Repository: linkerd/linkerd2
Pull request #5114 (2020-10-20 23:30:06)

Fixed multicluster Grafana chart
The graphs were empty because they were relying on the metric label `dst_target_gateway` which is no longer relevant.

When mirroring the `emoji` and `voting` services after this fix:

![image](https://user-images.githubusercontent.com/554287/96655037-2960bc80-1302-11eb-99bf-995283b7ccfd.png)



Patch:
diff --git a/charts/linkerd2/README.md b/charts/linkerd2/README.md
index ea4967076..6044554c7 100644
--- a/charts/linkerd2/README.md
+++ b/charts/linkerd2/README.md
@@ -87,8 +87,6 @@ their default values.
 | Parameter                                   | Description                                                                                                                                                                           | Default                              |
 |:--------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------|
 | `controllerImage`                           | Docker image for the controller, tap and identity components                                                                                                                          | `ghcr.io/linkerd/controller`       |
-| `controllerImageVersion`                    | Tag for the controller container docker image                                                                                                                                         | latest version                       |
-| `controllerLogLevel`                        | Log level for the control plane components                                                                                                                                            | `info`                               |
 | `controllerReplicas`                        | Number of replicas for each control plane pod                                                                                                                                         | `1`                                  |
 | `controllerUID`                             | User ID for the control plane components                                                                                                                                              | `2103`                               |
 | `dashboard.replicas`                        | Number of replicas of dashboard                                                                                                                                                       | `1`                                  |
@@ -100,19 +98,21 @@ their default values.
 | `disableHeartBeat`                          | Set to true to not start the heartbeat cronjob                                                                                                                                        | `false`                              |
 | `enableH2Upgrade`                           | Allow proxies to perform transparent HTTP/2 upgrading                                                                                                                                 | `true`                               |
 | `global.clusterDomain`                      | Kubernetes DNS Domain name to use                                                                                                                                                     | `cluster.local`                      |
+| `global.clusterNetworks`                    | The networks that may include pods & services in this cluscter                                                                                                                         | `10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16` |
 | `global.cniEnabled`                         | Omit the NET_ADMIN capability in the PSP and the proxy-init container when injecting the proxy; requires the linkerd-cni plugin to already be installed                               | `false`                              |
 | `global.controllerComponentLabel`           | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-component` |
-| `global.controllerNamespaceLabel`           | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-component` |
+| `global.controllerImageVersion`             | Tag for the controller container docker image                                                                                                                                         | latest version                       |
+| `global.controllerLogLevel`                 | Log level for the control plane components                                                                                                                                            | `info`                               |
+| `global.controllerNamespaceLabel`           | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-ns`        |
 | `global.podLabels`                          | Additional labels to add to all pods                                                                                                                                                  | `{}`                                 |
 | `global.podAnnotations`                     | Additional annotations to add to all pods                                                                                                                                             | `{}`                                 |
 | `global.createdByAnnotation`                | Annotation label for the proxy create. Do not edit.                                                                                                                                   | `linkerd.io/created-by`              |
 | `global.identityTrustAnchorsPEM`            | Trust root certificate (ECDSA). It must be provided during install.                                                                                                                   |                                      |
 | `global.identityTrustDomain`                | Trust domain used for identity                                                                                                                                                        | `cluster.local`                      |
 | `global.imagePullPolicy`                    | Docker image pull policy                                                                                                                                                              | `IfNotPresent`                       |
-| `global.linkerdNamespaceLabel`              | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/control-plane-component` |
+| `global.linkerdNamespaceLabel`              | Control plane label. Do not edit                                                                                                                                                      | `linkerd.io/is-control-plane` |
 | `global.linkerdVersion`                     | Control plane version                                                                                                                                                                 | latest version                       |
 | `global.namespace`                          | Control plane namespace                                                                                                                                                               | `linkerd`                            |
-| `global.proxy.destinationGetNetworks`       | Network ranges for which the Linkerd proxy does destination lookups by IP address                                                                                                     | `10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16` |
 | `global.proxy.enableExternalProfiles`       | Enable service profiles for non-Kubernetes services                                                                                                                                   | `false`                              |
 | `global.proxy.image.name`                   | Docker image for the proxy                                                                                                                                                            | `ghcr.io/linkerd/proxy`            |
 | `global.proxy.image.pullPolicy`             | Pull policy for the proxy container Docker image                                                                                                                                      | `IfNotPresent`                       |
@@ -127,14 +127,14 @@ their default values.
 | `global.proxy.resources.cpu.request`        | Amount of CPU units that the proxy requests                                                                                                                                           |                                      |
 | `global.proxy.resources.memory.limit`       | Maximum amount of memory that the proxy can use                                                                                                                                       |                                      |
 | `global.proxy.resources.memory.request`     | Amount of memory that the proxy requests                                                                                                                                              |                                      |
-| `global.proxy.trace.collectorSvcAccount`    | Service account associated with the Trace collector instance                                                                                                                          |                                      |
+| `global.proxy.trace.collectorSvcAccount`    | Service account associated with the Trace collector instance                                                                                                                          | `default`                            |
 | `global.proxy.trace.collectorSvcAddr`       | Collector Service address for the proxies to send Trace Data                                                                                                                          |                                      |
 | `global.proxy.uid`                          | User id under which the proxy runs                                                                                                                                                    | `2102`                               |
 | `global.proxy.waitBeforeExitSeconds`        | The proxy sidecar will stay alive for at least the given period before receiving SIGTERM signal from Kubernetes but no longer than pod's `terminationGracePeriodSeconds`.             | `0`                                  |
 | `global.proxy.outboundConnectTimeout`       | Maximum time allowed for the proxy to establish an outbound TCP connection                                                                                                            | `1000ms`                             |
 | `global.proxy.inboundConnectTimeout`        | Maximum time allowed for the proxy to establish an inbound TCP connection                                                                                                             | `100ms`                              |
-| `global.proxyInit.ignoreInboundPorts`       | Inbound ports the proxy should ignore                                                                                                                                                 |                                      |
-| `global.proxyInit.ignoreOutboundPorts`      | Outbound ports the proxy should ignore                                                                                                                                                |                                      |
+| `global.proxyInit.ignoreInboundPorts`       | Inbound ports the proxy should ignore                                                                                                                                                 | `25,443,587,3306,11211`              |
+| `global.proxyInit.ignoreOutboundPorts`      | Outbound ports the proxy should ignore                                                                                                                                                | `25,443,587,3306,11211`              |
 | `global.proxyInit.image.name`               | Docker image for the proxy-init container                                                                                                                                             | `ghcr.io/linkerd/proxy-init`       |
 | `global.proxyInit.image.pullPolicy`         | Pull policy for the proxy-init container Docker image                                                                                                                                 | `IfNotPresent`                       |
 | `global.proxyInit.image.version`            | Tag for the proxy-init container Docker image                                                                                                                                         | latest version                       |
@@ -142,18 +142,18 @@ their default values.
 | `global.proxyInit.resources.cpu.request`    | Amount of CPU units that the proxy-init container requests                                                                                                                            | `10m`                                |
 | `global.ProxyInit.resources.memory.limit`   | Maximum amount of memory that the proxy-init container can use                                                                                                                        | `50Mi`                               |
 | `global.proxyInit.resources.memory.request` | Amount of memory that the proxy-init container requests                                                                                                                               | `10Mi`                               |
-| `global.proxyInjectAnnotation`              | Annotation label to signal injection. Do not edit.                                                                                                                                    |                                      |
+| `global.proxyInjectAnnotation`              | Annotation label to signal injection. Do not edit.                                                                                                                                    | `linkerd.io/inject`                                    |
 | `global.proxyInjectDisabled`                | Annotation value to disable injection. Do not edit.                                                                                                                                   | `disabled`                           |
 | `heartbeatSchedule`                         | Config for the heartbeat cronjob                                                                                                                                                      | `0 0 * * *`                          |
 | `identity.issuer.clockSkewAllowance`        | Amount of time to allow for clock skew within a Linkerd cluster                                                                                                                       | `20s`                                |
 | `identity.issuer.crtExpiry`                 | Expiration timestamp for the issuer certificate. It must be provided during install                                                                                                   |                                      |
 | `identity.issuer.crtExpiryAnnotation`       | Annotation used to identity the issuer certificate expiration timestamp. Do not edit.                                                                                                 | `linkerd.io/identity-issuer-expiry`  |
-| `identity.issuer.issuanceLifetime`          | Amount of time for which the Identity issuer should certify identity                                                                                                                  | `86400s`                             |
+| `identity.issuer.issuanceLifetime`          | Amount of time for which the Identity issuer should certify identity                                                                                                                  | `24h0m0s`                             |
 | `identity.issuer.scheme`                    | Which scheme is used for the identity issuer secret format                                                                                                                            | `linkerd.io/tls`                     |
 | `identity.issuer.tls.crtPEM`                | Issuer certificate (ECDSA). It must be provided during install.                                                                                                                       |                                      |
 | `identity.issuer.tls.keyPEM`                | Key for the issuer certificate (ECDSA). It must be provided during install.                                                                                                           |                                      |
 | `identityResources`                         | CPU and Memory resources required by the identity controller (see `global.proxy.resources` for sub-fields)             |   |
-| `identityPoxyResources`                     | CPU and Memory resources required by proxy injected into identity pod (see `global.proxy.resources` for sub-fields)             | values in `global.proxy.resources`   |
+| `identityProxyResources`                    | CPU and Memory resources required by proxy injected into identity pod (see `global.proxy.resources` for sub-fields)             | values in `global.proxy.resources`   |
 | `installNamespace`                          | Set to false when installing Linkerd in a custom namespace. See the [Linkerd documentation](https://linkerd.io/2/tasks/install-helm/#customizing-the-namespace) for more information. | `true`                               |
 | `omitWebhookSideEffects`                    | Omit the `sideEffects` flag in the webhook manifests                                                                                                                                  | `false`                              |
 | `proxyInjector.externalSecret`              | Do not create a secret resource for the profileValidator webhook. If this is set to `true`, the value `proxyInjector.caBundle` must be set (see below).                               | `false`                              |
@@ -212,13 +212,14 @@ The following table lists the configurable parameters for the Prometheus Add-On.
 | `prometheus.enabled`                     | Flag to enable prometheus instance to be installed                                                                                                                                                | `true`                             |
 | `prometheus.alert_relabel_configs`                   | Alert relabeling is applied to alerts before they are sent to the Alertmanager.                                                                            | `[]`                                 |
 | `prometheus.alertManagers`                   | Alertmanager instances the Prometheus server sends alerts to configured via the static_configs parameter.                                                                             | `[]`                                 |
-| `prometheus.args`                       |  Command line options for Prometheus binary                                                                                                                                             | `storage.tsdb.path: /data, storage.tsdb.retention.time: 6h, config.file: /etc/prometheus/prometheus.yml, log.level: *controller_log_level`                                 |
+| `prometheus.args`                       |  Command line options for Prometheus binary                                                                                                                                             | `storage.tsdb.path: /data, storage.tsdb.retention.time: 6h, config.file: /etc/prometheus/prometheus.yml, log.level: info`                                 |
 | `prometheus.globalConfig`             | The global configuration specifies parameters that are valid in all other configuration contexts.                                                                 | `scrape_interval: 10s, scrape_timeout: 10s, evaluation_interval: 10s`                                 |
 | `prometheus.image`                | Docker image for the prometheus instance                                                                                                                                                 | `prom/prometheus:v2.19.3`                             |
 | `prometheus.proxy.resources`                  | CPU and Memory resources required by proxy injected into prometheus pod (see `global.proxy.resources` for sub-fields)             | values in `global.proxy.resources`   |
 | `prometheus.persistence.storageClass`        | Storage class used to create prometheus data PV.                                                                                                                                                                                                                        | `nil`                                |
 | `prometheus.persistence.accessMode`          | PVC access mode.                                                                                                                                                                                                                                                        | `ReadWriteOnce`                      |
 | `prometheus.persistence.size`                | Prometheus data volume size.                                                                                                                                                                                                                                            | `8Gi`                                |
+| `prometheus.remoteWrite`       | Allows transparently sending samples to an endpoint. Mostly used for long term storage.                  ||
 | `prometheus.resources.cpu.limit`       | Maximum amount of CPU units that the prometheus container can use                                                                                                                     ||
 | `prometheus.resources.cpu.request`     | Amount of CPU units that the prometheus container requests                                                                                                                            ||
 | `prometheus.resources.memory.limit`    | Maximum amount of memory that prometheus container can use                                                                                                                        ||
@@ -238,11 +239,11 @@ The following table lists the configurable parameters for the Tracing Add-On.
 |:---------------------------------------------|:-----------------------------------------------------------------------|:---------------------------------------|
 | `tracing.enabled`                            | Flag to enable tracing components to be installed                      | `false`                                |
 | `tracing.collector.image`                    | Docker image for the trace collector                                   | `omnition/opencensus-collector:0.1.10` |
-| `tracing.collector.resources.cpu.limit`      | Maximum amount of CPU units that the trace collector container can use | `1`                                    |
-| `tracing.collector.resources.cpu.request`    | Amount of CPU units that the trace collector container requests        | `200m`                                 |
-| `tracing.collector.resources.memory.limit`   | Maximum amount of memory that the trace collector container can use    | `2Gi`                                  |
-| `tracing.collector.resources.memory.request` | Amount of memory that the trace collector container requests           | `400Mi`                                |
-| `tracing.jaeger.image`                       | Docker image for the jaeger instance                                   | `jaegertracing/all-in-one:1.8`         |
+| `tracing.collector.resources.cpu.limit`      | Maximum amount of CPU units that the trace collector container can use |                                 |
+| `tracing.collector.resources.cpu.request`    | Amount of CPU units that the trace collector container requests        |                                  |
+| `tracing.collector.resources.memory.limit`   | Maximum amount of memory that the trace collector container can use    |                                  |
+| `tracing.collector.resources.memory.request` | Amount of memory that the trace collector container requests           |                                |
+| `tracing.jaeger.image`                       | Docker image for the jaeger instance                                   | `jaegertracing/all-in-one:1.19.2`         |
 | `tracing.jaeger.resources.cpu.limit`         | Maximum amount of CPU units that the jaeger container can use          |                                        |
 | `tracing.jaeger.resources.cpu.request`       | Amount of CPU units that the jaeger container requests                 |                                        |
 | `tracing.jaeger.resources.memory.limit`      | Maximum amount of memory that the jaeger container can use             |                                        |
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index afacde744..65fe05a77 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -4,7 +4,16 @@
 
 # Values that are passed along to sub-charts
 global:
+  # The kubernetes cluster domain.
   clusterDomain: &cluster_domain cluster.local
+
+  # The cluster networks for which service discovery is performed. This should
+  # include the pod network but need not include the node network.
+  #
+  # By default, all private networks are specified so that resolution works in
+  # typical Kubernetes environments.
+  clusterNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
+
   imagePullPolicy: &image_pull_policy IfNotPresent
   controllerLogLevel: &controller_log_level info
 
@@ -74,7 +83,6 @@ global:
     # for more info on container lifecycle hooks.
     waitBeforeExitSeconds: 0
     requireIdentityOnInboundPorts: ""
-    destinationGetNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
 
   # proxy-init configuration
   proxyInit:
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index 0221c0662..15ce991d7 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -10,10 +10,8 @@ env:
   value: {{.Values.global.proxy.logFormat | quote}}
 - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
   value: {{ternary "localhost.:8086" (printf "linkerd-dst-headless.%s.svc.%s:8086" .Values.global.namespace .Values.global.clusterDomain) (eq .Values.global.proxy.component "linkerd-destination")}}
-{{ if .Values.global.proxy.destinationGetNetworks -}}
 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-  value: {{.Values.global.proxy.destinationGetNetworks | quote}}
-{{ end -}}
+  value: {{.Values.global.clusterNetworks | quote}}
 {{ if .Values.global.proxy.inboundConnectTimeout -}}
 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT
   value: {{.Values.global.proxy.inboundConnectTimeout | quote}}
diff --git a/cli/cmd/options.go b/cli/cmd/options.go
index 25fea92d5..3a28cc2a9 100644
--- a/cli/cmd/options.go
+++ b/cli/cmd/options.go
@@ -576,7 +576,7 @@ func validateValues(ctx context.Context, k *k8s.KubernetesAPI, values *l5dcharts
 }
 
 func validateProxyValues(values *l5dcharts.Values) error {
-	networks := strings.Split(values.Global.Proxy.DestinationGetNetworks, ",")
+	networks := strings.Split(values.Global.ClusterNetworks, ",")
 	for _, network := range networks {
 		if _, _, err := net.ParseCIDR(network); err != nil {
 			return fmt.Errorf("cannot parse destination get networks: %s", err)
diff --git a/grafana/dashboards/multicluster.json b/grafana/dashboards/multicluster.json
index 99d4a2271..d473f2388 100644
--- a/grafana/dashboards/multicluster.json
+++ b/grafana/dashboards/multicluster.json
@@ -20,7 +20,7 @@
     "links": [],
     "panels": [
         {
-            "content": "<div style=\"display: flex; align-items: center\">\n  <img src=\"https://linkerd.io/images/identity/favicon/linkerd-favicon.png\" style=\"height:32px;\"/>&nbsp;\n  <span style=\"font-size: 32px\">Cluster: $cluster, Gateway: $gateway</span>\n</div>",
+            "content": "<div style=\"display: flex; align-items: center\">\n  <img src=\"https://linkerd.io/images/identity/favicon/linkerd-favicon.png\" style=\"height:32px;\"/>&nbsp;\n  <span style=\"font-size: 32px\">Cluster: $cluster</span>\n</div>",
             "gridPos": {
                 "h": 2,
                 "w": 24,
@@ -98,7 +98,7 @@
             "tableColumn": "",
             "targets": [
                 {
-                    "expr": "sum(irate(response_total{classification=\"success\", dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) / sum(irate(response_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s]))",
+                    "expr": "sum(irate(response_total{classification=\"success\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) / sum(irate(response_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s]))",
                     "format": "time_series",
                     "instant": false,
                     "intervalFactor": 1,
@@ -183,7 +183,7 @@
             "tableColumn": "",
             "targets": [
                 {
-                    "expr": "sum(irate(request_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s]))",
+                    "expr": "sum(irate(request_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s]))",
                     "format": "time_series",
                     "instant": false,
                     "intervalFactor": 1,
@@ -268,7 +268,7 @@
             "tableColumn": "",
             "targets": [
                 {
-                    "expr": "histogram_quantile(0.95, sum(irate(response_latency_ms_bucket{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le))",
+                    "expr": "histogram_quantile(0.95, sum(irate(response_latency_ms_bucket{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le))",
                     "format": "time_series",
                     "instant": false,
                     "intervalFactor": 1,
@@ -344,10 +344,10 @@
             "steppedLine": false,
             "targets": [
                 {
-                    "expr": "sum(irate(response_total{classification=\"success\", dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (dst_target_gateway) / sum(irate(response_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (dst_target_gateway)",
+                    "expr": "sum(irate(response_total{classification=\"success\",dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) / sum(irate(response_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s]))",
                     "format": "time_series",
                     "intervalFactor": 1,
-                    "legendFormat": "gateway/{{dst_target_gateway}}",
+                    "legendFormat": "",
                     "refId": "A"
                 }
             ],
@@ -431,17 +431,17 @@
             "steppedLine": false,
             "targets": [
                 {
-                    "expr": "sum(irate(request_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\", tls=\"true\"}[30s])) by (dst_target_gateway)",
+                    "expr": "sum(irate(request_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\", tls=\"true\"}[30s]))",
                     "format": "time_series",
                     "intervalFactor": 1,
-                    "legendFormat": "🔒gateway/{{dst_target_gateway}}",
+                    "legendFormat": "",
                     "refId": "A"
                 },
                 {
-                    "expr": "sum(irate(request_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", tls!=\"true\"}[30s])) by (dst_target_gateway)",
+                    "expr": "sum(irate(request_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", tls!=\"true\"}[30s]))",
                     "format": "time_series",
                     "intervalFactor": 1,
-                    "legendFormat": "gateway/{{dst_target_gateway}}",
+                    "legendFormat": "",
                     "refId": "B"
                 }
             ],
@@ -525,25 +525,25 @@
             "steppedLine": false,
             "targets": [
                 {
-                    "expr": "histogram_quantile(0.5, sum(irate(response_latency_ms_bucket{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le, dst_target_gateway))",
+                    "expr": "histogram_quantile(0.5, sum(irate(response_latency_ms_bucket{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le))",
                     "format": "time_series",
                     "intervalFactor": 1,
-                    "legendFormat": "p50 gateway/{{dst_target_gateway}}",
+                    "legendFormat": "p50 gateway",
                     "refId": "A"
                 },
                 {
-                    "expr": "histogram_quantile(0.95, sum(irate(response_latency_ms_bucket{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le, dst_target_gateway))",
+                    "expr": "histogram_quantile(0.95, sum(irate(response_latency_ms_bucket{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le))",
                     "format": "time_series",
                     "hide": false,
                     "intervalFactor": 1,
-                    "legendFormat": "p95 gateway/{{dst_target_gateway}}",
+                    "legendFormat": "p95 gateway",
                     "refId": "B"
                 },
                 {
-                    "expr": "histogram_quantile(0.99, sum(irate(response_latency_ms_bucket{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le, dst_target_gateway))",
+                    "expr": "histogram_quantile(0.99, sum(irate(response_latency_ms_bucket{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le))",
                     "format": "time_series",
                     "intervalFactor": 1,
-                    "legendFormat": "p99 gateway/{{dst_target_gateway}}",
+                    "legendFormat": "p99 gateway",
                     "refId": "C"
                 }
             ],
@@ -643,7 +643,7 @@
             "steppedLine": false,
             "targets": [
                 {
-                    "expr": "sum(irate(response_total{classification=\"success\", dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (dst_target_service) / sum(irate(response_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (dst_target_service)",
+                    "expr": "sum(irate(response_total{classification=\"success\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (dst_target_service) / sum(irate(response_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (dst_target_service)",
                     "format": "time_series",
                     "intervalFactor": 1,
                     "legendFormat": "target-svc/{{dst_target_service}}",
@@ -730,14 +730,14 @@
             "steppedLine": false,
             "targets": [
                 {
-                    "expr": "sum(irate(request_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", tls=\"true\"}[30s])) by (dst_target_service)",
+                    "expr": "sum(irate(request_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", tls=\"true\"}[30s])) by (dst_target_service)",
                     "format": "time_series",
                     "intervalFactor": 1,
                     "legendFormat": "🔒target-svc/{{dst_target_service}}",
                     "refId": "A"
                 },
                 {
-                    "expr": "sum(irate(request_total{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", tls!=\"true\"}[30s])) by (dst_target_service)",
+                    "expr": "sum(irate(request_total{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", tls!=\"true\"}[30s])) by (dst_target_service)",
                     "format": "time_series",
                     "intervalFactor": 1,
                     "legendFormat": "target-svc/{{dst_target_service}}",
@@ -823,7 +823,7 @@
             "steppedLine": false,
             "targets": [
                 {
-                    "expr": "histogram_quantile(0.95, sum(rate(response_latency_ms_bucket{dst_target_gateway=\"$gateway\", dst_target_gateway!=\"\", dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le, dst_target_service))",
+                    "expr": "histogram_quantile(0.95, sum(rate(response_latency_ms_bucket{dst_target_cluster=\"$cluster\", dst_target_cluster!=\"\", direction=\"outbound\"}[30s])) by (le, dst_target_service))",
                     "format": "time_series",
                     "intervalFactor": 1,
                     "legendFormat": "P95 target-svc/{{dst_target_service}}",
@@ -904,31 +904,6 @@
                 "tagsQuery": "",
                 "type": "query",
                 "useTags": false
-            },
-            {
-                "allValue": ".*",
-                "current": {
-                    "text": "All",
-                    "value": "$__all"
-                },
-                "datasource": "prometheus",
-                "definition": "",
-                "hide": 0,
-                "includeAll": false,
-                "label": "Gateway",
-                "multi": false,
-                "name": "gateway",
-                "options": [],
-                "query": "label_values(request_total{dst_target_cluster=\"$cluster\"}, dst_target_gateway)",
-                "refresh": 2,
-                "regex": "",
-                "skipUrlSync": false,
-                "sort": 1,
-                "tagValuesQuery": "",
-                "tags": [],
-                "tagsQuery": "",
-                "type": "query",
-                "useTags": false
             }
         ]
     },
@@ -965,4 +940,4 @@
     "title": "Linkerd Multicluster",
     "uid": "linkerd-multicluster",
     "version": 1
-}
\ No newline at end of file
+}
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index 69b31c360..d232ff005 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -73,6 +73,7 @@ type (
 	Global struct {
 		Namespace                string              `json:"namespace"`
 		ClusterDomain            string              `json:"clusterDomain"`
+		ClusterNetworks          string              `json:"clusterNetworks"`
 		ImagePullPolicy          string              `json:"imagePullPolicy"`
 		CliVersion               string              `json:"cliVersion"`
 		ControllerComponentLabel string              `json:"controllerComponentLabel"`
@@ -117,7 +118,6 @@ type (
 		DisableIdentity               bool             `json:"disableIdentity"`
 		DisableTap                    bool             `json:"disableTap"`
 		EnableExternalProfiles        bool             `json:"enableExternalProfiles"`
-		DestinationGetNetworks        string           `json:"destinationGetNetworks"`
 		Image                         *Image           `json:"image"`
 		LogLevel                      string           `json:"logLevel"`
 		LogFormat                     string           `json:"logFormat"`
diff --git a/pkg/config/config.go b/pkg/config/config.go
index e074bbfe5..459f63981 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -126,6 +126,7 @@ func ToValues(configs *pb.All) *l5dcharts.Values {
 			IdentityTrustAnchorsPEM: configs.GetGlobal().GetIdentityContext().GetTrustAnchorsPem(),
 			IdentityTrustDomain:     configs.GetGlobal().GetIdentityContext().GetTrustDomain(),
 			ClusterDomain:           configs.GetGlobal().GetClusterDomain(),
+			ClusterNetworks:         configs.GetProxy().GetDestinationGetNetworks(),
 			LinkerdVersion:          configs.GetGlobal().GetVersion(),
 			Proxy: &l5dcharts.Proxy{
 				Image: &l5dcharts.Image{
@@ -150,7 +151,6 @@ func ToValues(configs *pb.All) *l5dcharts.Values {
 					},
 				},
 				EnableExternalProfiles: !configs.Proxy.GetDisableExternalProfiles(),
-				DestinationGetNetworks: configs.GetProxy().GetDestinationGetNetworks(),
 				LogFormat:              configs.GetProxy().GetLogFormat(),
 				OutboundConnectTimeout: configs.GetProxy().GetOutboundConnectTimeout(),
 				InboundConnectTimeout:  configs.GetProxy().GetInboundConnectTimeout(),
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index 54edbd249..b43a31748 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -243,8 +243,8 @@ func (conf *ResourceConfig) GetPatch(injectProxy bool) ([]byte, error) {
 		return nil, fmt.Errorf("%s cannot be set when identity is disabled", k8s.ProxyRequireIdentityOnInboundPortsAnnotation)
 	}
 
-	if values.Global.Proxy.DestinationGetNetworks != "" {
-		for _, network := range strings.Split(strings.Trim(values.Global.Proxy.DestinationGetNetworks, ","), ",") {
+	if values.Global.ClusterNetworks != "" {
+		for _, network := range strings.Split(strings.Trim(values.Global.ClusterNetworks, ","), ",") {
 			if _, _, err := net.ParseCIDR(network); err != nil {
 				return nil, fmt.Errorf("cannot parse destination get networks: %s", err)
 			}
@@ -748,7 +748,7 @@ func (conf *ResourceConfig) applyAnnotationOverrides(values *l5dcharts.Values) {
 	}
 
 	if override, ok := annotations[k8s.ProxyDestinationGetNetworks]; ok {
-		values.Global.Proxy.DestinationGetNetworks = override
+		values.Global.ClusterNetworks = override
 	}
 
 	if override, ok := annotations[k8s.ProxyOutboundConnectTimeout]; ok {


Test patch:
diff --git a/cli/cmd/install_test.go b/cli/cmd/install_test.go
index c7b7c2dde..d224ca341 100644
--- a/cli/cmd/install_test.go
+++ b/cli/cmd/install_test.go
@@ -45,6 +45,7 @@ func TestRender(t *testing.T) {
 		Global: &charts.Global{
 			Namespace:                "Namespace",
 			ClusterDomain:            "cluster.local",
+			ClusterNetworks:          "ClusterNetworks",
 			ImagePullPolicy:          "ImagePullPolicy",
 			CliVersion:               "CliVersion",
 			ControllerComponentLabel: "ControllerComponentLabel",
@@ -63,7 +64,6 @@ func TestRender(t *testing.T) {
 			PodAnnotations:           map[string]string{},
 			PodLabels:                map[string]string{},
 			Proxy: &charts.Proxy{
-				DestinationGetNetworks: "DestinationGetNetworks",
 				Image: &charts.Image{
 					Name:       "ProxyImageName",
 					PullPolicy: "ImagePullPolicy",
@@ -222,7 +222,7 @@ func TestRender(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Unexpected error: %v\n", err)
 	}
-	withCustomDestinationGetNetsValues.Global.Proxy.DestinationGetNetworks = "10.0.0.0/8,100.64.0.0/10,172.0.0.0/8"
+	withCustomDestinationGetNetsValues.Global.ClusterNetworks = "10.0.0.0/8,100.64.0.0/10,172.0.0.0/8"
 	addFakeTLSSecrets(withCustomDestinationGetNetsValues)
 
 	testCases := []struct {
@@ -382,7 +382,7 @@ func TestValidate(t *testing.T) {
 			t.Fatalf("Unexpected error: %v\n", err)
 		}
 
-		values.Global.Proxy.DestinationGetNetworks = "wrong"
+		values.Global.ClusterNetworks = "wrong"
 		expected := "cannot parse destination get networks: invalid CIDR address: wrong"
 
 		err = validateValues(context.Background(), nil, values)
diff --git a/cli/cmd/testdata/install_addon.golden b/cli/cmd/testdata/install_addon.golden
index f12cda178..d42975d45 100644
--- a/cli/cmd/testdata/install_addon.golden
+++ b/cli/cmd/testdata/install_addon.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_control-plane.golden b/cli/cmd/testdata/install_control-plane.golden
index c973748e4..1db92b0bd 100644
--- a/cli/cmd/testdata/install_control-plane.golden
+++ b/cli/cmd/testdata/install_control-plane.golden
@@ -36,6 +36,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -71,7 +72,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 51c41b6d9..127ece261 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: true
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 7be440320..67809778f 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 7300be918..711bb319a 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 56da49cd0..0c2277175 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.0.0.0/8
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.0.0.0/8
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -3474,7 +3474,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlVmVyc2lvbjogaW5zdGFsbC1jb250cm9sLXBsYW5lLXZlcnNpb24KZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICB2ZXJzaW9uOiBpbnN0YWxsLWRlYnVnLXZlcnNpb24KZ2xvYmFsOgogIGNvbnRyb2xsZXJJbWFnZVZlcnNpb246IGluc3RhbGwtY29udHJvbC1wbGFuZS12ZXJzaW9uCiAgaWRlbnRpdHlUcnVzdEFuY2hvcnNQRU06IHwKICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgTUlJQndUQ0NBV2FnQXdJQkFnSVFlRFpwNWxEYUl5Z1E1VWZNS1pyRkFUQUtCZ2dxaGtqT1BRUURBakFwTVNjdwogICAgSlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1clpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d0hoY05NakF3T0RJNAogICAgTURjeE1qUTNXaGNOTXpBd09ESTJNRGN4TWpRM1dqQXBNU2N3SlFZRFZRUURFeDVwWkdWdWRHbDBlUzVzYVc1cgogICAgWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3V1RBVEJnY3Foa2pPUFFJQkJnZ3Foa2pPUFFNQkJ3TkNBQVJxYzcwWgogICAgbDF2Z3c3OXJqQjV1U0lUSUNVQTZHeWZ2U0ZmY3VJaXM3Qi9YRlNra3dBSFU1Uy9zMUFBUCtSMFRYN0hCV1VDNAogICAgdWFHNFdXc2l3SktObjdtZ28zQXdiakFPQmdOVkhROEJBZjhFQkFNQ0FRWXdFZ1lEVlIwVEFRSC9CQWd3QmdFQgogICAgL3dJQkFUQWRCZ05WSFE0RUZnUVU1WXRqVlZQZmQ3STdOTEhzbjJDMjZFQnlHVjB3S1FZRFZSMFJCQ0l3SUlJZQogICAgYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Bb0dDQ3FHU000OUJBTUNBMGtBTUVZQwogICAgSVFDTjdsQkZMRER2ang2VjArWGtqcEtFUlJzSllmNWFkTXZubG9GbDQ4aWxKZ0loQU50eGhuZGNyK1FKUHVDOAogICAgdmdVQzBkMi85Rk11ZUlWTWIrNDZXVENPanNxcgogICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogIHByb3h5OgogICAgZGVzdGluYXRpb25HZXROZXR3b3JrczogMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4wLjAuMC84CiAgICBpbWFnZToKICAgICAgdmVyc2lvbjogaW5zdGFsbC1wcm94eS12ZXJzaW9uCmhlYXJ0YmVhdFNjaGVkdWxlOiAxIDIgMyA0IDUKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb3h5SW5qZWN0b3I6CiAgY2FCdW5kbGU6IHByb3h5IGluamVjdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJveHkgaW5qZWN0b3IgY3J0CiAga2V5UEVNOiBwcm94eSBpbmplY3RvciBrZXkKdGFwOgogIGNhQnVuZGxlOiB0YXAgQ0EgYnVuZGxlCiAgY3J0UEVNOiB0YXAgY3J0CiAga2V5UEVNOiB0YXAga2V5Cg==
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlVmVyc2lvbjogaW5zdGFsbC1jb250cm9sLXBsYW5lLXZlcnNpb24KZGVidWdDb250YWluZXI6CiAgaW1hZ2U6CiAgICB2ZXJzaW9uOiBpbnN0YWxsLWRlYnVnLXZlcnNpb24KZ2xvYmFsOgogIGNsdXN0ZXJOZXR3b3JrczogMTAuMC4wLjAvOCwxMDAuNjQuMC4wLzEwLDE3Mi4wLjAuMC84CiAgY29udHJvbGxlckltYWdlVmVyc2lvbjogaW5zdGFsbC1jb250cm9sLXBsYW5lLXZlcnNpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgcHJveHk6CiAgICBpbWFnZToKICAgICAgdmVyc2lvbjogaW5zdGFsbC1wcm94eS12ZXJzaW9uCmhlYXJ0YmVhdFNjaGVkdWxlOiAxIDIgMyA0IDUKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb3h5SW5qZWN0b3I6CiAgY2FCdW5kbGU6IHByb3h5IGluamVjdG9yIENBIGJ1bmRsZQogIGNydFBFTTogcHJveHkgaW5qZWN0b3IgY3J0CiAga2V5UEVNOiBwcm94eSBpbmplY3RvciBrZXkKdGFwOgogIGNhQnVuZGxlOiB0YXAgQ0EgYnVuZGxlCiAgY3J0UEVNOiB0YXAgY3J0CiAga2V5UEVNOiB0YXAga2V5Cg==
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_grafana_existing.golden b/cli/cmd/testdata/install_grafana_existing.golden
index 8b0d97b19..e31167485 100644
--- a/cli/cmd/testdata/install_grafana_existing.golden
+++ b/cli/cmd/testdata/install_grafana_existing.golden
@@ -815,6 +815,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -850,7 +851,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index cc1497858..9836c12a2 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 420a4f2ae..80461dc54 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index dd8dc4928..319f23138 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -774,6 +774,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -809,7 +810,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index b2f44c51c..42f303b2f 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -844,6 +844,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -867,7 +868,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -931,6 +931,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -954,7 +955,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1019,6 +1019,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1042,7 +1043,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1138,6 +1138,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1161,7 +1162,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1229,6 +1229,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1252,7 +1253,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_addons.golden b/cli/cmd/testdata/install_helm_output_addons.golden
index 0c8509e6a..e0efd7a50 100644
--- a/cli/cmd/testdata/install_helm_output_addons.golden
+++ b/cli/cmd/testdata/install_helm_output_addons.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -873,7 +874,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -937,6 +937,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -960,7 +961,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1025,6 +1025,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1048,7 +1049,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1144,6 +1144,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1167,7 +1168,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1235,6 +1235,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1258,7 +1259,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1348,6 +1348,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1371,7 +1372,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1436,6 +1436,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1459,7 +1460,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index 3fc86a885..9aca54bc8 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -873,7 +874,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -937,6 +937,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -959,7 +960,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1024,6 +1024,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1046,7 +1047,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1161,6 +1161,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1183,7 +1184,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1251,6 +1251,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1273,7 +1274,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 822545de8..48da8dd2b 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -877,7 +878,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -941,6 +941,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -967,7 +968,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1032,6 +1032,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1058,7 +1059,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1173,6 +1173,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1199,7 +1200,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1267,6 +1267,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1293,7 +1294,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 4a930193c..299c0d675 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -850,6 +850,7 @@ data:
     global:
       cliVersion: ""
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -873,7 +874,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -937,6 +937,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -959,7 +960,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1024,6 +1024,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1046,7 +1047,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
@@ -1161,6 +1161,7 @@ data:
       global:
         cliVersion: ""
         clusterDomain: cluster.local
+        clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         cniEnabled: false
         controlPlaneTracing: false
         controllerComponentLabel: linkerd.io/control-plane-component
@@ -1183,7 +1184,6 @@ data:
         proxy:
           capabilities: null
           component: linkerd-controller
-          destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           disableIdentity: false
           disableTap: false
           enableExternalProfiles: false
@@ -1251,6 +1251,7 @@ data:
         global:
           cliVersion: ""
           clusterDomain: cluster.local
+          clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
           cniEnabled: false
           controlPlaneTracing: false
           controllerComponentLabel: linkerd.io/control-plane-component
@@ -1273,7 +1274,6 @@ data:
           proxy:
             capabilities: null
             component: linkerd-controller
-            destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
             disableIdentity: false
             disableTap: false
             enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index feb81a90d..acdcd2ed3 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -815,6 +815,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: true
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -850,7 +851,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index f992bb9b7..7f5a2d6bc 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: CliVersion
       clusterDomain: cluster.local
+      clusterNetworks: ClusterNetworks
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: ControllerComponentLabel
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: DestinationGetNetworks
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -1119,7 +1119,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -1354,7 +1354,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -1607,7 +1607,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: localhost.:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -1888,7 +1888,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2101,7 +2101,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2356,7 +2356,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2598,7 +2598,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -2910,7 +2910,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -3347,7 +3347,7 @@ spec:
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
           value: linkerd-dst-headless.Namespace.svc.cluster.local:8086
         - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
-          value: "DestinationGetNetworks"
+          value: "ClusterNetworks"
         - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
           value: 0.0.0.0:4190
         - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
@@ -3493,7 +3493,7 @@ spec:
 ---
 apiVersion: v1
 data:
-  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckltYWdlVmVyc2lvbjogQ29udHJvbGxlckltYWdlVmVyc2lvbgpkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmdsb2JhbDoKICBjbGlWZXJzaW9uOiBDbGlWZXJzaW9uCiAgY29udHJvbGxlckNvbXBvbmVudExhYmVsOiBDb250cm9sbGVyQ29tcG9uZW50TGFiZWwKICBjb250cm9sbGVySW1hZ2VWZXJzaW9uOiBDb250cm9sbGVySW1hZ2VWZXJzaW9uCiAgY29udHJvbGxlckxvZ0xldmVsOiBDb250cm9sbGVyTG9nTGV2ZWwKICBjb250cm9sbGVyTmFtZXNwYWNlTGFiZWw6IENvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbAogIGNyZWF0ZWRCeUFubm90YXRpb246IENyZWF0ZWRCeUFubm90YXRpb24KICBpZGVudGl0eVRydXN0QW5jaG9yc1BFTTogfAogICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICBNSUlCd1RDQ0FXYWdBd0lCQWdJUWVEWnA1bERhSXlnUTVVZk1LWnJGQVRBS0JnZ3Foa2pPUFFRREFqQXBNU2N3CiAgICBKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyWlhKa0xtTnNkWE4wWlhJdWJHOWpZV3d3SGhjTk1qQXdPREk0CiAgICBNRGN4TWpRM1doY05NekF3T0RJMk1EY3hNalEzV2pBcE1TY3dKUVlEVlFRREV4NXBaR1Z1ZEdsMGVTNXNhVzVyCiAgICBaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUnFjNzBaCiAgICBsMXZndzc5cmpCNXVTSVRJQ1VBNkd5ZnZTRmZjdUlpczdCL1hGU2trd0FIVTVTL3MxQUFQK1IwVFg3SEJXVUM0CiAgICB1YUc0V1dzaXdKS05uN21nbzNBd2JqQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCCiAgICAvd0lCQVRBZEJnTlZIUTRFRmdRVTVZdGpWVlBmZDdJN05MSHNuMkMyNkVCeUdWMHdLUVlEVlIwUkJDSXdJSUllCiAgICBhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCiAgICBJUUNON2xCRkxERHZqeDZWMCtYa2pwS0VSUnNKWWY1YWRNdm5sb0ZsNDhpbEpnSWhBTnR4aG5kY3IrUUpQdUM4CiAgICB2Z1VDMGQyLzlGTXVlSVZNYis0NldUQ09qc3FyCiAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgaW1hZ2VQdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICBpbWFnZVB1bGxTZWNyZXRzOiBudWxsCiAgbGlua2VyZE5hbWVzcGFjZUxhYmVsOiBMaW5rZXJkTmFtZXNwYWNlTGFiZWwKICBsaW5rZXJkVmVyc2lvbjogIiIKICBuYW1lc3BhY2U6IE5hbWVzcGFjZQogIHByb3h5OgogICAgZGVzdGluYXRpb25HZXROZXR3b3JrczogRGVzdGluYXRpb25HZXROZXR3b3JrcwogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eVZlcnNpb24KICAgIGluYm91bmRDb25uZWN0VGltZW91dDogIiIKICAgIG91dGJvdW5kQ29ubmVjdFRpbWVvdXQ6ICIiCiAgICByZXNvdXJjZXM6CiAgICAgIGNwdToKICAgICAgICBsaW1pdDogY3B1LWxpbWl0CiAgICAgICAgcmVxdWVzdDogY3B1LXJlcXVlc3QKICAgICAgbWVtb3J5OgogICAgICAgIGxpbWl0OiBtZW1vcnktbGltaXQKICAgICAgICByZXF1ZXN0OiBtZW1vcnktcmVxdWVzdAogICAgdHJhY2U6CiAgICAgIGNvbGxlY3RvclN2Y0FjY291bnQ6ICIiCiAgcHJveHlDb250YWluZXJOYW1lOiBQcm94eUNvbnRhaW5lck5hbWUKICBwcm94eUluaXQ6CiAgICBpZ25vcmVJbmJvdW5kUG9ydHM6ICIiCiAgICBpZ25vcmVPdXRib3VuZFBvcnRzOiAiIgogICAgaW1hZ2U6CiAgICAgIG5hbWU6IFByb3h5SW5pdEltYWdlTmFtZQogICAgICBwdWxsUG9saWN5OiBJbWFnZVB1bGxQb2xpY3kKICAgICAgdmVyc2lvbjogUHJveHlJbml0VmVyc2lvbgogIHByb3h5SW5qZWN0QW5ub3RhdGlvbjogUHJveHlJbmplY3RBbm5vdGF0aW9uCiAgcHJveHlJbmplY3REaXNhYmxlZDogUHJveHlJbmplY3REaXNhYmxlZAogIHdvcmtsb2FkTmFtZXNwYWNlTGFiZWw6IFdvcmtsb2FkTmFtZXNwYWNlTGFiZWwKaGVhcnRiZWF0U2NoZWR1bGU6ICIiCmlkZW50aXR5OgogIGlzc3VlcjoKICAgIGNydEV4cGlyeTogIjIwMzAtMDgtMjZUMDc6MTM6NDdaIgogICAgdGxzOgogICAgICBjcnRQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgICAgICBNSUlCd0RDQ0FXZWdBd0lCQWdJUkFKUklnWjhSdE84RXdnMVhlcGY4VDQ0d0NnWUlLb1pJemowRUF3SXdLVEVuCiAgICAgICAgTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdWEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01CNFhEVEl3TURneQogICAgICAgIE9EQTNNVE0wTjFvWERUTXdNRGd5TmpBM01UTTBOMW93S1RFbk1DVUdBMVVFQXhNZWFXUmxiblJwZEhrdWJHbHUKICAgICAgICBhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUxL0ZwCiAgICAgICAgZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyZFF2UmFZYW51eEQzNkR0MQogICAgICAgIDIvSnh5aVNneEtXUmRvYXkrYU53TUc0d0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUIKICAgICAgICBBZjhDQVFBd0hRWURWUjBPQkJZRUZJMVducnFNWUthSEhPbyt6cHlpaURxMnBPMEtNQ2tHQTFVZEVRUWlNQ0NDCiAgICAgICAgSG1sa1pXNTBhWFI1TG14cGJtdGxjbVF1WTJ4MWMzUmxjaTVzYjJOaGJEQUtCZ2dxaGtqT1BRUURBZ05IQURCRQogICAgICAgIEFpQXR1b0k1WHVDdHJHVlJ6U21SVGwycmEyOGFWOU15VFU3ZDVxblRBRkhLU2dJZ1JLQ3ZsdU9TZ0E1TzIxcDUKICAgICAgICA1MXRkcm1rSEVaUnIwcWxMU0pkSFlnRWZNems9CiAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQogICAgICBrZXlQRU06IHwKICAgICAgICAtLS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KICAgICAgICBNSGNDQVFFRUlBQWU4bmZielp1OWMvT0IyKzh4Sk0wRno3TlV3VFFhenVsa0ZOczRUSTUrb0FvR0NDcUdTTTQ5CiAgICAgICAgQXdFSG9VUURRZ0FFMS9GcGZjUm5EY2VkTDZBalVhWFlQdjRESU1CYUp1Zk9JNU5XdHkrWFNYN0pqWGdadE03MgogICAgICAgIGRRdlJhWWFudXhEMzZEdDEyL0p4eWlTZ3hLV1Jkb2F5K1E9PQogICAgICAgIC0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0KcHJvZmlsZVZhbGlkYXRvcjoKICBjYUJ1bmRsZTogcHJvZmlsZSB2YWxpZGF0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm9maWxlIHZhbGlkYXRvciBjcnQKICBrZXlQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGtleQpwcm9tZXRoZXVzOgogIGltYWdlOiBQcm9tZXRoZXVzSW1hZ2UKcHJveHlJbmplY3RvcjoKICBjYUJ1bmRsZTogcHJveHkgaW5qZWN0b3IgQ0EgYnVuZGxlCiAgY3J0UEVNOiBwcm94eSBpbmplY3RvciBjcnQKICBrZXlQRU06IHByb3h5IGluamVjdG9yIGtleQp0YXA6CiAgY2FCdW5kbGU6IHRhcCBDQSBidW5kbGUKICBjcnRQRU06IHRhcCBjcnQKICBrZXlQRU06IHRhcCBrZXkKd2ViSW1hZ2U6IFdlYkltYWdlCndlYmhvb2tGYWlsdXJlUG9saWN5OiBXZWJob29rRmFpbHVyZVBvbGljeQo=
+  linkerd-config-overrides: Y29udHJvbGxlckltYWdlOiBDb250cm9sbGVySW1hZ2UKY29udHJvbGxlckltYWdlVmVyc2lvbjogQ29udHJvbGxlckltYWdlVmVyc2lvbgpkZWJ1Z0NvbnRhaW5lcjoKICBpbWFnZToKICAgIG5hbWU6IERlYnVnSW1hZ2VOYW1lCiAgICBwdWxsUG9saWN5OiBEZWJ1Z0ltYWdlUHVsbFBvbGljeQogICAgdmVyc2lvbjogRGVidWdWZXJzaW9uCmdsb2JhbDoKICBjbGlWZXJzaW9uOiBDbGlWZXJzaW9uCiAgY2x1c3Rlck5ldHdvcmtzOiBDbHVzdGVyTmV0d29ya3MKICBjb250cm9sbGVyQ29tcG9uZW50TGFiZWw6IENvbnRyb2xsZXJDb21wb25lbnRMYWJlbAogIGNvbnRyb2xsZXJJbWFnZVZlcnNpb246IENvbnRyb2xsZXJJbWFnZVZlcnNpb24KICBjb250cm9sbGVyTG9nTGV2ZWw6IENvbnRyb2xsZXJMb2dMZXZlbAogIGNvbnRyb2xsZXJOYW1lc3BhY2VMYWJlbDogQ29udHJvbGxlck5hbWVzcGFjZUxhYmVsCiAgY3JlYXRlZEJ5QW5ub3RhdGlvbjogQ3JlYXRlZEJ5QW5ub3RhdGlvbgogIGlkZW50aXR5VHJ1c3RBbmNob3JzUEVNOiB8CiAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KICAgIE1JSUJ3VENDQVdhZ0F3SUJBZ0lRZURacDVsRGFJeWdRNVVmTUtackZBVEFLQmdncWhrak9QUVFEQWpBcE1TY3cKICAgIEpRWURWUVFERXg1cFpHVnVkR2wwZVM1c2FXNXJaWEprTG1Oc2RYTjBaWEl1Ykc5allXd3dIaGNOTWpBd09ESTQKICAgIE1EY3hNalEzV2hjTk16QXdPREkyTURjeE1qUTNXakFwTVNjd0pRWURWUVFERXg1cFpHVnVkR2wwZVM1c2FXNXIKICAgIFpYSmtMbU5zZFhOMFpYSXViRzlqWVd3d1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFScWM3MFoKICAgIGwxdmd3NzlyakI1dVNJVElDVUE2R3lmdlNGZmN1SWlzN0IvWEZTa2t3QUhVNVMvczFBQVArUjBUWDdIQldVQzQKICAgIHVhRzRXV3Npd0pLTm43bWdvM0F3YmpBT0JnTlZIUThCQWY4RUJBTUNBUVl3RWdZRFZSMFRBUUgvQkFnd0JnRUIKICAgIC93SUJBVEFkQmdOVkhRNEVGZ1FVNVl0alZWUGZkN0k3TkxIc24yQzI2RUJ5R1Ywd0tRWURWUjBSQkNJd0lJSWUKICAgIGFXUmxiblJwZEhrdWJHbHVhMlZ5WkM1amJIVnpkR1Z5TG14dlkyRnNNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUMKICAgIElRQ043bEJGTEREdmp4NlYwK1hranBLRVJSc0pZZjVhZE12bmxvRmw0OGlsSmdJaEFOdHhobmRjcitRSlB1QzgKICAgIHZnVUMwZDIvOUZNdWVJVk1iKzQ2V1RDT2pzcXIKICAgIC0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KICBpbWFnZVB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogIGltYWdlUHVsbFNlY3JldHM6IG51bGwKICBsaW5rZXJkTmFtZXNwYWNlTGFiZWw6IExpbmtlcmROYW1lc3BhY2VMYWJlbAogIGxpbmtlcmRWZXJzaW9uOiAiIgogIG5hbWVzcGFjZTogTmFtZXNwYWNlCiAgcHJveHk6CiAgICBpbWFnZToKICAgICAgbmFtZTogUHJveHlJbWFnZU5hbWUKICAgICAgcHVsbFBvbGljeTogSW1hZ2VQdWxsUG9saWN5CiAgICAgIHZlcnNpb246IFByb3h5VmVyc2lvbgogICAgaW5ib3VuZENvbm5lY3RUaW1lb3V0OiAiIgogICAgb3V0Ym91bmRDb25uZWN0VGltZW91dDogIiIKICAgIHJlc291cmNlczoKICAgICAgY3B1OgogICAgICAgIGxpbWl0OiBjcHUtbGltaXQKICAgICAgICByZXF1ZXN0OiBjcHUtcmVxdWVzdAogICAgICBtZW1vcnk6CiAgICAgICAgbGltaXQ6IG1lbW9yeS1saW1pdAogICAgICAgIHJlcXVlc3Q6IG1lbW9yeS1yZXF1ZXN0CiAgICB0cmFjZToKICAgICAgY29sbGVjdG9yU3ZjQWNjb3VudDogIiIKICBwcm94eUNvbnRhaW5lck5hbWU6IFByb3h5Q29udGFpbmVyTmFtZQogIHByb3h5SW5pdDoKICAgIGlnbm9yZUluYm91bmRQb3J0czogIiIKICAgIGlnbm9yZU91dGJvdW5kUG9ydHM6ICIiCiAgICBpbWFnZToKICAgICAgbmFtZTogUHJveHlJbml0SW1hZ2VOYW1lCiAgICAgIHB1bGxQb2xpY3k6IEltYWdlUHVsbFBvbGljeQogICAgICB2ZXJzaW9uOiBQcm94eUluaXRWZXJzaW9uCiAgcHJveHlJbmplY3RBbm5vdGF0aW9uOiBQcm94eUluamVjdEFubm90YXRpb24KICBwcm94eUluamVjdERpc2FibGVkOiBQcm94eUluamVjdERpc2FibGVkCiAgd29ya2xvYWROYW1lc3BhY2VMYWJlbDogV29ya2xvYWROYW1lc3BhY2VMYWJlbApoZWFydGJlYXRTY2hlZHVsZTogIiIKaWRlbnRpdHk6CiAgaXNzdWVyOgogICAgY3J0RXhwaXJ5OiAiMjAzMC0wOC0yNlQwNzoxMzo0N1oiCiAgICB0bHM6CiAgICAgIGNydFBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgIE1JSUJ3RENDQVdlZ0F3SUJBZ0lSQUpSSWdaOFJ0TzhFd2cxWGVwZjhUNDR3Q2dZSUtvWkl6ajBFQXdJd0tURW4KICAgICAgICBNQ1VHQTFVRUF4TWVhV1JsYm5ScGRIa3ViR2x1YTJWeVpDNWpiSFZ6ZEdWeUxteHZZMkZzTUI0WERUSXdNRGd5CiAgICAgICAgT0RBM01UTTBOMW9YRFRNd01EZ3lOakEzTVRNME4xb3dLVEVuTUNVR0ExVUVBeE1lYVdSbGJuUnBkSGt1YkdsdQogICAgICAgIGEyVnlaQzVqYkhWemRHVnlMbXh2WTJGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTEvRnAKICAgICAgICBmY1JuRGNlZEw2QWpVYVhZUHY0RElNQmFKdWZPSTVOV3R5K1hTWDdKalhnWnRNNzJkUXZSYVlhbnV4RDM2RHQxCiAgICAgICAgMi9KeHlpU2d4S1dSZG9heSthTndNRzR3RGdZRFZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQgogICAgICAgIEFmOENBUUF3SFFZRFZSME9CQllFRkkxV25ycU1ZS2FISE9vK3pweWlpRHEycE8wS01Da0dBMVVkRVFRaU1DQ0MKICAgICAgICBIbWxrWlc1MGFYUjVMbXhwYm10bGNtUXVZMngxYzNSbGNpNXNiMk5oYkRBS0JnZ3Foa2pPUFFRREFnTkhBREJFCiAgICAgICAgQWlBdHVvSTVYdUN0ckdWUnpTbVJUbDJyYTI4YVY5TXlUVTdkNXFuVEFGSEtTZ0lnUktDdmx1T1NnQTVPMjFwNQogICAgICAgIDUxdGRybWtIRVpScjBxbExTSmRIWWdFZk16az0KICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAgIGtleVBFTTogfAogICAgICAgIC0tLS0tQkVHSU4gRUMgUFJJVkFURSBLRVktLS0tLQogICAgICAgIE1IY0NBUUVFSUFBZThuZmJ6WnU5Yy9PQjIrOHhKTTBGejdOVXdUUWF6dWxrRk5zNFRJNStvQW9HQ0NxR1NNNDkKICAgICAgICBBd0VIb1VRRFFnQUUxL0ZwZmNSbkRjZWRMNkFqVWFYWVB2NERJTUJhSnVmT0k1Tld0eStYU1g3SmpYZ1p0TTcyCiAgICAgICAgZFF2UmFZYW51eEQzNkR0MTIvSnh5aVNneEtXUmRvYXkrUT09CiAgICAgICAgLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQpwcm9maWxlVmFsaWRhdG9yOgogIGNhQnVuZGxlOiBwcm9maWxlIHZhbGlkYXRvciBDQSBidW5kbGUKICBjcnRQRU06IHByb2ZpbGUgdmFsaWRhdG9yIGNydAogIGtleVBFTTogcHJvZmlsZSB2YWxpZGF0b3Iga2V5CnByb21ldGhldXM6CiAgaW1hZ2U6IFByb21ldGhldXNJbWFnZQpwcm94eUluamVjdG9yOgogIGNhQnVuZGxlOiBwcm94eSBpbmplY3RvciBDQSBidW5kbGUKICBjcnRQRU06IHByb3h5IGluamVjdG9yIGNydAogIGtleVBFTTogcHJveHkgaW5qZWN0b3Iga2V5CnRhcDoKICBjYUJ1bmRsZTogdGFwIENBIGJ1bmRsZQogIGNydFBFTTogdGFwIGNydAogIGtleVBFTTogdGFwIGtleQp3ZWJJbWFnZTogV2ViSW1hZ2UKd2ViaG9va0ZhaWx1cmVQb2xpY3k6IFdlYmhvb2tGYWlsdXJlUG9saWN5Cg==
 kind: Secret
 metadata:
   creationTimestamp: null
diff --git a/cli/cmd/testdata/install_prometheus_overwrite.golden b/cli/cmd/testdata/install_prometheus_overwrite.golden
index a77279648..e7e638b51 100644
--- a/cli/cmd/testdata/install_prometheus_overwrite.golden
+++ b/cli/cmd/testdata/install_prometheus_overwrite.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 039eaf67a..9a61eb7ad 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -818,6 +818,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -853,7 +854,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_restricted_dashboard.golden b/cli/cmd/testdata/install_restricted_dashboard.golden
index dfccac1af..372ab6fb7 100644
--- a/cli/cmd/testdata/install_restricted_dashboard.golden
+++ b/cli/cmd/testdata/install_restricted_dashboard.golden
@@ -750,6 +750,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -785,7 +786,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_tracing.golden b/cli/cmd/testdata/install_tracing.golden
index f12cda178..d42975d45 100644
--- a/cli/cmd/testdata/install_tracing.golden
+++ b/cli/cmd/testdata/install_tracing.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/cli/cmd/testdata/install_tracing_overwrite.golden b/cli/cmd/testdata/install_tracing_overwrite.golden
index b544b52e0..4c73af3af 100644
--- a/cli/cmd/testdata/install_tracing_overwrite.golden
+++ b/cli/cmd/testdata/install_tracing_overwrite.golden
@@ -824,6 +824,7 @@ data:
     global:
       cliVersion: linkerd/cli dev-undefined
       clusterDomain: cluster.local
+      clusterNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: linkerd.io/control-plane-component
@@ -859,7 +860,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
diff --git a/pkg/charts/linkerd2/values_test.go b/pkg/charts/linkerd2/values_test.go
index a450fb257..fb97a1306 100644
--- a/pkg/charts/linkerd2/values_test.go
+++ b/pkg/charts/linkerd2/values_test.go
@@ -47,6 +47,7 @@ func TestNewValues(t *testing.T) {
 		Global: &Global{
 			Namespace:                "linkerd",
 			ClusterDomain:            "cluster.local",
+			ClusterNetworks:          "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16",
 			ImagePullPolicy:          "IfNotPresent",
 			CliVersion:               "linkerd/cli dev-undefined",
 			ControllerComponentLabel: "linkerd.io/control-plane-component",
@@ -97,7 +98,6 @@ func TestNewValues(t *testing.T) {
 				},
 				UID:                    2102,
 				WaitBeforeExitSeconds:  0,
-				DestinationGetNetworks: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16",
 				OutboundConnectTimeout: "1000ms",
 				InboundConnectTimeout:  "100ms",
 			},
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index 85b6f4b35..58e713a6d 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2564,6 +2564,7 @@ data:
     global:
       cliVersion: CliVersion
       clusterDomain: cluster.local
+      clusterNetworks: ClusterNetworks
       cniEnabled: false
       controlPlaneTracing: false
       controllerComponentLabel: ControllerComponentLabel
@@ -2584,7 +2585,6 @@ data:
       proxy:
         capabilities: null
         component: linkerd-controller
-        destinationGetNetworks: DestinationGetNetworks
         disableIdentity: false
         disableTap: false
         enableExternalProfiles: false
@@ -2683,6 +2683,7 @@ data:
 				Global: &linkerd2.Global{
 					Namespace:                "Namespace",
 					ClusterDomain:            "cluster.local",
+					ClusterNetworks:          "ClusterNetworks",
 					ImagePullPolicy:          "ImagePullPolicy",
 					CliVersion:               "CliVersion",
 					ControllerComponentLabel: "ControllerComponentLabel",
@@ -2698,8 +2699,7 @@ data:
 					CNIEnabled:               false,
 					IdentityTrustDomain:      defaultValues.Global.IdentityTrustDomain,
 					Proxy: &linkerd2.Proxy{
-						Component:              "linkerd-controller",
-						DestinationGetNetworks: "DestinationGetNetworks",
+						Component: "linkerd-controller",
 						Image: &linkerd2.Image{
 							Name:       "ProxyImageName",
 							PullPolicy: "ImagePullPolicy",
diff --git a/pkg/inject/inject_test.go b/pkg/inject/inject_test.go
index d217ad4ba..c876563c9 100644
--- a/pkg/inject/inject_test.go
+++ b/pkg/inject/inject_test.go
@@ -75,7 +75,7 @@ func TestGetOverriddenValues(t *testing.T) {
 				values, _ := l5dcharts.NewValues(false)
 
 				values.Global.Proxy.DisableIdentity = true
-				values.Global.Proxy.DestinationGetNetworks = "10.0.0.0/8"
+				values.Global.ClusterNetworks = "10.0.0.0/8"
 				values.Global.Proxy.Image.Name = "ghcr.io/linkerd/proxy"
 				values.Global.Proxy.Image.PullPolicy = pullPolicy
 				values.Global.Proxy.Image.Version = proxyVersionOverride
@@ -211,7 +211,7 @@ func TestGetOverriddenValues(t *testing.T) {
 			},
 			expected: func() *l5dcharts.Values {
 				values, _ := l5dcharts.NewValues(false)
-				values.Global.Proxy.DestinationGetNetworks = ""
+				values.Global.ClusterNetworks = ""
 				return values
 			},
 		},