// ParseJSONCheckOutput parses the output of a check command run with json
+// output mode. The data is expected to be a checkOutput struct serialized
+// to json. In addition to deserializing, this function will convert the result
+// to a CheckResults struct.
+func ParseJSONCheckOutput(data []byte) (CheckResults, error) {
+	var checks checkOutput
+	err := json.Unmarshal(data, &checks)
+	if err != nil {
+		return CheckResults{}, err
+	}
+	results := []CheckResult{}
+	for _, category := range checks.Categories {
+		for _, check := range category.Checks {
+			var err error
+			if check.Error != "" {
+				err = errors.New(check.Error)
+			}
+			results = append(results, CheckResult{
+				Category:    CategoryID(category.Name),
+				Description: check.Description,
+				Err:         err,
+				HintAnchor:  check.Hint,
+				Warning:     check.Result == checkWarn,
+			})
+		}
+	}
+	return CheckResults{results}, nil
+}
diff --git a/pkg/k8s/labels.go b/pkg/k8s/labels.go
index 73f1d56cd..fb2ddbf82 100644
--- a/pkg/k8s/labels.go
+++ b/pkg/k8s/labels.go
@@ -363,54 +363,69 @@ const (
 	IdentityServiceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
 
 	/*
-	 * Multicluster labels
+	 * Service mirror constants
 	 */
 
-	// MulticlusterAnnotationsPrefix is the prefix common to all labels and
-	// annotations and types used by the service mirror component
-	MulticlusterAnnotationsPrefix = "multicluster.linkerd.io"
+	// SvcMirrorPrefix is the prefix common to all labels and annotations
+	// and types used by the service mirror component
+	SvcMirrorPrefix = "mirror.linkerd.io"
 
 	// MirrorSecretType is the type of secret that is supposed to contain
 	// the access information for remote clusters.
-	MirrorSecretType = MulticlusterAnnotationsPrefix + "/remote-kubeconfig"
+	MirrorSecretType = SvcMirrorPrefix + "/remote-kubeconfig"
 
 	// DefaultExportedServiceSelector is the default label selector for exported
 	// services.
-	DefaultExportedServiceSelector = MulticlusterAnnotationsPrefix + "/export"
+	DefaultExportedServiceSelector = SvcMirrorPrefix + "/exported"
 
 	// MirroredResourceLabel indicates that this resource is the result
 	// of a mirroring operation (can be a namespace or a service)
-	MirroredResourceLabel = MulticlusterAnnotationsPrefix + "/mirrored-service"
+	MirroredResourceLabel = SvcMirrorPrefix + "/mirrored-service"
 
 	// MirroredGatewayLabel indicates that this is a mirrored gateway
-	MirroredGatewayLabel = MulticlusterAnnotationsPrefix + "/mirrored-gateway"
+	MirroredGatewayLabel = SvcMirrorPrefix + "/mirrored-gateway"
 
 	// RemoteClusterNameLabel put on a local mirrored service, it
 	// allows us to associate a mirrored service with a remote cluster
-	RemoteClusterNameLabel = MulticlusterAnnotationsPrefix + "/cluster-name"
+	RemoteClusterNameLabel = SvcMirrorPrefix + "/cluster-name"
+
+	// RemoteResourceVersionAnnotation is the last observed remote resource
+	// version of a mirrored resource. Useful when doing updates
+	RemoteResourceVersionAnnotation = SvcMirrorPrefix + "/remote-resource-version"
 
 	// RemoteServiceFqName is the fully qualified name of the mirrored service
 	// on the remote cluster
-	RemoteServiceFqName = MulticlusterAnnotationsPrefix + "/remote-svc-fq-name"
+	RemoteServiceFqName = SvcMirrorPrefix + "/remote-svc-fq-name"
+
+	// RemoteGatewayResourceVersionAnnotation is the last observed remote resource
+	// version of the gateway for a particular mirrored service. It is used
+	// in cases we detect a change in a remote gateway
+	RemoteGatewayResourceVersionAnnotation = SvcMirrorPrefix + "/remote-gateway-resource-version"
 
 	// RemoteGatewayIdentity follows the same kind of logic as RemoteGatewayNameLabel
-	RemoteGatewayIdentity = MulticlusterAnnotationsPrefix + "/remote-gateway-identity"
+	RemoteGatewayIdentity = SvcMirrorPrefix + "/remote-gateway-identity"
 
 	// GatewayIdentity can be found on the remote gateway service
-	GatewayIdentity = MulticlusterAnnotationsPrefix + "/gateway-identity"
+	GatewayIdentity = SvcMirrorPrefix + "/gateway-identity"
 
 	// GatewayProbePeriod the interval at which the health of the gateway should be probed
-	GatewayProbePeriod = MulticlusterAnnotationsPrefix + "/probe-period"
+	GatewayProbePeriod = SvcMirrorPrefix + "/probe-period"
 
 	// GatewayProbePath the path at which the health of the gateway should be probed
-	GatewayProbePath = MulticlusterAnnotationsPrefix + "/probe-path"
+	GatewayProbePath = SvcMirrorPrefix + "/probe-path"
 
 	// ConfigKeyName is the key in the secret that stores the kubeconfig needed to connect
 	// to a remote cluster
 	ConfigKeyName = "kubeconfig"
 
+	// GatewayPortName is the name of the incoming port of the gateway
+	GatewayPortName = "mc-gateway"
+
 	// ProbePortName is the name of the probe port of the gateway
 	ProbePortName = "mc-probe"
+
+	// ServiceMirrorLabel is the value used in the controller component label
+	ServiceMirrorLabel = "servicemirror"
 )
 
 // CreatedByAnnotationValue returns the value associated with
diff --git a/pkg/opaqueports/defaults.go b/pkg/opaqueports/defaults.go
new file mode 100644
index 000000000..11b142553
--- /dev/null
+++ b/pkg/opaqueports/defaults.go
@@ -0,0 +1,16 @@
+package opaqueports
+
+// DefaultOpaquePorts is the default list of opaque ports that the destination
+// server will use to determine whether a destination is an opaque protocol.
+// When a pod or service already has its own annotation, that value will have
+// priority of this.
+//
+// Note: Keep in sync with proxy.opaquePorts in values.yaml
+var DefaultOpaquePorts = map[uint32]struct{}{
+	25:    {},
+	443:   {},
+	587:   {},
+	3306:  {},
+	5432:  {},
+	11211: {},
+}
diff --git a/viz/cmd/tap.go b/viz/cmd/tap.go
index cebd71f94..bda94f50a 100644
--- a/viz/cmd/tap.go
+++ b/viz/cmd/tap.go
@@ -210,15 +210,23 @@ func NewCmdTap() *cobra.Command {
 
 			req, err := pkg.BuildTapByResourceRequest(requestParams)
 			if err != nil {
-				return err
+				fmt.Fprint(os.Stderr, err.Error())
+				os.Exit(1)
 			}
 
 			k8sAPI, err := k8s.NewAPI(kubeconfigPath, kubeContext, impersonate, impersonateGroup, 0)
 			if err != nil {
-				return err
+				fmt.Fprint(os.Stderr, err.Error())
+				os.Exit(1)
 			}
 
-			return requestTapByResourceFromAPI(cmd.Context(), os.Stdout, k8sAPI, req, options)
+			err = requestTapByResourceFromAPI(cmd.Context(), os.Stdout, k8sAPI, req, options)
+			if err != nil {
+				fmt.Fprint(os.Stderr, err.Error())
+				os.Exit(1)
+			}
+
+			return nil
 		},
 	}
 
diff --git a/viz/main.go b/viz/main.go
new file mode 100644
index 000000000..dd57a852f
--- /dev/null
+++ b/viz/main.go
@@ -0,0 +1,13 @@
+package main
+
+import (
+	"os"
+
+	"github.com/linkerd/linkerd2/viz/cmd"
+)
+
+func main() {
+	if err := cmd.NewCmdViz().Execute(); err != nil {
+		os.Exit(1)
+	}
+}
diff --git a/viz/pkg/healthcheck/healthcheck.go b/viz/pkg/healthcheck/healthcheck.go
index 01ea74db0..70308e654 100644
--- a/viz/pkg/healthcheck/healthcheck.go
+++ b/viz/pkg/healthcheck/healthcheck.go
@@ -13,8 +13,6 @@ import (
 	"github.com/linkerd/linkerd2/viz/metrics-api/client"
 	pb "github.com/linkerd/linkerd2/viz/metrics-api/gen/viz"
 	"github.com/linkerd/linkerd2/viz/pkg/labels"
-	vizLabels "github.com/linkerd/linkerd2/viz/pkg/labels"
-	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	apiregistrationv1client "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/typed/apiregistration/v1"
@@ -273,17 +271,6 @@ func (hc *HealthChecker) VizDataPlaneCategory() healthcheck.Category {
 
 				return validateDataPlanePodReporting(pods)
 			}),
-		*healthcheck.NewChecker("data-plane pods have tap enabled").
-			WithHintAnchor("l5d-viz-data-plane-tap").
-			Warning().
-			WithCheck(func(ctx context.Context) error {
-				pods, err := hc.GetDataPlanePods(ctx)
-				if err != nil {
-					return err
-				}
-
-				return hc.checkForTapConfiguration(ctx, pods)
-			}),
 	}, true)
 }
 
@@ -313,31 +300,6 @@ func (hc *HealthChecker) getDataPlanePodsFromVizAPI(ctx context.Context) ([]*pb.
 	return pods, nil
 }
 
-// checkForTapConfiguration checks if the tap annotation is present
-// only for the pods with tap enabled
-func (hc *HealthChecker) checkForTapConfiguration(ctx context.Context, pods []corev1.Pod) error {
-	var podsWithoutTap []string
-	for i := range pods {
-		pod := pods[i]
-		ns, err := hc.KubeAPIClient().CoreV1().Namespaces().Get(ctx, pod.Namespace, metav1.GetOptions{})
-		if err != nil {
-			return err
-		}
-		// Check if Tap is disabled
-		if !vizLabels.IsTapDisabled(pod) && !vizLabels.IsTapDisabled(ns) {
-			// Check for tap-injector annotation
-			if !vizLabels.IsTapEnabled(&pod) {
-				podsWithoutTap = append(podsWithoutTap, fmt.Sprintf("* %s", pod.Name))
-			}
-		}
-	}
-
-	if len(podsWithoutTap) > 0 {
-		return fmt.Errorf("Some data plane pods do not have tap configured and cannot be tapped:\n\t%s", strings.Join(podsWithoutTap, "\n\t"))
-	}
-	return nil
-}
-
 func validateDataPlanePodReporting(pods []*pb.Pod) error {
 	notInPrometheus := []string{}
 
diff --git a/viz/tap/api/grpc_server.go b/viz/tap/api/grpc_server.go
index 173283003..ac674e3ad 100644
--- a/viz/tap/api/grpc_server.go
+++ b/viz/tap/api/grpc_server.go
@@ -78,8 +78,8 @@ func (s *GRPCTapServer) TapByResource(req *tapPb.TapByResourceRequest, stream ta
 	}
 
 	pods := []*corev1.Pod{}
-	tapDisabled := false
-	tapNotEnabled := false
+	tapDisabled := []*corev1.Pod{}
+	tapNotEnabled := []*corev1.Pod{}
 	for _, object := range objects {
 		podsFor, err := s.k8sAPI.GetPodsFor(object, false)
 		if err != nil {
@@ -89,9 +89,9 @@ func (s *GRPCTapServer) TapByResource(req *tapPb.TapByResourceRequest, stream ta
 		for _, pod := range podsFor {
 			if pkgK8s.IsMeshed(pod, s.controllerNamespace) {
 				if vizLabels.IsTapDisabled(pod) {
-					tapDisabled = true
+					tapDisabled = append(tapDisabled, pod)
 				} else if !vizLabels.IsTapEnabled(pod) {
-					tapNotEnabled = true
+					tapNotEnabled = append(tapNotEnabled, pod)
 				} else {
 					pods = append(pods, pod)
 				}
@@ -100,18 +100,23 @@ func (s *GRPCTapServer) TapByResource(req *tapPb.TapByResourceRequest, stream ta
 	}
 
 	if len(pods) == 0 {
-		errStrings := []string{}
-		errStr := fmt.Errorf("no pods to tap for %s/%s", res.GetType(), res.GetName())
-		errStrings = append(errStrings, errStr.Error())
-		if tapDisabled {
-			errStr = fmt.Errorf("pods found with tap disabled via the %s annotation", vizLabels.VizTapDisabled)
-			errStrings = append(errStrings, errStr.Error())
+		var errs strings.Builder
+		fmt.Fprintf(&errs, "no pods to tap for %s/%s\n", res.GetType(), res.GetName())
+		if len(tapDisabled) > 0 {
+			fmt.Fprintf(&errs, "%d pods found with tap disabled via the %s annotation:\n", len(tapDisabled), vizLabels.VizTapDisabled)
+			for _, pod := range tapDisabled {
+				fmt.Fprintf(&errs, "\t* %s\n", pod.Name)
+			}
+			fmt.Fprintln(&errs, "remove this annotation to make these pods valid tap targets")
 		}
-		if tapNotEnabled {
-			errStr = fmt.Errorf("pods found with tap not enabled; try restarting resource so that it can be injected")
-			errStrings = append(errStrings, errStr.Error())
+		if len(tapNotEnabled) > 0 {
+			fmt.Fprintf(&errs, "%d pods found with tap not enabled:\n", len(tapNotEnabled))
+			for _, pod := range tapNotEnabled {
+				fmt.Fprintf(&errs, "\t* %s\n", pod.Name)
+			}
+			fmt.Fprintln(&errs, "restart these pods to enable tap and make them valid tap targets")
 		}
-		return status.Errorf(codes.NotFound, strings.Join(errStrings, "\n"))
+		return status.Errorf(codes.NotFound, errs.String())
 	}
 
 	log.Infof("Tapping %d pods for target: %s", len(pods), res.String())


Test patch:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index 663ee2463..6740a04f4 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -51,6 +51,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -131,9 +133,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 8539e0ccf..5f054f856 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -51,6 +51,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -131,9 +133,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -218,6 +218,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -298,9 +300,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index 5f50b1a87..15d5e4794 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -51,6 +51,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -131,9 +133,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 60bbc267b..74cbc2090 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -80,6 +80,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -171,9 +173,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index efca29ccc..bd6bae398 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -62,6 +62,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -142,9 +144,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -240,6 +240,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -320,9 +322,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -418,6 +418,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -498,9 +500,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -596,6 +596,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -676,9 +678,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index caae28b81..6e86b2962 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -62,6 +62,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -142,9 +144,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index a130c1546..9cd7fdae2 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -70,6 +70,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -155,9 +157,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index 069f0ec54..d0905be2f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -72,6 +72,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index a733f2b97..74109e32a 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -62,6 +62,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -142,9 +144,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -240,6 +240,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -320,9 +322,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index afc6f1dd0..d916df7b9 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -67,6 +67,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -147,9 +149,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index 6ab57a7ba..38acbca62 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -62,6 +62,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -142,9 +144,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index 71a643cb6..0da02435f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -63,6 +63,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -143,9 +145,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
index 63b383f1d..3e6822fbe 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
@@ -62,6 +62,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index ba2ad7e49..c6f3babe8 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -63,6 +63,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -143,9 +145,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,1234,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,1234
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index 2cb38cc82..0bea45492 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -64,6 +64,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index 83fc27056..0293a5c44 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -64,6 +64,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -144,9 +146,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index d8598cb4f..48d9828cc 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -64,6 +64,8 @@ items:
             value: 10000ms
           - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
             value: 10000ms
+          - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+            value: 25,443,587,3306,5432,11211
           - name: _pod_ns
             valueFrom:
               fieldRef:
@@ -144,9 +146,7 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191,25,443,587,3306,11211
-          - --outbound-ports-to-ignore
-          - 25,443,587,3306,11211
+          - 4190,4191
           image: cr.l5d.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
@@ -236,6 +236,8 @@ items:
             value: 10000ms
           - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
             value: 10000ms
+          - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+            value: 25,443,587,3306,5432,11211
           - name: _pod_ns
             valueFrom:
               fieldRef:
@@ -316,9 +318,7 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191,25,443,587,3306,11211
-          - --outbound-ports-to-ignore
-          - 25,443,587,3306,11211
+          - 4190,4191
           image: cr.l5d.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index b984675da..794a1bed4 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -64,6 +64,8 @@ items:
             value: 10000ms
           - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
             value: 10000ms
+          - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+            value: 25,443,587,3306,5432,11211
           - name: _pod_ns
             valueFrom:
               fieldRef:
@@ -144,9 +146,7 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191,25,443,587,3306,11211
-          - --outbound-ports-to-ignore
-          - 25,443,587,3306,11211
+          - 4190,4191
           image: cr.l5d.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
@@ -236,6 +236,8 @@ items:
             value: 10000ms
           - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
             value: 10000ms
+          - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+            value: 25,443,587,3306,5432,11211
           - name: _pod_ns
             valueFrom:
               fieldRef:
@@ -316,9 +318,7 @@ items:
           - --proxy-uid
           - "2102"
           - --inbound-ports-to-ignore
-          - 4190,4191,25,443,587,3306,11211
-          - --outbound-ports-to-ignore
-          - 25,443,587,3306,11211
+          - 4190,4191
           image: cr.l5d.io/linkerd/proxy-init:v1.3.9
           imagePullPolicy: IfNotPresent
           name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index e9e5ab9a4..089d724ce 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -47,6 +47,8 @@ spec:
       value: 10000ms
     - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
       value: 10000ms
+    - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+      value: 25,443,587,3306,5432,11211
     - name: _pod_ns
       valueFrom:
         fieldRef:
@@ -127,9 +129,7 @@ spec:
     - --proxy-uid
     - "2102"
     - --inbound-ports-to-ignore
-    - 4190,4191,25,443,587,3306,11211
-    - --outbound-ports-to-ignore
-    - 25,443,587,3306,11211
+    - 4190,4191
     image: cr.l5d.io/linkerd/proxy-init:v1.3.9
     imagePullPolicy: IfNotPresent
     name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index 1e600eb3c..72dc9db81 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -49,6 +49,8 @@ spec:
       value: 10000ms
     - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
       value: 10000ms
+    - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+      value: 25,443,587,3306,5432,11211
     - name: _pod_ns
       valueFrom:
         fieldRef:
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index df516bac1..9356798ec 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -51,6 +51,8 @@ spec:
       value: 10000ms
     - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
       value: 10000ms
+    - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+      value: 25,443,587,3306,5432,11211
     - name: _pod_ns
       valueFrom:
         fieldRef:
@@ -138,9 +140,7 @@ spec:
     - --proxy-uid
     - "2102"
     - --inbound-ports-to-ignore
-    - 4190,4191,25,443,587,3306,11211
-    - --outbound-ports-to-ignore
-    - 25,443,587,3306,11211
+    - 4190,4191
     image: cr.l5d.io/linkerd/proxy-init:v1.3.9
     imagePullPolicy: IfNotPresent
     name: linkerd-init
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index 6841a33a0..025661dbb 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -63,6 +63,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -143,9 +145,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index 82d1a9652..c0d41832c 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -64,6 +64,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -144,9 +146,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -244,6 +244,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -324,9 +326,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index a1f75f97e..d9160ec01 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -115,6 +115,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: 25,443,587,3306,5432,11211
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -196,9 +198,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
-        - --outbound-ports-to-ignore
-        - 25,443,587,3306,11211
+        - 4190,4191
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install-cni-plugin_default.golden b/cli/cmd/testdata/install-cni-plugin_default.golden
index a2c24ba05..da89fbd08 100644
--- a/cli/cmd/testdata/install-cni-plugin_default.golden
+++ b/cli/cmd/testdata/install-cni-plugin_default.golden
@@ -123,8 +123,7 @@ data:
         "outgoing-proxy-port": 4140,
         "proxy-uid": 2102,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": ["4190","4191","25","443","587","3306","11211"],
-        "outbound-ports-to-ignore": ["25","443","587","3306","11211"],
+        "inbound-ports-to-ignore": ["4190","4191"],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install-cni-plugin_fully_configured.golden b/cli/cmd/testdata/install-cni-plugin_fully_configured.golden
index f25136df3..a924427ef 100644
--- a/cli/cmd/testdata/install-cni-plugin_fully_configured.golden
+++ b/cli/cmd/testdata/install-cni-plugin_fully_configured.golden
@@ -124,7 +124,6 @@ data:
         "proxy-uid": 12102,
         "ports-to-redirect": [],
         "inbound-ports-to-ignore": ["5190","5191"],
-        "outbound-ports-to-ignore": [],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install-cni-plugin_fully_configured_equal_dsts.golden b/cli/cmd/testdata/install-cni-plugin_fully_configured_equal_dsts.golden
index f72d7dde3..527af10f9 100644
--- a/cli/cmd/testdata/install-cni-plugin_fully_configured_equal_dsts.golden
+++ b/cli/cmd/testdata/install-cni-plugin_fully_configured_equal_dsts.golden
@@ -124,7 +124,6 @@ data:
         "proxy-uid": 12102,
         "ports-to-redirect": [],
         "inbound-ports-to-ignore": ["5190","5191"],
-        "outbound-ports-to-ignore": [],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install-cni-plugin_fully_configured_no_namespace.golden b/cli/cmd/testdata/install-cni-plugin_fully_configured_no_namespace.golden
index 623ef1072..326ca37ba 100644
--- a/cli/cmd/testdata/install-cni-plugin_fully_configured_no_namespace.golden
+++ b/cli/cmd/testdata/install-cni-plugin_fully_configured_no_namespace.golden
@@ -114,7 +114,6 @@ data:
         "proxy-uid": 12102,
         "ports-to-redirect": [],
         "inbound-ports-to-ignore": ["5190","5191"],
-        "outbound-ports-to-ignore": [],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install-cni-plugin_skip_ports.golden b/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
index ed3c4ba82..68f1809b3 100644
--- a/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
+++ b/cli/cmd/testdata/install-cni-plugin_skip_ports.golden
@@ -123,8 +123,8 @@ data:
         "outgoing-proxy-port": 4140,
         "proxy-uid": 2102,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": ["4190","4191","25","443","587","3306","11211","80","8080"],
-        "outbound-ports-to-ignore": ["25","443","587","3306","11211","443","1000"],
+        "inbound-ports-to-ignore": ["4190","4191","80","8080"],
+        "outbound-ports-to-ignore": ["443","1000"],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install_cni_helm_default_output.golden b/cli/cmd/testdata/install_cni_helm_default_output.golden
index aa297238b..8f022e349 100644
--- a/cli/cmd/testdata/install_cni_helm_default_output.golden
+++ b/cli/cmd/testdata/install_cni_helm_default_output.golden
@@ -125,8 +125,6 @@ data:
         "outgoing-proxy-port": 4140,
         "proxy-uid": 2102,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": ["25","443","587","3306","11211"],
-        "outbound-ports-to-ignore": ["25","443","587","3306","11211"],
         "simulate": false,
         "use-wait-flag": false
       }
diff --git a/cli/cmd/testdata/install_cni_helm_override_output.golden b/cli/cmd/testdata/install_cni_helm_override_output.golden
index 97f7ada7c..6fe96c375 100644
--- a/cli/cmd/testdata/install_cni_helm_override_output.golden
+++ b/cli/cmd/testdata/install_cni_helm_override_output.golden
@@ -125,8 +125,6 @@ data:
         "outgoing-proxy-port": 5678,
         "proxy-uid": 1111,
         "ports-to-redirect": [],
-        "inbound-ports-to-ignore": ["25","443","587","3306","11211"],
-        "outbound-ports-to-ignore": ["25","443","587","3306","11211"],
         "simulate": false,
         "use-wait-flag": true
       }
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index a4777e7a1..1a29f3d11 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -966,7 +966,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -988,8 +988,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1180,6 +1180,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1261,9 +1263,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1411,6 +1413,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1492,9 +1496,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1661,6 +1665,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1742,9 +1748,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1917,6 +1923,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1998,9 +2006,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2169,6 +2177,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2250,9 +2260,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 80d7fc1f3..3042fdd1d 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -966,7 +966,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -988,8 +988,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1179,6 +1179,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1260,9 +1262,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1409,6 +1411,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1490,9 +1494,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1658,6 +1662,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1739,9 +1745,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1914,6 +1920,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1995,9 +2003,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2166,6 +2174,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2247,9 +2257,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 3edbd8681..6523fbbe0 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -966,7 +966,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -988,8 +988,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: my.custom.registry/linkerd-io/proxy-init
         pullPolicy: ""
@@ -1179,6 +1179,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1260,9 +1262,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1409,6 +1411,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1490,9 +1494,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1658,6 +1662,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1739,9 +1745,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1914,6 +1920,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1995,9 +2003,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2166,6 +2174,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2247,9 +2257,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 2dfe67ffb..74aaf180a 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -966,7 +966,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -988,8 +988,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1179,6 +1179,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1260,9 +1262,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1409,6 +1411,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1490,9 +1494,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1658,6 +1662,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1739,9 +1745,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1914,6 +1920,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1995,9 +2003,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2166,6 +2174,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2247,9 +2257,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 709acf47a..2fa1be42a 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -966,7 +966,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -988,8 +988,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1179,6 +1179,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1260,9 +1262,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1409,6 +1411,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1490,9 +1494,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1658,6 +1662,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1739,9 +1745,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1914,6 +1920,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1995,9 +2003,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2166,6 +2174,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2247,9 +2257,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 4f46a1871..4d2d7ee0c 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -984,7 +984,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1006,8 +1006,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1260,6 +1260,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1346,9 +1348,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1540,6 +1542,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1626,9 +1630,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1839,6 +1843,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1925,9 +1931,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2135,6 +2141,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2221,9 +2229,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2453,6 +2461,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2539,9 +2549,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index dadf689cf..4555cd333 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -984,7 +984,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1006,8 +1006,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1260,6 +1260,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1346,9 +1348,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1540,6 +1542,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1626,9 +1630,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1839,6 +1843,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1925,9 +1931,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2135,6 +2141,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2221,9 +2229,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2453,6 +2461,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2539,9 +2549,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 22812f244..63cfa2d09 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -894,7 +894,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -916,8 +916,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1107,6 +1107,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1188,9 +1190,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1337,6 +1339,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1418,9 +1422,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1586,6 +1590,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1667,9 +1673,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1797,6 +1803,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1878,9 +1886,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2049,6 +2057,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2130,9 +2140,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index 9a39d0681..3edcf9f8a 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -964,7 +964,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1183,6 +1183,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1404,6 +1406,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1644,6 +1648,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1893,6 +1899,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2136,6 +2144,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index f2cabe919..1cf1fc4ca 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -982,7 +982,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1264,6 +1264,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1535,6 +1537,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1825,6 +1829,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2114,6 +2120,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2423,6 +2431,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 30672239b..4a475b488 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -986,7 +986,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1272,6 +1272,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1547,6 +1549,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1841,6 +1845,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2138,6 +2144,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2451,6 +2459,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 45e282736..7f265c20f 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -982,7 +982,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1264,6 +1264,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1535,6 +1537,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1825,6 +1829,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2114,6 +2120,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2423,6 +2431,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index f4b3e23bb..2077c10c5 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -963,7 +963,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -985,8 +985,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1176,6 +1176,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1368,6 +1370,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1579,6 +1583,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1797,6 +1803,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2011,6 +2019,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index f03a02ee2..346dd233d 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -2297,7 +2297,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y2xpVmVyc2lvbjogQ2xpVmVyc2lvbgpjbHVzdGVyTmV0d29ya3M6IENsdXN0ZXJOZXR3b3Jrcwpjb250cm9sUGxhbmVUcmFjaW5nTmFtZXNwYWNlOiAiIgpjb250cm9sbGVySW1hZ2U6IENvbnRyb2xsZXJJbWFnZQpjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCmNvbnRyb2xsZXJMb2dGb3JtYXQ6IENvbnRyb2xsZXJMb2dGb3JtYXQKY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICBuYW1lOiBEZWJ1Z0ltYWdlTmFtZQogICAgcHVsbFBvbGljeTogRGVidWdJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IERlYnVnVmVyc2lvbgpoZWFydGJlYXRTY2hlZHVsZTogIiIKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQppZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogIE1JSUJ3VENDQVdhZ0F3SUJBZ0lRZURacDVsRGFJeWdRNVVmTUtackZBVEFLQmdncWhrak9QUVFEQWpBcE1TY3cKICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgTURjeE1qUTNXaGNOTXpBd09ESTJNRGN4TWpRM1dqQXBNU2N3SlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1cgogIFpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFScWM3MFoKICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgdWFHNFdXc2l3SktObjdtZ28zQXdiakFPQmdOVkhROEJBZjhFQkFNQ0FRWXdFZ1lEVlIwVEFRSC9CQWd3QmdFQgogIC93SUJBVEFkQmdOVkhRNEVGZ1FVNVl0alZWUGZkN0k3TkxIc24yQzI2RUJ5R1Ywd0tRWURWUjBSQkNJd0lJSWUKICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgSVFDTjdsQkZMRER2ang2VjArWGtqcEtFUlJzSllmNWFkTXZubG9GbDQ4aWxKZ0loQU50eGhuZGNyK1FKUHVDOAogIHZnVUMwZDIvOUZNdWVJVk1iKzQ2V1RDT2pzcXIKICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCmltYWdlUHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CmltYWdlUHVsbFNlY3JldHM6IG51bGwKbGlua2VyZFZlcnNpb246ICIiCnByb2ZpbGVWYWxpZGF0b3I6CiAgY2FCdW5kbGU6IHByb2ZpbGUgdmFsaWRhdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJvZmlsZSB2YWxpZGF0b3IgY3J0CiAga2V5UEVNOiBwcm9maWxlIHZhbGlkYXRvciBrZXkKcHJveHk6CiAgaW1hZ2U6CiAgICBuYW1lOiBQcm94eUltYWdlTmFtZQogICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICBpbmJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgb3V0Ym91bmRDb25uZWN0VGltZW91dDogIiIKICByZXNvdXJjZXM6CiAgICBjcHU6CiAgICAgIGxpbWl0OiBjcHUtbGltaXQKICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgIG1lbW9yeToKICAgICAgbGltaXQ6IG1lbW9yeS1saW1pdAogICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdApwcm94eUNvbnRhaW5lck5hbWU6IFByb3h5Q29udGFpbmVyTmFtZQpwcm94eUluaXQ6CiAgaWdub3JlSW5ib3VuZFBvcnRzOiAiIgogIGlnbm9yZU91dGJvdW5kUG9ydHM6ICI0NDMiCiAgaW1hZ2U6CiAgICBuYW1lOiBQcm94eUluaXRJbWFnZU5hbWUKICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgpwcm94eUluamVjdG9yOgogIGNhQnVuZGxlOiBwcm94eSBpbmplY3RvciBDQSBidW5kbGUKICBjcnRQRU06IHByb3h5IGluamVjdG9yIGNydAogIGtleVBFTTogcHJveHkgaW5qZWN0b3Iga2V5CndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
+  linkerd-config-overrides: Y2xpVmVyc2lvbjogQ2xpVmVyc2lvbgpjbHVzdGVyTmV0d29ya3M6IENsdXN0ZXJOZXR3b3Jrcwpjb250cm9sUGxhbmVUcmFjaW5nTmFtZXNwYWNlOiAiIgpjb250cm9sbGVySW1hZ2U6IENvbnRyb2xsZXJJbWFnZQpjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCmNvbnRyb2xsZXJMb2dGb3JtYXQ6IENvbnRyb2xsZXJMb2dGb3JtYXQKY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICBuYW1lOiBEZWJ1Z0ltYWdlTmFtZQogICAgcHVsbFBvbGljeTogRGVidWdJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IERlYnVnVmVyc2lvbgpoZWFydGJlYXRTY2hlZHVsZTogIiIKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQppZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogIE1JSUJ3VENDQVdhZ0F3SUJBZ0lRZURacDVsRGFJeWdRNVVmTUtackZBVEFLQmdncWhrak9QUVFEQWpBcE1TY3cKICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgTURjeE1qUTNXaGNOTXpBd09ESTJNRGN4TWpRM1dqQXBNU2N3SlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1cgogIFpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFScWM3MFoKICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgdWFHNFdXc2l3SktObjdtZ28zQXdiakFPQmdOVkhROEJBZjhFQkFNQ0FRWXdFZ1lEVlIwVEFRSC9CQWd3QmdFQgogIC93SUJBVEFkQmdOVkhRNEVGZ1FVNVl0alZWUGZkN0k3TkxIc24yQzI2RUJ5R1Ywd0tRWURWUjBSQkNJd0lJSWUKICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgSVFDTjdsQkZMRER2ang2VjArWGtqcEtFUlJzSllmNWFkTXZubG9GbDQ4aWxKZ0loQU50eGhuZGNyK1FKUHVDOAogIHZnVUMwZDIvOUZNdWVJVk1iKzQ2V1RDT2pzcXIKICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCmltYWdlUHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CmltYWdlUHVsbFNlY3JldHM6IG51bGwKbGlua2VyZFZlcnNpb246ICIiCnByb2ZpbGVWYWxpZGF0b3I6CiAgY2FCdW5kbGU6IHByb2ZpbGUgdmFsaWRhdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJvZmlsZSB2YWxpZGF0b3IgY3J0CiAga2V5UEVNOiBwcm9maWxlIHZhbGlkYXRvciBrZXkKcHJveHk6CiAgaW1hZ2U6CiAgICBuYW1lOiBQcm94eUltYWdlTmFtZQogICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICBpbmJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgb3BhcXVlUG9ydHM6ICIiCiAgb3V0Ym91bmRDb25uZWN0VGltZW91dDogIiIKICByZXNvdXJjZXM6CiAgICBjcHU6CiAgICAgIGxpbWl0OiBjcHUtbGltaXQKICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgIG1lbW9yeToKICAgICAgbGltaXQ6IG1lbW9yeS1saW1pdAogICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdApwcm94eUNvbnRhaW5lck5hbWU6IFByb3h5Q29udGFpbmVyTmFtZQpwcm94eUluaXQ6CiAgaWdub3JlT3V0Ym91bmRQb3J0czogIjQ0MyIKICBpbWFnZToKICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICB2ZXJzaW9uOiBQcm94eUluaXRWZXJzaW9uCnByb3h5SW5qZWN0b3I6CiAgY2FCdW5kbGU6IHByb3h5IGluamVjdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJveHkgaW5qZWN0b3IgY3J0CiAga2V5UEVNOiBwcm94eSBpbmplY3RvciBrZXkKd2ViaG9va0ZhaWx1cmVQb2xpY3k6IFdlYmhvb2tGYWlsdXJlUG9saWN5Cg==
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 4a291a601..fde60089f 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -966,7 +966,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -1179,6 +1179,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1409,6 +1411,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1658,6 +1662,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1914,6 +1920,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2166,6 +2174,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index b4a9c45b5..8192f8312 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -952,7 +952,7 @@ data:
       isIngress: false
       logFormat: plain
       logLevel: warn,linkerd=info
-      opaquePorts: ""
+      opaquePorts: 25,443,587,3306,5432,11211
       outboundConnectTimeout: 1000ms
       ports:
         admin: 4191
@@ -974,8 +974,8 @@ data:
     proxyInit:
       capabilities: null
       closeWaitTimeoutSecs: 0
-      ignoreInboundPorts: 25,443,587,3306,11211
-      ignoreOutboundPorts: 25,443,587,3306,11211
+      ignoreInboundPorts: ""
+      ignoreOutboundPorts: ""
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
@@ -1165,6 +1165,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1246,9 +1248,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1395,6 +1397,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1476,9 +1480,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1644,6 +1648,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1725,9 +1731,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1900,6 +1906,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -1981,9 +1989,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2152,6 +2160,8 @@ spec:
           value: 10000ms
         - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
           value: 10000ms
+        - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
+          value: "25,443,587,3306,5432,11211"
         - name: _pod_ns
           valueFrom:
             fieldRef:
@@ -2233,9 +2243,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - "4190,4191,25,443,587,3306,11211"
+        - "4190,4191"
         - --outbound-ports-to-ignore
-        - "25,443,587,3306,11211"
+        - "443"
         image: cr.l5d.io/linkerd/proxy-init:v1.3.9
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/controller/api/destination/watcher/endpoints_watcher_test.go b/controller/api/destination/watcher/endpoints_watcher_test.go
index ce559aa79..77704d152 100644
--- a/controller/api/destination/watcher/endpoints_watcher_test.go
+++ b/controller/api/destination/watcher/endpoints_watcher_test.go
@@ -1466,10 +1466,10 @@ metadata:
   name: name1-remote
   namespace: ns
   annotations:
-    multicluster.linkerd.io/remote-gateway-identity: "gateway-identity-1"
-    multicluster.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
+    mirror.linkerd.io/remote-gateway-identity: "gateway-identity-1"
+    mirror.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
   labels:
-    multicluster.linkerd.io/mirrored-service: "true"
+    mirror.linkerd.io/mirrored-service: "true"
 subsets:
 - addresses:
   - ip: 172.17.0.12
@@ -1503,9 +1503,9 @@ metadata:
   name: name1-remote
   namespace: ns
   annotations:
-    multicluster.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
+    mirror.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
   labels:
-    multicluster.linkerd.io/mirrored-service: "true"
+    mirror.linkerd.io/mirrored-service: "true"
 subsets:
 - addresses:
   - ip: 172.17.0.12
@@ -1540,10 +1540,10 @@ metadata:
   name: name1-remote
   namespace: ns
   annotations:
-    multicluster.linkerd.io/remote-gateway-identity: "gateway-identity-1"
-    multicluster.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
+    mirror.linkerd.io/remote-gateway-identity: "gateway-identity-1"
+    mirror.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
   labels:
-    multicluster.linkerd.io/mirrored-service: "true"
+    mirror.linkerd.io/mirrored-service: "true"
 subsets:
 - addresses:
   - ip: 172.17.0.12
@@ -1577,10 +1577,10 @@ metadata:
   name: name1-remote
   namespace: ns
   annotations:
-    multicluster.linkerd.io/remote-gateway-identity: ""
-    multicluster.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
+    mirror.linkerd.io/remote-gateway-identity: ""
+    mirror.linkerd.io/remote-svc-fq-name: "name1-remote-fq"
   labels:
-    multicluster.linkerd.io/mirrored-service: "true"
+    mirror.linkerd.io/mirrored-service: "true"
 subsets:
 - addresses:
   - ip: 172.17.0.12
@@ -1722,10 +1722,10 @@ metadata:
   name: remote-service
   namespace: ns
   annotations:
-    multicluster.linkerd.io/remote-gateway-identity: "gateway-identity-1"
-    multicluster.linkerd.io/remote-svc-fq-name: "remote-service.svc.default.cluster.local"
+    mirror.linkerd.io/remote-gateway-identity: "gateway-identity-1"
+    mirror.linkerd.io/remote-svc-fq-name: "remote-service.svc.default.cluster.local"
   labels:
-    multicluster.linkerd.io/mirrored-service: "true"
+    mirror.linkerd.io/mirrored-service: "true"
 subsets:
 - addresses:
   - ip: 1.2.3.4
diff --git a/controller/api/destination/watcher/opaque_ports_watcher_test.go b/controller/api/destination/watcher/opaque_ports_watcher_test.go
index f51996f1f..30dfab373 100644
--- a/controller/api/destination/watcher/opaque_ports_watcher_test.go
+++ b/controller/api/destination/watcher/opaque_ports_watcher_test.go
@@ -53,6 +53,24 @@ metadata:
 			Ports: []corev1.ServicePort{{Port: 3306}},
 		},
 	}
+	explicitlyNotOpaqueService = `
+apiVersion: v1
+kind: Service
+metadata:
+  name: svc
+  namespace: ns
+  annotations:
+    config.linkerd.io/opaque-ports: ""`
+	explicitlyNotOpaqueServiceObject = corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        "svc",
+			Namespace:   "ns",
+			Annotations: map[string]string{"config.linkerd.io/opaque-ports": ""},
+		},
+		Spec: corev1.ServiceSpec{
+			Ports: []corev1.ServicePort{{Port: 3306}},
+		},
+	}
 )
 
 type testOpaquePortsListener struct {
@@ -87,9 +105,11 @@ func TestOpaquePortsWatcher(t *testing.T) {
 				Name:      "svc",
 				Namespace: "ns",
 			},
-			// Adding and removing services that do not have the opaque ports
-			// annotation should not result in any updates being sent.
-			expectedOpaquePorts: []map[uint32]struct{}{},
+			// 1. default opaque ports
+			// 2. svc updated: no update
+			// 3. svc deleted: no update
+			// 4. svc created: ?
+			expectedOpaquePorts: []map[uint32]struct{}{{11211: {}, 25: {}, 3306: {}, 443: {}, 5432: {}, 587: {}}},
 		},
 		{
 			name:         "namespace with opaque service",
@@ -102,9 +122,9 @@ func TestOpaquePortsWatcher(t *testing.T) {
 			},
 			// 1: svc annotation 3306
 			// 2: svc updated: no update
-			// 2: svc deleted: update with no ports
+			// 2: svc deleted: update with default ports
 			// 3. svc created: update with port 3306
-			expectedOpaquePorts: []map[uint32]struct{}{{3306: {}}, {}, {3306: {}}},
+			expectedOpaquePorts: []map[uint32]struct{}{{3306: {}}, {11211: {}, 25: {}, 3306: {}, 443: {}, 5432: {}, 587: {}}, {3306: {}}},
 		},
 		{
 			name:         "namespace and service, create opaque service",
@@ -115,11 +135,11 @@ func TestOpaquePortsWatcher(t *testing.T) {
 				Name:      "svc",
 				Namespace: "ns",
 			},
-			// 1: no svc annotation
+			// 1: default opaque ports
 			// 2: svc updated: update with port 3306
-			// 3: svc deleted: update with no ports
+			// 3: svc deleted: update with default ports
 			// 4. svc created: update with port 3306
-			expectedOpaquePorts: []map[uint32]struct{}{{3306: {}}, {}, {3306: {}}},
+			expectedOpaquePorts: []map[uint32]struct{}{{11211: {}, 25: {}, 3306: {}, 443: {}, 5432: {}, 587: {}}, {3306: {}}, {11211: {}, 25: {}, 3306: {}, 443: {}, 5432: {}, 587: {}}, {3306: {}}},
 		},
 		{
 			name:         "namespace and opaque service, create base service",
@@ -131,10 +151,25 @@ func TestOpaquePortsWatcher(t *testing.T) {
 				Namespace: "ns",
 			},
 			// 1: svc annotation 3306
-			// 2. svc updated: update with no ports
+			// 2. svc updated: update with default ports
 			// 3. svc deleted: no update
 			// 4. svc added: no update
-			expectedOpaquePorts: []map[uint32]struct{}{{3306: {}}, {}},
+			expectedOpaquePorts: []map[uint32]struct{}{{3306: {}}, {11211: {}, 25: {}, 3306: {}, 443: {}, 5432: {}, 587: {}}},
+		},
+		{
+			name:         "namespace and explicitly not opaque service, create explicitly not opaque service",
+			initialState: []string{testNS, explicitlyNotOpaqueService},
+			nsObject:     &testNSObject,
+			svcObject:    &explicitlyNotOpaqueServiceObject,
+			service: ServiceID{
+				Name:      "svc",
+				Namespace: "ns",
+			},
+			// 1: svc annotation empty
+			// 2. svc updated: no update
+			// 3. svc deleted: update with default ports
+			// 4. svc added: update with no ports
+			expectedOpaquePorts: []map[uint32]struct{}{{}, {11211: {}, 25: {}, 3306: {}, 443: {}, 5432: {}, 587: {}}, {}},
 		},
 	} {
 		k8sAPI, err := k8s.NewFakeAPI(tt.initialState...)
diff --git a/multicluster/service-mirror/cluster_watcher_test_util.go b/multicluster/service-mirror/cluster_watcher_test_util.go
index 877115878..a6b9c572c 100644
--- a/multicluster/service-mirror/cluster_watcher_test_util.go
+++ b/multicluster/service-mirror/cluster_watcher_test_util.go
@@ -10,7 +10,6 @@ import (
 
 	"github.com/ghodss/yaml"
 	"github.com/linkerd/linkerd2/controller/k8s"
-	labels "github.com/linkerd/linkerd2/multicluster/pkg"
 	consts "github.com/linkerd/linkerd2/pkg/k8s"
 	"github.com/linkerd/linkerd2/pkg/multicluster"
 	logging "github.com/sirupsen/logrus"
@@ -469,7 +468,7 @@ func remoteServiceAsYaml(name, namespace, resourceVersion string, ports []corev1
 
 func mirrorService(name, namespace, resourceVersion string, ports []corev1.ServicePort) *corev1.Service {
 	annotations := make(map[string]string)
-	annotations[labels.RemoteResourceVersionAnnotation] = resourceVersion
+	annotations[consts.RemoteResourceVersionAnnotation] = resourceVersion
 	annotations[consts.RemoteServiceFqName] = fmt.Sprintf("%s.%s.svc.cluster.local", strings.Replace(name, "-remote", "", 1), namespace)
 
 	return &corev1.Service{
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index 5d6a25831..e9102e7a9 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -82,10 +82,9 @@ func TestNewValues(t *testing.T) {
 			WaitBeforeExitSeconds:  0,
 			OutboundConnectTimeout: "1000ms",
 			InboundConnectTimeout:  "100ms",
+			OpaquePorts:            "25,443,587,3306,5432,11211",
 		},
 		ProxyInit: &ProxyInit{
-			IgnoreInboundPorts:  "25,443,587,3306,11211",
-			IgnoreOutboundPorts: "25,443,587,3306,11211",
 			Image: &Image{
 				Name:    "cr.l5d.io/linkerd/proxy-init",
 				Version: testVersion,
diff --git a/test/integration/inject/inject_test.go b/test/integration/inject/inject_test.go
index 08bb6f856..e2ded14da 100644
--- a/test/integration/inject/inject_test.go
+++ b/test/integration/inject/inject_test.go
@@ -382,7 +382,6 @@ func TestInjectAutoPod(t *testing.T) {
 			"--proxy-uid", "2102",
 			// 1234,5678 were added at install time in `install_test.go`'s helmOverridesEdge()
 			"--inbound-ports-to-ignore", "4190,4191,1234,5678",
-			"--outbound-ports-to-ignore", "25,443,587,3306,11211",
 		},
 		Resources: v1.ResourceRequirements{
 			Limits: v1.ResourceList{
diff --git a/test/integration/install_test.go b/test/integration/install_test.go
index 2ca795bda..57e17d1cb 100644
--- a/test/integration/install_test.go
+++ b/test/integration/install_test.go
@@ -783,7 +783,7 @@ func testCheckCommand(t *testing.T, stage string, expectedVersion string, namesp
 		}
 	}
 
-	timeout := time.Minute
+	timeout := time.Minute * 5
 	err := TestHelper.RetryFor(timeout, func() error {
 		if cliVersionOverride != "" {
 			cliVOverride := []string{"--cli-version-override", cliVersionOverride}
diff --git a/test/integration/multicluster/target1/testdata/emojivoto-no-bot.yml b/test/integration/multicluster/target1/testdata/emojivoto-no-bot.yml
index 9a1ba2e0f..b0db932cd 100644
--- a/test/integration/multicluster/target1/testdata/emojivoto-no-bot.yml
+++ b/test/integration/multicluster/target1/testdata/emojivoto-no-bot.yml
@@ -54,7 +54,7 @@ metadata:
   name: web-svc
   namespace: emojivoto
   labels:
-    multicluster.linkerd.io/export: "true"
+    mirror.linkerd.io/exported: "true"
 spec:
   ports:
   - name: http
diff --git a/test/integration/tap/tap_test.go b/test/integration/tap/tap_test.go
index 8657cd84e..168ffedd4 100644
--- a/test/integration/tap/tap_test.go
+++ b/test/integration/tap/tap_test.go
@@ -144,8 +144,8 @@ func TestCliTap(t *testing.T) {
 			if stderr == "" {
 				testutil.Fatal(t, "expected an error, got none")
 			}
-			expectedErr := `Error: no pods to tap for deployment/t4
-pods found with tap disabled via the viz.linkerd.io/disable-tap annotation`
+			expectedErr := `no pods to tap for deployment/t4
+1 pods found with tap disabled via the viz.linkerd.io/disable-tap annotation:`
 			split := strings.Split(stderr, "\n")
 			actualErr := strings.Join(split[:2], "\n")
 			if actualErr != expectedErr {
diff --git a/test/integration/testdata/check.viz.proxy.golden b/test/integration/testdata/check.viz.proxy.golden
index 243e8f3fa..8353ea947 100644
--- a/test/integration/testdata/check.viz.proxy.golden
+++ b/test/integration/testdata/check.viz.proxy.golden
@@ -16,6 +16,5 @@ linkerd-viz-data-plane
 ----------------------
 √ data plane namespace exists
 √ data plane proxy metrics are present in Prometheus
-√ data-plane pods have tap enabled
 
 Status check results are √
diff --git a/viz/tap/api/grpc_server_test.go b/viz/tap/api/grpc_server_test.go
index e57d4b04f..b8ba706cb 100644
--- a/viz/tap/api/grpc_server_test.go
+++ b/viz/tap/api/grpc_server_test.go
@@ -91,7 +91,7 @@ status:
 			},
 		},
 		{
-			err: status.Errorf(codes.NotFound, "no pods to tap for pod/emojivoto-not-meshed"),
+			err: status.Errorf(codes.NotFound, "no pods to tap for pod/emojivoto-not-meshed\n"),
 			k8sRes: []string{`
 apiVersion: v1
 kind: Pod
@@ -157,7 +157,7 @@ status:
 			},
 		},
 		{
-			err: status.Errorf(codes.NotFound, "no pods to tap for pod/emojivoto-meshed"),
+			err: status.Errorf(codes.NotFound, "no pods to tap for pod/emojivoto-meshed\n"),
 			k8sRes: []string{`
 apiVersion: v1
 kind: Pod
@@ -186,7 +186,10 @@ status:
 		},
 		{
 			err: status.Errorf(codes.NotFound, `no pods to tap for pod/emojivoto-meshed-tap-disabled
-pods found with tap disabled via the viz.linkerd.io/disable-tap annotation`),
+1 pods found with tap disabled via the viz.linkerd.io/disable-tap annotation:
+	* emojivoto-meshed-tap-disabled
+remove this annotation to make these pods valid tap targets
+`),
 			k8sRes: []string{`
 apiVersion: v1
 kind: Pod
@@ -221,7 +224,10 @@ status:
 		},
 		{
 			err: status.Errorf(codes.NotFound, `no pods to tap for pod/emojivoto-meshed-tap-not-enabled
-pods found with tap not enabled; try restarting resource so that it can be injected`),
+1 pods found with tap not enabled:
+	* emojivoto-meshed-tap-not-enabled
+restart these pods to enable tap and make them valid tap targets
+`),
 			k8sRes: []string{`
 apiVersion: v1
 kind: Pod