Repository: linkerd/linkerd2
Pull request #7229 (2021-11-05 17:03:30)

build(deps-dev): bump webpack from 5.61.0 to 5.62.1 in /web/app
Bumps [webpack](https://github.com/webpack/webpack) from 5.61.0 to 5.62.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/webpack/webpack/releases">webpack's releases</a>.</em></p>
<blockquote>
<h2>v5.62.1</h2>
<h1>Bugfix</h1>
<ul>
<li>fix invalid generated code when omitting <code>;</code></li>
</ul>
<h2>v5.62.0</h2>
<h1>Features</h1>
<ul>
<li>add options to configure export presence checking
<ul>
<li><code>parser.javascript.reexportExportsPresence: false</code> allows to disable warnings for non-existing exports during the migration from <code>export ... from &quot;...&quot;</code> to <code>export type ... from &quot;...&quot;</code> for type reexports in TypeScript</li>
</ul>
</li>
<li>add <code>experiments.backCompat: false</code> to disable some expensive deprecations for better performance</li>
</ul>
<h1>Bugfixes</h1>
<ul>
<li>use <code>['catch']</code> instead of <code>.catch</code> for better ES3 support</li>
<li>fix removed parentheses when using <code>new (require(&quot;...&quot;)).Something()</code></li>
<li>fix <code>{ require }</code> object literals</li>
<li><code>splitChunks.chunks</code> option is now correctly used for <code>splitChunks.fallbackCacheGroup.maxSize</code> too</li>
<li>fix schema of <code>listen</code> option, allow to omit <code>port</code></li>
<li>add better support for Promises from different isolates</li>
</ul>
<h1>Developer Experience</h1>
<ul>
<li>add typings for the webpack API that is available within modules
<ul>
<li>use <code>/// &lt;reference types=&quot;webpack/module&quot; /&gt;</code> to use the typings in typescript modules</li>
<li>or <code>&quot;types&quot;: [..., &quot;webpack/module&quot;]</code> in tsconfig</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/webpack/webpack/commit/daba59b3d60e7895543b6563682c209e4ad6b8b8"><code>daba59b</code></a> 5.62.1</li>
<li><a href="https://github.com/webpack/webpack/commit/707a6d360f39419ea158a1e174a8ecd6483d9188"><code>707a6d3</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/14663">#14663</a> from webpack/hotfix/14662</li>
<li><a href="https://github.com/webpack/webpack/commit/610d4356607eb74409e29954dd35945fdb2eb42b"><code>610d435</code></a> fix <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/14662">#14662</a></li>
<li><a href="https://github.com/webpack/webpack/commit/04640dcc757c8b3e78c6cbf6e4dda7cbbde33fe2"><code>04640dc</code></a> 5.62.0</li>
<li><a href="https://github.com/webpack/webpack/commit/122db57e7bb0ddb8327b37eeaa0adb9bd5135962"><code>122db57</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/14653">#14653</a> from webpack/feature/no-back-compat</li>
<li><a href="https://github.com/webpack/webpack/commit/43f6109957cc31f8bc8a98c0a82061dac185a2b8"><code>43f6109</code></a> update snapshot</li>
<li><a href="https://github.com/webpack/webpack/commit/e06c2c0ac5859077a2d8fa8610505a7ea888075b"><code>e06c2c0</code></a> update snapshot and move cli test to basic tests</li>
<li><a href="https://github.com/webpack/webpack/commit/7afcc5d4ff4ecaa371a2f82d7428dabd3728c63e"><code>7afcc5d</code></a> allow to disable some deprecations</li>
<li><a href="https://github.com/webpack/webpack/commit/95b101fc8ea719b57e94370e35fb8f417b299158"><code>95b101f</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/14641">#14641</a> from webpack/dependabot/npm_and_yarn/jest-junit-13.0.0</li>
<li><a href="https://github.com/webpack/webpack/commit/26482ea249507e8143d3a43f79272ce7c147360e"><code>26482ea</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/14640">#14640</a> from webpack/dependabot/npm_and_yarn/mini-svg-data-...</li>
<li>Additional commits viewable in <a href="https://github.com/webpack/webpack/compare/v5.61.0...v5.62.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=webpack&package-manager=npm_and_yarn&previous-version=5.61.0&new-version=5.62.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/charts/linkerd2/templates/destination.yaml b/charts/linkerd2/templates/destination.yaml
index 90358444d..77fb348b8 100644
--- a/charts/linkerd2/templates/destination.yaml
+++ b/charts/linkerd2/templates/destination.yaml
@@ -251,6 +251,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace={{.Values.namespace}}
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks={{.Values.clusterNetworks}}
diff --git a/policy-controller/k8s/index/src/authz.rs b/policy-controller/k8s/index/src/authz.rs
index 6b2713d47..9ef9ba5f4 100644
--- a/policy-controller/k8s/index/src/authz.rs
+++ b/policy-controller/k8s/index/src/authz.rs
@@ -1,4 +1,4 @@
-use crate::{server::ServerSelector, Errors, Index, SrvIndex};
+use crate::{server::ServerSelector, ClusterInfo, Errors, Index, SrvIndex};
 use anyhow::{anyhow, bail, Result};
 use linkerd_policy_controller_core::{
     ClientAuthentication, ClientAuthorization, IdentityMatch, IpNet, NetworkMatch,
@@ -42,12 +42,7 @@ impl Index {
             .namespaces
             .get_or_default(authz.namespace().expect("namespace required"));
 
-        ns.authzs.apply(
-            authz,
-            &mut ns.servers,
-            &*self.identity_domain,
-            &*self.cluster_networks,
-        )
+        ns.authzs.apply(authz, &mut ns.servers, &self.cluster_info)
     }
 
     #[instrument(
@@ -141,11 +136,10 @@ impl AuthzIndex {
         &mut self,
         authz: policy::ServerAuthorization,
         servers: &mut SrvIndex,
-        domain: &str,
-        cluster_networks: &[IpNet],
+        cluster: &ClusterInfo,
     ) -> Result<()> {
         let name = authz.name();
-        let authz = mk_authz(authz, domain, cluster_networks)?;
+        let authz = mk_authz(authz, cluster)?;
 
         match self.index.entry(name) {
             HashEntry::Vacant(entry) => {
@@ -171,11 +165,7 @@ impl AuthzIndex {
     }
 }
 
-fn mk_authz(
-    srv: policy::authz::ServerAuthorization,
-    domain: &str,
-    cluster_networks: &[IpNet],
-) -> Result<Authz> {
+fn mk_authz(srv: policy::authz::ServerAuthorization, cluster: &ClusterInfo) -> Result<Authz> {
     let policy::authz::ServerAuthorization { metadata, spec, .. } = srv;
 
     let servers = {
@@ -203,7 +193,8 @@ fn mk_authz(
             .collect::<Result<Vec<NetworkMatch>>>()?
     } else {
         // If no networks are specified, the cluster networks are used as the default.
-        cluster_networks
+        cluster
+            .networks
             .iter()
             .copied()
             .map(NetworkMatch::from)
@@ -217,7 +208,7 @@ fn mk_authz(
             .client
             .mesh_tls
             .ok_or_else(|| anyhow!("client mtls missing"))?;
-        mk_mtls_authn(&metadata, mtls, domain)?
+        mk_mtls_authn(&metadata, mtls, cluster)?
     };
 
     Ok(Authz {
@@ -232,7 +223,7 @@ fn mk_authz(
 fn mk_mtls_authn(
     metadata: &k8s::ObjectMeta,
     mtls: MeshTls,
-    domain: &str,
+    cluster: &ClusterInfo,
 ) -> Result<ClientAuthentication> {
     if mtls.unauthenticated_tls {
         return Ok(ClientAuthentication::TlsUnauthenticated);
@@ -264,7 +255,10 @@ fn mk_mtls_authn(
             .namespace
             .unwrap_or_else(|| metadata.namespace.clone().unwrap());
         debug!(ns = %ns, serviceaccount = %name, "Authenticated");
-        let n = format!("{}.{}.serviceaccount.identity.linkerd.{}", name, ns, domain);
+        let n = format!(
+            "{}.{}.serviceaccount.identity.{}.{}",
+            name, ns, cluster.control_plane_ns, cluster.identity_domain
+        );
         identities.push(IdentityMatch::Name(n));
     }
 
diff --git a/policy-controller/k8s/index/src/lib.rs b/policy-controller/k8s/index/src/lib.rs
index 88ccf2795..67883c40e 100644
--- a/policy-controller/k8s/index/src/lib.rs
+++ b/policy-controller/k8s/index/src/lib.rs
@@ -60,20 +60,28 @@ type PodServerRx = watch::Receiver<ServerRx>;
 /// Publishes a pod's port for a new `ServerRx`.
 type PodServerTx = watch::Sender<ServerRx>;
 
+/// Holds cluster metadata.
+#[derive(Clone, Debug)]
+pub struct ClusterInfo {
+    /// Networks including PodIPs in this cluster.
+    ///
+    /// Unfortunately, there's no way to discover this at runtime.
+    pub networks: Vec<IpNet>,
+
+    /// The namespace where the linkerd control plane is deployed
+    pub control_plane_ns: String,
+
+    /// The cluster's mesh identity trust domain.
+    pub identity_domain: String,
+}
+
 /// Holds all indexing state. Owned and updated by a single task that processes watch events,
 /// publishing results to the shared lookup map for quick lookups in the API server.
 pub struct Index {
     /// Holds per-namespace pod/server/authorization indexes.
     namespaces: NamespaceIndex,
 
-    /// The cluster's mesh identity trust domain.
-    identity_domain: String,
-
-    /// Networks including PodIPs in this cluster.
-    ///
-    /// TODO(ver) this can be discovered dynamically by the node index, but this would complicate
-    /// notifications.
-    cluster_networks: Vec<IpNet>,
+    cluster_info: ClusterInfo,
 
     /// Holds watches for the cluster's default-allow policies. These watches are never updated but
     /// this state is held so we can used shared references when updating a pod-port's server watch
@@ -91,14 +99,13 @@ struct Errors(Vec<anyhow::Error>);
 
 impl Index {
     pub fn new(
-        cluster_networks: Vec<IpNet>,
-        identity_domain: String,
+        cluster_info: ClusterInfo,
         default_policy: DefaultPolicy,
         detect_timeout: time::Duration,
     ) -> (lookup::Reader, Self) {
         // Create a common set of receivers for all supported default policies.
         let default_policy_watches =
-            DefaultPolicyWatches::new(cluster_networks.clone(), detect_timeout);
+            DefaultPolicyWatches::new(cluster_info.networks.clone(), detect_timeout);
 
         // Provide the cluster-wide default-allow policy to the namespace index so that it may be
         // used when a workload-level annotation is not set.
@@ -108,8 +115,7 @@ impl Index {
         let idx = Self {
             lookups: writer,
             namespaces,
-            identity_domain,
-            cluster_networks,
+            cluster_info,
             default_policy_watches,
         };
         (reader, idx)
diff --git a/policy-controller/src/main.rs b/policy-controller/src/main.rs
index 41b50d461..27e680d12 100644
--- a/policy-controller/src/main.rs
+++ b/policy-controller/src/main.rs
@@ -53,6 +53,9 @@ struct Args {
 
     #[structopt(long, default_value = "all-unauthenticated")]
     default_policy: DefaultPolicy,
+
+    #[structopt(long, default_value = "linkerd")]
+    control_plane_namespace: String,
 }
 
 #[derive(Clone, Debug)]
@@ -72,6 +75,7 @@ async fn main() -> Result<()> {
         default_policy,
         log_level,
         log_format,
+        control_plane_namespace,
     } = Args::from_args();
 
     log_init(log_level, log_format)?;
@@ -92,12 +96,13 @@ async fn main() -> Result<()> {
     // Index cluster resources, returning a handle that supports lookups for the gRPC server.
     let handle = {
         const DETECT_TIMEOUT: time::Duration = time::Duration::from_secs(10);
-        let (handle, index) = linkerd_policy_controller::k8s::Index::new(
-            cluster_networks.clone(),
+        let cluster = linkerd_policy_controller::k8s::ClusterInfo {
+            networks: cluster_networks.clone(),
             identity_domain,
-            default_policy,
-            DETECT_TIMEOUT,
-        );
+            control_plane_ns: control_plane_namespace,
+        };
+        let (handle, index) =
+            linkerd_policy_controller::k8s::Index::new(cluster, default_policy, DETECT_TIMEOUT);
 
         tokio::spawn(index.run(client.clone(), ready_tx));
         handle
diff --git a/web/app/package.json b/web/app/package.json
index e6f55f809..5894e6066 100644
--- a/web/app/package.json
+++ b/web/app/package.json
@@ -77,7 +77,7 @@
     "sinon-stub-promise": "4.0.0",
     "style-loader": "^3.3.1",
     "url-loader": "^4.1.1",
-    "webpack": "^5.61.0",
+    "webpack": "^5.62.1",
     "webpack-bundle-analyzer": "4.5.0",
     "webpack-cli": "4.9.1",
     "webpack-dev-server": "4.4.0"
diff --git a/web/app/yarn.lock b/web/app/yarn.lock
index 597f47d0b..1f517f39d 100644
--- a/web/app/yarn.lock
+++ b/web/app/yarn.lock
@@ -2380,18 +2380,7 @@ browser-process-hrtime@^1.0.0:
   resolved "https://registry.yarnpkg.com/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz#3c9b4b7d782c8121e56f10106d84c0d0ffc94626"
   integrity sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==
 
-browserslist@^4.14.5, browserslist@^4.16.6:
-  version "4.17.1"
-  resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.17.1.tgz#a98d104f54af441290b7d592626dd541fa642eb9"
-  integrity sha512-aLD0ZMDSnF4lUt4ZDNgqi5BUn9BZ7YdQdI/cYlILrhdSSZJLU9aNZoD5/NBmM4SK34APB2e83MOsRt1EnkuyaQ==
-  dependencies:
-    caniuse-lite "^1.0.30001259"
-    electron-to-chromium "^1.3.846"
-    escalade "^3.1.1"
-    nanocolors "^0.1.5"
-    node-releases "^1.1.76"
-
-browserslist@^4.17.6:
+browserslist@^4.14.5, browserslist@^4.16.6, browserslist@^4.17.6:
   version "4.17.6"
   resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.17.6.tgz#c76be33e7786b497f66cad25a73756c8b938985d"
   integrity sha512-uPgz3vyRTlEiCv4ee9KlsKgo2V6qPk7Jsn0KAn2OBqbqKo3iNcPEC1Ti6J4dwnz+aIRfEEEuOzC9IBk8tXUomw==
@@ -2468,11 +2457,6 @@ camelcase@^6.0.0, camelcase@^6.2.0:
   resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-6.2.0.tgz#924af881c9d525ac9d87f40d964e5cea982a1809"
   integrity sha512-c7wVvbw3f37nuobQNtgsgG9POC9qMbNuMQmTCqZv23b6MIz0fcYpBiOlv9gEN/hdLdnZTDQhg6e9Dq5M1vKvfg==
 
-caniuse-lite@^1.0.30001259:
-  version "1.0.30001259"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001259.tgz#ae21691d3da9c4be6144403ac40f71d9f6efd790"
-  integrity sha512-V7mQTFhjITxuk9zBpI6nYsiTXhcPe05l+364nZjK7MFK/E7ibvYBSAXr4YcA6oPR8j3ZLM/LN+lUqUVAQEUZFg==
-
 caniuse-lite@^1.0.30001274:
   version "1.0.30001275"
   resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001275.tgz#26f5076629fe4e52bbd245f9046ad7b90aafdf57"
@@ -3272,11 +3256,6 @@ ee-first@1.1.1:
   resolved "https://registry.yarnpkg.com/ee-first/-/ee-first-1.1.1.tgz#590c61156b0ae2f4f0255732a158b266bc56b21d"
   integrity sha1-WQxhFWsK4vTwJVcyoViyZrxWsh0=
 
-electron-to-chromium@^1.3.846:
-  version "1.3.846"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.846.tgz#a55fd59613dbcaed609e965e3e88f42b08c401d3"
-  integrity sha512-2jtSwgyiRzybHRxrc2nKI+39wH3AwQgn+sogQ+q814gv8hIFwrcZbV07Ea9f8AmK0ufPVZUvvAG1uZJ+obV4Jw==
-
 electron-to-chromium@^1.3.886:
   version "1.3.887"
   resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.887.tgz#b36aeed12a28aaa19460a467823f5bbe1f3c6f06"
@@ -5908,11 +5887,6 @@ node-modules-regexp@^1.0.0:
   resolved "https://registry.yarnpkg.com/node-modules-regexp/-/node-modules-regexp-1.0.0.tgz#8d9dbe28964a4ac5712e9131642107c71e90ec40"
   integrity sha1-jZ2+KJZKSsVxLpExZCEHxx6Q7EA=
 
-node-releases@^1.1.76:
-  version "1.1.76"
-  resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-1.1.76.tgz#df245b062b0cafbd5282ab6792f7dccc2d97f36e"
-  integrity sha512-9/IECtNr8dXNmPWmFXepT0/7o5eolGesHUa3mtr0KlgnCvnZxwh2qensKL42JJY2vQKC3nIBXetFAqR+PW1CmA==
-
 node-releases@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.1.tgz#3d1d395f204f1f2f29a54358b9fb678765ad2fc5"
@@ -7920,10 +7894,10 @@ webpack-sources@^3.2.0:
   resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.2.1.tgz#251a7d9720d75ada1469ca07dbb62f3641a05b6d"
   integrity sha512-t6BMVLQ0AkjBOoRTZgqrWm7xbXMBzD+XDq2EZ96+vMfn3qKgsvdXZhbPZ4ElUOpdv4u+iiGe+w3+J75iy/bYGA==
 
-webpack@^5.61.0:
-  version "5.61.0"
-  resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.61.0.tgz#fa827f0ee9bdfd141dd73c3e891e955ebd52fe7f"
-  integrity sha512-fPdTuaYZ/GMGFm4WrPi2KRCqS1vDp773kj9S0iI5Uc//5cszsFEDgHNaX4Rj1vobUiU1dFIV3mA9k1eHeluFpw==
+webpack@^5.62.1:
+  version "5.62.1"
+  resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.62.1.tgz#06f09b56a7b1bb13ed5137ad4b118358a90c9505"
+  integrity sha512-jNLtnWChS2CMZ7vqWtztv0G6fYB5hz11Zsadp5tE7e4/66zVDj7/KUeQZOsOl8Hz5KrLJH1h2eIDl6AnlyE12Q==
   dependencies:
     "@types/eslint-scope" "^3.7.0"
     "@types/estree" "^0.0.50"


Test patch:
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index bfc2cc5ff..9a63238f9 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -2056,6 +2056,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index fbb163cf2..92d96feae 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -2054,6 +2054,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=l5d
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 3778321d7..96292b84d 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -2054,6 +2054,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 92e8fc2fb..57a06c2aa 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -2054,6 +2054,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index f88cba777..97f92aaaa 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -2054,6 +2054,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.0.0.0/8
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index e079cca33..3226e3b4d 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -2043,6 +2043,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 995d254eb..b816f85d6 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -2190,6 +2190,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index e6defaa38..4e5ba6c14 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -2190,6 +2190,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index ff5348ab1..792e9c69d 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -1985,6 +1985,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index 16b59e205..e96fdf4fe 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -2047,6 +2047,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index a3f496ccf..a63ecd04e 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -2183,6 +2183,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 15b885e58..6363a29b8 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -2195,6 +2195,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 22785fee9..23387d91b 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -2183,6 +2183,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index b930ac1f2..ed19dd7d8 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -2017,6 +2017,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 01928f65b..76f4d7222 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -2059,6 +2059,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=ClusterNetworks
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 2876f9cc3..97cf68c23 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -2054,6 +2054,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=linkerd
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index cacb71c3b..de247860d 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -2040,6 +2040,7 @@ spec:
           readOnly: true
       - args:
         - --admin-addr=0.0.0.0:9990
+        - --control-plane-namespace=l5d
         - --grpc-addr=0.0.0.0:8090
         - --admission-addr=0.0.0.0:9443
         - --cluster-networks=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
diff --git a/policy-controller/k8s/index/src/tests.rs b/policy-controller/k8s/index/src/tests.rs
index 6fdfeec85..ab2a9c674 100644
--- a/policy-controller/k8s/index/src/tests.rs
+++ b/policy-controller/k8s/index/src/tests.rs
@@ -13,11 +13,15 @@ use tokio::time;
 #[tokio::test]
 async fn incrementally_configure_server() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
     let (lookup_rx, mut idx) = Index::new(
-        vec![cluster_net],
-        "cluster.example.com".into(),
+        cluster,
         DefaultPolicy::Allow {
             authenticated_only: false,
             cluster_only: true,
@@ -135,18 +139,18 @@ async fn incrementally_configure_server() {
 #[test]
 fn server_update_deselects_pod() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
     let default = DefaultPolicy::Allow {
         authenticated_only: false,
         cluster_only: true,
     };
-    let (lookup_rx, mut idx) = Index::new(
-        vec![cluster_net],
-        "cluster.example.com".into(),
-        default,
-        detect_timeout,
-    );
+    let (lookup_rx, mut idx) = Index::new(cluster, default, detect_timeout);
 
     let p = mk_pod(
         "ns-0",
@@ -198,16 +202,16 @@ fn server_update_deselects_pod() {
 #[test]
 fn default_policy_global() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
-        let (lookup_rx, mut idx) = Index::new(
-            vec![cluster_net],
-            "cluster.example.com".into(),
-            *default,
-            detect_timeout,
-        );
+        let (lookup_rx, mut idx) = Index::new(cluster.clone(), *default, detect_timeout);
 
         let p = mk_pod(
             "ns-0",
@@ -241,13 +245,17 @@ fn default_policy_global() {
 #[test]
 fn default_policy_annotated() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
         let (lookup_rx, mut idx) = Index::new(
-            vec![cluster_net],
-            "cluster.example.com".into(),
+            cluster.clone(),
             // Invert default to ensure override applies.
             match *default {
                 DefaultPolicy::Deny => DefaultPolicy::Allow {
@@ -288,6 +296,11 @@ fn default_policy_annotated() {
 #[test]
 fn default_policy_annotated_invalid() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
 
@@ -295,12 +308,7 @@ fn default_policy_annotated_invalid() {
         authenticated_only: false,
         cluster_only: false,
     };
-    let (lookup_rx, mut idx) = Index::new(
-        vec![cluster_net],
-        "cluster.example.com".into(),
-        default,
-        detect_timeout,
-    );
+    let (lookup_rx, mut idx) = Index::new(cluster, default, detect_timeout);
 
     let mut p = mk_pod(
         "ns-0",
@@ -338,16 +346,16 @@ fn default_policy_annotated_invalid() {
 #[test]
 fn opaque_annotated() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
-        let (lookup_rx, mut idx) = Index::new(
-            vec![cluster_net],
-            "cluster.example.com".into(),
-            *default,
-            detect_timeout,
-        );
+        let (lookup_rx, mut idx) = Index::new(cluster.clone(), *default, detect_timeout);
 
         let mut p = mk_pod(
             "ns-0",
@@ -376,16 +384,16 @@ fn opaque_annotated() {
 #[test]
 fn authenticated_annotated() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
+    let cluster = ClusterInfo {
+        networks: vec![cluster_net],
+        control_plane_ns: "linkerd".to_string(),
+        identity_domain: "cluster.example.com".into(),
+    };
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
-        let (lookup_rx, mut idx) = Index::new(
-            vec![cluster_net],
-            "cluster.example.com".into(),
-            *default,
-            detect_timeout,
-        );
+        let (lookup_rx, mut idx) = Index::new(cluster.clone(), *default, detect_timeout);
 
         let mut p = mk_pod(
             "ns-0",