Repository: linkerd/linkerd2
Pull request #7224 (2021-11-04 19:46:48)

proxy: v2.165.1
This release improves retries so that requests without a
`content-length` can be retried. This should permit requests emitted by
grpc-go to be retried.

Discovery diagnostics have also been improved by ensuring that service
discovery updates are logged at DEBUG. Previously these messages were
only emitted at the TRACE level.

---

* build(deps): bump hdrhistogram from 7.3.0 to 7.4.0 (linkerd/linkerd2-proxy#1330)
* build(deps): bump libc from 0.2.104 to 0.2.105 (linkerd/linkerd2-proxy#1332)
* tracing: update `tracing-subscriber` to v0.3.x (linkerd/linkerd2-proxy#1327)
* tls: Avoid circular dependencies (linkerd/linkerd2-proxy#1334)
* Fix misspecified dependencies (linkerd/linkerd2-proxy#1335)
* build(deps): bump tracing-subscriber from 0.2.25 to 0.3.1 (linkerd/linkerd2-proxy#1328)
* update `tonic`, `prost`, and `linkerd2-proxy-api` (linkerd/linkerd2-proxy#1339)
* Refactor mTLS & identity crates (linkerd/linkerd2-proxy#1333)
* Log discovery changes at DEBUG (linkerd/linkerd2-proxy#1340)
* build(deps): bump tokio-util from 0.6.8 to 0.6.9 (linkerd/linkerd2-proxy#1342)
* build(deps): bump tokio from 1.12.0 to 1.13.0 (linkerd/linkerd2-proxy#1343)
* build(deps): bump tokio-stream from 0.1.7 to 0.1.8 (linkerd/linkerd2-proxy#1344)
* retry: allow retrying requests without content-length headers  (linkerd/linkerd2-proxy#1341)
* retry: Simplify ReplayBody::poll_data for readability (linkerd/linkerd2-proxy#1346)
* build(deps): bump libc from 0.2.105 to 0.2.106 (linkerd/linkerd2-proxy#1348)
* reorg: Decouple TLS implementation from proxy client (linkerd/linkerd2-proxy#1349)
* build(deps): bump actions/checkout from 2.3.5 to 2.4.0 (linkerd/linkerd2-proxy#1352)
* Introduce `meshtls` facade to hide rustls crate (linkerd/linkerd2-proxy#1353)

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->



Patch:
diff --git a/.github/workflows/static_checks.yml b/.github/workflows/static_checks.yml
index 733166cdf..798716910 100644
--- a/.github/workflows/static_checks.yml
+++ b/.github/workflows/static_checks.yml
@@ -21,7 +21,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
     - name: Go lint
-      run: bin/lint --verbose
+      run: bin/lint --verbose --timeout=10m
   go_format:
     name: Go format
     timeout-minutes: 10
diff --git a/.proxy-version b/.proxy-version
index 46fa61734..fd877283b 100644
--- a/.proxy-version
+++ b/.proxy-version
@@ -1,1 +1,1 @@
-v2.164.0
+v2.165.1
diff --git a/CHANGES.md b/CHANGES.md
index 3014405cb..173f9de6e 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,27 @@
 # Changes
 
+## edge-21.11.1
+
+In this edge, we're very excited to introduce Service Account Token Volume
+Projections, used to set up the pods' identities. These tokens are bounded
+specifically for this use case and are rotated daily, replacing the usage of the
+default tokens injected by Kubernetes which are overly permissive.
+
+Note that this edge release updates the minimum supported kubernetes version to 1.20.
+
+* Updated the minimum supported kubernetes version to 1.20
+* Use Service Account Token Volume Projections to set up the pods' identities;
+  now injection also works on pods with `automountServiceAccountToken` set to
+  `false`
+* Updated proxy-init's Alpine base image to fix some CVEs (not affecting
+  Linkerd)
+* Updated the Prometheus image in linkerd-viz to 2.30.3
+* Changed the proxy and policy controller to use jemalloc on x86_64 gnu/linux to
+  reduce memory usage
+* Fixed output for `linkerd check -o json`
+* Added ability to configure ephemeral-storage resources for each component
+  (thanks @michaellzc!)
+
 ## edge-21.10.3
 
 This edge release fixes a bug in the proxy that could cause it to be killed in
diff --git a/charts/linkerd2/README.md b/charts/linkerd2/README.md
index a0addafc3..e59bd7e24 100644
--- a/charts/linkerd2/README.md
+++ b/charts/linkerd2/README.md
@@ -210,7 +210,7 @@ Kubernetes: `>=1.20.0-0`
 | proxyInit.ignoreOutboundPorts | string | `"4567,4568"` | Default set of outbound ports to skip via iptables - Galera (4567,4568) |
 | proxyInit.image.name | string | `"cr.l5d.io/linkerd/proxy-init"` | Docker image for the proxy-init container |
 | proxyInit.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy-init container Docker image |
-| proxyInit.image.version | string | `"v1.5.0"` | Tag for the proxy-init container Docker image |
+| proxyInit.image.version | string | `"v1.5.1"` | Tag for the proxy-init container Docker image |
 | proxyInit.resources.cpu.limit | string | `"100m"` | Maximum amount of CPU units that the proxy-init container can use |
 | proxyInit.resources.cpu.request | string | `"10m"` | Amount of CPU units that the proxy-init container requests |
 | proxyInit.resources.ephemeral-storage.limit | string | `""` | Maximum amount of ephemeral storage that the proxy-init container can use |
diff --git a/charts/linkerd2/values.yaml b/charts/linkerd2/values.yaml
index 238ef4741..0a8d88d5e 100644
--- a/charts/linkerd2/values.yaml
+++ b/charts/linkerd2/values.yaml
@@ -174,7 +174,7 @@ proxyInit:
     # @default -- imagePullPolicy
     pullPolicy: ""
     # -- Tag for the proxy-init container Docker image
-    version: v1.5.0
+    version: v1.5.1
   resources:
     cpu:
       # -- Maximum amount of CPU units that the proxy-init container can use
diff --git a/charts/partials/templates/_proxy-init.tpl b/charts/partials/templates/_proxy-init.tpl
index 324115520..7c145dee3 100644
--- a/charts/partials/templates/_proxy-init.tpl
+++ b/charts/partials/templates/_proxy-init.tpl
@@ -40,12 +40,13 @@ securityContext:
     {{- end }}
   {{- if .Values.proxyInit.closeWaitTimeoutSecs }}
   privileged: true
+  runAsNonRoot: false
+  runAsUser: 0
   {{- else }}
   privileged: false
+  runAsNonRoot: true
   {{- end }}
   readOnlyRootFilesystem: true
-  runAsNonRoot: false
-  runAsUser: 0
 terminationMessagePolicy: FallbackToLogsOnError
 {{- if or (not .Values.cniEnabled) .Values.proxyInit.saMountPath }}
 volumeMounts:
diff --git a/controller/proxy-injector/fake/data/inject-init-container-spec.yaml b/controller/proxy-injector/fake/data/inject-init-container-spec.yaml
index 727e14926..7e56cb1a1 100644
--- a/controller/proxy-injector/fake/data/inject-init-container-spec.yaml
+++ b/controller/proxy-injector/fake/data/inject-init-container-spec.yaml
@@ -16,6 +16,5 @@ securityContext:
     add:
     - NET_ADMIN
   privileged: false
-  runAsNonRoot: false
-  runAsUser: 0
+  runAsNonRoot: true
 terminationMessagePolicy: FallbackToLogsOnError
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index 613f8aff2..77e96b03a 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -58,7 +58,7 @@
         "--outbound-ports-to-ignore",
         "4567,4568"
       ],
-      "image": "cr.l5d.io/linkerd/proxy-init:v1.5.0",
+      "image": "cr.l5d.io/linkerd/proxy-init:v1.5.1",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
@@ -80,9 +80,8 @@
           ]
         },
         "privileged": false,
-        "readOnlyRootFilesystem": true,
-        "runAsNonRoot": false,
-        "runAsUser": 0
+        "runAsNonRoot": true,
+        "readOnlyRootFilesystem": true
       },
       "terminationMessagePolicy": "FallbackToLogsOnError",
       "volumeMounts": [
diff --git a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
index 18cdf81b7..65aa04543 100644
--- a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
@@ -68,7 +68,7 @@
         "--outbound-ports-to-ignore",
         "34567"
       ],
-      "image": "cr.l5d.io/linkerd/proxy-init:v1.5.0",
+      "image": "cr.l5d.io/linkerd/proxy-init:v1.5.1",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
@@ -90,9 +90,8 @@
           ]
         },
         "privileged": false,
-        "readOnlyRootFilesystem": true,
-        "runAsNonRoot": false,
-        "runAsUser": 0
+        "runAsNonRoot": true,
+        "readOnlyRootFilesystem": true
       },
       "terminationMessagePolicy": "FallbackToLogsOnError",
       "volumeMounts": [
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index c54e08870..2989c4ab0 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -58,7 +58,7 @@
         "--outbound-ports-to-ignore",
         "4567,4568"
       ],
-      "image": "cr.l5d.io/linkerd/proxy-init:v1.5.0",
+      "image": "cr.l5d.io/linkerd/proxy-init:v1.5.1",
       "imagePullPolicy": "IfNotPresent",
       "name": "linkerd-init",
       "resources": {
@@ -80,9 +80,8 @@
           ]
         },
         "privileged": false,
-        "readOnlyRootFilesystem": true,
-        "runAsNonRoot": false,
-        "runAsUser": 0
+        "runAsNonRoot": true,
+        "readOnlyRootFilesystem": true
       },
       "terminationMessagePolicy": "FallbackToLogsOnError",
       "volumeMounts": [
diff --git a/go.mod b/go.mod
index b4eac3741..6dd8e5437 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/imdario/mergo v0.3.12
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/linkerd/linkerd2-proxy-api v0.3.0
-	github.com/linkerd/linkerd2-proxy-init v1.5.0
+	github.com/linkerd/linkerd2-proxy-init v1.5.1
 	github.com/mattn/go-isatty v0.0.14
 	github.com/mattn/go-runewidth v0.0.13
 	github.com/nsf/termbox-go v0.0.0-20180613055208-5c94acc5e6eb
diff --git a/go.sum b/go.sum
index 774609675..515fcffdf 100644
--- a/go.sum
+++ b/go.sum
@@ -583,8 +583,8 @@ github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-b
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/linkerd/linkerd2-proxy-api v0.3.0 h1:TUfIw+XffDQQ3SQEJcIiHnZgZZxKK/ZfsVx7SeZH2nM=
 github.com/linkerd/linkerd2-proxy-api v0.3.0/go.mod h1:BuA+jXhgCXiBJkNjQrA9h1PLsJN5z6NOYJI5KVYDc2U=
-github.com/linkerd/linkerd2-proxy-init v1.5.0 h1:Dr6oU5/mbVOPQbmPLffA25R+yrwxpINW8aIu1IaV+QY=
-github.com/linkerd/linkerd2-proxy-init v1.5.0/go.mod h1:pbWWdLASP+FKBZ61rvCMx6nvHAP2nc1bhGUhhh8gY/k=
+github.com/linkerd/linkerd2-proxy-init v1.5.1 h1:eE+hVvLJqyQbLYhG61yeOOs5ASc71cMXYuXcPNXPmS8=
+github.com/linkerd/linkerd2-proxy-init v1.5.1/go.mod h1:pbWWdLASP+FKBZ61rvCMx6nvHAP2nc1bhGUhhh8gY/k=
 github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
diff --git a/pkg/version/version.go b/pkg/version/version.go
index e80280e9e..94c758b62 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -16,7 +16,7 @@ var Version = undefinedVersion
 // https://github.com/linkerd/linkerd2-proxy-init
 // This has to be kept in sync with the constraint version for
 // github.com/linkerd/linkerd2-proxy-init in /go.mod
-var ProxyInitVersion = "v1.5.0"
+var ProxyInitVersion = "v1.5.1"
 
 const (
 	// undefinedVersion should take the form `channel-version` to conform to
diff --git a/web/app/package.json b/web/app/package.json
index 945d45df8..e6f55f809 100644
--- a/web/app/package.json
+++ b/web/app/package.json
@@ -56,7 +56,7 @@
     "babel-plugin-transform-react-remove-prop-types": "0.4.24",
     "chai": "4.3.4",
     "clean-webpack-plugin": "4.0.0",
-    "css-loader": "^6.5.0",
+    "css-loader": "^6.5.1",
     "enzyme": "3.11.0",
     "enzyme-adapter-react-16": "^1.15.6",
     "eslint": "^7.32.0",
@@ -73,7 +73,7 @@
     "jest": "^27.3.1",
     "lodash-webpack-plugin": "^0.11.6",
     "react-test-renderer": "16.14.0",
-    "sinon": "12.0.0",
+    "sinon": "12.0.1",
     "sinon-stub-promise": "4.0.0",
     "style-loader": "^3.3.1",
     "url-loader": "^4.1.1",
diff --git a/web/app/yarn.lock b/web/app/yarn.lock
index cd2d49268..597f47d0b 100644
--- a/web/app/yarn.lock
+++ b/web/app/yarn.lock
@@ -2863,10 +2863,10 @@ cross-spawn@^7.0.2, cross-spawn@^7.0.3:
     shebang-command "^2.0.0"
     which "^2.0.1"
 
-css-loader@^6.5.0:
-  version "6.5.0"
-  resolved "https://registry.yarnpkg.com/css-loader/-/css-loader-6.5.0.tgz#9d1cf7766a9a8f0b3c6e1638309b964dbdab46d3"
-  integrity sha512-VmuSdQa3K+wJsl39i7X3qGBM5+ZHmtTnv65fqMGI+fzmHoYmszTVvTqC1XN8JwWDViCB1a8wgNim5SV4fb37xg==
+css-loader@^6.5.1:
+  version "6.5.1"
+  resolved "https://registry.yarnpkg.com/css-loader/-/css-loader-6.5.1.tgz#0c43d4fbe0d97f699c91e9818cb585759091d1b1"
+  integrity sha512-gEy2w9AnJNnD9Kuo4XAP9VflW/ujKoS9c/syO+uWMlm5igc7LysKzPXaDoR2vroROkSwsTS2tGr1yGGEbZOYZQ==
   dependencies:
     icss-utils "^5.1.0"
     postcss "^8.2.15"
@@ -7158,10 +7158,10 @@ sinon-stub-promise@4.0.0:
   resolved "https://registry.yarnpkg.com/sinon-stub-promise/-/sinon-stub-promise-4.0.0.tgz#6d498ba1198557cd01e3466af92dc7df725192c2"
   integrity sha1-bUmLoRmFV80B40Zq+S3H33JRksI=
 
-sinon@12.0.0:
-  version "12.0.0"
-  resolved "https://registry.yarnpkg.com/sinon/-/sinon-12.0.0.tgz#07b2485248e0cd871df16761a02ee39c3cddbadd"
-  integrity sha512-wVMT1jvgyLroQu+tWTa2XJu2g5SoVaEBhdwGPuzmWlRvZNSG+pcEb8HEmsxTdoPjUL58pJFQ3+oFRWrhC4JKHw==
+sinon@12.0.1:
+  version "12.0.1"
+  resolved "https://registry.yarnpkg.com/sinon/-/sinon-12.0.1.tgz#331eef87298752e1b88a662b699f98e403c859e9"
+  integrity sha512-iGu29Xhym33ydkAT+aNQFBINakjq69kKO6ByPvTsm3yyIACfyQttRTP03aBP/I8GfhFmLzrnKwNNkr0ORb1udg==
   dependencies:
     "@sinonjs/commons" "^1.8.3"
     "@sinonjs/fake-timers" "^8.1.0"


Test patch:
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index f06a87086..a2526897e 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -163,7 +163,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -181,8 +181,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index a826387a5..f096f16bb 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -163,7 +163,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -181,8 +181,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -366,7 +365,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -384,8 +383,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index a0ace4d43..07b8a3bea 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -163,7 +163,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -181,8 +181,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 235b79cf7..ef5ff6120 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -221,8 +221,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index 2c9da60cf..4a299c5fb 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -174,7 +174,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -192,8 +192,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -388,7 +387,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -406,8 +405,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -602,7 +600,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -620,8 +618,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -816,7 +813,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -834,8 +831,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index b28aa5048..264cfaf8b 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -174,7 +174,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -192,8 +192,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
index ee7cfd6da..26172561e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
@@ -166,7 +166,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -184,8 +184,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index cded769a3..0b163476f 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -187,7 +187,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -208,8 +208,7 @@ spec:
             - ALL
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index 43bb6ceda..4f5efc68c 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -191,7 +191,7 @@ spec:
         - 4190,9998,7777,8888
         - --outbound-ports-to-ignore
         - "9999"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -209,8 +209,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index d65aef613..b6de9ff49 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -174,7 +174,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -192,8 +192,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -388,7 +387,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -406,8 +405,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index df895f9b3..8d1ed7fab 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -179,7 +179,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -197,8 +197,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index 2e001de82..3e895ebcb 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -174,7 +174,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -192,8 +192,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index a9d4011f4..bcd529b24 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -175,7 +175,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -193,8 +193,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
index 98c703577..e351b158e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
@@ -175,7 +175,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -193,8 +193,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index 322ea4bb9..43d2d45b7 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -175,7 +175,7 @@ spec:
         - 4190,1234,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -193,8 +193,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index e7140297b..f13a5324d 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -176,7 +176,7 @@ spec:
         - 4190,4191,22,8100-8102
         - --outbound-ports-to-ignore
         - "5432"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -194,8 +194,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index b8efd96fd..83e926f37 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -176,7 +176,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -194,8 +194,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index c98fd7a70..ae16e2eef 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -176,7 +176,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+          image: cr.l5d.io/linkerd/proxy-init:v1.5.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -194,8 +194,7 @@ items:
               - NET_RAW
             privileged: false
             readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
+            runAsNonRoot: true
           terminationMessagePolicy: FallbackToLogsOnError
           volumeMounts:
           - mountPath: /run
@@ -384,7 +383,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+          image: cr.l5d.io/linkerd/proxy-init:v1.5.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -402,8 +401,7 @@ items:
               - NET_RAW
             privileged: false
             readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
+            runAsNonRoot: true
           terminationMessagePolicy: FallbackToLogsOnError
           volumeMounts:
           - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index db2be4cfa..d5f815067 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -176,7 +176,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+          image: cr.l5d.io/linkerd/proxy-init:v1.5.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -194,8 +194,7 @@ items:
               - NET_RAW
             privileged: false
             readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
+            runAsNonRoot: true
           terminationMessagePolicy: FallbackToLogsOnError
           volumeMounts:
           - mountPath: /run
@@ -384,7 +383,7 @@ items:
           - 4190,4191,4567,4568
           - --outbound-ports-to-ignore
           - 4567,4568
-          image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+          image: cr.l5d.io/linkerd/proxy-init:v1.5.1
           imagePullPolicy: IfNotPresent
           name: linkerd-init
           resources:
@@ -402,8 +401,7 @@ items:
               - NET_RAW
             privileged: false
             readOnlyRootFilesystem: true
-            runAsNonRoot: false
-            runAsUser: 0
+            runAsNonRoot: true
           terminationMessagePolicy: FallbackToLogsOnError
           volumeMounts:
           - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index 336eea6dd..2d5a0c455 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -157,7 +157,7 @@ spec:
     - 4190,4191,4567,4568
     - --outbound-ports-to-ignore
     - 4567,4568
-    image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+    image: cr.l5d.io/linkerd/proxy-init:v1.5.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
@@ -175,8 +175,7 @@ spec:
         - NET_RAW
       privileged: false
       readOnlyRootFilesystem: true
-      runAsNonRoot: false
-      runAsUser: 0
+      runAsNonRoot: true
     terminationMessagePolicy: FallbackToLogsOnError
     volumeMounts:
     - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
index 96b667273..3e752cc07 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
@@ -160,7 +160,7 @@ spec:
     - 4190,4191,4567,4568
     - --outbound-ports-to-ignore
     - 4567,4568
-    image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+    image: cr.l5d.io/linkerd/proxy-init:v1.5.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
@@ -178,8 +178,7 @@ spec:
         - NET_RAW
       privileged: false
       readOnlyRootFilesystem: true
-      runAsNonRoot: false
-      runAsUser: 0
+      runAsNonRoot: true
     terminationMessagePolicy: FallbackToLogsOnError
     volumeMounts:
     - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index aed46b8e9..bf12c2fa5 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -159,7 +159,7 @@ spec:
     - 4190,4191,22,8100-8102
     - --outbound-ports-to-ignore
     - "5432"
-    image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+    image: cr.l5d.io/linkerd/proxy-init:v1.5.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
@@ -177,8 +177,7 @@ spec:
         - NET_RAW
       privileged: false
       readOnlyRootFilesystem: true
-      runAsNonRoot: false
-      runAsUser: 0
+      runAsNonRoot: true
     terminationMessagePolicy: FallbackToLogsOnError
     volumeMounts:
     - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index b18148a81..a2dd581db 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -168,7 +168,7 @@ spec:
     - 4190,4191,4567,4568
     - --outbound-ports-to-ignore
     - 4567,4568
-    image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+    image: cr.l5d.io/linkerd/proxy-init:v1.5.1
     imagePullPolicy: IfNotPresent
     name: linkerd-init
     resources:
@@ -186,8 +186,7 @@ spec:
         - NET_RAW
       privileged: false
       readOnlyRootFilesystem: true
-      runAsNonRoot: false
-      runAsUser: 0
+      runAsNonRoot: true
     terminationMessagePolicy: FallbackToLogsOnError
     volumeMounts:
     - mountPath: /run
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index e86a0193f..817c1e8ab 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -175,7 +175,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -193,8 +193,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index f11169d87..cd092565a 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -176,7 +176,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -194,8 +194,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -392,7 +391,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -410,8 +409,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/inject_tap_deployment.input.yml b/cli/cmd/testdata/inject_tap_deployment.input.yml
index 1f78130b9..64bc90663 100644
--- a/cli/cmd/testdata/inject_tap_deployment.input.yml
+++ b/cli/cmd/testdata/inject_tap_deployment.input.yml
@@ -203,7 +203,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568,443
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -220,9 +220,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: FallbackToLogsOnError
       restartPolicy: Always
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index c1379872e..7fd52460e 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -228,7 +228,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -246,8 +246,7 @@ spec:
             - NET_RAW
           privileged: false
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
+          runAsNonRoot: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index fc62e9002..bfc2cc5ff 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1696,7 +1696,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1713,9 +1713,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2103,7 +2102,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2120,9 +2119,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2400,7 +2398,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2417,9 +2415,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 62f637b3a..fbb163cf2 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1695,7 +1695,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1712,9 +1712,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2101,7 +2100,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2118,9 +2117,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2398,7 +2396,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2415,9 +2413,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 5ed5d859e..3778321d7 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: my.custom.registry/linkerd-io/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1695,7 +1695,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.5.0
+        image: my.custom.registry/linkerd-io/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1712,9 +1712,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2101,7 +2100,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.5.0
+        image: my.custom.registry/linkerd-io/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2118,9 +2117,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2398,7 +2396,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: my.custom.registry/linkerd-io/proxy-init:v1.5.0
+        image: my.custom.registry/linkerd-io/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2415,9 +2413,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index c89aaa3aa..92e8fc2fb 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1695,7 +1695,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1712,9 +1712,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2101,7 +2100,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2118,9 +2117,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2398,7 +2396,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2415,9 +2413,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index d7da81797..f88cba777 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1695,7 +1695,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1712,9 +1712,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2101,7 +2100,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2118,9 +2117,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2398,7 +2396,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2415,9 +2413,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index f89fb0909..e079cca33 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1693,7 +1693,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1710,9 +1710,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2090,7 +2089,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2107,9 +2106,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2378,7 +2376,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2395,9 +2393,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 6896ef0ff..995d254eb 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -1409,7 +1409,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1781,7 +1781,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1798,9 +1798,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2237,7 +2236,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2254,9 +2253,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2574,7 +2572,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2591,9 +2589,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 0d357b042..e6defaa38 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -1409,7 +1409,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1781,7 +1781,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1798,9 +1798,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2237,7 +2236,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2254,9 +2253,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2574,7 +2572,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2591,9 +2589,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index ab3044a55..ff5348ab1 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -1313,7 +1313,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1626,7 +1626,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1643,9 +1643,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2032,7 +2031,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2049,9 +2048,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2280,7 +2278,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2297,9 +2295,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index 21012df87..16b59e205 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -1703,9 +1703,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2111,9 +2110,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2412,9 +2410,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index 99d9d62c5..a3f496ccf 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -1789,9 +1789,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2247,9 +2246,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2588,9 +2586,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 5b75630ba..15b885e58 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -1797,9 +1797,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2259,9 +2258,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2608,9 +2606,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 0f99759c4..22785fee9 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -1789,9 +1789,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2247,9 +2246,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2588,9 +2586,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index 653d68f19..b930ac1f2 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 12302b76c..01928f65b 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -1714,9 +1714,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2129,9 +2128,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2430,9 +2428,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index b0d84545b..2876f9cc3 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -1382,7 +1382,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1695,7 +1695,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1712,9 +1712,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2101,7 +2100,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2118,9 +2117,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2398,7 +2396,7 @@ spec:
         - "4190,4191,22,8100-8102"
         - --outbound-ports-to-ignore
         - "5432"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2415,9 +2413,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index f5fad284c..cacb71c3b 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -1368,7 +1368,7 @@ data:
       image:
         name: cr.l5d.io/linkerd/proxy-init
         pullPolicy: ""
-        version: v1.5.0
+        version: v1.5.1
       resources:
         cpu:
           limit: 100m
@@ -1681,7 +1681,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -1698,9 +1698,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2087,7 +2086,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "443"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2104,9 +2103,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
@@ -2384,7 +2382,7 @@ spec:
         - "4190,4191,4567,4568"
         - --outbound-ports-to-ignore
         - "4567,4568"
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.0
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
@@ -2401,9 +2399,8 @@ spec:
             - NET_ADMIN
             - NET_RAW
           privileged: false
+          runAsNonRoot: true
           readOnlyRootFilesystem: true
-          runAsNonRoot: false
-          runAsUser: 0
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /run
diff --git a/pkg/healthcheck/healthcheck_test.go b/pkg/healthcheck/healthcheck_test.go
index e61c8500a..5964b676f 100644
--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@@ -2187,7 +2187,7 @@ data:
   global: |
     {"linkerdNamespace":"linkerd","cniEnabled":false,"version":"install-control-plane-version","identityContext":{"trustDomain":"cluster.local","trustAnchorsPem":"fake-trust-anchors-pem","issuanceLifetime":"86400s","clockSkewAllowance":"20s"}}
   proxy: |
-    {"proxyImage":{"imageName":"cr.l5d.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"cr.l5d.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.5.0","debugImage":{"imageName":"cr.l5d.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
+    {"proxyImage":{"imageName":"cr.l5d.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"cr.l5d.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.5.1","debugImage":{"imageName":"cr.l5d.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
   install: |
     {"cliVersion":"dev-undefined","flags":[]}`,
 			},
@@ -2233,7 +2233,7 @@ data:
 					},
 					DisableExternalProfiles: true,
 					ProxyVersion:            "install-proxy-version",
-					ProxyInitImageVersion:   "v1.5.0",
+					ProxyInitImageVersion:   "v1.5.1",
 					DebugImage: &configPb.Image{
 						ImageName:  "cr.l5d.io/linkerd/debug",
 						PullPolicy: "IfNotPresent",
@@ -2325,7 +2325,7 @@ data:
   global: |
     {"linkerdNamespace":"linkerd","cniEnabled":false,"version":"install-control-plane-version","identityContext":{"trustDomain":"cluster.local","trustAnchorsPem":"fake-trust-anchors-pem","issuanceLifetime":"86400s","clockSkewAllowance":"20s"}}
   proxy: |
-    {"proxyImage":{"imageName":"cr.l5d.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"cr.l5d.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.5.0","debugImage":{"imageName":"cr.l5d.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
+    {"proxyImage":{"imageName":"cr.l5d.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"cr.l5d.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.5.1","debugImage":{"imageName":"cr.l5d.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
   install: |
     {"cliVersion":"dev-undefined","flags":[]}
   values: |
@@ -2485,7 +2485,7 @@ data:
   global: |
     {"linkerdNamespace":"linkerd","cniEnabled":false,"version":"install-control-plane-version","identityContext":{"trustDomain":"cluster.local","trustAnchorsPem":"fake-trust-anchors-pem","issuanceLifetime":"86400s","clockSkewAllowance":"20s"}}
   proxy: |
-    {"proxyImage":{"imageName":"cr.l5d.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"cr.l5d.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.5.0","debugImage":{"imageName":"cr.l5d.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
+    {"proxyImage":{"imageName":"cr.l5d.io/linkerd/proxy","pullPolicy":"IfNotPresent"},"proxyInitImage":{"imageName":"cr.l5d.io/linkerd/proxy-init","pullPolicy":"IfNotPresent"},"controlPort":{"port":4190},"ignoreInboundPorts":[],"ignoreOutboundPorts":[],"inboundPort":{"port":4143},"adminPort":{"port":4191},"outboundPort":{"port":4140},"resource":{"requestCpu":"","requestMemory":"","limitCpu":"","limitMemory":""},"proxyUid":"2102","logLevel":{"level":"warn,linkerd=info"},"disableExternalProfiles":true,"proxyVersion":"install-proxy-version","proxy_init_image_version":"v1.5.1","debugImage":{"imageName":"cr.l5d.io/linkerd/debug","pullPolicy":"IfNotPresent"},"debugImageVersion":"install-debug-version"}
   install: |
     {"cliVersion":"dev-undefined","flags":[]}
   values: |
diff --git a/test/integration/inject/inject_test.go b/test/integration/inject/inject_test.go
index a63aca79d..a2fbe2056 100644
--- a/test/integration/inject/inject_test.go
+++ b/test/integration/inject/inject_test.go
@@ -384,7 +384,6 @@ func TestInjectAutoPod(t *testing.T) {
 
 	truthy := true
 	falsy := false
-	zero := int64(0)
 	reg := "cr.l5d.io/linkerd"
 	if override := os.Getenv(flags.EnvOverrideDockerRegistry); override != "" {
 		reg = override
@@ -428,8 +427,7 @@ func TestInjectAutoPod(t *testing.T) {
 				Add: []v1.Capability{v1.Capability("NET_ADMIN"), v1.Capability("NET_RAW")},
 			},
 			Privileged:               &falsy,
-			RunAsUser:                &zero,
-			RunAsNonRoot:             &falsy,
+			RunAsNonRoot:             &truthy,
 			AllowPrivilegeEscalation: &falsy,
 			ReadOnlyRootFilesystem:   &truthy,
 		},