Repository: linkerd/linkerd2
Pull request #5671 (2021-02-05 06:41:32)

CLI: Remove the `--disable-tap` flag from inject
Fixes https://github.com/linkerd/linkerd2/issues/5664

- Remove `--disable-flag` from `inject`
-  Move `config.linkerd.io/disable-tap` to `viz.linkerd.io/disable-tap`

Signed-off-by: Mayank Shah <mayankshah1614@gmail.com>

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->


mayankshah1607: Should we also remove `--restrict-dashboard-privileges` from `install`?
alpeb: > Should we also remove `--restrict-dashboard-privileges` from `install`?

I think that was already removed. It wasn't added back into `linkerd viz install`, but IMO that's fine given it sounds to me like a not frequently used flag. Nevertheless it was replaced by `dashboard.restrictPrivileges` in viz' values.yaml, which still is modifiable through `--set` in the CLI.
mayankshah1607: Thanks @alpeb 
All instances of `config.linkerd.io/disable-tap` have been replaced 
mayankshah1607: Thanks @kleimkuhler!
I have made the changes as per your comment. Let me know if I may have missed anything else that may have to be cleaned up! :)

Patch:
diff --git a/charts/linkerd2/README.md b/charts/linkerd2/README.md
index a144e49ae..75cf21cba 100644
--- a/charts/linkerd2/README.md
+++ b/charts/linkerd2/README.md
@@ -100,17 +100,19 @@ helm install \
 [slack]: http://slack.linkerd.io
 [twitter]: https://twitter.com/linkerd
 
-## Addons for linkerd
-
-For the linkerd application there are some addons that can be configured. The
-documentation for the configurations of the addons can be found in their
-respective readme.md
-
-[Prometheus](https://github.com/linkerd/linkerd2/blob/main/charts/add-ons/prometheus/README.md)
-
-[Grafana](https://github.com/linkerd/linkerd2/blob/main/charts/add-ons/grafana/README.md)
-
-[Tracing](https://github.com/linkerd/linkerd2/blob/main/charts/add-ons/tracing/README.md)
+## Extensions for Linkerd
+
+The current chart installs the core Linkerd components, which grant you
+reliability and security features. Other functionality is available through
+extensions. Check the corresponding docs for each one of the following
+extensions:
+
+* Observability:
+  [Linkerd-viz](https://github.com/linkerd/linkerd2/blob/main/viz/charts/linkerd-viz/README.md)
+* Multicluster:
+  [Linkerd-multicluster](https://github.com/linkerd/linkerd2/blob/main/multicluster/charts/linkerd-multicluster/README.md)
+* Tracing:
+  [Linkerd-jaeger](https://github.com/linkerd/linkerd2/blob/main/jaeger/charts/linkerd-jaeger/README.md)
 
 ## Requirements
 
diff --git a/charts/linkerd2/README.md.gotmpl b/charts/linkerd2/README.md.gotmpl
index d2bb0982c..b4bdef413 100644
--- a/charts/linkerd2/README.md.gotmpl
+++ b/charts/linkerd2/README.md.gotmpl
@@ -98,18 +98,19 @@ helm install \
 [slack]: http://slack.linkerd.io
 [twitter]: https://twitter.com/linkerd
 
-## Addons for linkerd
-
-For the linkerd application there are some addons that can be configured. The
-documentation for the configurations of the addons can be found in their
-respective readme.md
-
-[Prometheus](https://github.com/linkerd/linkerd2/blob/main/charts/add-ons/prometheus/README.md)
-
-[Grafana](https://github.com/linkerd/linkerd2/blob/main/charts/add-ons/grafana/README.md)
-
-[Tracing](https://github.com/linkerd/linkerd2/blob/main/charts/add-ons/tracing/README.md)
-
+## Extensions for Linkerd
+
+The current chart installs the core Linkerd components, which grant you
+reliability and security features. Other functionality is available through
+extensions. Check the corresponding docs for each one of the following
+extensions:
+
+* Observability:
+  [Linkerd-viz](https://github.com/linkerd/linkerd2/blob/main/viz/charts/linkerd-viz/README.md)
+* Multicluster:
+  [Linkerd-multicluster](https://github.com/linkerd/linkerd2/blob/main/multicluster/charts/linkerd-multicluster/README.md)
+* Tracing:
+  [Linkerd-jaeger](https://github.com/linkerd/linkerd2/blob/main/jaeger/charts/linkerd-jaeger/README.md)
 
 {{ template "chart.requirementsSection" . }}
 
diff --git a/charts/partials/templates/_validate.tpl b/charts/partials/templates/_validate.tpl
index d93d81875..d1379b5cc 100644
--- a/charts/partials/templates/_validate.tpl
+++ b/charts/partials/templates/_validate.tpl
@@ -2,8 +2,4 @@
 {{- if .disableIdentity -}}
 {{- fail (printf "Can't disable identity mTLS for %s. Set '.Values.global.proxy.disableIdentity' to 'false'" .component) -}}
 {{- end -}}
-
-{{- if .disableTap -}}
-{{- fail (printf "Can't disable tap for %s. Set '.Values.global.proxy.disableTap' to 'false'" .component) -}}
-{{- end -}}
 {{- end -}}
diff --git a/cli/cmd/doc.go b/cli/cmd/doc.go
index e04dbdaf8..7a9648e09 100644
--- a/cli/cmd/doc.go
+++ b/cli/cmd/doc.go
@@ -207,10 +207,6 @@ func generateAnnotationsDocs() []annotationDoc {
 			Name:        k8s.ProxyDisableIdentityAnnotation,
 			Description: "Disables resources from participating in TLS identity",
 		},
-		{
-			Name:        k8s.ProxyDisableTapAnnotation,
-			Description: "Disables resources from being tapped",
-		},
 		{
 			Name:        k8s.ProxyEnableDebugAnnotation,
 			Description: "Inject a debug sidecar for data plane debugging",
diff --git a/cli/cmd/inject.go b/cli/cmd/inject.go
index a2a4a6589..1af7cd82c 100644
--- a/cli/cmd/inject.go
+++ b/cli/cmd/inject.go
@@ -427,10 +427,6 @@ func getOverrideAnnotations(values *charts.Values, base *charts.Values) map[stri
 		overrideAnnotations[k8s.ProxyRequireIdentityOnInboundPortsAnnotation] = proxy.RequireIdentityOnInboundPorts
 	}
 
-	if proxy.DisableTap != baseProxy.DisableTap {
-		overrideAnnotations[k8s.ProxyDisableTapAnnotation] = strconv.FormatBool(proxy.DisableTap)
-	}
-
 	if proxy.EnableExternalProfiles != baseProxy.EnableExternalProfiles {
 		overrideAnnotations[k8s.ProxyEnableExternalProfilesAnnotation] = strconv.FormatBool(proxy.EnableExternalProfiles)
 	}
diff --git a/cli/cmd/options.go b/cli/cmd/options.go
index e8f4e1b69..9dbeeec6f 100644
--- a/cli/cmd/options.go
+++ b/cli/cmd/options.go
@@ -460,12 +460,6 @@ func makeInjectFlags(defaults *l5dcharts.Values) ([]flag.Flag, *pflag.FlagSet) {
 				return nil
 			}),
 
-		flag.NewBoolFlag(injectFlags, "disable-tap", defaults.GetGlobal().Proxy.DisableTap,
-			"Disables resources from being tapped", func(values *l5dcharts.Values, value bool) error {
-				values.GetGlobal().Proxy.DisableTap = value
-				return nil
-			}),
-
 		flag.NewStringSliceFlag(injectFlags, "require-identity-on-inbound-ports", strings.Split(defaults.GetGlobal().Proxy.RequireIdentityOnInboundPorts, ","),
 			"Inbound ports on which the proxy should require identity", func(values *l5dcharts.Values, value []string) error {
 				values.GetGlobal().Proxy.RequireIdentityOnInboundPorts = strings.Join(value, ",")
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index 763f2f1a3..3161f58c5 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -107,7 +107,6 @@ type (
 		// This should match .Resources.CPU.Limit, but must be a whole number
 		Cores                         int64            `json:"cores,omitempty"`
 		DisableIdentity               bool             `json:"disableIdentity"`
-		DisableTap                    bool             `json:"disableTap"`
 		EnableExternalProfiles        bool             `json:"enableExternalProfiles"`
 		Image                         *Image           `json:"image"`
 		LogLevel                      string           `json:"logLevel"`
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index 1d5e9ad74..b9b928cec 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -40,7 +40,6 @@ var (
 		k8s.ProxyAdminPortAnnotation,
 		k8s.ProxyControlPortAnnotation,
 		k8s.ProxyDisableIdentityAnnotation,
-		k8s.ProxyDisableTapAnnotation,
 		k8s.ProxyEnableDebugAnnotation,
 		k8s.ProxyEnableExternalProfilesAnnotation,
 		k8s.ProxyImagePullPolicyAnnotation,
@@ -707,13 +706,6 @@ func (conf *ResourceConfig) applyAnnotationOverrides(values *l5dcharts.Values) {
 		}
 	}
 
-	if override, ok := annotations[k8s.ProxyDisableTapAnnotation]; ok {
-		value, err := strconv.ParseBool(override)
-		if err == nil {
-			values.GetGlobal().Proxy.DisableTap = value
-		}
-	}
-
 	if override, ok := annotations[k8s.ProxyRequireIdentityOnInboundPortsAnnotation]; ok {
 		values.GetGlobal().Proxy.RequireIdentityOnInboundPorts = override
 	}
diff --git a/pkg/k8s/labels.go b/pkg/k8s/labels.go
index b44e55e2a..14ba579f5 100644
--- a/pkg/k8s/labels.go
+++ b/pkg/k8s/labels.go
@@ -7,7 +7,6 @@ package k8s
 
 import (
 	"fmt"
-	"strconv"
 
 	"github.com/linkerd/linkerd2/pkg/version"
 	appsv1 "k8s.io/api/apps/v1"
@@ -225,9 +224,6 @@ const (
 	// ProxyDisableIdentityAnnotation can be used to disable identity on the injected proxy.
 	ProxyDisableIdentityAnnotation = ProxyConfigAnnotationsPrefix + "/disable-identity"
 
-	// ProxyDisableTapAnnotation can be used to disable tap on the injected proxy.
-	ProxyDisableTapAnnotation = ProxyConfigAnnotationsPrefix + "/disable-tap"
-
 	// ProxyEnableDebugAnnotation is set to true if the debug container is
 	// injected.
 	ProxyEnableDebugAnnotation = ProxyConfigAnnotationsPrefix + "/enable-debug-sidecar"
@@ -477,22 +473,3 @@ func GetPodLabels(ownerKind, ownerName string, pod *corev1.Pod) map[string]strin
 func IsMeshed(pod *corev1.Pod, controllerNS string) bool {
 	return pod.Labels[ControllerNSLabel] == controllerNS
 }
-
-// IsTapDisabled returns true if a namespace or pod has an annotation for
-// explicitly disabling tap
-func IsTapDisabled(obj interface{}) bool {
-	var valStr string
-	switch resource := obj.(type) {
-	case *corev1.Pod:
-		valStr = resource.GetAnnotations()[ProxyDisableTapAnnotation]
-	case *corev1.Namespace:
-		valStr = resource.GetAnnotations()[ProxyDisableTapAnnotation]
-	}
-	if valStr != "" {
-		valBool, err := strconv.ParseBool(valStr)
-		if err == nil && valBool {
-			return true
-		}
-	}
-	return false
-}
diff --git a/viz/charts/linkerd-viz/README.md b/viz/charts/linkerd-viz/README.md
index ce85ed01a..1d8f48992 100644
--- a/viz/charts/linkerd-viz/README.md
+++ b/viz/charts/linkerd-viz/README.md
@@ -164,6 +164,7 @@ Kubernetes: `>=1.13.0-0`
 | tapInjector.image.registry | string | `"ghcr.io/linkerd"` | Docker registry for the tapInjector instance |
 | tapInjector.image.tag | string | `"linkerdVersionValue"` | Docker image tag for the tapInjector instance |
 | tapInjector.keyPEM | string | `""` | Certificate key for the tapInjector. If not provided then Helm will generate one. |
+| tapInjector.logLevel | string | defaultLogLevel | log level of the tapInjector |
 | tapInjector.namespaceSelector | string | `nil` |  |
 | tapInjector.objectSelector | string | `nil` |  |
 | tapInjector.proxy | string | `nil` |  |
diff --git a/viz/charts/linkerd-viz/templates/tap-injector.yaml b/viz/charts/linkerd-viz/templates/tap-injector.yaml
index 02fa0a1a9..21a1cfa1f 100644
--- a/viz/charts/linkerd-viz/templates/tap-injector.yaml
+++ b/viz/charts/linkerd-viz/templates/tap-injector.yaml
@@ -71,6 +71,7 @@ spec:
       - args:
         - injector
         - -tap-service-name=linkerd-tap.{{.Values.namespace}}.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
+        - -log-level={{.Values.tapInjector.logLevel | default .Values.defaultLogLevel}}
         image: {{.Values.tapInjector.image.registry}}/{{.Values.tapInjector.image.name}}:{{.Values.tapInjector.image.tag}}
         imagePullPolicy: {{.Values.tapInjector.image.pullPolicy}}
         livenessProbe:
diff --git a/viz/charts/linkerd-viz/values.yaml b/viz/charts/linkerd-viz/values.yaml
index 734cead84..576e4e61f 100644
--- a/viz/charts/linkerd-viz/values.yaml
+++ b/viz/charts/linkerd-viz/values.yaml
@@ -145,6 +145,9 @@ tap:
 tapInjector:
   # -- Number of replicas of tapInjector
   replicas: 1
+  # -- log level of the tapInjector
+  # @default -- defaultLogLevel
+  logLevel: ""
   image:
     # -- Docker registry for the tapInjector instance
     registry: *registry
diff --git a/viz/pkg/healthcheck/healthcheck.go b/viz/pkg/healthcheck/healthcheck.go
index e2020a80c..d8263b8ac 100644
--- a/viz/pkg/healthcheck/healthcheck.go
+++ b/viz/pkg/healthcheck/healthcheck.go
@@ -339,7 +339,7 @@ func (hc *HealthChecker) checkForTapConfiguration(ctx context.Context, pods []co
 			return err
 		}
 		// Check if Tap is disabled
-		if !k8s.IsTapDisabled(pod) && !k8s.IsTapDisabled(ns) {
+		if !vizLabels.IsTapDisabled(pod) && !vizLabels.IsTapDisabled(ns) {
 			// Check for tap-injector annotation
 			if !vizLabels.IsTapEnabled(&pod) {
 				podsWithoutTap = append(podsWithoutTap, fmt.Sprintf("* %s", pod.Name))
diff --git a/viz/pkg/labels/labels.go b/viz/pkg/labels/labels.go
index c118fc235..cb487c403 100644
--- a/viz/pkg/labels/labels.go
+++ b/viz/pkg/labels/labels.go
@@ -13,6 +13,9 @@ const (
 	// VizTapEnabled is set by the tap-injector component when tap has been
 	// enabled on a pod.
 	VizTapEnabled = VizAnnotationsPrefix + "/tap-enabled"
+
+	// VizTapDisabled can be used to disable tap on the injected proxy.
+	VizTapDisabled = VizAnnotationsPrefix + "/disable-tap"
 )
 
 // IsTapEnabled returns true if a pod has an annotation indicating that tap
@@ -27,3 +30,22 @@ func IsTapEnabled(pod *corev1.Pod) bool {
 	}
 	return false
 }
+
+// IsTapDisabled returns true if a namespace or pod has an annotation for
+// explicitly disabling tap
+func IsTapDisabled(obj interface{}) bool {
+	var valStr string
+	switch resource := obj.(type) {
+	case *corev1.Pod:
+		valStr = resource.GetAnnotations()[VizTapDisabled]
+	case *corev1.Namespace:
+		valStr = resource.GetAnnotations()[VizTapDisabled]
+	}
+	if valStr != "" {
+		valBool, err := strconv.ParseBool(valStr)
+		if err == nil && valBool {
+			return true
+		}
+	}
+	return false
+}
diff --git a/viz/tap/api/grpc_server.go b/viz/tap/api/grpc_server.go
index cf76e4ff9..173283003 100644
--- a/viz/tap/api/grpc_server.go
+++ b/viz/tap/api/grpc_server.go
@@ -88,7 +88,7 @@ func (s *GRPCTapServer) TapByResource(req *tapPb.TapByResourceRequest, stream ta
 
 		for _, pod := range podsFor {
 			if pkgK8s.IsMeshed(pod, s.controllerNamespace) {
-				if pkgK8s.IsTapDisabled(pod) {
+				if vizLabels.IsTapDisabled(pod) {
 					tapDisabled = true
 				} else if !vizLabels.IsTapEnabled(pod) {
 					tapNotEnabled = true
@@ -104,7 +104,7 @@ func (s *GRPCTapServer) TapByResource(req *tapPb.TapByResourceRequest, stream ta
 		errStr := fmt.Errorf("no pods to tap for %s/%s", res.GetType(), res.GetName())
 		errStrings = append(errStrings, errStr.Error())
 		if tapDisabled {
-			errStr = fmt.Errorf("pods found with tap disabled via the %s annotation", pkgK8s.ProxyDisableTapAnnotation)
+			errStr = fmt.Errorf("pods found with tap disabled via the %s annotation", vizLabels.VizTapDisabled)
 			errStrings = append(errStrings, errStr.Error())
 		}
 		if tapNotEnabled {
diff --git a/viz/tap/injector/webhook.go b/viz/tap/injector/webhook.go
index 7a0362612..0e1c8aca9 100644
--- a/viz/tap/injector/webhook.go
+++ b/viz/tap/injector/webhook.go
@@ -8,7 +8,6 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/linkerd/linkerd2/controller/k8s"
 	"github.com/linkerd/linkerd2/controller/webhook"
-	labels "github.com/linkerd/linkerd2/pkg/k8s"
 	vizLabels "github.com/linkerd/linkerd2/viz/pkg/labels"
 	"github.com/prometheus/common/log"
 	admissionv1beta1 "k8s.io/api/admission/v1beta1"
@@ -53,7 +52,7 @@ func Mutate(tapSvcName string) webhook.Handler {
 			return nil, err
 		}
 		var t *template.Template
-		if labels.IsTapDisabled(namespace) || labels.IsTapDisabled(pod) {
+		if vizLabels.IsTapDisabled(namespace) || vizLabels.IsTapDisabled(pod) {
 			return admissionResponse, nil
 		}
 		t, err = template.New("tpl").Parse(tpl)


Test patch:
diff --git a/cli/cmd/inject_test.go b/cli/cmd/inject_test.go
index c88061a6d..4e107a37a 100644
--- a/cli/cmd/inject_test.go
+++ b/cli/cmd/inject_test.go
@@ -594,7 +594,6 @@ func TestProxyConfigurationAnnotations(t *testing.T) {
 	values.GetGlobal().Proxy.LogLevel = "debug"
 	values.GetGlobal().Proxy.LogFormat = "cool"
 	values.GetGlobal().Proxy.DisableIdentity = true
-	values.GetGlobal().Proxy.DisableTap = true
 	values.GetGlobal().Proxy.EnableExternalProfiles = true
 	values.GetGlobal().Proxy.Resources.CPU.Request = "10m"
 	values.GetGlobal().Proxy.Resources.CPU.Limit = "100m"
@@ -603,17 +602,17 @@ func TestProxyConfigurationAnnotations(t *testing.T) {
 	values.GetGlobal().Proxy.WaitBeforeExitSeconds = 10
 
 	expectedOverrides := map[string]string{
-		k8s.ProxyIgnoreInboundPortsAnnotation:     "8500-8505",
-		k8s.ProxyIgnoreOutboundPortsAnnotation:    "3306",
-		k8s.ProxyAdminPortAnnotation:              "1234",
-		k8s.ProxyControlPortAnnotation:            "4191",
-		k8s.ProxyInboundPortAnnotation:            "4144",
-		k8s.ProxyOutboundPortAnnotation:           "4141",
-		k8s.ProxyUIDAnnotation:                    "999",
-		k8s.ProxyLogLevelAnnotation:               "debug",
-		k8s.ProxyLogFormatAnnotation:              "cool",
-		k8s.ProxyDisableIdentityAnnotation:        "true",
-		k8s.ProxyDisableTapAnnotation:             "true",
+		k8s.ProxyIgnoreInboundPortsAnnotation:  "8500-8505",
+		k8s.ProxyIgnoreOutboundPortsAnnotation: "3306",
+		k8s.ProxyAdminPortAnnotation:           "1234",
+		k8s.ProxyControlPortAnnotation:         "4191",
+		k8s.ProxyInboundPortAnnotation:         "4144",
+		k8s.ProxyOutboundPortAnnotation:        "4141",
+		k8s.ProxyUIDAnnotation:                 "999",
+		k8s.ProxyLogLevelAnnotation:            "debug",
+		k8s.ProxyLogFormatAnnotation:           "cool",
+		k8s.ProxyDisableIdentityAnnotation:     "true",
+
 		k8s.ProxyEnableExternalProfilesAnnotation: "true",
 		k8s.ProxyCPURequestAnnotation:             "10m",
 		k8s.ProxyCPULimitAnnotation:               "100m",
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index b60f42a17..b5af5b228 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         config.linkerd.io/admin-port: "9998"
-        config.linkerd.io/disable-tap: "true"
         config.linkerd.io/proxy-cpu-limit: "1"
         config.linkerd.io/proxy-cpu-request: "0.5"
         config.linkerd.io/proxy-memory-limit: 256Mi
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.input.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.input.yml
index f3dcc150a..fc6c6f67e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.input.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.input.yml
@@ -12,7 +12,6 @@ spec:
     metadata:
       annotations:
         config.linkerd.io/admin-port: "9998"
-        config.linkerd.io/disable-tap: "true"
         config.linkerd.io/proxy-cpu-limit: "1"
         config.linkerd.io/proxy-cpu-request: "0.5"
         config.linkerd.io/proxy-memory-limit: 256Mi
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index b24460d6a..ef378c7e0 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index afbd96f8b..b349c7eac 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 3af4f0b4f..2bb940ba9 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: my.custom.registry/linkerd-io/proxy
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 7a30e54f2..3dc1916ae 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 6b3a80fed..e7e28559c 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 7499af845..8057ed244 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -900,7 +900,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index d8f40ca84..59cc56d35 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -900,7 +900,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 3c183b1cb..bfaaa54d8 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -851,7 +851,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index a02adc242..475bee630 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -904,7 +904,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index cb9969e52..b0c2864ee 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -910,7 +910,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 700b2ddf1..6cd842ab3 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -914,7 +914,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 3c2f670d3..ee8d96ba1 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -910,7 +910,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 5cbff38b0..8b53ad42f 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -891,7 +891,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 64ec07251..77c5a8ecc 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ProxyImageName
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index bfd664c32..4ee9fbde8 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -894,7 +894,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 916d42087..78352feb8 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -880,7 +880,6 @@ data:
       proxy:
         capabilities: null
         disableIdentity: false
-        disableTap: false
         enableExternalProfiles: false
         image:
           name: ghcr.io/linkerd/proxy
diff --git a/test/integration/inject/inject_test.go b/test/integration/inject/inject_test.go
index e5fced81d..2fc9963d2 100644
--- a/test/integration/inject/inject_test.go
+++ b/test/integration/inject/inject_test.go
@@ -50,7 +50,6 @@ func TestInjectManualParams(t *testing.T) {
 
 	injectionValidator := testutil.InjectValidator{
 		DisableIdentity:        true,
-		DisableTap:             true,
 		Version:                "proxy-version",
 		Image:                  "proxy-image",
 		InitImage:              "init-image",
@@ -113,7 +112,6 @@ func TestInjectAutoParams(t *testing.T) {
 			AutoInject:             true,
 			AdminPort:              8888,
 			ControlPort:            8881,
-			DisableTap:             true,
 			EnableExternalProfiles: true,
 			EnableDebug:            true,
 			ImagePullPolicy:        "Never",
diff --git a/test/integration/tap/tap_test.go b/test/integration/tap/tap_test.go
index d8404fc67..8657cd84e 100644
--- a/test/integration/tap/tap_test.go
+++ b/test/integration/tap/tap_test.go
@@ -145,7 +145,7 @@ func TestCliTap(t *testing.T) {
 				testutil.Fatal(t, "expected an error, got none")
 			}
 			expectedErr := `Error: no pods to tap for deployment/t4
-pods found with tap disabled via the config.linkerd.io/disable-tap annotation`
+pods found with tap disabled via the viz.linkerd.io/disable-tap annotation`
 			split := strings.Split(stderr, "\n")
 			actualErr := strings.Join(split[:2], "\n")
 			if actualErr != expectedErr {
diff --git a/test/integration/tap/testdata/tap_application.yaml b/test/integration/tap/testdata/tap_application.yaml
index 953922078..3361c8c4c 100644
--- a/test/integration/tap/testdata/tap_application.yaml
+++ b/test/integration/tap/testdata/tap_application.yaml
@@ -133,7 +133,7 @@ spec:
   template:
     metadata:
       annotations:
-        config.linkerd.io/disable-tap: "true"
+        viz.linkerd.io/disable-tap: "true"
       labels:
         app: t4
     spec:
diff --git a/testutil/inject_validator.go b/testutil/inject_validator.go
index bc616ca4d..0fa7c0ee6 100644
--- a/testutil/inject_validator.go
+++ b/testutil/inject_validator.go
@@ -25,7 +25,6 @@ type InjectValidator struct {
 	AutoInject             bool
 	AdminPort              int
 	ControlPort            int
-	DisableTap             bool
 	EnableDebug            bool
 	EnableExternalProfiles bool
 	ImagePullPolicy        string
@@ -77,15 +76,6 @@ func (iv *InjectValidator) validateEnvVar(container *v1.Container, envName, expe
 	return fmt.Errorf("cannot find env: %s", envName)
 }
 
-func (iv *InjectValidator) validateNoEnvVar(container *v1.Container, envName string) error {
-	for _, env := range container.Env {
-		if env.Name == envName {
-			return fmt.Errorf("env: %s, expected to not be set, actual %s", envName, env.Value)
-		}
-	}
-	return nil
-}
-
 func (iv *InjectValidator) validatePort(container *v1.Container, portName string, expectedValue int) error {
 	for _, port := range container.Ports {
 		if port.Name == portName {
@@ -137,12 +127,6 @@ func (iv *InjectValidator) validateProxyContainer(pod *v1.PodSpec) error {
 		}
 	}
 
-	if iv.DisableTap {
-		if err := iv.validateNoEnvVar(proxyContainer, "LINKERD2_PROXY_TAP_SVC"); err != nil {
-			return err
-		}
-	}
-
 	if iv.EnableExternalProfiles {
 		if err := iv.validateEnvVar(proxyContainer, "LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES", "."); err != nil {
 			return err
@@ -422,11 +406,6 @@ func (iv *InjectValidator) GetFlagsAndAnnotations() ([]string, map[string]string
 		flags = append(flags, "--disable-identity")
 	}
 
-	if iv.DisableTap {
-		annotations[k8s.ProxyDisableTapAnnotation] = enabled
-		flags = append(flags, "--disable-tap")
-	}
-
 	if iv.EnableDebug {
 		annotations[k8s.ProxyEnableDebugAnnotation] = enabled
 		flags = append(flags, "--enable-debug-sidecar")
diff --git a/viz/cmd/testdata/install_default.golden b/viz/cmd/testdata/install_default.golden
index 7279d4ea0..65f18ecdd 100644
--- a/viz/cmd/testdata/install_default.golden
+++ b/viz/cmd/testdata/install_default.golden
@@ -1094,6 +1094,7 @@ spec:
       - args:
         - injector
         - -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
+        - -log-level=info
         image: ghcr.io/linkerd/tap:dev-undefined
         imagePullPolicy: 
         livenessProbe:
diff --git a/viz/cmd/testdata/install_prometheus_disabled.golden b/viz/cmd/testdata/install_prometheus_disabled.golden
index 91d0e3c9f..3bf0b3850 100644
--- a/viz/cmd/testdata/install_prometheus_disabled.golden
+++ b/viz/cmd/testdata/install_prometheus_disabled.golden
@@ -803,6 +803,7 @@ spec:
       - args:
         - injector
         - -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
+        - -log-level=info
         image: ghcr.io/linkerd/tap:dev-undefined
         imagePullPolicy: 
         livenessProbe:
diff --git a/viz/cmd/testdata/install_proxy_resources.golden b/viz/cmd/testdata/install_proxy_resources.golden
index 40be613e7..dca68b8cc 100644
--- a/viz/cmd/testdata/install_proxy_resources.golden
+++ b/viz/cmd/testdata/install_proxy_resources.golden
@@ -1106,6 +1106,7 @@ spec:
       - args:
         - injector
         - -tap-service-name=linkerd-tap.linkerd-viz.serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
+        - -log-level=info
         image: ghcr.io/linkerd/tap:dev-undefined
         imagePullPolicy: 
         livenessProbe:
diff --git a/viz/tap/api/grpc_server_test.go b/viz/tap/api/grpc_server_test.go
index 3e7e739cc..e57d4b04f 100644
--- a/viz/tap/api/grpc_server_test.go
+++ b/viz/tap/api/grpc_server_test.go
@@ -186,7 +186,7 @@ status:
 		},
 		{
 			err: status.Errorf(codes.NotFound, `no pods to tap for pod/emojivoto-meshed-tap-disabled
-pods found with tap disabled via the config.linkerd.io/disable-tap annotation`),
+pods found with tap disabled via the viz.linkerd.io/disable-tap annotation`),
 			k8sRes: []string{`
 apiVersion: v1
 kind: Pod
@@ -197,7 +197,7 @@ metadata:
     app: emoji-svc
     linkerd.io/control-plane-ns: controller-ns
   annotations:
-    config.linkerd.io/disable-tap: "true"
+    viz.linkerd.io/disable-tap: "true"
     linkerd.io/proxy-version: testinjectversion
 status:
   phase: Running