Repository: linkerd/linkerd2
Pull request #5161 (2020-11-02 12:10:23)

upgrade: set identity.issuer.crtExpiry correctly with legacy upgrades
With legacy upgrades, we can parse the cert and store the expiry
correctly instead of storing it as the default value which could be a
problem when we use that field. Currently, we do not use this field and
hence it did not cause any problems.

With Install on the latest edges, This field is correctly set and works
as expected. Thus, upgrades also hav the right value.

Signed-off-by: Tarun Pothulapati <tarunpothulapati@outlook.com>



Patch:
diff --git a/charts/add-ons/grafana/templates/grafana.yaml b/charts/add-ons/grafana/templates/grafana.yaml
index 8034e7ee6..e36f4c8bd 100644
--- a/charts/add-ons/grafana/templates/grafana.yaml
+++ b/charts/add-ons/grafana/templates/grafana.yaml
@@ -86,8 +86,9 @@ spec:
     port: 3000
     targetPort: 3000
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-grafana" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-grafana" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -108,7 +109,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: grafana
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -119,7 +120,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: grafana
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8 }}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8 }}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -160,7 +161,6 @@ spec:
         - mountPath: /etc/grafana
           name: grafana-config
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.proxy) }}
       {{- if not (empty .Values.proxy.resources) }}
       {{- $r := merge .Values.proxy.resources .Values.global.proxy.resources }}
diff --git a/charts/add-ons/prometheus/templates/prometheus.yaml b/charts/add-ons/prometheus/templates/prometheus.yaml
index 44475f1f8..e5b5296e5 100644
--- a/charts/add-ons/prometheus/templates/prometheus.yaml
+++ b/charts/add-ons/prometheus/templates/prometheus.yaml
@@ -186,8 +186,9 @@ spec:
     port: 9090
     targetPort: 9090
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-prometheus" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-prometheus" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -212,7 +213,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: prometheus
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -223,7 +224,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: prometheus
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -278,7 +279,6 @@ spec:
           name: prometheus-config
           subPath: prometheus.yml
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.proxy) }}
       {{- if not (empty .Values.proxy.resources) }}
       {{- $r := merge .Values.proxy.resources .Values.global.proxy.resources }}
diff --git a/charts/add-ons/tracing/templates/tracing.yaml b/charts/add-ons/tracing/templates/tracing.yaml
index b38fdaa21..a8b75c487 100644
--- a/charts/add-ons/tracing/templates/tracing.yaml
+++ b/charts/add-ons/tracing/templates/tracing.yaml
@@ -60,9 +60,10 @@ spec:
   selector:
     {{.Values.global.controllerComponentLabel}}: linkerd-collector
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-collector" -}}
-{{ include "linkerd.proxy.validation" .Values.global.proxy -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-collector" -}}
+{{ include "linkerd.proxy.validation" $tree.Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -82,7 +83,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: linkerd-collector
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   minReadySeconds: 5
   progressDeadlineSeconds: 120
   template:
@@ -98,7 +99,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: linkerd-collector
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       containers:
@@ -129,7 +130,7 @@ spec:
         volumeMounts:
         - mountPath: /conf
           name: linkerd-collector-config-val
-      - {{- include "partials.proxy" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
       - {{- include "partials.proxy-init" . | indent 8 | trimPrefix (repeat 7 " ") }}
@@ -174,9 +175,10 @@ spec:
     - name: ui
       port: 16686
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-jaeger" -}}
-{{ include "linkerd.proxy.validation" .Values.global.proxy -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-jaeger" -}}
+{{ include "linkerd.proxy.validation" $tree.Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -196,7 +198,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: linkerd-jaeger
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -210,7 +212,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: linkerd-jaeger
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       containers:
@@ -227,7 +229,7 @@ spec:
         {{- if .Values.jaeger.resources -}}
         {{- include "partials.resources" .Values.jaeger.resources | nindent 8 }}
         {{- end }}
-      - {{- include "partials.proxy" . | indent 8 | trimPrefix (repeat 7 " ") }}
+      - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
       {{ if not .Values.global.cniEnabled -}}
       initContainers:
       - {{- include "partials.proxy-init" . | indent 8 | trimPrefix (repeat 7 " ") }}
diff --git a/charts/linkerd2/templates/controller.yaml b/charts/linkerd2/templates/controller.yaml
index d7a111a57..072e165b1 100644
--- a/charts/linkerd2/templates/controller.yaml
+++ b/charts/linkerd2/templates/controller.yaml
@@ -22,8 +22,9 @@ spec:
     port: 8085
     targetPort: 8085
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-controller" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-controller" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -44,7 +45,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: controller
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -60,7 +61,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: controller
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -107,7 +108,6 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.publicAPIProxyResources) }}
       {{- $r := merge .Values.publicAPIProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/linkerd2/templates/destination.yaml b/charts/linkerd2/templates/destination.yaml
index 6b853f5ae..fba76ce94 100644
--- a/charts/linkerd2/templates/destination.yaml
+++ b/charts/linkerd2/templates/destination.yaml
@@ -41,8 +41,9 @@ spec:
     port: 8086
     targetPort: 8086
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-destination" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-destination" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -63,7 +64,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: destination
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -79,7 +80,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: destination
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -124,7 +125,6 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.destinationProxyResources) }}
       {{- $r := merge .Values.destinationProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/linkerd2/templates/identity.yaml b/charts/linkerd2/templates/identity.yaml
index 14450c806..1fc7b2db9 100644
--- a/charts/linkerd2/templates/identity.yaml
+++ b/charts/linkerd2/templates/identity.yaml
@@ -61,8 +61,9 @@ spec:
     port: 8080
     targetPort: 8080
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-identity" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-identity" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -83,7 +84,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: identity
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -99,7 +100,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: identity
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -147,7 +148,6 @@ spec:
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/issuer
           name: identity-issuer
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.identityProxyResources) }}
       {{- $r := merge .Values.identityProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/linkerd2/templates/proxy-injector.yaml b/charts/linkerd2/templates/proxy-injector.yaml
index 7b2f68ef8..d5b67e759 100644
--- a/charts/linkerd2/templates/proxy-injector.yaml
+++ b/charts/linkerd2/templates/proxy-injector.yaml
@@ -3,8 +3,9 @@
 ### Proxy Injector
 ###
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-proxy-injector" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-proxy-injector" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -42,7 +43,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: proxy-injector
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -86,7 +87,6 @@ spec:
         - mountPath: /var/run/linkerd/tls
           name: tls
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.proxyInjectorProxyResources) }}
       {{- $r := merge .Values.proxyInjectorProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/linkerd2/templates/sp-validator.yaml b/charts/linkerd2/templates/sp-validator.yaml
index 58e94b53a..e3943ce79 100644
--- a/charts/linkerd2/templates/sp-validator.yaml
+++ b/charts/linkerd2/templates/sp-validator.yaml
@@ -22,8 +22,9 @@ spec:
     port: 443
     targetPort: sp-validator
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-sp-validator" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-sp-validator" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -61,7 +62,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: sp-validator
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -103,7 +104,6 @@ spec:
         - mountPath: /var/run/linkerd/tls
           name: tls
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.spValidatorProxyResources) }}
       {{- $r := merge .Values.spValidatorProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/linkerd2/templates/tap.yaml b/charts/linkerd2/templates/tap.yaml
index a6754f18e..7d8f6cc32 100644
--- a/charts/linkerd2/templates/tap.yaml
+++ b/charts/linkerd2/templates/tap.yaml
@@ -25,8 +25,9 @@ spec:
     port: 443
     targetPort: apiserver
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-tap" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-tap" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 kind: Deployment
 apiVersion: apps/v1
@@ -47,7 +48,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: tap
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   {{- if .Values.enablePodAntiAffinity }}
   strategy:
     rollingUpdate:
@@ -66,7 +67,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: tap
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -113,7 +114,6 @@ spec:
         - mountPath: /var/run/linkerd/tls
           name: tls
           readOnly: true
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.tapProxyResources) }}
       {{- $r := merge .Values.tapProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/linkerd2/templates/web.yaml b/charts/linkerd2/templates/web.yaml
index eb5be68af..f8272ef78 100644
--- a/charts/linkerd2/templates/web.yaml
+++ b/charts/linkerd2/templates/web.yaml
@@ -25,8 +25,9 @@ spec:
     port: 9994
     targetPort: 9994
 ---
-{{ $_ := set .Values.global.proxy "workloadKind" "deployment" -}}
-{{ $_ := set .Values.global.proxy "component" "linkerd-web" -}}
+{{- $tree := deepCopy . }}
+{{ $_ := set $tree.Values.global.proxy "workloadKind" "deployment" -}}
+{{ $_ := set $tree.Values.global.proxy "component" "linkerd-web" -}}
 {{ include "linkerd.proxy.validation" .Values.global.proxy -}}
 apiVersion: apps/v1
 kind: Deployment
@@ -47,7 +48,7 @@ spec:
     matchLabels:
       {{.Values.global.controllerComponentLabel}}: web
       {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
-      {{- include "partials.proxy.labels" .Values.global.proxy | nindent 6}}
+      {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 6}}
   template:
     metadata:
       annotations:
@@ -58,7 +59,7 @@ spec:
         {{.Values.global.controllerComponentLabel}}: web
         {{.Values.global.controllerNamespaceLabel}}: {{.Values.global.namespace}}
         {{.Values.global.workloadNamespaceLabel}}: {{.Values.global.namespace}}
-        {{- include "partials.proxy.labels" .Values.global.proxy | nindent 8}}
+        {{- include "partials.proxy.labels" $tree.Values.global.proxy | nindent 8}}
         {{- with .Values.global.podLabels }}{{ toYaml . | trim | nindent 8 }}{{- end }}
     spec:
       {{- if .Values.tolerations -}}
@@ -110,7 +111,6 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
-      {{- $tree := deepCopy . }}
       {{- if not (empty .Values.webProxyResources) }}
       {{- $r := merge .Values.webProxyResources .Values.global.proxy.resources }}
       {{- $_ := set $tree.Values.global.proxy "resources" $r }}
diff --git a/charts/partials/templates/_proxy-init.tpl b/charts/partials/templates/_proxy-init.tpl
index 59508e7cc..c818e713a 100644
--- a/charts/partials/templates/_proxy-init.tpl
+++ b/charts/partials/templates/_proxy-init.tpl
@@ -7,11 +7,8 @@ args:
 - --proxy-uid
 - {{.Values.global.proxy.uid | quote}}
 - --inbound-ports-to-ignore
-- {{.Values.global.proxy.ports.control}},{{.Values.global.proxy.ports.admin}}{{ternary (printf ",%s" .Values.global.proxyInit.ignoreInboundPorts) "" (not (empty .Values.global.proxyInit.ignoreInboundPorts)) }}
-{{- if hasPrefix "linkerd-" .Values.global.proxy.component }}
-- --outbound-ports-to-ignore
-- {{ternary (printf "443,%s" .Values.global.proxyInit.ignoreOutboundPorts) (quote "443") (not (empty .Values.global.proxyInit.ignoreOutboundPorts)) }}
-{{- else if .Values.global.proxyInit.ignoreOutboundPorts }}
+- "{{.Values.global.proxy.ports.control}},{{.Values.global.proxy.ports.admin}}{{ternary (printf ",%s" .Values.global.proxyInit.ignoreInboundPorts) "" (not (empty .Values.global.proxyInit.ignoreInboundPorts)) }}"
+{{- if .Values.global.proxyInit.ignoreOutboundPorts }}
 - --outbound-ports-to-ignore
 - {{.Values.global.proxyInit.ignoreOutboundPorts | quote}}
 {{- end }}
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index e67a3547f..36dc5c571 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -9,7 +9,7 @@ env:
 - name: LINKERD2_PROXY_LOG_FORMAT
   value: {{.Values.global.proxy.logFormat | quote}}
 - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
-  value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s:8086" .Values.global.namespace .Values.global.clusterDomain) (eq .Values.global.proxy.component "linkerd-destination")}}
+  value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s:8086" .Values.global.namespace .Values.global.clusterDomain) (eq (toString .Values.global.proxy.component) "linkerd-destination")}}
 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
   value: {{.Values.global.clusterNetworks | quote}}
 {{ if .Values.global.proxy.inboundConnectTimeout -}}
@@ -74,8 +74,7 @@ env:
 - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE
   value: /var/run/secrets/kubernetes.io/serviceaccount/token
 - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR
-  {{- $identitySvcAddr := printf "linkerd-identity-headless.%s.svc.%s:8080" .Values.global.namespace .Values.global.clusterDomain }}
-  value: {{ternary "localhost.:8080" $identitySvcAddr (eq .Values.global.proxy.component "linkerd-identity")}}
+  value: {{ternary "localhost.:8080" (printf "linkerd-identity-headless.%s.svc.%s:8080" .Values.global.namespace .Values.global.clusterDomain) (eq (toString .Values.global.proxy.component) "linkerd-identity")}}
 - name: _pod_sa
   valueFrom:
     fieldRef:
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index b8569f594..34e3992e9 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -113,7 +113,6 @@ type (
 	// Proxy contains the fields to set the proxy sidecar container
 	Proxy struct {
 		Capabilities                  *Capabilities    `json:"capabilities"`
-		Component                     string           `json:"component"`
 		DisableIdentity               bool             `json:"disableIdentity"`
 		DisableTap                    bool             `json:"disableTap"`
 		EnableExternalProfiles        bool             `json:"enableExternalProfiles"`
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index bca97051e..62357d6ea 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -516,7 +516,6 @@ func (conf *ResourceConfig) complete(template *corev1.PodTemplateSpec) {
 
 // injectPodSpec adds linkerd sidecars to the provided PodSpec.
 func (conf *ResourceConfig) injectPodSpec(values *patch) {
-	values.Global.Proxy.Component = conf.pod.labels[k8s.ProxyDeploymentLabel]
 	saVolumeMount := conf.serviceAccountVolumeMount()
 
 	// use the primary container's capabilities to ensure psp compliance, if
diff --git a/pkg/issuercerts/issuercerts.go b/pkg/issuercerts/issuercerts.go
index 57cc56c22..02a0a2ece 100644
--- a/pkg/issuercerts/issuercerts.go
+++ b/pkg/issuercerts/issuercerts.go
@@ -44,7 +44,12 @@ func FetchIssuerData(ctx context.Context, api kubernetes.Interface, trustAnchors
 		return nil, fmt.Errorf(keyMissingError, k8s.IdentityIssuerKeyName, "issuer key", k8s.IdentityIssuerSecretName, true)
 	}
 
-	return &IssuerCertData{trustAnchors, string(crt), string(key), nil}, nil
+	cert, err := tls.DecodePEMCrt(string(crt))
+	if err != nil {
+		return nil, fmt.Errorf("could not parse issuer certificate: %w", err)
+	}
+
+	return &IssuerCertData{trustAnchors, string(crt), string(key), &cert.Certificate.NotAfter}, nil
 }
 
 // FetchExternalIssuerData fetches the issuer data from the linkerd-identity-issuer secrets (used for kubernetes.io/tls schemed secrets)


Test patch:
diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
index 81413585f..3ce799ea2 100644
--- a/cli/cmd/install_test.go
+++ b/cli/cmd/install_test.go
@@ -95,6 +95,7 @@ func TestRender(t *testing.T) {
 					PullPolicy: "ImagePullPolicy",
 					Version:    "ProxyInitVersion",
 				},
+				IgnoreOutboundPorts: "443",
 				Resources: &charts.Resources{
 					CPU: charts.Constraints{
 						Limit:   "100m",
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index ba5431a1b..b66a2cae6 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -200,7 +200,7 @@ spec:
         - --inbound-ports-to-ignore
         - 4190,4191,25,443,587,3306,11211
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - 25,443,587,3306,11211
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_addon.golden b/cli/cmd/testdata/install_addon.golden
index 6dfaa3a8c..f6d98698b 100644
--- a/cli/cmd/testdata/install_addon.golden
+++ b/cli/cmd/testdata/install_addon.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1226,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1459,9 +1457,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1710,9 +1708,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1990,9 +1988,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2201,9 +2199,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2454,9 +2452,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2694,9 +2692,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3004,9 +3002,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3439,9 +3437,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3738,9 +3736,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3959,9 +3957,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index bbe5e4c01..b6b479cc8 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1229,9 +1227,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1477,9 +1475,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1743,9 +1741,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2037,9 +2035,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2262,9 +2260,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2529,9 +2527,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2784,9 +2782,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3108,9 +3106,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3557,9 +3555,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index fc9fce581..397ae9c4f 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: my.custom.registry/linkerd-io/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index c06dfe45a..af26c6236 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 9c7f5f43e..73954259b 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_grafana_existing.golden b/cli/cmd/testdata/install_grafana_existing.golden
index 2bdfeef9d..17dca2e71 100644
--- a/cli/cmd/testdata/install_grafana_existing.golden
+++ b/cli/cmd/testdata/install_grafana_existing.golden
@@ -849,7 +849,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -883,7 +882,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1217,9 +1215,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1450,9 +1448,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1701,9 +1699,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1980,9 +1978,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2191,9 +2189,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2444,9 +2442,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2684,9 +2682,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3111,9 +3109,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index cfce0ac49..a0db0183b 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1318,9 +1316,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1587,9 +1585,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1874,9 +1872,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2173,9 +2171,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2420,9 +2418,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2709,9 +2707,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2985,9 +2983,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3308,9 +3306,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3756,9 +3754,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 6b0f7f453..b4244dcdc 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1318,9 +1316,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1587,9 +1585,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1874,9 +1872,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2173,9 +2171,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2420,9 +2418,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2709,9 +2707,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2985,9 +2983,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3308,9 +3306,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3756,9 +3754,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 99a0a656f..60b8a7af1 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -808,7 +808,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -842,7 +841,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1176,9 +1174,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1409,9 +1407,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1660,9 +1658,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1894,9 +1892,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2105,9 +2103,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2358,9 +2356,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2598,9 +2596,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2908,9 +2906,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3343,9 +3341,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index 7a189d137..f8a90da26 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -866,7 +866,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -900,7 +899,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -954,7 +952,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -988,7 +985,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1043,7 +1039,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1077,7 +1072,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1163,7 +1157,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1197,7 +1190,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1255,7 +1247,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1289,7 +1280,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1571,9 +1561,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1795,9 +1785,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2037,9 +2027,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2309,9 +2299,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2512,9 +2502,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2757,9 +2747,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2989,9 +2979,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3292,9 +3282,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3720,9 +3710,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_addons.golden b/cli/cmd/testdata/install_helm_output_addons.golden
index 2969b8182..29cd41b19 100644
--- a/cli/cmd/testdata/install_helm_output_addons.golden
+++ b/cli/cmd/testdata/install_helm_output_addons.golden
@@ -872,7 +872,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -906,7 +905,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -960,7 +958,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -994,7 +991,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1049,7 +1045,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1083,7 +1078,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1169,7 +1163,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1203,7 +1196,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1261,7 +1253,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1295,7 +1286,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1375,7 +1365,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1409,7 +1398,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1464,7 +1452,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1498,7 +1485,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1754,9 +1740,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1978,9 +1964,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2220,9 +2206,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2493,9 +2479,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2696,9 +2682,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2941,9 +2927,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3173,9 +3159,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3476,9 +3462,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3904,9 +3890,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4196,9 +4182,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4406,9 +4392,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index cbf7d8dae..a2171df0a 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -872,7 +872,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -906,7 +905,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -959,7 +957,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -993,7 +990,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1047,7 +1043,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1081,7 +1076,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1185,7 +1179,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1219,7 +1212,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1276,7 +1268,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1310,7 +1301,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1665,9 +1655,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1925,9 +1915,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2203,9 +2193,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2495,9 +2485,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2734,9 +2724,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3015,9 +3005,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3283,9 +3273,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3599,9 +3589,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4040,9 +4030,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 2b4ffdc81..1d052a7a5 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -876,7 +876,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -910,7 +909,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -967,7 +965,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1001,7 +998,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1059,7 +1055,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1093,7 +1088,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1201,7 +1195,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1235,7 +1228,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1296,7 +1288,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1330,7 +1321,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1689,9 +1679,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1953,9 +1943,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2235,9 +2225,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2535,9 +2525,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2778,9 +2768,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3063,9 +3053,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3335,9 +3325,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3655,9 +3645,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4100,9 +4090,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,444
+        - "4190,4191,444"
         - --outbound-ports-to-ignore
-        - 443,333
+        - "333"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 97ff6b828..de12859fd 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -872,7 +872,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -906,7 +905,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -959,7 +957,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -993,7 +990,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1047,7 +1043,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1081,7 +1076,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1185,7 +1179,6 @@ data:
         prometheusUrl: ""
         proxy:
           capabilities: null
-          component: linkerd-controller
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1219,7 +1212,6 @@ data:
             collectorSvcAddr: ""
           uid: 2102
           waitBeforeExitSeconds: 0
-          workloadKind: deployment
         proxyContainerName: linkerd-proxy
         proxyInit:
           capabilities: null
@@ -1276,7 +1268,6 @@ data:
           prometheusUrl: ""
           proxy:
             capabilities: null
-            component: linkerd-controller
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1310,7 +1301,6 @@ data:
               collectorSvcAddr: ""
             uid: 2102
             waitBeforeExitSeconds: 0
-            workloadKind: deployment
           proxyContainerName: linkerd-proxy
           proxyInit:
             capabilities: null
@@ -1665,9 +1655,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1925,9 +1915,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2203,9 +2193,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2495,9 +2485,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2734,9 +2724,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3015,9 +3005,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3283,9 +3273,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3599,9 +3589,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -4040,9 +4030,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,222
+        - "4190,4191,222"
         - --outbound-ports-to-ignore
-        - 443,111
+        - "111"
         image: ghcr.io/linkerd/proxy-init:test-proxy-init-version
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 2d9059d44..4a9eb230d 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -849,7 +849,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -883,7 +882,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 2fdb1b912..57b800e51 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,13 +885,12 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: ProxyContainerName
       proxyInit:
         capabilities: null
         closeWaitTimeoutSecs: 0
         ignoreInboundPorts: ""
-        ignoreOutboundPorts: ""
+        ignoreOutboundPorts: "443"
         image:
           name: ProxyInitImageName
           pullPolicy: ImagePullPolicy
@@ -1223,7 +1221,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -1458,7 +1456,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -1711,7 +1709,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -1992,7 +1990,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -2205,7 +2203,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -2460,7 +2458,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -2702,7 +2700,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -3014,7 +3012,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -3451,7 +3449,7 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191
+        - "4190,4191"
         - --outbound-ports-to-ignore
         - "443"
         image: ProxyInitImageName:ProxyInitVersion
@@ -3493,7 +3491,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICBuYW1lOiBEZWJ1Z0ltYWdlTmFtZQogICAgcHVsbFBvbGljeTogRGVidWdJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IERlYnVnVmVyc2lvbgpnbG9iYWw6CiAgY2xpVmVyc2lvbjogQ2xpVmVyc2lvbgogIGNsdXN0ZXJOZXR3b3JrczogQ2x1c3Rlck5ldHdvcmtzCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICBuYW1lOiBEZWJ1Z0ltYWdlTmFtZQogICAgcHVsbFBvbGljeTogRGVidWdJbWFnZVB1bGxQb2xpY3kKICAgIHZlcnNpb246IERlYnVnVmVyc2lvbgpnbG9iYWw6CiAgY2xpVmVyc2lvbjogQ2xpVmVyc2lvbgogIGNsdXN0ZXJOZXR3b3JrczogQ2x1c3Rlck5ldHdvcmtzCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiNDQzIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_prometheus_overwrite.golden b/cli/cmd/testdata/install_prometheus_overwrite.golden
index 8db0e0740..6d64b22f5 100644
--- a/cli/cmd/testdata/install_prometheus_overwrite.golden
+++ b/cli/cmd/testdata/install_prometheus_overwrite.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1277,9 +1275,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1510,9 +1508,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1761,9 +1759,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2040,9 +2038,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2251,9 +2249,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2504,9 +2502,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2744,9 +2742,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3054,9 +3052,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3542,9 +3540,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index f63988141..0d8cd53d4 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -852,7 +852,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -886,7 +885,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1220,9 +1218,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1453,9 +1451,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1704,9 +1702,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1983,9 +1981,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2194,9 +2192,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2447,9 +2445,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2687,9 +2685,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2997,9 +2995,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3432,9 +3430,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,22,8100-8102
+        - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
-        - 443,5432
+        - "5432"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_restricted_dashboard.golden b/cli/cmd/testdata/install_restricted_dashboard.golden
index 8a5ee9e91..075e58f7c 100644
--- a/cli/cmd/testdata/install_restricted_dashboard.golden
+++ b/cli/cmd/testdata/install_restricted_dashboard.golden
@@ -784,7 +784,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -818,7 +817,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1152,9 +1150,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1385,9 +1383,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1636,9 +1634,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1915,9 +1913,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2126,9 +2124,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2379,9 +2377,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2619,9 +2617,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2929,9 +2927,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3364,9 +3362,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_tracing.golden b/cli/cmd/testdata/install_tracing.golden
index 6dfaa3a8c..f6d98698b 100644
--- a/cli/cmd/testdata/install_tracing.golden
+++ b/cli/cmd/testdata/install_tracing.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1226,9 +1224,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1459,9 +1457,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1710,9 +1708,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1990,9 +1988,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2201,9 +2199,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2454,9 +2452,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2694,9 +2692,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3004,9 +3002,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3439,9 +3437,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3738,9 +3736,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3959,9 +3957,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/cli/cmd/testdata/install_tracing_overwrite.golden b/cli/cmd/testdata/install_tracing_overwrite.golden
index e25aa5392..87e5f9778 100644
--- a/cli/cmd/testdata/install_tracing_overwrite.golden
+++ b/cli/cmd/testdata/install_tracing_overwrite.golden
@@ -858,7 +858,6 @@ data:
       prometheusUrl: ""
       proxy:
         capabilities: null
-        component: linkerd-controller
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -892,7 +891,6 @@ data:
           collectorSvcAddr: ""
         uid: 2102
         waitBeforeExitSeconds: 0
-        workloadKind: deployment
       proxyContainerName: linkerd-proxy
       proxyInit:
         capabilities: null
@@ -1228,9 +1226,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1461,9 +1459,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1712,9 +1710,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -1992,9 +1990,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2203,9 +2201,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2456,9 +2454,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -2696,9 +2694,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3006,9 +3004,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3441,9 +3439,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3740,9 +3738,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
@@ -3961,9 +3959,9 @@ spec:
         - --proxy-uid
         - "2102"
         - --inbound-ports-to-ignore
-        - 4190,4191,25,443,587,3306,11211
+        - "4190,4191,25,443,587,3306,11211"
         - --outbound-ports-to-ignore
-        - 443,25,443,587,3306,11211
+        - "25,443,587,3306,11211"
         image: ghcr.io/linkerd/proxy-init:v1.3.6
         imagePullPolicy: IfNotPresent
         name: linkerd-init
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 59e068c4e..e4d103ea7 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2698,7 +2698,6 @@ data:
 					CNIEnabled:               false,
 					IdentityTrustDomain:      defaultValues.Global.IdentityTrustDomain,
 					Proxy: &linkerd2.Proxy{
-						Component: "linkerd-controller",
 						Image: &linkerd2.Image{
 							Name:       "ProxyImageName",
 							PullPolicy: "ImagePullPolicy",