Repository: linkerd/linkerd2
Pull request #7646 (2022-01-20 03:16:19)

build(deps): bump github.com/prometheus/client_golang from 1.11.0 to 1.12.0
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.11.0 to 1.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's releases</a>.</em></p>
<blockquote>
<h2>1.12.0 / 2022-01-19</h2>
<ul>
<li>[CHANGE] example/random: Move flags and metrics into main() <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/935">#935</a></li>
<li>[FEATURE] API client: Support wal replay status api <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/944">#944</a></li>
<li>[FEATURE] Use the runtime/metrics package for the Go collector for 1.17+ <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/955">#955</a></li>
<li>[ENHANCEMENT] API client: Update /api/v1/status/tsdb to include headStats <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/925">#925</a></li>
<li>[ENHANCEMENT] promhttp: Check validity of method and code label values <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/962">#962</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Address minor issues on the changelog by <a href="https://github.com/kakkoyun"><code>@​kakkoyun</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/879">prometheus/client_golang#879</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/888">prometheus/client_golang#888</a></li>
<li>Update status badgets by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/885">prometheus/client_golang#885</a></li>
<li>Updating dependency versions + cleanup by <a href="https://github.com/sivabalan"><code>@​sivabalan</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/881">prometheus/client_golang#881</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/892">prometheus/client_golang#892</a></li>
<li>add ExponentialBucketsRange function by <a href="https://github.com/sbunce"><code>@​sbunce</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/899">prometheus/client_golang#899</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/909">prometheus/client_golang#909</a></li>
<li>Update cespare/xxhash dependency by <a href="https://github.com/dtrudg"><code>@​dtrudg</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/913">prometheus/client_golang#913</a></li>
<li>example/random: Move flags and metrics into main() by <a href="https://github.com/beorn7"><code>@​beorn7</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/935">prometheus/client_golang#935</a></li>
<li>Fix typo by <a href="https://github.com/gozeloglu"><code>@​gozeloglu</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/939">prometheus/client_golang#939</a></li>
<li>Add support for go 1.17 by <a href="https://github.com/mrueg"><code>@​mrueg</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/950">prometheus/client_golang#950</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/928">prometheus/client_golang#928</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/952">prometheus/client_golang#952</a></li>
<li>API: support wal replay status api by <a href="https://github.com/yeya24"><code>@​yeya24</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/944">prometheus/client_golang#944</a></li>
<li>Update /api/v1/status/tsdb to include headStats by <a href="https://github.com/prymitive"><code>@​prymitive</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/925">prometheus/client_golang#925</a></li>
<li>Use the runtime/metrics package for the Go collector for 1.17+ by <a href="https://github.com/mknyszek"><code>@​mknyszek</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/955">prometheus/client_golang#955</a></li>
<li>promhttp: Check validity of method and code label values by <a href="https://github.com/kakkoyun"><code>@​kakkoyun</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/962">prometheus/client_golang#962</a></li>
<li>go.*: Update dependencies by <a href="https://github.com/kakkoyun"><code>@​kakkoyun</code></a> in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/965">prometheus/client_golang#965</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/sivabalan"><code>@​sivabalan</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/881">prometheus/client_golang#881</a></li>
<li><a href="https://github.com/sbunce"><code>@​sbunce</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/899">prometheus/client_golang#899</a></li>
<li><a href="https://github.com/dtrudg"><code>@​dtrudg</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/913">prometheus/client_golang#913</a></li>
<li><a href="https://github.com/gozeloglu"><code>@​gozeloglu</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/939">prometheus/client_golang#939</a></li>
<li><a href="https://github.com/mrueg"><code>@​mrueg</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/950">prometheus/client_golang#950</a></li>
<li><a href="https://github.com/prymitive"><code>@​prymitive</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/925">prometheus/client_golang#925</a></li>
<li><a href="https://github.com/mknyszek"><code>@​mknyszek</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/prometheus/client_golang/pull/955">prometheus/client_golang#955</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/client_golang/compare/v1.11.0...v1.12.0">https://github.com/prometheus/client_golang/compare/v1.11.0...v1.12.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's changelog</a>.</em></p>
<blockquote>
<h2>1.12.0 / 2022-01-19</h2>
<ul>
<li>[CHANGE] example/random: Move flags and metrics into main() <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/935">#935</a></li>
<li>[FEATURE] API client: Support wal replay status api <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/944">#944</a></li>
<li>[FEATURE] Use the runtime/metrics package for the Go collector for 1.17+ <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/955">#955</a></li>
<li>[ENHANCEMENT] API client: Update /api/v1/status/tsdb to include headStats <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/925">#925</a></li>
<li>[ENHANCEMENT] promhttp: Check validity of method and code label values <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/962">#962</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/prometheus/client_golang/commit/01087964d02726ef7438fdb19c2672e6e5d0b48a"><code>0108796</code></a> Cut v1.12.0 (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/966">#966</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/5bd9ee52dcd8aaa216b74e7fda166fcad25643c9"><code>5bd9ee5</code></a> go.*: Update dependencies (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/965">#965</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7"><code>9075cdf</code></a> promhttp: Check validity of method and code label values (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/962">#962</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/22da9497b8f0d53072dfc4721904faa7395d8318"><code>22da949</code></a> Use the runtime/metrics package for the Go collector for 1.17+ (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/955">#955</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/dc1559e8efad6493bfa27e5af5e9a030e8675d73"><code>dc1559e</code></a> Update /api/v1/status/tsdb to include headStats (<a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/925">#925</a>)</li>
<li><a href="https://github.com/prometheus/client_golang/commit/e6e54e8082154cc124a3ca7163a10403cb26cf02"><code>e6e54e8</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/944">#944</a> from yeya24/add-wal-replay-status</li>
<li><a href="https://github.com/prometheus/client_golang/commit/98fbd996b0dbbae228185efcd0ac0965e422fb4f"><code>98fbd99</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/952">#952</a> from prometheus/repo_sync</li>
<li><a href="https://github.com/prometheus/client_golang/commit/70a41d58f8f68d12db5547096d9ecb0fcb663764"><code>70a41d5</code></a> Update common Prometheus files</li>
<li><a href="https://github.com/prometheus/client_golang/commit/dbf420e7cee2a9e2d6a972bafc82b09c8cedd94d"><code>dbf420e</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/928">#928</a> from prometheus/repo_sync</li>
<li><a href="https://github.com/prometheus/client_golang/commit/1d09783cb9363024cc3e46dc4d60ac43f952ed72"><code>1d09783</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/prometheus/client_golang/issues/950">#950</a> from mrueg/go-1.17</li>
<li>Additional commits viewable in <a href="https://github.com/prometheus/client_golang/compare/v1.11.0...v1.12.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.11.0&new-version=1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/charts/linkerd-control-plane/README.md b/charts/linkerd-control-plane/README.md
index ccedd7546..41c0d7ddd 100644
--- a/charts/linkerd-control-plane/README.md
+++ b/charts/linkerd-control-plane/README.md
@@ -233,6 +233,7 @@ Kubernetes: `>=1.20.0-0`
 | proxyInit.resources.memory.limit | string | `"50Mi"` | Maximum amount of memory that the proxy-init container can use |
 | proxyInit.resources.memory.request | string | `"10Mi"` | Amount of memory that the proxy-init container requests |
 | proxyInit.runAsRoot | bool | `false` | Allow overriding the runAsNonRoot behaviour (<https://github.com/linkerd/linkerd2/issues/7308>) |
+| proxyInit.skipSubnets | string | `""` | Comma-separated list of subnets in valid CIDR format that should be skipped by the proxy |
 | proxyInit.xtMountPath.mountPath | string | `"/run"` |  |
 | proxyInit.xtMountPath.name | string | `"linkerd-proxy-init-xtables-lock"` |  |
 | proxyInjector.caBundle | string | `""` | Bundle of CA certificates for proxy injector. If not provided nor injected with cert-manager, then Helm will use the certificate generated for `proxyInjector.crtPEM`. If `proxyInjector.externalSecret` is set to true, this value, injectCaFrom, or injectCaFromSecret must be set, as no certificate will be generated. See the cert-manager [CA Injector Docs](https://cert-manager.io/docs/concepts/ca-injector) for more information. |
diff --git a/charts/linkerd-control-plane/values.yaml b/charts/linkerd-control-plane/values.yaml
index 7428af147..72d5757aa 100644
--- a/charts/linkerd-control-plane/values.yaml
+++ b/charts/linkerd-control-plane/values.yaml
@@ -167,6 +167,8 @@ proxyInit:
   # -- Default set of outbound ports to skip via iptables
   # - Galera (4567,4568)
   ignoreOutboundPorts: "4567,4568"
+  # -- Comma-separated list of subnets in valid CIDR format that should be skipped by the proxy
+  skipSubnets: ""
   # -- Log level for the proxy-init
   # @default -- info
   logLevel: ""
diff --git a/charts/partials/templates/_proxy-init.tpl b/charts/partials/templates/_proxy-init.tpl
index b103d7889..5d41ab8bb 100644
--- a/charts/partials/templates/_proxy-init.tpl
+++ b/charts/partials/templates/_proxy-init.tpl
@@ -24,6 +24,10 @@ args:
 - --log-level
 - {{ .Values.proxyInit.logLevel }}
 {{- end }}
+{{- if .Values.proxyInit.skipSubnets }}
+- --subnets-to-ignore
+- {{ .Values.proxyInit.skipSubnets | quote }}
+{{- end }}
 image: {{.Values.proxyInit.image.name}}:{{.Values.proxyInit.image.version}}
 imagePullPolicy: {{.Values.proxyInit.image.pullPolicy | default .Values.imagePullPolicy}}
 name: linkerd-init
diff --git a/cli/cmd/doc.go b/cli/cmd/doc.go
index 556f43fbd..c8ee973aa 100644
--- a/cli/cmd/doc.go
+++ b/cli/cmd/doc.go
@@ -236,5 +236,9 @@ func generateAnnotationsDocs() []annotationDoc {
 			Name:        k8s.CloseWaitTimeoutAnnotation,
 			Description: "Sets nf_conntrack_tcp_timeout_close_wait. Accepts a duration string, e.g. `1m` or `3600s`",
 		},
+		{
+			Name:        k8s.ProxySkipSubnetsAnnotation,
+			Description: "Comma-separated list of subnets in valid CIDR format that should be skipped by the proxy",
+		},
 	}
 }
diff --git a/go.mod b/go.mod
index 95b9df842..2fd92983d 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/briandowns/spinner v0.0.0-20190212173954-5cf08d0ac778
 	github.com/clarketm/json v1.15.7
 	github.com/containernetworking/cni v1.0.1
-	github.com/emicklei/proto v1.9.1
+	github.com/emicklei/proto v1.9.2
 	github.com/evanphx/json-patch v5.6.0+incompatible
 	github.com/fatih/color v1.13.0
 	github.com/fsnotify/fsnotify v1.5.1
@@ -26,7 +26,7 @@ require (
 	github.com/nsf/termbox-go v0.0.0-20180613055208-5c94acc5e6eb
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pkg/browser v0.0.0-20170505125900-c90ca0c84f15
-	github.com/prometheus/client_golang v1.11.0
+	github.com/prometheus/client_golang v1.12.0
 	github.com/prometheus/common v0.32.1
 	github.com/sergi/go-diff v1.2.0
 	github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 // indirect
@@ -41,11 +41,11 @@ require (
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
 	google.golang.org/protobuf v1.27.1
 	helm.sh/helm/v3 v3.7.2
-	k8s.io/api v0.23.1
-	k8s.io/apiextensions-apiserver v0.23.1
-	k8s.io/apimachinery v0.23.1
-	k8s.io/client-go v0.23.1
-	k8s.io/code-generator v0.23.1
+	k8s.io/api v0.23.2
+	k8s.io/apiextensions-apiserver v0.23.2
+	k8s.io/apimachinery v0.23.2
+	k8s.io/client-go v0.23.2
+	k8s.io/code-generator v0.23.2
 	k8s.io/klog/v2 v2.40.1
 	k8s.io/kube-aggregator v0.23.1
 	sigs.k8s.io/yaml v1.3.0
@@ -128,7 +128,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
@@ -143,7 +143,7 @@ require (
 	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.0.0-20211205182925-97ca703d548d // indirect
+	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
 	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
@@ -162,7 +162,7 @@ require (
 	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
 	sigs.k8s.io/kustomize/api v0.10.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.13.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 )
 
 // to avoid the `github.com/golang/protobuf/protoc-gen-go/generator` deprecation warning
diff --git a/go.sum b/go.sum
index cd6f59a0c..179600300 100644
--- a/go.sum
+++ b/go.sum
@@ -287,8 +287,8 @@ github.com/elazarl/goproxy v0.0.0-20190711103511-473e67f1d7d2/go.mod h1:/Zj4wYkg
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/proto v1.9.1 h1:MUgjFo5xlMwYv72TnF5xmmdKZ04u+dVbv6wdARv16D8=
-github.com/emicklei/proto v1.9.1/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
+github.com/emicklei/proto v1.9.2 h1:YX2MPuUfUi/h8v+yt4WD8cdj6bt9P3475d2zrL0iogM=
+github.com/emicklei/proto v1.9.2/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -759,8 +759,9 @@ github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5Fsn
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.0 h1:HNkLOAEQMIDv/K+04rukrLx6ch7msSRwf3/SASFAGtQ=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.12.0 h1:C+UIj/QWtmqY13Arb8kwMt5j34/0Z2iKamrJ+ryC0Gg=
+github.com/prometheus/client_golang v1.12.0/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -784,8 +785,9 @@ github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDa
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0 h1:mxy4L2jP6qMonqmq+aTtOx1ifVWUgG/TAmntgbh3xv4=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0VU=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
@@ -1198,8 +1200,9 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211205182925-97ca703d548d h1:FjkYO/PPp4Wi0EAUOVLxePm7qVW4r4ctbWpURyuOD0E=
 golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 h1:XfKQ4OlFl8okEOr5UvAqFRVj8pY/4yfcXrddB8qAbU0=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1510,33 +1513,39 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
 k8s.io/api v0.22.4/go.mod h1:Rgs+9gIGYC5laXQSZZ9JqT5NevNgoGiOdVWi1BAB3qk=
 k8s.io/api v0.23.0/go.mod h1:8wmDdLBHBNxtOIytwLstXt5E9PddnZb0GaMcqsvDBpg=
-k8s.io/api v0.23.1 h1:ncu/qfBfUoClqwkTGbeRqqOqBCRoUAflMuOaOD7J0c8=
 k8s.io/api v0.23.1/go.mod h1:WfXnOnwSqNtG62Y1CdjoMxh7r7u9QXGCkA1u0na2jgo=
+k8s.io/api v0.23.2 h1:62cpzreV3dCuj0hqPi8r4dyWh48ogMcyh+ga9jEGij4=
+k8s.io/api v0.23.2/go.mod h1:sYuDb3flCtRPI8ghn6qFrcK5ZBu2mhbElxRE95qpwlI=
 k8s.io/apiextensions-apiserver v0.22.4/go.mod h1:kH9lxD8dbJ+k0ZizGET55lFgdGjO8t45fgZnCVdZEpw=
-k8s.io/apiextensions-apiserver v0.23.1 h1:xxE0q1vLOVZiWORu1KwNRQFsGWtImueOrqSl13sS5EU=
-k8s.io/apiextensions-apiserver v0.23.1/go.mod h1:0qz4fPaHHsVhRApbtk3MGXNn2Q9M/cVWWhfHdY2SxiM=
+k8s.io/apiextensions-apiserver v0.23.2 h1:N6CIVAhmF0ahgFKUMDdV/AUyckhUb4nIyVPohPtdUPk=
+k8s.io/apiextensions-apiserver v0.23.2/go.mod h1:9cs7avT6+GfzbB0pambTvH11wcaR85QQg4ovl9s15UU=
 k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
 k8s.io/apimachinery v0.22.4/go.mod h1:yU6oA6Gnax9RrxGzVvPFFJ+mpnW6PBSqp0sx0I0HHW0=
 k8s.io/apimachinery v0.23.0/go.mod h1:fFCTTBKvKcwTPFzjlcxp91uPFZr+JA0FubU4fLzzFYc=
-k8s.io/apimachinery v0.23.1 h1:sfBjlDFwj2onG0Ijx5C+SrAoeUscPrmghm7wHP+uXlo=
 k8s.io/apimachinery v0.23.1/go.mod h1:SADt2Kl8/sttJ62RRsi9MIV4o8f5S3coArm0Iu3fBno=
+k8s.io/apimachinery v0.23.2 h1:dBmjCOeYBdg2ibcQxMuUq+OopZ9fjfLIR5taP/XKeTs=
+k8s.io/apimachinery v0.23.2/go.mod h1:zDqeV0AK62LbCI0CI7KbWCAYdLg+E+8UXJ0rIz5gmS8=
 k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
 k8s.io/apiserver v0.22.4/go.mod h1:38WmcUZiiy41A7Aty8/VorWRa8vDGqoUzDf2XYlku0E=
 k8s.io/apiserver v0.23.1/go.mod h1:Bqt0gWbeM2NefS8CjWswwd2VNAKN6lUKR85Ft4gippY=
+k8s.io/apiserver v0.23.2/go.mod h1:Kdt8gafkPev9Gfh+H6lCPbmRu42f7BfhOfHKKa3dtyU=
 k8s.io/cli-runtime v0.22.4/go.mod h1:x35r0ERHXr/MrbR1C6MPJxQ3xKG6+hXi9m2xLzlMPZA=
 k8s.io/cli-runtime v0.23.0 h1:UONt0BV2+edjUVAXuR1nnOAL2CB9r+Gl9yk4UBQpKfs=
 k8s.io/cli-runtime v0.23.0/go.mod h1:B5N3YH0KP1iKr6gEuJ/RRmGjO0mJQ/f/JrsmEiPQAlU=
 k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
 k8s.io/client-go v0.22.4/go.mod h1:Yzw4e5e7h1LNHA4uqnMVrpEpUs1hJOiuBsJKIlRCHDA=
 k8s.io/client-go v0.23.0/go.mod h1:hrDnpnK1mSr65lHHcUuIZIXDgEbzc7/683c6hyG4jTA=
-k8s.io/client-go v0.23.1 h1:Ma4Fhf/p07Nmj9yAB1H7UwbFHEBrSPg8lviR24U2GiQ=
 k8s.io/client-go v0.23.1/go.mod h1:6QSI8fEuqD4zgFK0xbdwfB/PthBsIxCJMa3s17WlcO0=
+k8s.io/client-go v0.23.2 h1:BNbOcxa99jxHH8mM1cPKGIrrKRnCSAfAtyonYGsbFtE=
+k8s.io/client-go v0.23.2/go.mod h1:k3YbsWg6GWdHF1THHTQP88X9RhB1DWPo3Dq7KfU/D1c=
 k8s.io/code-generator v0.22.4/go.mod h1:qjYl54pQ/emhkT0UxbufbREYJMWsHNNV/jSVwhYZQGw=
-k8s.io/code-generator v0.23.1 h1:ViFOlP/0bYD7VrnUDS+ch5ej5EIuMawFmHcRuv9Yxyw=
 k8s.io/code-generator v0.23.1/go.mod h1:V7yn6VNTCWW8GqodYCESVo95fuiEg713S8B7WacWZDA=
+k8s.io/code-generator v0.23.2 h1:KqIwRDwEZpjA0x7gr4S8LQgyT6iFnR57lksnxBha0g0=
+k8s.io/code-generator v0.23.2/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
 k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
 k8s.io/component-base v0.22.4/go.mod h1:MrSaQy4a3tFVViff8TZL6JHYSewNCLshZCwHYM58v5A=
 k8s.io/component-base v0.23.1/go.mod h1:6llmap8QtJIXGDd4uIWJhAq0Op8AtQo6bDW2RrNMTeo=
+k8s.io/component-base v0.23.2/go.mod h1:wS9Z03MO3oJ0RU8bB/dbXTiluGju+SC/F5i660gxB8c=
 k8s.io/component-helpers v0.22.4/go.mod h1:A50qTyczDFbhZDifIfS2zFrHuPk9UNOWPpvNZ+3RSIs=
 k8s.io/cri-api v0.20.6/go.mod h1:ew44AjNXwyn1s0U4xCKGodU7J1HzBeZ1MpGrpa5r8Yc=
 k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
@@ -1574,6 +1583,7 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.25/go.mod h1:Mlj9PNLmG9bZ6BHFwFKDo5afkpWyUISkb9Me0GnK66I=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.27/go.mod h1:tq2nT0Kx7W+/f2JVE+zxYtUhdjuELJkVpNz+x/QN5R4=
 sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 h1:fD1pz4yfdADVNfFmcP2aBEtudwUQ1AlLnRBALr33v3s=
 sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
 sigs.k8s.io/kustomize/api v0.8.11/go.mod h1:a77Ls36JdfCWojpUqR6m60pdGY1AYFix4AH83nJtY1g=
@@ -1586,8 +1596,9 @@ sigs.k8s.io/kustomize/kyaml v0.13.0 h1:9c+ETyNfSrVhxvphs+K2dzT3dh5oVPPEqPOE/cUpS
 sigs.k8s.io/kustomize/kyaml v0.13.0/go.mod h1:FTJxEZ86ScK184NpGSAQcfEqee0nul8oLCK30D47m4E=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.1.2 h1:Hr/htKFmJEbtMgS/UD0N+gtgctAqz81t3nu+sPzynno=
 sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.1 h1:bKCqE9GvQ5tiVHn5rfn1r+yao3aLQEaLzkkmAkf+A6Y=
+sigs.k8s.io/structured-merge-diff/v4 v4.2.1/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index a29c4ffe9..1cdc32487 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -118,6 +118,7 @@ type (
 		Capabilities         *Capabilities    `json:"capabilities"`
 		IgnoreInboundPorts   string           `json:"ignoreInboundPorts"`
 		IgnoreOutboundPorts  string           `json:"ignoreOutboundPorts"`
+		SkipSubnets          string           `json:"skipSubnets"`
 		LogLevel             string           `json:"logLevel"`
 		LogFormat            string           `json:"logFormat"`
 		Image                *Image           `json:"image"`
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index e17cf6a5a..7085d51cb 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -69,6 +69,7 @@ var (
 		k8s.ProxyInboundConnectTimeout,
 		k8s.ProxyAwait,
 		k8s.ProxyDefaultInboundPolicyAnnotation,
+		k8s.ProxySkipSubnetsAnnotation,
 	}
 	// ProxyAlphaConfigAnnotations is the list of all alpha configuration
 	// (config.alpha prefix) that can be applied to a pod or namespace.
@@ -1080,6 +1081,10 @@ func (conf *ResourceConfig) applyAnnotationOverrides(values *l5dcharts.Values) {
 			values.Proxy.DefaultInboundPolicy = override
 		}
 	}
+
+	if override, ok := annotations[k8s.ProxySkipSubnetsAnnotation]; ok {
+		values.ProxyInit.SkipSubnets = override
+	}
 }
 
 // GetOverriddenConfiguration returns a map of the overridden proxy annotations
diff --git a/pkg/k8s/labels.go b/pkg/k8s/labels.go
index c01b1f90b..f7233a508 100644
--- a/pkg/k8s/labels.go
+++ b/pkg/k8s/labels.go
@@ -164,6 +164,9 @@ const (
 	// ignoreOutboundPorts config.
 	ProxyIgnoreOutboundPortsAnnotation = ProxyConfigAnnotationsPrefix + "/skip-outbound-ports"
 
+	// ProxySkipSubnetsAnnotation can be used to override the skipSubnets config
+	ProxySkipSubnetsAnnotation = ProxyConfigAnnotationsPrefix + "/skip-subnets"
+
 	// ProxyInboundPortAnnotation can be used to override the inboundPort config.
 	ProxyInboundPortAnnotation = ProxyConfigAnnotationsPrefix + "/inbound-port"
 


Test patch:
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 28b5c960c..e7f2413cd 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 6adb7d710..9b069cbe3 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index d4ceed128..5fd5ffcb3 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 6adb7d710..9b069cbe3 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index 5bf040e39..ae2e3d1dd 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index d4c4f2e1b..6c6d26c67 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 4e54a20b6..3499b3124 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -1293,6 +1293,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index b2b92eaee..61cbce8a8 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -1293,6 +1293,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index 417ba1a92..937ef1260 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -1197,6 +1197,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index 83a52f55b..ff2a0a591 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -532,6 +532,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index 2ca7362ed..fe218fe4b 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -559,6 +559,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 5225e7523..8c3f46d3d 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -563,6 +563,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index f9ac619fc..3b0548499 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -559,6 +559,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 87f05efc2..c44c044bf 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 8d77108f1..88e8f3cd3 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -1263,6 +1263,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 75b7b4ba4..6398ca210 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 84f3a8ccc..cf90f82a4 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -1266,6 +1266,7 @@ data:
           request: 10Mi
       runAsRoot: false
       saMountPath: null
+      skipSubnets: ""
       xtMountPath:
         mountPath: /run
         name: linkerd-proxy-init-xtables-lock
diff --git a/pkg/inject/inject_test.go b/pkg/inject/inject_test.go
index e0224fddb..f7562b7c6 100644
--- a/pkg/inject/inject_test.go
+++ b/pkg/inject/inject_test.go
@@ -68,6 +68,7 @@ func TestGetOverriddenValues(t *testing.T) {
 							k8s.ProxyInboundConnectTimeout:                   "600ms",
 							k8s.ProxyOpaquePortsAnnotation:                   "4320-4325,3306",
 							k8s.ProxyAwait:                                   "enabled",
+							k8s.ProxySkipSubnetsAnnotation:                   "172.17.0.0/16",
 						},
 					},
 					Spec: corev1.PodSpec{},
@@ -109,6 +110,7 @@ func TestGetOverriddenValues(t *testing.T) {
 				values.ProxyInit.Image.Version = version.ProxyInitVersion
 				values.ProxyInit.IgnoreInboundPorts = "4222,6222"
 				values.ProxyInit.IgnoreOutboundPorts = "8079,8080"
+				values.ProxyInit.SkipSubnets = "172.17.0.0/16"
 				values.Proxy.RequireIdentityOnInboundPorts = "8888,9999"
 				values.Proxy.OutboundConnectTimeout = "6000ms"
 				values.Proxy.InboundConnectTimeout = "600ms"
diff --git a/pkg/prometheus/test_helper.go b/pkg/prometheus/test_helper.go
index 6c59b3245..93c3d0cff 100644
--- a/pkg/prometheus/test_helper.go
+++ b/pkg/prometheus/test_helper.go
@@ -131,3 +131,8 @@ func (m *MockProm) QueryExemplars(ctx context.Context, query string, startTime t
 func (m *MockProm) TSDB(ctx context.Context) (promv1.TSDBResult, error) {
 	return promv1.TSDBResult{}, nil
 }
+
+// WalReplay returns the current replay status of the wal.
+func (m *MockProm) WalReplay(ctx context.Context) (promv1.WalReplayStatus, error) {
+	return promv1.WalReplayStatus{}, nil
+}
diff --git a/testutil/inject_validator.go b/testutil/inject_validator.go
index e880cd98d..15ebdde46 100644
--- a/testutil/inject_validator.go
+++ b/testutil/inject_validator.go
@@ -47,6 +47,7 @@ type InjectValidator struct {
 	OutboundConnectTimeout  string
 	InboundConnectTimeout   string
 	WaitBeforeExitSeconds   int
+	SkipSubnets             string
 }
 
 func (iv *InjectValidator) getContainer(pod *v1.PodSpec, name string, isInit bool) *v1.Container {
@@ -363,6 +364,12 @@ func (iv *InjectValidator) validateInitContainer(pod *v1.PodSpec) error {
 		}
 	}
 
+	if iv.SkipSubnets != "" {
+		if err := iv.validateArg(initContainer, "--skip-subnets", iv.SkipSubnets); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -551,5 +558,10 @@ func (iv *InjectValidator) GetFlagsAndAnnotations() ([]string, map[string]string
 
 	}
 
+	if iv.SkipSubnets != "" {
+		annotations[k8s.ProxySkipSubnetsAnnotation] = iv.SkipSubnets
+		flags = append(flags, fmt.Sprintf("--skip-subnets=%s", iv.SkipSubnets))
+	}
+
 	return flags, annotations
 }